Atlassian flags critical Apache Axis RCE in Confluence Data Center's remote API

·2 views

Atlassian published advisory CVE-2026-90436 on November 9, 2026, describing a remote code execution flaw in Apache Axis, a third-party component behind Confluence Data Center's XML-RPC and SOAP APIs. The issue applies only when the "Remote API (XML-RPC & SOAP)" setting is enabled, though older installations often keep it on for scripts and integrations that outlive their original purpose. Atlassian rates it critical with a CVSS 4.0 score of 9.3, affecting Data Center versions 1.x through 9.x, while Confluence 10.x and later and Atlassian Cloud sites are not affected. The vendor recommends upgrading to 9.2.28 or a later fixed release and disabling the remote API as an interim containment step, verified by a 403 response from the Axis service endpoint. Because Atlassian cannot confirm whether any instance has been compromised, administrators are advised to review proxy logs for SOAP and XML-RPC requests and recent account and configuration changes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Inertia 3.11 live props let pages refresh on server events without polling

A page showing an order as "Preparing" stays stale after the kitchen marks it ready, forcing customers to refresh. Common workarounds are polling the server or subscribing to a channel and reloading manually, which duplicates logic and fails to recover after dropped connections. Inertia 3.11 introduced live props, where the server declares which channels and events signal a prop has changed, and the browser refetches only that prop when one arrives. The author maintains Guren, a TypeScript fullstack framework on Bun and Hono, which added support for live props in version 2.36 via a live() helper and a WebSocket-based transport. The post walks through a small diner demo with a kitchen board and a customer tracking page, showing setup of broadcasting, a socket route, the client transport, and an OrderUpdated event; the demo's page updated within about 0.12 to 0.17 seconds of each click.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

osFoundry requires Claude Code to pin a commit when requesting a GitNest check rerun

osFoundry's MCP endpoint exposes a propose_gitnest_check_rerun tool that Claude Code calls to ask for a finished GitNest check to be retried. The tool requires six fields, including an expected change-set version and composition commit, so approval can recheck that the repository state has not moved. The author explains that GitNest's UI reduces check runs to a status using ordered rules where no runs means none, any failure means failed, and only full success means passed. A test script shows that naive shortcuts, such as treating the absence of failures as green, give wrong verdicts in 5 of 7 cases. The author therefore recommends that agents report individual check states rather than a single green verdict.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Idempotent Webhook Handling and Audited Recovery for Logistics Shipment Events

A design proposal describes how a logistics webhook consumer can process shipment status events exactly once during outages. Each request is authenticated and bound to a tenant before any deduplication occurs, so unauthorized senders cannot reserve event IDs. Deduplication relies on a database uniqueness constraint over the authenticated source, tenant, and event ID, with the deduplication record, shipment update, and audit entry committed in one transaction before acknowledgement. The author notes that a preliminary lookup is insufficient under concurrency, since the constraint must decide which of two simultaneous deliveries proceeds. The approach does not make remote side effects transactional or guarantee delivery order, and a failed database write must withhold success acknowledgement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Attributing AI Gateway Spend by Service Using Stateful Actors

An AI gateway bill shows total spend but not which service, environment, or tenant caused a sudden rise, which matters when several applications share one gateway. Attribution Wheel, an open-source TypeScript sample running on Telnyx Edge Compute, addresses this by attaching metadata such as service, environment, and tenant to each request via the x-ltg-metadata header. It groups spend by these dimensions, stores one daily ledger row per service, and compares each service against its own seven-day baseline. When a new anomaly appears, the system can send an SMS alert to an on-call number. The design uses one Stateful Actor per AI Gateway token group, a SQL ledger keyed by date and service to prevent duplicate rows, and a demo mode for testing without real traffic or alerts.

0 comments Read more at DEV Community