CERT-In Flags 14 High-Severity BIND Flaws Enabling Cache Poisoning and Zone Injection

·1 views

India's CERT-In published advisory CIVN-2026-0467 on 21 September 2026, identifying 14 high-severity vulnerabilities in ISC BIND that go beyond typical denial-of-service risks. The flaws affect multiple BIND 9 release lines, including versions 9.11.0 through 9.18.50 and 9.20.0 through 9.20.27, among others. Root causes include origin validation errors, insufficient data authenticity checks, and acceptance of untrusted data alongside trusted data — three weakness classes that sit on the integrity boundary. Successful exploitation could allow attackers to poison DNS caches, spoof responses, or inject unauthorized records into authoritative zones, silently misdirecting traffic for an entire domain without triggering obvious alerts. Administrators are advised to apply vendor patches, enable DNSSEC validation, restrict recursive queries to known clients, and monitor for unexpected changes in cached or authoritative DNS data.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Full-Duplex AI Voice Agent to Handle Shopify Customer Support

A developer has created SupportAI, a low-latency AI voice agent designed to manage real-time customer support and abandoned cart recovery for Shopify and direct-to-consumer e-commerce stores. The system operates over live voice calls, addressing limitations of traditional text-based chatbots that often leave customer queries unresolved. A key technical challenge was achieving full-duplex communication, including sub-800ms response times and barge-in handling, which allows the AI to stop speaking instantly when a customer interrupts. The agent can dynamically perform actions such as checking order status, processing changes, and re-engaging customers who abandoned their carts. A live demo has been made publicly available for testing and community feedback.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TypeSafe Opens Jev AI to All Users With $5 Free Credit After 140K Waitlist

TypeSafe launched its decision-focused AI model Jev on September 15, attracting a 140,000-person waitlist within days before opening registration to everyone on September 20. Unlike conventional text generators, Jev returns structured typed outputs — such as choices, scores, and yes/no probabilities — with calibrated confidence rather than free-form text. The model is priced at $0.042 per million input tokens with output provided free, making the $5 starter credit sufficient to classify roughly 120 million tokens or prototype a real-world workflow. Jev is accessible via its own console, Vercel AI Gateway, and Cloudflare Workers AI, though an earlier claim that it was listed on OpenRouter has been confirmed inaccurate. The model is designed for classification and decision tasks and is not suited for generative, predictive, or compound reasoning use cases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Modern Data Stack Tools Are Helping Travel Platforms Scale Analytics in 2025

Travel companies have long struggled with data infrastructure as rapid growth strains operational databases handling both transactions and analytics simultaneously. A practitioner with nearly a decade of experience outlines a layered warehouse architecture designed to address these challenges for online travel agencies and metasearch platforms. The recommended approach separates operational and analytical workloads using three distinct layers: ingestion, transformation, and consumption, each powered by purpose-built tools. Airbyte is highlighted as the preferred ingestion tool for its pre-built connectors, declarative configuration, and automated handling of schema changes. The author argues that even early-stage travel platforms can now adopt enterprise-grade analytics infrastructure without the costly migrations that have historically followed unchecked growth.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Satellite Geo QCM Leaderboard Shows How Transparent LLM Benchmarking Works

The Satellite Geo QCM benchmark evaluates large language models on geolocation tasks using satellite images, asking each model to pick the correct location from four fixed options. Unlike many leaderboards, it uses fully deterministic scoring with no LLM judge, meaning results are raw accuracy counts rather than subjective assessments. On the public leaderboard, DeepSeek V4 Flash Vision scored 98.18%, while the submitting team's own model, GLM 5.2, scored 78.0%, a gap of roughly 20 percentage points. The benchmark also breaks down scores by difficulty level, allowing users to see whether a model performs consistently or merely excels on easier items. A publicly accessible verbatim response trail lets anyone inspect the exact image, options, and answer each model provided, adding a layer of accountability rare in LLM evaluation.

0 comments Read more at DEV Community