Checklist for Verifying an Unauthenticated RCE in a Nextcloud File-Sync Stack

·4 views

A DEV Community guide sets out a reusable checklist for handling an unauthenticated remote code execution flaw, tracked as CVE-2026-110447, in self-hosted file-sharing software. The vulnerable code sits in proxy.php, delivered by the optional richdocumentscode app rather than core Nextcloud or standalone Collabora servers. The authors recommend scoping exposure with component-specific searches restricted to an organization's own address ranges, then closing gaps external scans miss through configuration data. Administrators should also search for exploit artifacts such as shx*.php files and review logs for attempted requests and known attacker addresses. The checklist is intended to produce a defensible verification sequence rather than an affected-host count.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

CAPTD adds Get Clients captions, place recognition, and a theme switcher

CAPTD this week rolled out a new "Get clients" caption option alongside "Tell the story" across its Snapshot, Video, and Slideshow workspaces, with structured business details and call-to-action placement. Photos lacking GPS data are now automatically assessed for location using a downscaled upload and Gemini flash-lite, so place suggestions appear during caption generation. The platform also introduced light, dark, and system theme options across all pages, alongside a privacy update featuring cookieless aggregate analytics and locally hosted fonts. The Marketing workspace was renamed Spotlight, and its Episode mode now accepts audio uploads with transcription and chapter generation. Additional camera settings guides for the Canon R5 Mark II and Nikon Z9 were also published.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source Severity Scorer and pytest CI Gate for Red-Team Findings in Banking LLMs

The article argues that binary red-team reporting for LLM assistants fails to guide release decisions because it ignores differences in harm severity. The author describes an Apache-2.0 open-source Python scorer that converts red-team findings into a typed data model with severity levels and harm categories. The scorer is designed for UAE banks but applies to any release that must pass a risk gate. It can run as a pytest check in CI to block releases that fail defined criteria. The author notes that the tool includes no numeric weights by default, so it reports when a score cannot be computed rather than inventing one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP Playbook auto-generates interactive docs and a live tester for MCP servers

A new open-source tool called MCP Playbook reads the tool schemas of a Model Context Protocol server and produces an interactive documentation site automatically. The generated site describes each tool's parameters, types, and defaults, and includes a browser-based form for running tools against the live server. Teams can also save and load example calls and view the raw JSON Schema for copying. Developers install it through npm and configure it to launch a local server or connect to a running HTTP endpoint, with a dev mode for live previews and a build command for static hosting. The static export keeps docs and examples online but disables live tool execution, since no server backs the hosted site.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Safe Postgres Embedding Migration Keeps Course-Page Search Live During Reindexing

Migrating embedding models should be treated as a data migration: a second index is built under an explicit version while the current index keeps serving traffic. The new index is only promoted to reads after it passes a retrieval-quality check and a latency target. Vectors from different models must never be combined in one searchable set, which keeps alerts about course-page changes reliable during background re-embedding. The write-up argues that uptime alone is misleading, since recall can quietly degrade while a service still responds quickly. To prevent stale data, each page revision is stored as the durable unit of work and writes are checked against the expected revision, with deletions applied to both indexes.

0 comments Read more at DEV Community