CISA Adds LiteLLM and Kestra AI Infrastructure Flaws to Exploited Vulnerabilities List

·1 views

The US Cybersecurity and Infrastructure Security Agency (CISA) added vulnerabilities in LiteLLM and Kestra to its Known Exploited Vulnerabilities catalog on September 2, 2026, marking the first time AI infrastructure components have appeared alongside traditional software flaws on the list. LiteLLM, an AI gateway, carries an improper authentication flaw rated CVSS 8.8, while Kestra, a workflow orchestration platform, has an OS command injection vulnerability rated a critical CVSS 10.0. A ZoomEye internet scan conducted on September 19, 2026, found over 34,000 internet-facing LiteLLM instances and 126 Kestra deployments, highlighting meaningful public exposure. Because these platforms routinely store sensitive credentials such as model provider API keys and database tokens, a successful exploit risks large-scale credential theft rather than mere service disruption. Security researchers are urging organizations to take these AI services offline from public internet access, apply patches immediately, and rotate any potentially exposed credentials.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Dev Shares Architecture for Reliable Password Reset Emails Using Transactional API

A developer has outlined a practical architecture for handling password reset emails using a transactional email API, durable job queues, and isolated reset templates within a property-management marketplace application. The approach separates reset token management from email delivery, treating the token as security-critical data and the email as an independent background job. The system uses FastAPI to create reset records, a worker to render templates via the provider API, and a reconciler to poll for delivered or bounced outcomes. The author emphasizes configuring SPF, DKIM, and DMARC records on a verified sending domain before enabling reset traffic, recommending a non-production subdomain for initial testing. The piece also notes that reset links should be short-lived and single-use, and that public endpoint responses must remain identical for known and unknown addresses to prevent account enumeration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

In 2026, Engineers Are Ditching Stack Sprawl for PostgreSQL and Go

A growing number of engineering teams in 2026 are moving away from complex, multi-tool stacks toward simpler, more maintainable combinations anchored by PostgreSQL and Go. PostgreSQL's mature JSONB support and extensions like pgvector now allow it to handle unstructured data and AI-related workloads, reducing the need for separate databases like MongoDB, Redis, or Pinecone. Go has emerged as a preferred backend language for high-throughput services, valued for its simplicity, efficient concurrency model via goroutines, and suitability for cloud-native infrastructure. The emerging industry standard, often called the 'golden path', pairs TypeScript on the frontend with Go on the backend and PostgreSQL as the data layer, attracting strong hiring pools and AI coding assistant support. The overarching lesson is to avoid over-engineering — many startups are advised to start with a well-structured monolith and split into microservices only when genuine organisational or traffic demands arise.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Integrity-OS Uses AI to Track Promises Against Real Evidence

Integrity-OS is an AI-native accountability system submitted for the Sanity Challenge that traces commitments through a structured chain of actions, claims, evidence, verification, and community feedback. Built by a developer using an AI-first workflow, the system was designed to move beyond generic dashboards and make accountability evidence-based and traceable. Rather than generating a synthesized answer, it preserves discrepancies — for instance, flagging gaps between 500 students promised aid and only 312 verifiably reached. Users can explore commitments, inspect supporting evidence, and interact with an AI accountability agent via a live demo application. The project aims to make the gap between what was promised and what actually happened visible, structured, and auditable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Temporary Message-Sharing API Using NestJS, PostgreSQL, and Redis

A developer has published a detailed walkthrough of a temporary message-sharing API built with NestJS, PostgreSQL, Prisma, and Redis. The API lets users create short-lived messages with configurable rules such as expiration windows, visit limits, optional password protection, and one-time access. Each message is assigned a randomly generated short code, and expiration is stored as an absolute timestamp to simplify validity checks at retrieval time. Redis is used for caching, while a scheduled cron job handles automatic cleanup of expired records, and rate limiting is enforced via the NestJS throttler module. The project was intentionally kept small and modular to give each layer — controller, service, database, and cache — a clearly defined responsibility.

0 comments Read more at DEV Community