CISA Flags LiteLLM, Kestra, and Starlette CVEs as Actively Exploited in the Wild

·6 views

The U.S. Cybersecurity and Infrastructure Security Agency added seven CVEs to its Known Exploited Vulnerabilities catalog in the second week of September 2026, three of which directly affect common self-hosted AI infrastructure. LiteLLM, a popular AI gateway proxy, carries a flaw exposing an unauthenticated admin endpoint that leaks all configured API keys in a single request. Kestra, widely used for AI pipeline orchestration, has a remote code execution vulnerability allowing attackers to run arbitrary commands via crafted workflow definitions. Starlette, the underlying framework for roughly 70% of self-hosted AI model servers built on FastAPI, contains a server-side request forgery flaw that can expose internal network resources. Security researchers warn that once code execution is achieved on these servers, plaintext API keys and cloud credentials stored in environment variables — as recommended in most official setup guides — are trivially recoverable.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Parent-engineer builds ad-free, no-tracking Sudoku app for kids

A developer and parent has launched Animal Sudoku Kids Puzzle, a free iOS app designed to teach logic to children without ads, data collection, or third-party tracking. The app offers three difficulty levels using color-coded animal icons on 4×4 and 6×6 grids, with features like auto-save, smart hints, and gentle background music. The developer built it out of frustration with existing free children's games that monetize attention through intrusive ads and quietly harvest behavioral data. Accessibility was a core priority from the start, with support for VoiceOver, TalkBack, voice control, haptic feedback, and high-contrast visuals. The app is fully COPPA-compliant, requires no internet connection or account creation, and is available free on the App Store, with an Android version in development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Benchmarking 5 React Table Optimisations: Only Two Actually Improved Speed

A developer tested five common optimisation techniques on a React table rendering 4,000 rows with a live filter, measuring re-render times on a production build. Using React.memo alone reduced render time by just 13ms — within measurement noise — because inline callback functions passed as props change reference on every render, defeating memo's shallow comparison. Combining memo with useCallback and useMemo cut the slowest keystroke re-render from 166ms to 47ms, making it the first genuinely effective fix. A children bailout approach clocked 0.4ms but only because it skipped the filtering work entirely, not because it processed data faster. Virtualisation, which renders only visible rows, reduced render time to 3.6ms while preserving full filter functionality, making it the most practical solution for large datasets.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer launches ToolFlow with 84 free CSS tools, no login or ads required

A developer built ToolFlow, a free web platform housing 84 CSS generators, design utilities, and calculators, after growing frustrated with slow, paywalled, or sign-up-required alternatives. The site organizes tools across six categories — Color, Accessibility, CSS Generators, Layout, Typography, and Utility — covering everything from gradient builders to a CSS Specificity Calculator. Each tool is a standalone HTML file built with vanilla JavaScript and CSS, keeping the entire site at roughly 2.3MB with fast load times. ToolFlow requires no account, displays no ads, and the developer has committed to keeping all tools permanently free. A optional Gumroad store offers paid CSS preset packs, but the core toolset at toolflow.app remains fully open to all users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SpikeForge splits into modular toolkit, model hub, and dashboard packages

SpikeForge, a Python toolkit for building and testing spiking neural networks, has restructured into four separate packages: spikeforge, spikeforge-targets, spikeforge-hub, and spikeforge-dashboard. The project released versions 0.4.0 and 0.5.0 during this cycle, adding a train/test split for event data, quantization updates, and shared logging via capsize-commons. The modular design allows users to install only the components they need, so a researcher experimenting in Python is not required to install the desktop application or web dashboard. The offline-first model hub lets users browse and use a model catalogue without requiring a network connection for every experiment. Source code is available on GitHub, desktop releases are hosted on itch.io, and package links can be found at spikeforge.net.

0 comments Read more at DEV Community