Cisco ISE Zero-Day CVE-2026-76460 Actively Exploited, CISA Adds to KEV Catalog

·1 views

Cisco has disclosed a critical authentication bypass vulnerability (CVE-2026-76460) in its Identity Services Engine (ISE) and ISE Passive Identity Connector, carrying a maximum CVSS score of 10.0. The flaw allows unauthenticated remote attackers to send crafted HTTP requests to the management API, bypass authentication entirely, and execute arbitrary commands with root privileges. Active exploitation in the wild has been confirmed by both Cisco and CISA, which added the vulnerability to its Known Exploited Vulnerabilities catalog on September 16, 2026. All vulnerable ISE releases are affected regardless of which features are enabled, and attackers may erase local log files to conceal intrusions. Cisco has released an emergency patch, and administrators are urged to apply it immediately across all nodes while restricting management interface access to trusted networks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer releases 425-byte library to parse partial JSON from streaming LLMs

A developer building an LLM-powered recipe app found that JSON.parse fails on every incomplete token during streaming, since valid JSON only exists once the final closing bracket arrives. To solve this without discarding streaming benefits or relying on fragile regex hacks, they built a minimal open-source library called SoFar. The library exposes two functions — parsePartialJSON and createJSONStream — that return the best structurally complete value available from any partial JSON buffer without throwing errors or guessing incomplete values. It works by scanning the buffer once, tracking open containers and string state, and identifying safe cut points where valid JSON can be reconstructed by appending the necessary closing brackets. At 425 bytes gzipped and zero dependencies, it is designed as a thin complement to the native JSON.parse rather than a replacement.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hidden AI Reasoning Tokens Drive Unexpected Billing Costs for Developers

Companies using AI inference services are facing significant billing surprises due to hidden reasoning tokens that are charged as output but not visible during usage. A 2025 study found that these concealed tokens can account for over 90% of total token spend on complex tasks, with a seemingly simple response potentially hiding more than 10,000 reasoning tokens. The problem is expected to grow as Goldman Sachs projects global token usage to reach 120 quadrillion per month by 2030, a 24-fold increase. In response, the Linux Foundation has proposed a Tokenomics Foundation to establish open, vendor-neutral token measurement standards, while providers like Groq and Cerebras have moved toward flat per-token pricing models. Developers are increasingly demanding greater transparency in token accounting as AI costs shift from minor line items to significant operational expenses.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security Audit Flags 11 Vulnerabilities in Aave V3, Rates Risk 7.4 out of 10

A security audit of Aave V3, the decentralized lending protocol with approximately $17.7 billion in total value locked, identified 11 vulnerabilities across reentrancy and access-control domains, with three rated Critical. The review, dated September 2026, found improperly guarded external calls in flash-loan and collateral-withdrawal paths, as well as overly broad admin role assignments in the upgrade proxy. Auditors warned that a successful reentrancy exploit on the flash-loan entry point could theoretically allow an attacker to drain up to $1.2 billion before liquidation mechanisms respond. None of the vulnerabilities are currently exploitable on the live mainnet, as existing safeguards such as reentrancy guards and multi-signature governance provide interim protection. However, the audit stresses that any future upgrade or misconfiguration removing those defenses could expose the protocol to significant risk, making prompt remediation essential.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

iOS camera briefly reports wrong orientation for ~100ms, masking a longstanding bug

A developer investigating sideways video recordings on iPhone discovered that the iOS camera temporarily reports incorrect landscape dimensions for roughly 100–150 milliseconds after a track is created, before correcting itself to portrait. This narrow window explains why the bug went undetected: tests that wait for a preview to load before reading track dimensions always land outside the faulty window and pass cleanly. The developer confirmed the timing across multiple runs, observing the flip from 1920x1080 to 1080x1920 occurring between roughly 100 and 150 milliseconds after track creation. The finding has broader implications beyond iOS, highlighting that any value which eventually corrects itself can silently fool well-written tests that wait for things to settle. The developer also found that most major webcam libraries, including react-webcam and react-media-recorder, are largely inactive, with LiveKit being the only one showing consistent recent human contributions.

0 comments Read more at DEV Community