Cisco Patches Critical SQL Injection Flaw in Secure Email Gateway, Exploited in Wild

·3 views

Cisco released fixes in September 2026 for CVE-2026-76461, a critical SQL injection vulnerability in AsyncOS for its Secure Email Gateway, scoring 9.8 on the CVSS scale. The flaw exists in the inbound mail parsing component, where insufficient input validation allows an unauthenticated remote attacker to execute arbitrary SQL statements and ultimately gain root access on the underlying operating system. Both physical and virtual deployments are affected, with patched builds available at versions 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Cisco confirmed active exploitation in the wild prior to the patch release, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a federal remediation deadline of 17 September 2026. Beyond upgrading to a fixed build, Cisco advises organizations to audit devices for signs of compromise, rotate credentials, and rebuild any appliance suspected of full compromise, as root-level access cannot be reliably eliminated through a firmware upgrade alone.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Horizontal vs Vertical Scaling: When to Use Which for Growing Apps

As applications grow to serve millions of concurrent users, a single server often struggles with load, crashes, and data inconsistencies, making scaling essential. Vertical scaling solves this by upgrading a single machine's CPU, memory, and storage, but hits a hard limit and creates a single point of failure. Horizontal scaling adds more machines and uses a load balancer to distribute traffic, theoretically allowing unlimited growth and better fault tolerance. However, horizontal scaling requires applications to be stateless, as session-based authentication can break when requests are routed to different servers. A common fix is to store sessions in a shared external database like Redis, which also supports automatic session expiration via its TTL feature.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Small Teams Can Build a Minimal AI Agent Training Dojo on a Weekend

A five-part series on building AI agent training environments concludes with a practical guide aimed at small teams with limited budgets and no GPU infrastructure. The author outlines four core components of a minimal dojo: a task set drawn from real team work, an automated checker, a lesson log, and a defined practice cycle. Using content writing as a concrete example, the guide shows how mechanical checks such as verifying citations and paragraph length can be scripted, while subjective quality judgments still require human review. Teams are advised to run weekly one-hour practice rounds, comparing each cycle's results against the previous to track incremental improvement. The author cautions that this approach is not suitable for every team, particularly those whose tasks change too frequently or whose work carries high stakes requiring mandatory human sign-off.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds and ships MarkdownStack, a self-made markdown notes and publishing app

A software developer has launched MarkdownStack, a personal side project built to solve frustrations with existing note-taking and publishing tools. The app offers a private markdown workspace with nested folders, wiki-style note linking, hashtag organization, and a quick search switcher. Users can publish notes or entire folders to public URLs with a single click, allowing readers to comment and upvote without needing an account. An AI assistant feature lets users generate and save markdown notes directly to their vault using their own API key. The app is built on React and FastAPI with PostgreSQL full-text search, deployed on AWS via Docker Compose and GitHub Actions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Simple Kotlin Validator Prevents Silent Data Corruption in Distance Tracking

A software engineering team discovered that five distance metrics in their tracking system — original, cleaned, mock, abnormal, and spike — had no code-level checks ensuring their mathematical relationships held true. To fix this, they built an 80-line Kotlin validator that enforces key invariants, such as cleaned distance equaling original minus mock and abnormal, while deliberately excluding spike to avoid double-counting. The validator uses a 0.1-metre floating-point tolerance to avoid false failures and separates hard errors, which block data submission, from warnings that flag unusual ratios without stopping the pipeline. Ratio-based warnings catch a different class of problem: cases where all numbers are internally consistent but a classification filter is quietly discarding large portions of a genuine journey. The team argues that asserting system invariants explicitly in code is far cheaper than discovering silent data corruption weeks later through customer support complaints.

0 comments Read more at DEV Community