City-Forum Campaign Exploits Salesforce and ServiceNow Guest APIs to Harvest Data

·1 views

A threat actor tracked as City-Forum is using a custom Go-based tool to silently enumerate publicly accessible data on Salesforce Experience Cloud and ServiceNow Service Portal instances without requiring authentication. The tool exploits misconfigured guest user permissions in Salesforce Aura and LWR GraphQL APIs to extract records including accounts, contacts, cases, leads, and documents left visible to unauthenticated users. It simultaneously probes ServiceNow's public Service Portal search API to collect data exposed through Knowledge Bases and custom search sources. All traffic originates from IP address 158.220.87.79 hosted on Contabo, linked to the domain city-forum.com since March 2025, with no malware deployed on victim systems and no user login events generated. Security researchers recommend disabling LWR guest UI APIs, enforcing minimum privilege for guest users, and adding login gates to ServiceNow search sources to mitigate the risk.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Spider-Man-Themed Portfolio Site Inspired by Peter Parker's Curiosity

A software developer has launched a personal portfolio website called 'Peter Parker's Lab', designed to reflect the spirit of the fictional character rather than follow conventional portfolio templates. The developer drew inspiration from Peter Parker's identity as a curious, experimental builder rather than from Spider-Man's superhero persona. The site serves as a digital lab showcasing ongoing work in areas such as AI, automation, full-stack development, cloud infrastructure, and DevOps. Rather than presenting a static list of skills or repositories, the portfolio is intended to highlight the problems the developer is curious about and the projects they are actively building. The site, hosted at peterparker-lab.vercel.app, is described as version one, with updates planned as the developer's work and interests evolve.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CSS :has() selector eliminates JavaScript for common form interactions

The CSS :has() pseudo-class, now supported across Chrome, Edge, Firefox, Safari, and Opera without polyfills, allows developers to style a parent element based on conditions inside its child elements. Previously, tasks like highlighting a focused field, showing validation errors, or marking required inputs demanded JavaScript event listeners and class toggling. With :has(), a single CSS selector can replace multiple lines of JS — for example, styling a wrapper when its input receives focus or when it contains an invalid value. Pairing :has() with states like :invalid and :not(:placeholder-shown) enables real-time inline validation that only triggers after user interaction, avoiding premature error messages on page load. While :has() handles most visual state changes natively, developers are advised to remain cautious around accessibility concerns, such as using pointer-events: none alone to disable form submission buttons.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How UPI Handles Millions of Simultaneous Payments Without Crashing

India's Unified Payments Interface faces extreme traffic spikes on salary days, when simultaneous transactions can surge from roughly 100,000 to over one million requests per second. Rather than relying on a single powerful server, UPI-style systems distribute traffic across many machines using load balancers and horizontal scaling, so that no single point of failure can bring down the entire network. However, scaling the application layer alone is insufficient, as concurrent requests accessing the same bank account can trigger race conditions that allow more money to be spent than actually exists. Solving this requires additional techniques such as database-level concurrency controls, idempotency, and distributed consistency mechanisms. Together, these challenges make large-scale payment systems one of the most complex problems in distributed systems design.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tim King, Creator of Tripos OS That Powered the Amiga, Dies at 78

Tim King, a British computer scientist who built the operating system at the heart of the Commodore Amiga, passed away in 2026 at the age of 78. As a Cambridge PhD student in the late 1970s, King developed Tripos, a preemptive multitasking OS written in BCPL, which became the foundation of AmigaDOS when Commodore adopted it for the Amiga's 1985 launch. The Amiga's ability to multitask years before Windows or Mac OS was largely due to the maturity of King's earlier work. After his time at MetaComCo in Bristol, King founded Perihelion in 1986 to work on parallel computing and the Helios OS, and later established UK Online, one of Britain's earliest internet service providers. His career spanned three defining decades of computing, leaving a lasting mark on operating systems, personal computing, and early consumer internet.

0 comments Read more at DEV Community