Critical GitLab CVE-2026-85706 Exposes Over 1.2M Instances to File Read Attacks

·13 views

A maximum-severity vulnerability, CVE-2026-85706, was discovered in GitLab's repository commits API, allowing unauthenticated arbitrary file reads with a CVSS score of 10.0. GitLab released patches on September 10, 2026, covering versions 19.1.8, 19.2.6, and 19.3.2, with CISA adding the flaw to its Known Exploited Vulnerabilities catalog the next day. Internet scans via ZoomEye identified over 1.26 million publicly reachable GitLab instances as of September 19, 2026, though the figure reflects exposure scope rather than confirmed vulnerable systems. Security teams are advised to inventory all self-managed instances, apply available patches immediately, and restrict public access where upgrades cannot be deployed right away. Additionally, service account credentials accessible through potentially exposed instances should be audited and rotated as a precautionary measure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

wFabricSecurity uses SHA-256 hashing to protect blockchain worker nodes from tampering

Developer William Steve Rodríguez Villamizar has released wFabricSecurity, an open-source Python library designed to verify the integrity of code running on Hyperledger Fabric worker nodes. The tool computes SHA-256 cryptographic hashes of critical files and halts execution if even a single byte has been altered, guarding against backdoor injection or silent configuration drift across node fleets. It also ties code hashes to specific version labels, providing an auditable trail confirming that workers ran the approved business logic. The library is compatible with Python 3.10 and above and includes cryptographic identity management and token-bucket rate limiting alongside its integrity checks. It is available on both GitHub and PyPI under the project name wFabricSecurity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Launches EmbedCatalog, an Open-Source Tool for Custom Project Embeds

A developer has released a new version of EmbedCatalog, a personal project built over a few weeks and available at embedcatalog.com. The platform allows users to create and manage custom embeds to enhance the visual presentation of applications or Markdown files. It supports a range of project types including open-source tools, web apps, packages, and commercial services. The platform offers both free and premium tiers, with features including user registration, login, and an embed editor. The project is open source and hosted on GitHub, where the creator is inviting community contributions and feedback.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Software Engineering Skills Remain Essential Despite Rise of AI Coding Tools

A software engineering perspective published on DEV Community argues that AI and LLMs cannot fully replace human software engineers, despite growing industry claims to the contrary. The author contends that key engineering activities — such as requirements gathering, architectural decision-making, mentoring, and complex system design — still require human judgment and expertise. While acknowledging that AI tools can boost productivity in areas like unit testing, prototyping, and formal verification, the author maintains they lack the broader context needed to build large-scale systems. The piece pushes back against the narrative, often promoted by executives and AI vendors, that software development is simply a matter of writing code that machines can replicate. Ultimately, the author predicts AI will settle into the role of a powerful but conventional tool — much like compilers or IDEs — rather than a wholesale replacement for software engineers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Two Open-Source Tools Simplify AMD GPU Setup and Benchmarking for Local LLMs

Running large language models locally on AMD GPUs has been complicated by missing drivers and unrecognised GPU architectures requiring manual environment variable tweaks. A tool called ROCmFix addresses this by automatically detecting GPU PCI IDs and setting the HSA_OVERRIDE_GFX_VERSION variable across multiple shells on both Windows and Linux. A companion tool, InferBench, helps users determine whether Vulkan or ROCm/HIP backends deliver better performance by running structured benchmarks with warm-up queries and forced VRAM unloads between runs. InferBench measures key metrics including median tokens per second and Time-to-First-Token to reduce caching bias in results. Both tools are available as open-source repositories aimed at AMD GPU users seeking a more reliable local AI inference experience.

0 comments Read more at DEV Community