Critical NetScaler SAML Bypass CVE-2026-19490 Scores 9.3, Exploits Already Observed

·1 views

A critical vulnerability tracked as CVE-2026-19490 affects Citrix NetScaler ADC and NetScaler Gateway, allowing attackers to forge SAML assertions and obtain valid sessions without a legitimate signature. Citrix published advisory CTX696939 on August 19, 2026, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 9, 2026, confirming active exploitation in the wild. The vulnerability carries a CVSS v4.0 score of 9.3 and is particularly dangerous because compromised sessions appear legitimate to downstream systems, leaving no obvious trace in authentication logs. Affected builds include NetScaler ADC and Gateway versions 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, with no workaround available — patching to a fixed build is the only complete remedy. End-of-life branches 12.1 and 13.0 will not receive fixes and should be replaced or isolated, while a ZoomEye scan identified over 239,000 publicly reachable NetScaler instances, underscoring the scale of potential exposure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Choose the Right Multimodal AI API for Your Workload in 2026

Selecting a multimodal AI API in 2026 requires matching the platform to the specific workload rather than simply comparing model counts or opting for a single provider. Key questions include what output types are needed, whether models are commercial or custom-deployed, and how billing units like tokens, megapixels, or generated seconds align with actual usage. Four platform categories stand out: cross-provider gateways for mixed workloads, Replicate for open-model experimentation, fal.ai for high-volume media generation, and Google Vertex AI for teams already operating within Google Cloud. Vertex AI is particularly suited to regulated or governance-heavy environments, where Google's own models — Gemini, Imagen, Veo, and Lyria — integrate with existing IAM policies and regional controls. Pricing figures cited, such as Gemini 3.8 Flash at $0.75 per million input tokens, reflect a September 2026 snapshot and should be independently verified before being used in cost models.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

IBM's Chunkless RAG Challenged: Does Ditching Document Chunks Actually Help?

IBM has been promoting a 'Chunkless RAG' approach that uses AI agents to navigate document structure — preserving headings, tables, and hierarchies — instead of splitting text into fixed-size chunks for embedding. Critics argue the method is overhyped, noting that real-world document corpora — including scanned PDFs, legal contracts, and Slack exports — are too messy for reliable structure parsing. When a parser fails to extract a clean document tree, the navigating agent simply traverses noisy data with added latency, swapping one failure mode for another that is harder to detect. Analysts also point out that the core retrieval problem in most pipelines is poor query-to-passage semantic overlap, which Chunkless RAG does not inherently solve. Techniques like hypothetical document embeddings, query expansion, and hybrid BM25-plus-dense-vector retrieval are seen as more reliably moving the needle on retrieval precision.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds TGDown Chrome extension for one-click Telegram Web media downloads

A developer has released TGDown, a Manifest V3 Chrome extension built with TypeScript and Vue that adds download controls for images and videos directly within Telegram Web. The extension supports both Telegram Web interfaces and offers one-click downloads, batch downloads from search results, and a popup panel listing detected media. TGDown operates across three execution contexts — a content script, a page-context script, and extension pages — to stay isolated from Telegram's internal code while using its existing authenticated session. During development, a critical dark-mode bug caused the entire Telegram page to flash white due to a full-screen iframe rendering the browser's default white canvas before initializing. The developer resolved the issue by replacing the iframe approach with a Shadow DOM host, which maintains CSS isolation without introducing a separate document rendering surface.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Video Background Removal Fails and How Temporal AI Models Fix It

Developers commonly misapply image-based background removal tools to video, treating each frame as an independent photo rather than part of a continuous temporal sequence. This approach causes visible flickering, ghosting on fast movements, and inconsistent edge detection between frames. Architectures like Robust Video Matting (RVM) address this by using recurrent neural networks that carry memory across frames, enabling stable real-time matting at resolutions up to 4K. A separate but related pitfall is exporting transparent video as H.264 MP4, which does not support an alpha channel, causing transparent pixels to render as black; formats like WebM or ProRes 4444 MOV are needed for true transparency. Understanding both the temporal processing model and format constraints is essential for developers building reliable video segmentation pipelines.

0 comments Read more at DEV Community