Critical ServiceNow AI Platform Flaw CVE-2026-6875 Actively Exploited in the Wild

·1 views

Threat actors are actively exploiting CVE-2026-6875, a critical sandbox escape vulnerability in the ServiceNow AI Platform carrying a CVSS score of 9.5. The flaw allows unauthenticated attackers to execute arbitrary code via a pre-authentication endpoint, requiring no stolen credentials or prior foothold. Threat intelligence firm Defused Cyber confirmed in-the-wild exploitation on July 21, 2026, with attack payloads targeting the '/assessment_thanks.do' endpoint via HTTP POST requests. Successful exploitation can result in full compromise of the ServiceNow instance and all connected proxy servers, exposing ITSM data, integration credentials, and linked systems. ServiceNow released patches in June 2026, and all organizations running self-hosted instances are urged to apply them immediately without waiting for a scheduled maintenance window.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Apple Releases Safari Technology Preview 248 With Latest WebKit Updates

Apple has released Safari Technology Preview 248, the latest build of its experimental browser used to test upcoming features. The release includes updates to the WebKit rendering engine, which powers Safari across Apple platforms. Safari Technology Preview serves as a testing ground for web developers and early adopters to evaluate new web technologies before they reach the stable version of Safari. Full release notes detailing the specific changes and fixes are available on the official WebKit blog.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How to Set Up an Apache Virtual Host on a Local LAMP Server

Setting up a virtual host on a local LAMP stack requires creating an Apache configuration file under /etc/apache2/sites-available/ with directives such as ServerName, DocumentRoot, and Directory permissions. Once the config file is saved, the site must be enabled using the a2ensite command, followed by reloading the Apache service via systemctl. The local domain, such as example.sandbox, must then be mapped to 127.0.0.1 by editing the system's /etc/hosts file. A corresponding web root directory should be created under /var/www/ and ownership assigned to the current user and the www-data group. After these steps, the virtual host becomes accessible through a browser at the configured local domain.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Browser-Level Behaviors Like Permissions and Notifications Break Automation Suites

Modern web applications increasingly rely on browser-level features — such as permissions, push notifications, geolocation, and email-based authentication — that extend well beyond a single tab or page interaction. These factors make automated testing significantly more complex, as test suites must account for varied permission states, notification deep-links, and multi-system email flows rather than simple click-and-verify scenarios. Common brittle points include inbox harnesses that assume stable subject lines and instant delivery, and permission tests that only cover the 'Allow' case while ignoring denial, dismissal, or revocation. Experts recommend treating email inboxes and browser storage as structured test infrastructure, using unique addresses or correlation IDs and verifying both the message produced and the resulting browser journey. Robust test coverage requires mapping the full agreement between the application, browser, operating environment, and external services rather than testing each component in isolation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

3 Next.js Micro-Interactions That Give Web Apps a Premium Feel

A developer at Ninth Node has outlined three micro-interaction techniques for Next.js applications aimed at improving user experience beyond basic functionality. The first involves a mouse-tracking radial gradient on card components, replacing standard CSS hover states with a more immersive cursor-following glow effect. The second uses Framer Motion to stagger the entrance of elements as users scroll into new sections, rather than fading all content in simultaneously. The third recommends fluid typography using CSS clamp() to scale headings smoothly across screen sizes without relying on fixed breakpoints. Together, these techniques are presented as practical ways to elevate a modern web interface from functional to polished.

0 comments Read more at DEV Community