Critical vulnerabilities in LXD allow container escape via backup import

·1 views

Multiple critical vulnerabilities have been discovered in LXD container management software. CVE-2026-87799 and related flaws allow attackers to write files as root on the host system during backup import operations. These vulnerabilities affect LXD versions 4.0 and later, with severity ratings up to 9.9 on the CVSS scale. The issues involve improper handling of symbolic links during btrfs filesystem restore processes. Project maintainers have released fixed versions and recommend immediate patching and restricting backup imports from untrusted sources.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer creates free browser simulators to explain Kubernetes scheduling and networking

A developer has built three free browser-based simulators to help users understand Kubernetes scheduling and networking. The first simulator demonstrates how the scheduler places pods onto nodes based on resource requests, taints, affinity rules, and zone distribution. The second simulator visualizes network traffic paths for pod-to-pod communication, services, and network policies across different CNI modes. The tools aim to help developers debug common issues like pending pods and unreachable services by revealing underlying mechanisms. All simulators are available without registration or a running cluster.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Transition from iDEAL to Wero payment system shows varied progress among major retailers.

The migration from the Netherlands' dominant iDEAL payment system to its European successor, Wero, is underway with a deadline of the end of 2027. Monitoring of 24 major Dutch and German online shops in October 2026 found only 5 displaying the dual iDEAL and Wero branding as intended. Five other major merchants still displayed only iDEAL, while payment logos for many others could not be verified without deeper checkout analysis. Payment service providers show mixed readiness, with some cautioning that adoption remains in early stages despite the ongoing transition.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Study audits if published reference lists still cite retracted papers

A 2026 audit tested the OpenAlex database's ability to identify retracted papers in published reference lists. Using a sample of 120 known retractions, OpenAlex correctly flagged 95.8% as retracted, showing high agreement with the authoritative Crossref database. In live audits of reference lists from 2019-2025, no retracted citations were found, though the sample size limits definitive conclusions. A seeded control test successfully identified a known retracted paper, proving the audit pipeline functions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cryptographic key rotation failures often stem from incomplete system inventories.

Key rotation frequently fails because teams overlook all the places a key is used, such as forgotten partner integrations. Different keys, like signing keys or symmetric data keys, require specific rotation mechanics involving overlap periods or version tracking. Effective rotation requires a complete inventory from configuration systems, staging new keys, and monitoring during the switch. Automated reminders are recommended, but the actual switch should remain manual until the inventory process is proven reliable.

0 comments Read more at DEV Community