Critical WordPress Flaw CVE-2026-87902 Exploited Within Hours of Patch Release

·2 views

A critical path traversal vulnerability in WordPress core, tracked as CVE-2026-87902 with a CVSS v4.0 score of 9.2, was publicly patched on September 22, 2026. Security firm Patchstack observed unauthenticated attackers probing vulnerable sites and attempting PHP file writes on the same day the patch was released, with traffic volume surging tenfold by the following day. The flaw allows local file inclusion and can escalate to remote code execution in environments where specific theme directory structures, pearcmd.php, and certain PHP configurations are present. Successful exploitation requires several conditions to align, including the existence of a page- prefixed directory under an active theme and write permissions to target directories. WordPress site administrators are urged to update immediately to version 7.1.2 or the patched release for their active branch.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

MCP Tooling Draws 42,270 Monthly Searches But Most Demand Is Hard to Win

An analysis of 73 MCP-related search phrases, measured on September 21, 2026, found a combined 42,270 monthly U.S. searches, with 'model context protocol' alone accounting for 28.6% of that volume. Only 48 of the 73 phrases cleared the 50-searches-per-month threshold, and the top terms carry high SEO difficulty scores, making them hard for new entrants to rank for. Clustering by search-result overlap revealed 43 distinct topical clusters, meaning nearly every phrase leads to a unique results page rather than sharing traffic across a common hub. Lower-difficulty phrases like 'mcp vs api' and 'streamable http' attract more specific, later-stage searchers and represent more realistic ranking opportunities for smaller players. The publisher's own site earned just 54 impressions and 7 clicks during the measurement period, all from branded queries, underscoring the gap between total market demand and what a new site can realistically capture.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev Tutorial: Pullfrog and Ollama Cloud Enable Low-Cost AI Code Reviews on GitHub

A developer has published a guide detailing how to connect Pullfrog, a GitHub Actions-based coding agent, to DeepSeek V4.1 Flash served via Ollama Cloud for automated pull request code reviews. The setup is designed to run repeatedly at near-flat cost, with Ollama Cloud pricing at $0.15 per million input tokens and $0.60 per million output tokens. A key factor in choosing Ollama Cloud was its Zero Data Retention policy, which ensures that code sent for review is neither stored nor used for model training. Configuration involves linking Pullfrog to Ollama's OpenAI-compatible API endpoint using a few environment variables, after which reviews trigger automatically on pull request opens or @pullfrog mentions. In testing, the system surfaced real issues such as undeclared runtime dependencies and comments inconsistent with upstream library status.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Plugin.Maui.VideoPipeline 1.1.0 Adds Thumbnails and OS-Based Transcoding for .NET MAUI

Version 1.1.0 of Plugin.Maui.VideoPipeline, an open-source .NET MAUI library, is now available on NuGet, adding thumbnail generation and OS-level video transcoding. The plugin lets developers cap video duration, resolution, and file size before upload, delegating compression to the device's native encoder rather than bundling a third-party binary like FFmpeg. If the device cannot transcode, the plugin returns a typed CannotTranscode status instead of throwing an exception. Videos can also be encrypted using AES-256-GCM, producing a .vault file that can be reversed with DecryptFileAsync. The package supports Android (API 21+), iOS, Mac Catalyst, and Windows, and is MIT licensed under the net10.0 target framework.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Disposable Email Signups Silently Drain SaaS Revenue and Domain Health

Disposable or temporary email addresses used during signups create lasting financial damage for SaaS platforms, e-commerce sites, and newsletters. Dead contacts inflate CRM databases, pushing businesses into higher-cost subscription tiers on platforms like HubSpot, Mailchimp, and Klaviyo — costing hundreds of extra dollars monthly. Products offering free trial credits are also vulnerable, as automated bot scripts exploit throwaway inboxes to repeatedly claim sign-up perks, potentially racking up thousands in unrecoverable API or cloud costs. Beyond storage and credits, high volumes of invalid addresses drive up hard bounce rates, damaging a sender's domain reputation with major email providers like Gmail and Microsoft 365. Deploying a disposable email checker at the point of registration is presented as a low-friction way to block these exploits before they enter the system.

0 comments Read more at DEV Community