SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

CVE-2026-0313: OS command injection in Cortex XSOAR and XSIAM OS Query pack

0
·1 views

Palo Alto Networks disclosed CVE-2026-0313 on 14 October 2026, an OS command injection flaw in the OS Query content pack used by Cortex XSOAR and Cortex XSIAM. An authenticated administrator could exploit it to run arbitrary commands on remote endpoints through the SSH integration. The issue is rated moderate urgency, with no known malicious exploitation reported so far. Affected versions are below 1.0.17, and upgrading to that release fixes both products. Security teams are also advised to tighten the privileges of SSH integration accounts and restrict access to management interfaces.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Argo CD Security Landscape 2026: Four Critical Flaws, Three Without CVEs – The Repo Server as an Attack Vector

Argo CD is the de facto standard for GitOps on Kubernetes: In the 2023 Argo community survey, 93 percent of respondents said they use the tool in production. And right there, at the center of the deployment pipeline, the security situation escalated in October 2026. On October 7, the project released six security advisories in one go — four of them with the highest rating CVSS 9.9 (critical). Three of the four critical vulnerabilities still have no CVE number today. For teams whose patch processes rely on CVE feeds and scanners, this is a structural blind spot.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Providers Contain October 2026 Supply Chain, CA, and Cloud Security Incidents

Security advisories from October 2026 flagged compromised credentials, malicious package uploads, and TLS weaknesses across several platforms. By October 22, affected organizations reported that fast containment had halted active exposure, though downstream developers and administrators still need to take remediation steps. LiteLLM pulled a tampered PyPI release and malicious Docker tags within hours, while its private enterprise edition was unaffected. Python's package tooling had to be updated to distrust eMudhra intermediate certificates whose elliptic curve keys were found to be weak. Hetzner rolled out patches for two PHP vulnerabilities across supported and legacy versions, and Andromeda revoked compromised credentials without affecting customer data or trained models.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

One Tenant's Bad Mailing List Can Drag Down Shared SES Sender Reputation

A multi-tenant SaaS running on Amazon SES shares one account and one sender reputation across all tenants, so a single tenant's poor list hygiene can affect everyone. Imported or purchased lists can cause hard bounces and spam complaints that push the account's bounce or complaint rates past SES thresholds, leading to account review or paused sending for every tenant. The author argues this is an architecture problem rather than one solved by monitoring alone. Recommended isolation measures include per-tenant sending subdomains, per-tenant configuration sets for attributed event tracking, and dedicated IP pools reserved for tenants with steady volume. Per-tenant event ledgers and suppression lists are also suggested so each tenant's reputation can be measured and enforced separately.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Open-source Flutter package transcribes speech fully on-device with no server or API key

A developer released transcribe_cpp, an MIT-licensed Flutter package for speech-to-text that runs entirely on iOS and Android phones. It requires no server, account, or API key, and it works in airplane mode, so user audio never leaves the device. The package uses voice detection to mark sentence boundaries and shows live text that settles without flickering as the user speaks. It wraps the transcribe.cpp engine, built on ggml, and runs NVIDIA's Parakeet 110M model, a roughly 90 MB download fetched on first use. The developer reports about 40 times real-time speed on a mid-range phone and says the hard work lay in the surrounding plumbing rather than the models themselves.

0 comments Read more at DEV Community