CVE-2026-79875: Critical Auth Bypass in HPE ArubaOS AOS-8 PAPI Protocol

·12 views

A critical authentication bypass, tracked as CVE-2026-79875, has been identified in the PAPI protocol of HPE Networking ArubaOS AOS-8. The flaw can be exploited by an unauthenticated attacker on an adjacent network, potentially granting administrative access, enabling configuration changes, and exposing or altering sensitive data. Affected versions span 8.13.0.0 to 8.13.3.0 and 8.10.0.0 to 8.10.0.23, with fixes available in 8.13.3.1 and 8.10.0.24. The CVE record gives it a CVSS 3.1 score of 9.3 and classifies it as improper authentication (CWE-287). Asset owners are advised to inventory device builds, restrict reachability of the management interface, apply fixed releases or document compensating controls, and review the wider HPESBNW05162 advisory and audit logs for unauthorized administrative activity.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer urges locking down GitHub Actions workflows

A blog post by developer Hugo van Kemenade, published in 2026, advises readers to lock their GitHub Actions configurations. The article, shared on Hacker News, is presented as a guide to securing CI/CD workflows. The post had gathered six points and one comment on the forum at the time of the listing. The available text provides only the link and metadata, so the specific recommendations are not detailed here.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Report Says Nvidia CEO Jensen Huang Had Relationship With Company Executive

A New York Times report alleges that Nvidia CEO Jensen Huang had a personal relationship with an executive at the chipmaker. The article was published on November 11, 2026, and was shared on Hacker News, where it drew 38 points and 23 comments. The available text provides only the headline and link metadata, so the specific details, sourcing, and any company or personal response cannot be confirmed from this item. Readers seeking the full account should consult the original New York Times article.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Year-End Invoicing Checklist: Timing Tasks Before and After December

Year-end administration often falls behind because it collides with the busy December period, when clients slow down and leftover work piles up. The recommended approach is to sequence tasks: first pursue money that can still be collected before the year closes, then tidy records while there is time to locate missing items. Priorities include billing completed but unbilled work, ranking receivables by age, and separating disputed invoices from merely late ones. Afterward, the focus shifts to checking invoice numbering, storing every issued invoice as a consistently named file, verifying client details, and reconciling partial payments. The checklist is framed as deadlines relative to a business's own year-end, since requirements vary by jurisdiction and entity type.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Agency Billing Models and the Unbilled Work Most Firms Miss

Agency invoices must satisfy clients, procurement, and the agency's own cash flow, and most problems stem from unstated rules. The article outlines four billing approaches: retainers billed in advance or arrears, milestone or fixed fees, and time-and-materials. It stresses that each invoice should tie directly to a contract clause or an approved deliverable, with approval details recorded. Pass-through costs should be billed at cost on separate lines with supporting third-party invoices, and any markup agreed upfront. The piece also flags the unbilled work agencies often overlook, along with client-specific invoicing requirements that should be documented once and reused.

0 comments Read more at DEV Community