CVSS 10.0 Flaw in VeloCloud Orchestrator Actively Exploited, Patches Available

·1 views

A critical vulnerability, CVE-2026-93952, with a maximum CVSS score of 10.0 has been confirmed actively exploited in on-premises VeloCloud Orchestrator (VCO) by Arista Networks. The flaw stems from improper input validation in the VCO web interface, allowing attackers to gain access without operator credentials under certain network conditions. Affected versions include builds 5.2.3.15 and earlier, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below, while fixed builds 5.2.3.16 and 6.4.2.8 are now available. Cloud-hosted VCO instances were automatically patched and are not affected, but on-premises deployments managing branch SD-WAN infrastructure remain at risk. Security teams are advised to patch immediately, monitor for anomalous files such as vcnode.js, rotate exposed credentials, and establish clear incident response procedures including isolation authority and rebuild plans.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Data Engineering: The Backbone Behind Big Data at Netflix, Google and Beyond

Data Engineering is a software engineering discipline focused on building systems that collect, store, and process data at massive scale, forming the foundation for AI predictions and data visualizations. The field traces its roots to the 1970s–80s, when Database Administrators handled data management under frameworks like Information Engineering Methodology. The rise of the internet in the early 2010s triggered the Big Data era, prompting companies like Facebook and Airbnb to popularize the 'Data Engineer' title as traditional ETL methods could no longer handle exploding data volumes. Modern data engineers rely on tools such as Apache Spark for distributed processing, NoSQL databases for horizontal scalability, and dataflow programming to manage complex data pipelines. Without their work, raw data would remain disorganized and unusable, making data engineering a core pillar of digital business strategy today.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Business Interviews, Not Tech Jargon, Should Drive ERP Configuration

Software setup wizards often fail small business owners by asking technical questions they cannot meaningfully answer, such as whether to enable accrual accounting. A more effective approach starts with observable business realities: how sales are made, how stock arrives, who handles cash, and who can approve refunds. Based on these answers, the system should propose configurations in plain language rather than silently enabling complex settings. The process should flag contradictions and reserve regulated or specialist decisions for qualified review. The true measure of success is whether a non-technical owner can confirm the setup reflects how their business actually operates.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Perplexity Sonar API and Appsmith AI Plugin Set for Shutdown by End of September

Perplexity is retiring its Sonar API tiers on September 27, 2026, replacing them with the Agent API, which uses a different endpoint, request structure, and a mixed billing model combining token costs with per-tool-invocation fees. Appsmith is shutting down its managed AI plugin on September 30, 2026, having already blocked creation of new AI datasources since version 2.3. Developers using either service have days to assess exposure, as both deprecations were announced with limited visibility in official changelogs and migration guides. The Perplexity migration is not a simple model-string swap — response parsing, source citations, and cost-alert configurations all require review. For Appsmith, the recommended path is to switch to bring-your-own-key integrations with OpenAI, Anthropic, or Google AI before managed credentials are revoked.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

F-Droid 2.0 Launches with Overhauled UI as Google Tightens Play Store Identity Rules

F-Droid released version 2.0 of its open-source Android app store on September 24, 2026, marking its biggest update in a decade after over a year of development and 14 test releases. The new version features a fully rebuilt interface using Kotlin Compose, improved search across descriptions and categories, and support for 17 game genres. A key usability improvement sees F-Droid adopt Android's pre-approval API, reducing the installation process to just one extra tap compared to the Play Store. Six days later, on September 30, 2026, Google activated mandatory developer identity verification for Android apps in Brazil, Indonesia, Singapore, and Thailand, with a global rollout planned for 2027. The F-Droid 2.0 release also underwent an independent security audit by the Open Technology Fund's Security Lab, with the team reporting all findings were addressed.

0 comments Read more at DEV Community