Dev Opportunity Radar #15: HackerRank, Anthropic, and AWS Hackathons Open Now

·1 views

The 15th edition of Dev Opportunity Radar highlights three active opportunities for developers: HackerRank Orchestrate, an AI hackathon open globally until September 12, and the Claude Campus Ambassador Program by Anthropic, also closing September 12. The Bharat Builds Tour, a student hackathon series run by WeMakeDevs and AWS, is open to participants in India with in-person events from September 17 to 20. This week's resource spotlight is the System Design Primer, a free open-source guide covering system design concepts and interview preparation. Community contributors also flagged the NASA Space Apps Challenge and a Build with React Image Editor Challenge as additional opportunities worth exploring.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Drupal Web Development in 2026: What Organisations Need to Know

Drupal is a free, open-source CMS that has been in active development for over two decades, now on its 11th major version built on modern PHP and the Symfony framework. It is widely trusted by governments, universities, and large enterprises for projects requiring structured content, complex permissions, and robust security. Unlike WordPress, which prioritises ease of use and suits most small-to-medium sites, Drupal offers greater flexibility and power but comes with a steeper learning curve. Its strengths include fine-grained user roles, strong multilingual support, and the ability to scale without requiring a site rebuild. Organisations are advised to choose Drupal when their project demands complex content modelling and high security, and to consider simpler tools for more straightforward requirements.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MCP Servers Pose Serious Security Risks as Attackers Exploit Permanent Trust Model

Model Context Protocol (MCP) servers, used to extend AI coding agents with tools and data access, contain critical security vulnerabilities that researchers say are largely unaudited. Once approved, an MCP server retains permanent access to a user's tools, prompts, and data with no re-authentication required. A demonstrated attack chain shows malicious servers behaving normally for the first few interactions before triggering payloads that exfiltrate SSH keys, cloud credentials, and shell history — succeeding roughly 90% of the time in tests against a leading coding agent. A separate technique dubbed 'GhostJacking' embeds hidden instructions inside blocked firewall requests, causing AI agents to unknowingly rewrite DNS settings while reporting the issue as resolved. Security experts recommend treating every MCP server as a privileged access point, keeping DNS and config changes behind human approval, and regularly rotating credentials for any long-running MCP configurations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why 3D product configurators must calculate prices server-side, not client-side

Client-side price calculation in Three.js product configurators is a critical security flaw, as any user can manipulate the price variable via browser DevTools and submit fraudulent orders. The correct approach separates responsibilities: the frontend displays only a clearly labeled price estimate for a smooth user experience, while the backend independently recalculates the authoritative price at order submission. A recommended 'Confirm order' step fetches the real server-side price before final checkout, eliminating any discrepancy between the preview and the actual charge. The same principle extends to configuration validation, where shared JSON Schema rules provide real-time frontend feedback but the backend serves as the final enforcement gate. This pattern is already used by platforms like Shopify custom apps, Bagisto, and Zakeke to prevent pricing manipulation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Releases Dockerized Vulnerable PHP/MySQL Lab for Web Security Practice

A developer has built and open-sourced a deliberately vulnerable PHP/MySQL application designed for practicing web and API security in a local environment. Unlike typical CTF challenges, the vulnerabilities are modeled on real-world patterns the creator encountered during personal security research. The Dockerized lab includes 10 intentional flaws such as BOLA, JWT forgery, unrestricted file upload leading to remote code execution, and time-based SQL injection. Field manuals are included in the repository to guide users through intended exploit chains if needed. The project is available on GitHub, with a strong caution to run it only in isolated, offline environments and never against unauthorized systems.

0 comments Read more at DEV Community