SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Developer Builds Tool to Detect Lingering Access After Permissions Are Revoked

0
·1 views

A developer created an open-source testing tool called Parallax, built for the All Things Agentic Hackathon, that simultaneously opens multiple isolated browser sessions to compare application behaviour across different user roles, locales, themes, and viewport sizes. The tool addresses a security blind spot: while companies log when access is revoked, no standard automated tool measures how long a previously authenticated session continues to function after removal. An already-open browser tab can retain loaded data, active WebSockets, and cached membership status for an unmeasured window of time even after an admin removes a user. OWASP's ASVS V3 standard requires all active sessions to be invalidated upon account disablement, but its own testing guide only describes manual verification methods. Microsoft's continuous-access documentation acknowledges propagation delays of up to 15 minutes, highlighting that this gap remains largely unaddressed by existing tooling.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Tutorial Shows How Federated Learning Can Train Fitness AI Without Sharing Raw Data

A developer tutorial published on DEV Community demonstrates how to build a privacy-preserving fitness AI model using Federated Learning and Edge AI techniques. The approach keeps sensitive health data — such as heart rate, GPS, and sleep metrics — on users' devices rather than uploading it to a central cloud server. Only encrypted mathematical model updates, not raw data, are shared with an aggregation server using the FedAvg algorithm. The tutorial uses open-source tools Flower (flwr) and PySyft to build a collaborative calorie-prediction model across multiple simulated users. The method is presented as a practical path toward HIPAA-compliant, trust-building health applications in community fitness ecosystems.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developers Cancel AI Coding Subscriptions Over Unpredictable Usage Limits

Developers on Hacker News have been publicly abandoning paid AI coding tools like Claude Pro and Codex, citing usage limits that run out faster than expected and without clear explanation. Multiple users reported exhausting their monthly allowances within minutes or hours of starting complex tasks, prompting mid-project switches to competing services. The core frustration is not the tightness of the limits but their illegibility — subscribers cannot predict how limits are measured or when they will run out, making planning impossible. Some users concluded that paying directly through usage-based APIs is more reliable than flat subscriptions, since per-token billing at least makes costs transparent and predictable. The pattern documented across the week's discussions points to a recurring cycle: a heavy user hits an invisible wall mid-task, and that friction — rather than model quality — is what drives the cancellation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Spring Ring Vishing Campaign Exploits Microsoft Teams to Target Corporate Networks

A threat campaign dubbed Spring Ring uses fraudulent Microsoft 365 external tenants to impersonate corporate IT staff via Microsoft Teams chat and voice calls, according to a Unit 42 report published August 31, 2026. Attackers trick employees into granting remote access through RMM tools like Quick Assist or running malicious executables delivered via customized S3 URLs. In more advanced intrusions, the campaign deploys an obfuscated PowerShell RAT and attempts NTLM Relay attacks against domain controllers using the PetitPotam technique to escalate privileges. The attack chain can result in persistent access, hidden browser instances with sideloaded extensions, and lateral movement across internal networks, though NTLM Relay was blocked in observed cases. Security teams are advised to restrict external Teams communication, enforce RMM tool approvals, enable PowerShell and AMSI controls, and harden NTLM relay defenses including SMB signing.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Vulnerabilities

ServiceNow has released patches for four severe security vulnerabilities affecting its AI Platform and Now Platform, three of which carry the maximum CVSS score of 10.0. The flaws include unauthenticated code injection via the GraphQL Composite Data API (CVE-2026-18885), a privilege escalation bug in configuration image upload processing (CVE-2026-18886), SQL injection in dynamic ORDER BY clauses (CVE-2026-74820), and a sandbox escape vulnerability (CVE-2026-6876). All four can be exploited remotely without authentication or user interaction, potentially allowing attackers to execute arbitrary code, manipulate databases, escalate privileges, and compromise integration credentials. No active exploitation has been confirmed in the wild as of the disclosure date. Organizations are advised to apply the available hotfixes immediately and restrict external access to ServiceNow administration, API, and upload endpoints.

0 comments Read more at DEV Community
Developer Builds Tool to Detect Lingering Access After Permissions Are Revoked · ShortSingh