Developer shares guide to updating Xbox controller firmware on Linux via Windows VM

·1 views

A developer has published scripts and a step-by-step guide on GitHub for updating Xbox controller firmware from a Linux host without booting into Windows. The process runs Microsoft's official updater inside a Windows 10 virtual machine using KVM and rootful Docker on Linux. A key challenge involved the controller dropping and re-enumerating its USB connection mid-update, which prevented QEMU from reacquiring the device due to missing hotplug events inside the container. The workaround used a targeted udev event relay to forward USB add/remove notifications for Microsoft devices on the selected physical port. The solution was validated on openSUSE Tumbleweed with SELinux enforcing, though portions of the refactored workflow have not yet been retested on hardware.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Security Report Flags High Flash Loan Attack Risk on DeFi Protocol Portal

A DeFi security research team published an analysis on September 29, 2026, identifying six flash loan attack vectors targeting Portal, a cross-chain liquidity protocol with approximately $1.8 billion in total value locked across Ethereum L1 and L2. The report assigned Portal an aggregate risk score of 8 out of 10, placing it in the high-risk category. The most critical vulnerability involves oracle price manipulation, where an attacker could use a flash loan to distort Portal's time-weighted average price oracle and exploit mispriced collateral or liquidations, potentially draining up to 30 percent of TVL in a single transaction. Other significant risks include re-entrancy attacks through flash loan receiver callbacks and a 'liquidation sandwich' technique that could siphon collateral from borrowers. Researchers strongly recommended immediate remediation of oracle integrity safeguards and re-entrancy protections as priority measures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Enterprise AI Gateways Compared on Security, Audit, and Tenant Isolation

A detailed comparison of five enterprise AI gateways — Bifrost, LiteLLM, Kong, Cloudflare, and Vercel — evaluates each against five core procurement criteria: identity management, authorization, auditability, tenant isolation, and deployment control. Bifrost stands out for HMAC-signed audit logs, row-level access controls between teams, and SCIM 2.0 support, with options for on-premises and air-gapped deployment. LiteLLM offers the broadest provider coverage at over 140 integrations but requires a more complex Postgres-and-Redis production setup. Cloudflare is the only gateway that inspects prompt content in transit using DLP and guardrails, though its account-scoped tokens create tenant isolation challenges. Kong consolidates AI and non-AI traffic under one control plane but reserves most enterprise governance features for paid tiers, while Vercel offers per-request governance metering and audit log drains but remains a fully managed service.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LINQ Aggregate Operators: What Lies Beyond Count and Sum in C#

LINQ offers a range of aggregate operators beyond the commonly used Count() and Sum(), including Average(), Min(), Max(), MinBy(), and MaxBy(). While Count and Sum handle empty sequences safely, operators like Average, Min, and Max throw InvalidOperationException on empty collections unless nullable overloads or DefaultIfEmpty() are used. Introduced in .NET 6, MinBy() and MaxBy() return the full element with the minimum or maximum value in a single pass, though they work only with in-memory LINQ and not EF Core. For database queries, the recommended equivalent is OrderBy() followed by FirstOrDefaultAsync(). The general-purpose Aggregate() operator serves as a flexible tool for building custom reductions, from running totals to string concatenation and tree structures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Coolify Patches Password Reset Poisoning Flaw That Could Redirect Tokens to Attackers

A vulnerability in Coolify, an open-source deployment platform, allowed attackers to manipulate password reset links by injecting a forged 'x-forwarded-host' header into requests. Because the application derived the reset URL destination from untrusted request metadata rather than a fixed configuration value, a crafted header could redirect the reset token to an attacker-controlled server. The flaw involved a host-validation cache bug that skipped validation on an empty cache, enabling the malicious header to influence the generated link. Exploitation required the forged header to reach the application and the victim to click the link, meaning it was not an automatic or universal compromise. Coolify credited security researcher bugbunny.ai for the report and released a patch in version v4.0.0-beta.471.

0 comments Read more at DEV Community