Exploited Vulnerabilities in JFrog Artifactory Lead to Backdoor Installation

·1 views

Attackers exploited two patched vulnerabilities in self-hosted JFrog Artifactory between mid-August and early September 2026 to gain administrator access. The U.S. cybersecurity agency CISA added these flaws to its Known Exploited Vulnerabilities catalog on September 11, 2026. This chained attack allowed the creation of admin accounts and the installation of malicious plugins as a backdoor. The vulnerabilities, which had patches available for over a month, affected specific software versions and were rated as High severity.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer benchmarks Cloudflare's new Clef model against hosted Jev API for agent tasks

Cloudflare released Clef, an open-weights decision model designed as an alternative to TypeSafe's hosted Jev API for agent developers. An independent developer benchmarked Clef-Flash 9B running locally on an RTX 3090 against the Jev API using 42 real decisions from an autonomous coding agent. Both models performed identically on computer-use action choices (10/10 correct) and agent supervision tasks (8/12 correct), including safety-critical decisions. Jev showed an advantage only in message triage tasks, scoring 12/20 versus Clef's 10/20, leading to overall accuracy rates of 71.4% for Jev and 66.7% for Clef.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developers design self-deleting file system for sensitive one-time shares

A new file-sharing model called delete-on-read is designed for sharing sensitive information only once. Unlike traditional systems, it automatically deletes files immediately after the recipient's first successful download. The system uses unique, unguessable tokens as links instead of file paths to ensure security. This approach prevents the common security risk of users forgetting that shared links remain active. The pattern can be applied to individual files, text snippets, or multiple files bundled into a single-use archive.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Software agent error reveals distinction between publishing and listing events

A scheduled publishing agent failed to detect three existing posts because its duplicate-checking mechanism conflated two separate events. The agent checked a listing endpoint, which returned a complete-looking list that omitted the three most recent posts, even though they had been live for over six hours. The root cause was using the same term 'published' for both the immediate write event and the later indexing event, which updates on an independent schedule. This made the agent treat the listing's answer about index freshness as a definitive answer about what had been published. The solution involves the publishing job creating its own synchronous record of work, making the remote listing a secondary check rather than the primary source of truth.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Introduction to Pandas library for data analysis in Python

The article introduces Pandas, an open-source Python library designed for data manipulation and analysis. It explains that Pandas provides specialized structures like Series and DataFrames for handling tabular data more effectively than native Python types. The piece demonstrates how to import data from various sources including CSV files, Excel spreadsheets, and SQL databases. It also emphasizes the importance of inspecting data using methods like .info() and .shape to identify issues before analysis.

0 comments Read more at DEV Community