Git Patches Six Vulnerabilities, Including a Code Execution Flaw in Recursive Clones

·2 views

On 10 November 2026, the Git project released fixes for six security vulnerabilities across several maintenance branches. The most serious, CVE-2026-111760, can allow attacker-controlled code to run on a machine when a malicious repository is cloned with recursive submodules. The remaining five flaws involve file writes outside intended directories, memory corruption, and denial-of-service risks triggered by crafted repositories, patches, or input streams. The fixes are included in Git 2.56.1 and several maintenance releases, and the announcement says all versions back to v2.27.0 are affected. No active exploitation has been reported in the coverage reviewed, and users are advised to update Git along with any tools that bundle their own copy.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Catching Missing .env Variables and Config Drift Before Production Deploys

Adding a key to a local .env file without mirroring it in .env.example or the deployment environment can go unnoticed until production fails with a KeyError or empty value. Stale variables also build up in templates, making required settings hard for new developers to identify. The article proposes treating configuration drift as a build failure instead of a passive warning. It introduces the zero-dependency envdoctor-cli tool, which compares .env against .env.example, exits non-zero on mismatches, and can add masked placeholders for missing keys. An AST-based audit of os.getenv and os.environ calls is also recommended to catch undocumented variables, and running these checks in CI on each pull request is advised.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why an AWS Bill Rises When Traffic Stays Flat

A rising AWS bill with steady traffic usually comes from accumulating data, an expired discount, or a new charge that began on a set date. Cost Explorer's free Compare view across two months, grouped by service, names the largest changes as usage, discounts, or other charges. Steady monthly growth in usage points to data that keeps accumulating, while a jump tied to lost discounts suggests an expired Savings Plan, reservation, or depleted credits. Common hidden storage costs include S3 noncurrent versions and incomplete multipart uploads, ECR images, RDS storage that autoscaling never shrinks, manual snapshots, and CloudWatch logs with no expiry. The source also recommends lifecycle rules for S3 and renewal alerts for Savings Plans and reservations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Genjutsu AI lets users swap faces in viral clips using photos, without prompts

A developer has released Genjutsu AI, a web tool that replaces people in existing short videos with photos the user selects. Users upload a clip, which the app splits into scenes and identifies the people in frame, then attach one photo per person to be swapped. Backgrounds, props, timing, and original audio stay as filmed, with output at 720p. Scenes must be 15 seconds or shorter, and the service runs on a credit system priced at $9.99 for 10 credits after an introductory first purchase. The creator, who built the paid product, is seeking feedback on scene splitting, face consistency, and pricing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hand-Typed Probability Input Inflated Drug Valuation by 4.5x, Developer Reports

A developer of Somota, a drug valuation tool from the company Codebat, found that a Phase 2 cancer drug was valued at $1.29 billion. After correcting two errors, the same drug with the same sales forecast was valued at $283.5 million. The main error was a 30% probability of success that had been typed in by hand with no source, while public industry data gives roughly 10.8% for an oncology drug at Phase 2. The second error charged the full development cost as if it were only incurred if the drug succeeded, when in practice later trial costs depend on earlier trials passing. The developer notes that the unsourced input also had the largest effect on the valuation, and suggests labeling the source of every input in any model.

0 comments Read more at DEV Community