How Cloudflare cache misconfigurations can leak WordPress user data across visitors

·1 views

WordPress sites running behind Cloudflare's reverse proxy can serve incorrect or personalized content to the wrong users when cache bypass rules are misconfigured. The core issue arises because Cloudflare's default caching does not distinguish between static and dynamic WordPress pages unless explicitly instructed via Cache Rules. Plugins like WooCommerce set session-specific cookies that signal personalized responses, but bypass rules relying solely on URL paths — such as matching '/cart' — fail to account for these cookies. This gap means a cached response containing one visitor's cart or account data can be incorrectly served to another. The problem often goes unnoticed until caching is broadened to improve hit ratios, and it worsens as new plugins introduce additional dynamic endpoints that existing rules never covered.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Graph Neural Networks Proposed for Real-Time Deep-Sea Habitat Safety Decisions

A developer and researcher explored applying probabilistic graph neural inference to deep-sea habitat engineering, treating interconnected habitat modules as nodes in a graph where structural failures can cascade across the network. The core challenge involves computing the probability of structural health states across all modules in under one second, using low-power edge hardware during time-critical rescue windows that may last only 90 minutes. Standard belief propagation methods proved unreliable on cyclic habitat topologies, prompting a shift toward learned message-passing neural networks that can amortize inference across similar scenarios. The prototype system also investigated variational inference and hybrid quantum-classical sampling to handle uncertainty under severe communication bandwidth constraints typical of deep-sea operations. The work is presented as a learning artifact rather than a production system, but offers insights into uncertainty propagation and real-time probabilistic reasoning in extreme environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Zeek 9.0 Released as LTS Version with Cluster Streaming and Spicy 2.0

The Zeek project released version 9.0 on September 17, 2026, designating it a long-term support (LTS) release aimed at enterprise-grade stability. The update introduces cluster-wide event streaming over a fault-tolerant bus, simplifying large multi-sensor deployments for security operations centers. A fully rewritten Spicy 2.0 parser generator delivers up to 40% faster compilation and adds support for modern protocols including QUIC-v2 and HTTP/3. The release also includes over 30 CVE-level security fixes and built-in cluster orchestration tools, with roughly 1,300 commits and 400 pull requests merged in total. The Zeek team has already outlined a 9.1 release for early 2027, which will focus on AI-assisted anomaly detection integrated directly into the event pipeline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Incus Lab Offers Hands-On Linux Container Environment for Network Learning

Incus Lab is an open-source project designed to help IT students learn networking concepts through direct experimentation rather than theory alone. Built on the Incus platform, it uses Linux containers such as lab-scanner and lab-target to simulate real network environments. Students can run commands like ping, nmap, and dig, and observe live results to understand how connectivity, port behaviour, and DNS lookups actually work. A command log feature displays the underlying Linux commands behind each action, bridging the gap between a graphical interface and real-world system administration. The project is still growing, with topics such as routing, packet inspection, and troubleshooting planned for future additions, and is currently available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How stateful replay ledgers make x402 payment gates secure against reuse attacks

Developer paygate402 is a Go middleware library built around the x402 HTTP payment protocol, which requires a server to respond with a 402 status and payment terms before a client resends the request with an X-PAYMENT header. The library deliberately delegates signature verification and fund settlement to an external facilitator component, keeping the middleware itself focused only on scheme and network matching. The critical security insight behind the design is that an X-PAYMENT header is a self-contained bearer token whose signature remains valid on any subsequent replay, meaning any proxy, log, or retry loop that captures it could reuse it indefinitely. The only defense against replay attacks is a server-side ledger that records every payment already settled, making this the sole stateful component in an otherwise stateless protocol flow. To protect the payment offer itself, the library uses a signed, nonce-bearing quote with a fixed TTL, whose signature covers fields in a canonical length-prefixed format to prevent boundary-manipulation forgery.

0 comments Read more at DEV Community