HPE Warns of Critical AOS-8 Flaw CVE-2026-79856 Enabling Authentication Bypass

·4 views

HPE has disclosed CVE-2026-79856, a buffer overflow in the PAPI management protocol of ArubaOS (AOS-8), rated 9.8 Critical. The flaw can let an unauthenticated remote attacker get around authentication and potentially gain administrative access, change configurations, or reach sensitive data. The advisory, HPESBNW05162, was published on October 22, 2026, and covers specific AOS-8 branches including Mobility Conductors, Controllers, Gateways and Instant Access Points, with AOS-10 outside its scope. HPE has not released public exploit code, and it has not confirmed that any customer has been attacked. Fixed releases are 8.13.3.1 and 8.10.0.24 or later, and administrators are advised to upgrade and preserve logs while investigating any unexplained privileged activity.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Vibewright: a free desktop app that turns a one-line idea into a plan Claude Code builds

Vibewright is a free, open-source desktop app for Windows and macOS that helps users turn a rough project idea into a structured plan. The app guides users through a short multiple-choice interview, then produces a needs analysis and a phased plan with completion criteria. Before any build begins, it checks which tools or plugins each phase requires and installs nothing without the user's approval. The build stage runs Claude Code in an embedded terminal, which tracks progress and checks off finished steps while the user approves each gate.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Versioned Itinerary Retrieval Keeps Travel Planners Current and Auditable

Travel itinerary systems should retrieve the newest valid revision of a trip document while keeping older versions available for explanation. The recommended design stores each revision as an immutable document, indexed by a stable trip identifier and an active-at timestamp, with revision IDs attached to every chunk and citation. This avoids overwriting source files, which can break the link between an answer and the evidence behind it. Retrieval first resolves the permitted revision set and filters by freshness and authorization, and only then ranks results, so rerankers cannot decide which versions are valid. The article supports the approach with a small in-memory Python example that selects the active revision for a given time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Utilkits Runs PDF, OCR and AI Tools Locally in the Browser, Reports What Broke

A developer built Utilkits, a platform of 99 everyday tools, to keep uploaded PDFs and images on the user's device rather than on a server. The Next.js 16 app runs PDF manipulation, OCR via Tesseract.js, and several on-device AI models client-side using WebAssembly and web workers. The developer says the tools that cannot run locally are disclosed on the site, such as a redirect checker that needs a server. Two production bugs stood out: an onnxruntime import that failed without an import map and a content security policy that blocked the CDN-fetched engine, plus a background remover that worked in development but failed in production due to mismatched model input and output names. Each tool page also includes a privacy badge that inspects browser network requests to show downloads versus data sent.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Electing one WebSocket leader across browser tabs with the Web Locks API

A developer building a realtime issue tracker with IndexedDB and a WebSocket needed only one connection per browser when the same workspace was open in many tabs. They use navigator.locks: every tab requests the same named lock, and the browser grants it to one tab, which holds leadership until it closes. When the leader closes, the browser releases the lock and the next queued tab takes over, so no explicit failover code is needed. Tabs coordinate through a BroadcastChannel using seven message types, with the leader writing data to IndexedDB before announcing it to followers. Followers that detect a version gap reload from storage rather than repairing it themselves.

0 comments Read more at DEV Community