IBM Patches webMethods Integration Server Flaw Allowing 2FA Backup Code Authentication Bypass

·9 views

IBM disclosed CVE-2026-118904, affecting webMethods Integration Server 12.1, on November 3, 2026. The flaw stems from improper validation of backup codes used in two-factor authentication, allowing an already-authenticated remote attacker to bypass security restrictions. IBM rates it 8.1 on the CVSS scale, with high confidentiality and integrity impact, and recommends applying IS_12.1_Core_Fix1 or later via webMethods Update Manager. The vendor's bulletin does not describe the precise validation error or report any public exploitation. Security analysts advise reviewing logs for suspicious successful access and backup-code use, and verifying that recovery codes are properly rejected after patching.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

PharmA2A: Open Protocol Aims to Automate Pharmacy-to-Supplier Orders

A French pharmacist has released PharmA2A, an open source protocol built on the A2A standard to automate orders between pharmacies and their suppliers. The developer says they currently place orders with more than a hundred suppliers by phone, email, or web forms, which motivated the project. The protocol has been publicly available on GitHub since 12 November. The project was shared on Hacker News, where the author asked whether others are using A2A in real-world applications.

0 comments Read more at Hacker News

ProgrammingHacker News ·

IceWM: Lightweight Window Manager Resurfaces on Hacker News

A link to the IceWM project website was shared on Hacker News, drawing a small amount of attention from readers. The post received 10 points and one comment at the time of recording. The source material provides no details about recent releases, features, or announcements from the project. IceWM is a lightweight window manager for the X Window System, but the submission itself offers no further specifics.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How the .NET compiler wires up ModuleInitializer methods, read from decompiled IL

A method marked with ModuleInitializer runs before any other code in an assembly, yet the runtime does not invoke the attribute directly. Decompiling the assembly reveals a static constructor on the reserved module pseudo-type that calls the initializer on the program's behalf. The initializer must be static, parameterless, void, non-generic, and accessible to the module, or the compiler rejects it. The article uses a simple example that sets a readiness flag to show the generated constructor and its IL metadata. It also explains how the free Glass.NET decompiler maps this synthesized code back to the original attributed methods using static analysis alone.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Scrape Goodreads with Node.js: Ratings, Reviews, and Author Data in 2026

Goodreads has stopped issuing new developer API keys and plans to retire its public API, so new projects have no official route to its ratings or reviews. The article notes that Goodreads' Terms of Use prohibit data mining and scraping, so readers should review those terms and weigh the legal risk before using any scraping approach. It suggests alternatives such as exporting your own library data from Goodreads or using the Open Library API, which has far fewer ratings. For Goodreads-specific data, the author presents a dependency-free Node.js script that reads the Apollo GraphQL cache embedded in book pages to fetch book details, rating distributions, reviews, author lists, and rating snapshots. The tutorial was tested in November 2026 on Node 24.22.1 and requires Node 22.13 or later.

0 comments Read more at DEV Community