SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

ISC Discloses Four High-Severity BIND 9 Flaws With No Workarounds

0
·4 views

ISC disclosed four high-severity vulnerabilities in BIND 9 on 21 October 2026, none of which has a documented workaround, leaving upgrading as the only remedy. The most serious flaw, CVE-2026-94300, can corrupt memory through replayed GSS-TSIG signed messages and may enable remote code execution, with independent discovery credited to Dave Aitel of OpenAI. Three other flaws cause resolver crashes or excessive resource consumption under specific conditions. Affected versions span several BIND 9 branches, and fixed releases include 9.20.30, 9.21.27 and 9.20.30-S1 for preview edition users. ISC says it knows of no active exploits or public proofs of concept, though the reporting leaves open how widely GSS-TSIG is deployed and whether some flaws can be triggered without a captured message.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Designing a One-Tap Mobile App for Connecting AI Tools via MCP

An article from DEV Community argues that the Model Context Protocol (MCP), which links AI assistants to outside tools and data, should not require a desktop setup. It explains MCP as a standard connection language between AI clients and external services, while noting that it does not by itself guarantee security or reliability. The author points out that current setup often involves installing runtimes, editing JSON configs, and managing credentials, which is especially awkward on phones. The proposed remedy is a mobile-first interface where users pick a connector, sign in, review permissions, and use tools without manual configuration. The piece presents this as a design goal rather than a finished product.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Kafka vs AWS SQS for Fintech Retries: Three Recovery Boundaries to Weigh

A DEV Community article argues that for fintech reservations with fixed hold windows, the key design question is where the expiration decision is made and how failed attempts are recovered, not which queue retries fastest. It contends that a retry mechanism only redelivers work and cannot determine whether a state transition is still valid, so expiration should be driven by a stored deadline and guarded by idempotent, version-checked state changes. The piece compares Kafka's durable log with replay control, Amazon SQS's visibility-timeout redelivery, and RabbitMQ's direct acknowledgement and requeue semantics. It recommends treating the database as the authority on reservation state while the broker serves only as a delivery envelope, with recovery records that let operators inspect failures without reconstructing them from logs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds Schengen day-counter checked against EU Commission calculator and automated tests

After an unexpected one-day overstay risk at the EU border, a developer created Ninety, a tool that tracks Schengen 90/180-day limits against the EES entry/exit record. It can draft an Article 52 correction letter when the border's count appears wrong. The project's accuracy is validated against the European Commission's own short-stay calculator, which the tests use as the source of expected values. The test suite includes 408 unit tests, fuzzed travel histories, and an independent reference implementation, with TestSprite running end-to-end and API checks on every pull request. The article reports that 14 pull requests failed TestSprite runs before turning green, and that the project's pipeline gates merges on full test passage.

0 comments Read more at DEV Community