Metabase patches CVSS 10.0 SQL injection zero-day exploited before disclosure

·1 views

Metabase has disclosed a critical unauthenticated SQL injection vulnerability in its business intelligence platform, rated CVSS 10.0, that was actively exploited in the wild before the patch was released. The flaw allows remote attackers without any credentials to inject SQL into the Metabase application database and grant themselves administrator access. Because Metabase holds stored credentials to connected data warehouses and production databases, a successful compromise effectively exposes all linked data sources. Six version branches from 1.58 onwards are affected, and self-hosted users must manually apply the exact fixed build for their branch, as Metabase Cloud instances have already been updated by the vendor. As a temporary workaround, administrators who cannot patch immediately are advised to block the /api/session/reset_password endpoint at their reverse proxy or WAF.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer ditches C++ for C23 when rewriting a PHP extension, here is why

A developer forked the dormant DataStax Cassandra PHP driver after it stopped compiling on PHP 8 and began rewriting it, initially choosing C++. Attempts to use C++ abstractions like RAII and smart pointers around PHP's Zend Engine API introduced hard-to-trace memory bugs rather than simplifying the code. The core issue is that the Zend Engine controls its own memory lifecycle through custom allocators and request-scoped functions, making C++ standard containers and destructors incompatible without significant adapter code. A particularly dangerous conflict arises because Zend's error-handling uses setjmp/longjmp, which can bypass C++ destructors and cause undefined behavior during stack unwinding. The developer concluded that C23 aligns more naturally with the Zend Engine's C-based rules, making the extension simpler and safer to maintain than a C++ approach would allow.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DOE Launches Genesis Open Models Initiative With No Models Released Yet

The U.S. Department of Energy has announced the Genesis Open Models Initiative, hosted at a domain tied to Argonne National Laboratory, positioning the federal government as a player in open AI model development similar to Meta or Mistral. However, as of the launch, the initiative consists only of a registered hostname and a title, with no downloadable weights, model cards, benchmark data, license terms, or dataset provenance made public. The author notes this is structurally typical of federal AI launches, where communications and interagency approvals precede any actual technical deliverables. Unlike private labs that can release model checkpoints quickly, DOE initiatives must clear export-control reviews, legal processes, and multi-agency sign-off before any model artifacts can be published. Observers are advised to treat the announcement and an actual model release as distinct milestones, and to wait for verifiable outputs such as a public repository, technical report, and reproducible evaluation scores.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Guide Lists 22 Fixes for Common Redbelly Network Integration Errors

A troubleshooting guide published on DEV Community documents 22 recurring errors developers encounter when building on Redbelly Network, an EVM-compatible Layer 1 blockchain designed for compliant asset tokenisation. The guide covers issues across six areas including RPC connectivity, wallet configuration, gas fees, permissioning, contract deployment, and SDK integration. One notable quirk of the network is that gas is priced in US dollars rather than gwei, causing eth_gasPrice to return approximately 165,000 gwei — far above Ethereum norms — which breaks tools with hardcoded fee caps. The network is also permissioned, meaning addresses without a valid network access credential cannot write to the chain, producing failures that resemble ordinary transaction reverts. The guide notes that Redbelly's two official documentation sites contain conflicting information, including disagreement on the mainnet chain ID, and recommends developers treat sections A1, A2, C1, and B1 as essential starting-point reading.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How stale AI infrastructure snapshots silently produce confident wrong answers

When an AI assistant like Claude Code reads a cached snapshot of cloud infrastructure, it can deliver authoritative-sounding but outdated answers — for example, reporting a dead-letter queue as missing hours after it was added. Infrawise, a tool that maps AWS and database infrastructure into a graph served to AI editors via MCP, faces this challenge directly since re-querying live AWS APIs on every assistant call is too slow and resource-intensive. To manage this, Infrawise caches infrastructure data in local JSON files with a strict TTL check that returns null — not stale data with a warning — when an entry expires, forcing a fresh analysis. All infrastructure data, including the graph, findings, and raw metadata, shares a unified 24-hour TTL after an earlier mismatch between a 1-hour metadata cache and a 24-hour graph cache caused subtle rebuild bugs. The core design principle is that bounded, explicitly invalidated staleness is safer than silently drifting context that feels current but is not.

0 comments Read more at DEV Community