Metalogos VM in Rust enforces XSS and SQL injection checks at compile time

·1 views

Metalogos is a programming language and compiler built in approximately 30,500 lines of Rust that treats security as a type-system concern, making vulnerabilities like XSS and SQL injection compile-time errors rather than runtime risks. The project features two execution backends — a tree-walking interpreter and a 44-instruction bytecode VM — that must produce identical outputs for every program, acting as a structural semantic guarantee. A recent internal audit uncovered 13 subtle divergence points between the two backends, including issues with rule sorting, silent feature unavailability in VM mode, and masked test failures, all of which have since been resolved. The codebase also includes a PEG-based parser with around 180 grammar rules that has remained stable for 18 months, alongside 91 Architecture Decision Records documenting every major design choice. The bytecode VM runs roughly three to five times faster than the reference interpreter, with the crosscheck methodology ensuring that added complexity does not compromise semantic correctness.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why the 'cheapest' AI model may cost more depending on your workload

Choosing the most cost-effective AI model depends not on leaderboard rankings but on the ratio of input to output tokens a specific workload generates. Models price input and output tokens differently, and that gap varies significantly — for example, Grok 4.3 charges only twice as much for output as input, while others charge five to six times more. A document classification task heavily skewed toward input tokens favors Claude Haiku 4.5 by 17%, whereas a code generation task with far more output tokens makes Grok 4.3 42% cheaper. Reliability also affects true cost: a model with a 20% failure rate that reroutes failed calls to a pricier fallback can erase its apparent savings entirely. Developers are advised to measure their own token ratios across real requests before comparing model prices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

macOS Screen Sharing Flaw CVE-2026-65400 Lets Attackers Gain Root, Install Crypto Miner

A critical authentication bypass vulnerability, CVE-2026-65400, has been discovered in macOS Screen Sharing, affecting macOS Tahoe before 26.6.1, Sequoia before 15.7.9, and Sonoma before 14.8.9. Attackers can connect remotely via TCP port 5900 and exploit an authentication state management flaw to establish a session without valid credentials, requiring no user interaction. In multiple incidents reported to NCSC-NL, threat actors leveraged this access to gain root privileges and install a Monero cryptocurrency miner. Apple has released patched versions of all three affected macOS branches to address the vulnerability. Users and administrators are advised to apply updates immediately, disable unnecessary Screen Sharing, and block TCP/5900 from public internet access.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GeoServer Zero-Day SQL Injection Draws Mass Probes Within Hours of Disclosure

A critical SQL injection vulnerability in GeoServer's jsonArrayContains filter was publicly disclosed on August 14, 2026, allowing attackers to inject malicious arguments into backend database queries on PostGIS, Oracle JDBC, and H2 data stores. Security firm WatchTowr observed hundreds of exploit attempts from a small number of source IPs within hours of the public disclosure. The flaw can potentially escalate to remote code execution depending on the server's database configuration, though RCE has not been confirmed across all affected deployments. No patches were available at the time of publication, and no successful compromises have been publicly confirmed despite the volume of probing activity. Administrators are advised to isolate GeoServer from public internet access, apply WAF rules to block malformed filter inputs, and enforce database least-privilege principles until an official fix is released.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AmnesiaStealer Malware Uses Fake GitHub Pages to Hijack macOS Browser Sessions

Jamf Threat Labs has identified AmnesiaStealer, a multi-stage Rust-based infostealer targeting macOS users, published in a report dated August 13, 2026. The malware spreads through a fake GitHub ClickFix page that tricks users into pasting a Terminal command, which downloads and executes a malicious shell script. Once installed, it steals login passwords, Keychain data, Apple Notes, Telegram content, Chromium browser profiles, and cryptocurrency wallet information, sending it all to a remote command-and-control server. A secondary module called stream_module uses Chrome DevTools Protocol to silently take over live browser sessions, enabling remote control of tabs, cookies, mouse, and keyboard input. The malware also attempts to establish persistence by creating a root LaunchDaemon, though its exploit of CVE-2020-9771 for TCC bypass was found to fail on current macOS 26 without Full Disk Access.

0 comments Read more at DEV Community