Microsoft August 2026 Patch Tuesday: 790 CVEs Fixed, One Zero-Day Actively Exploited

·1 views

Microsoft released its August 2026 Patch Tuesday update, addressing 790 vulnerabilities across its products, including 109 rated Critical and 396 rated Important. One zero-day, CVE-2026-68820, is already being actively exploited in the wild — a use-after-free elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock that can allow a local attacker to gain SYSTEM-level access. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog and affects all supported Windows versions, making it the highest-priority patch this cycle. Two additional flaws in the Windows User Profile Service and the Container Isolation FS Filter Driver were publicly disclosed before the update but have not yet been confirmed as exploited. The release also includes fixes for high-severity remote code execution bugs in Windows Deployment Services, SharePoint, and Azure SQL Database, among others.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Pixy Launches Visual Editor Letting Coding Agents Edit Live Websites Like Figma

A new tool called Pixy has been introduced as a visual editor designed for coding agents to make changes directly on live websites. The tool draws comparisons to Figma, the popular interface design platform, but operates on deployed sites rather than static design files. Pixy was shared on Hacker News as a community showcase post, garnering early attention from developers. The product is accessible via its website at pixydesignapp.com, targeting developers and teams who want a more visual approach to AI-assisted web editing.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why Bulk Database Inserts Stay Slow Even When Your Code Looks Fine

A common performance trap in database-heavy applications involves foreign key dependencies that force inserts to pause and retrieve auto-generated IDs before proceeding. When loading relational data — such as bands and their associated songs — each child record cannot be built until the parent's database-assigned ID is returned, creating an unavoidable sequential dependency. This means the entire load is split into distinct phases that cannot overlap, preventing parallel processing across tables regardless of batch size tuning. SQLAlchemy's insertmanyvalues feature, using INSERT...RETURNING, can speed up this process roughly 15 times by batching ID retrieval, but the fundamental sequencing constraint remains. The article argues the real bottleneck is architectural — an application waiting on the database to assign identities — rather than query performance or indexing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Local vs Cloud LLMs: A Practical Framework for Choosing the Right Approach

Developers and organizations deploying AI in 2026 face a critical architectural choice between running large language models locally or using cloud-based APIs. Cost analysis shows that self-hosting becomes economical only beyond certain usage thresholds — for example, around 40 million tokens per month when compared to GPT-5.6 Sol pricing. Local deployment involves hardware, electricity, and engineering labor costs, while cloud APIs range widely from $0.14 to $10 per million tokens depending on the model. Beyond cost, the decision also hinges on privacy requirements, latency needs, vendor dependency risk, and long-term strategic flexibility. Hybrid architectures that combine both local and cloud models are increasingly popular as a way to balance these competing tradeoffs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Firefox extension to strip tracking codes from copied links

A privacy-conscious developer is building a Firefox browser extension that removes tracking parameters — such as utm_*, fbclid, gclid, and igshid — from URLs when copied. The tool adds a 'Copy clean link' option to the right-click context menu, stripping trackers while preserving legitimate query parameters and fragments. The developer, who is learning JavaScript from scratch, is following a public four-week build plan inspired by the 'Learn in Public' philosophy. The first version requires no host permissions and cannot read page content, keeping the extension minimal and privacy-safe. The long-term vision is a system-wide, cross-platform clean-link tool that works across all applications, not just browsers.

0 comments Read more at DEV Community