Microsoft Exchange Server Replay Flaw CVE-2026-62911 Allows Privilege Escalation, Patched

·1 views

Microsoft has patched CVE-2026-62911, an authentication bypass caused by capture-replay that is classified as CWE-294 and carries a CVSS 3.1 base score of 8.0. The flaw affects Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition RTM, and lets an authorized network attacker escalate privileges. Rather than a cryptographic weakness, it stems from authentication material from an earlier session being accepted in a new one. CSIRT.CZ reported around 22,000 unpatched internet-facing Exchange servers, and a public exploit is reportedly available. Experts note that such replay attacks may appear as successful logins from unusual locations, making monitoring of authentication context more useful than tracking failure counts.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Stripe to acquire OpenRouter for $7.5 billion

Payments company Stripe has reportedly agreed to acquire OpenRouter, a platform that routes traffic between AI models, in a deal valued at $7.5 billion. The information comes from a Startup Fortune report, which describes OpenRouter as a kind of traffic cop for AI model requests. The source material available here is limited to the headline and link, so details on deal terms, timing, and strategic rationale could not be independently confirmed. Discussion of the report on Hacker News drew modest attention at the time of sourcing.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Qwen3-4B fine-tuned to suppress common AI writing patterns, shared on Hacker News

A developer has released a version of the Qwen3-4B language model that has been trained to reduce the stylistic habits typical of AI-generated text. The project was posted to Hacker News as a Show HN submission, linking to a write-up on the 100toolkit.com blog. The post drew 14 points and 3 comments from the community. The available source does not detail the training method, evaluation results, or the specific writing tics targeted.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Poll Finds Most Americans Oppose Live-Streaming Executions

A Washington Post poll reports that roughly eight in ten Americans oppose broadcasting executions live. The question was raised in connection with the case of the Fort Hood shooter, whose potential execution has drawn public attention. The survey indicates broad public discomfort with turning capital punishment into a live spectacle. The findings were first highlighted on Hacker News, where the article gained modest attention. Details beyond the headline poll figure are limited in the available source material.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Persona Lines in AI Instruction Files Correlate With Lower Quality Scores

A study of the 10,000 most-starred repositories found 285 main AI instruction files, such as CLAUDE.md and AGENTS.md, that open with a 'You are a...' persona line. On the ails check 0 to 10 scale, these files had a median score of 6.6, compared with 7.7 for the other 20,551 main files. The gap persisted across all four file-size groups, ranging from 0.9 to 1.25 points. The analysis attributes the difference to the rest of the file: persona files devote more lines to instructions, and their prohibitions are more often written as strong 'never' statements without matching permissions, hedged, or weakly ordered. The author suggests replacing persona lines with specific, tool-named directives.

0 comments Read more at DEV Community