MOVEit Transfer Patches Twelve CVEs, Including Authentication Bypass in OIDC Module

·1 views

Progress has released fixes for MOVEit Transfer addressing twelve CVEs, among them CVE-2026-89070, a 7.5 CVSS authentication bypass via capture-replay in the OIDC module. The CVE record confirms the affected versions as those before 2025.1.6 and from 2026.0.0 through 2026.0.3, with 2025.1.6 and 2026.0.4 as the remediated releases. The record does not specify which freshness control failed, what attacker access is required, or what privileges a replayed session would gain. Initial reporting indicated no confirmed exploitation and no public proof-of-concept code at publication. The analysis stresses reading the official CVE records and vendor advisory rather than secondary summaries that may overstate details.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Hosted Checkout Breaks Purchase Analytics; Webhooks Restore Attribution

A developer building subscriptions for Belle AI found that a standard GA4 purchase event on the thank-you page recorded almost no sales. Hosted checkout sends users to the payment provider's domain, so they often never return to the site, and revenue appeared in the payment dashboard but not in analytics. To fix this, the developer stored first-touch UTM parameters and referrer data in localStorage, which are preserved across later visits. At checkout, that attribution data and GA4 identifiers were passed into the order metadata, which the payment provider returns in its webhook. The webhook handler then sends a purchase event to GA4 via the Measurement Protocol, reusing the stored client and session IDs so sales are credited to the correct traffic source.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LLM API list prices steady in mid-October as Chinese models trade at about a fifth of US prices

The TANDIU weekly data note for October 13 to 19, 2026 tracks official list prices for 69 AI models and reports that no vendor changed an official list price that week. Chinese models are priced in RMB, so their dollar equivalents shifted only with the exchange rate. The blended average is about ¥56.48 per million tokens for US models versus ¥10.79 for Chinese models, a gap of roughly 5.2 times. DeepSeek V4.1 Flash drew attention on social media, with its input and output tokens costing about 1/13 and 1/17 of Claude Opus 5.5's at list price. The same period's funding tracker logged over 150 rounds, including Ramp's $1.85B Series G at a $60B valuation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why a two-node Proxmox cluster freezes, and how a QDevice vote fixes it

A two-node Proxmox cluster can lock itself up because losing either node leaves the survivor with exactly half the votes, which is not a majority. Without quorum, the cluster filesystem at /etc/pve goes read-only, blocking guest starts, config changes and backups even though the surviving node is healthy. Adding a QDevice, a small external voter that can run on a Raspberry Pi or similar always-on Linux box, provides a third vote so the survivor keeps quorum. The QDevice must run on separate hardware, since placing it on a cluster node would remove two votes if that node fails. Unstable links, such as Wi-Fi with high jitter, can also make a cluster appear broken by causing nodes to repeatedly drop out and rejoin.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Choosing Between Vercel and Cloudflare for Low-Cost Website Hosting

A solo developer working on a micro-SaaS product shares lessons on keeping hosting costs minimal while avoiding unexpected cloud bills. The piece compares traditional VPS setups, which demand manual server management, with serverless platforms that handle operations and scale automatically. It argues that early-stage founders should default to serverless to preserve their time for building and validating products. The author also notes that workloads needing persistent processes, heavy computation, or custom binaries are better suited to VPS or container hosts. The article then turns to a comparison of Vercel and Cloudflare Workers, as the author's preferred platform choice.

0 comments Read more at DEV Community