Nearly 4,000 Proxmox Hypervisor Consoles Exposed Online Amid Auth Bypass Flaw

·14 views

A ZoomEye scan conducted in September 2026 found 3,988 hosts responding on port 8006, the default port for the Proxmox VE web management interface. This exposure coincides with a Proxmox authentication bypass vulnerability disclosed in August 2026, affecting versions 7.x through 8.0.3. An attacker reaching an unpatched console gains root-level access without needing to exploit additional vulnerabilities, making exposed instances high-value targets for ransomware and data extortion. Security researchers note the scan reflects exposure only and does not confirm which hosts are running vulnerable versions or who owns them. Defenders are advised to block port 8006 from public internet access and enforce multi-factor authentication on root accounts as immediate mitigations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds free-tier earnings tracker using AlphAI API with 25-ticker watchlist support

A developer behind AlphAI built a Python script called week.py to answer three recurring earnings-season questions: which watchlist stocks report that week, what their filings actually said, and which macro events fall in the same window. The script was built and tested on a free API tier — one key, 20 requests per minute, 100 per day, no card required — starting Saturday, 12 September 2026. A watchlist of 25 tickers costs 25 API requests via the earnings endpoint, with one additional call for the macro calendar, totaling 26 of the daily 100 allowance. The earnings endpoint returns both a company-confirmed next report date and structured analyses of past SEC filings, including key metrics, guidance, and omissions. The developer noted two inconsistencies: the calendar endpoint is not yet wrapped in the SDK, and date-window handling differs between the calendar and news endpoints.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Geographic Enclaves Like Campione d'Italia Are a Nightmare for Software Developers

Enclaves — territories of one country entirely surrounded by another — present unusual edge cases for software systems, as illustrated by Campione d'Italia, an Italian town enclosed within Switzerland. Despite being Italian territory, Campione uses Swiss postal codes, Swiss phone numbers, and the Swiss franc as its primary currency, while remaining subject to Italian law and EU data protection rules. Emergency services are provided by Switzerland, vehicles must be registered in Italy, and the town sits outside the EU VAT area but inside the EU customs territory since 2020. These overlapping jurisdictions mean that software handling taxation, addresses, payments, healthcare, or privacy cannot simply derive rules from a country code. The article argues that such geographic anomalies highlight a broader truth in software design: attributes like currency, tax regime, postal system, and applicable law must each be treated as independent data points rather than assumed from location.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Developer Built a Truly Offline PWA With No Server and Silent Pitfalls

A developer built Mes mots, a pictogram communication app for a non-verbal child, with a strict requirement to function entirely offline on a tablet without regular Wi-Fi access. Unlike most 'offline-first' apps, Mes mots has no backend server, meaning no data syncing or conflict resolution — only occasional code updates need to reach the device. Using the vite-plugin-pwa plugin with Workbox, the developer configured a service worker to precache all necessary assets, including MP3 audio files for each pictogram tile. A critical early mistake was omitting the .mp3 extension from the cache pattern, causing the app to silently lose its audio functionality offline with no console errors or visible warnings. The project also required careful handling of different deployment paths — a personal domain root versus a GitHub Pages subdirectory — to prevent blank-page failures caused by mismatched asset URLs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds none of his 14 SaaS sites had sitemaps submitted to search engines

A developer managing 14 small SaaS websites discovered that despite all sites correctly generating and declaring sitemaps, none had ever been actively submitted to Google Search Console or Bing Webmaster Tools. The oversight left 188 URLs passively waiting to be crawled for months, with one domain not even registered in Bing Webmaster Tools at all. The developer highlights that for new sites with no inbound links, passive sitemap discovery can cause significant indexing delays compared to active submission. He also notes that submitting only to Google is increasingly insufficient, as AI tools like ChatGPT rely on Bing's index and Claude draws on Brave Search, meaning modern SEO now spans multiple distinct indexes. The fix is straightforward: open both Search Console and Bing Webmaster Tools, check the Sitemaps table, and submit the full sitemap URL if the table is empty.

0 comments Read more at DEV Community