Oracle corrige une faille OCI permettant à un User Manager de créer une clé API pour un administrateur

·5 views

Une vulnérabilité découverte par Scott Weston, chercheur chez NetSPI, affectait Oracle Cloud Infrastructure (OCI). Un utilisateur doté du rôle User Manager pouvait créer une clé API au nom d'un Identity Domain Administrator. Il pouvait ainsi s'authentifier auprès des API OCI sous l'identité de cet administrateur, sans son mot de passe ni ses facteurs MFA. Oracle a corrigé le problème en juin 2026, avant la divulgation publique du 13 octobre 2026. Selon l'analyse, la faille tient à deux modèles d'autorisation qui, pris séparément, sont cohérents mais ouvrent une voie d'élévation de privilèges lorsqu'ils contrôlent des opérations équivalentes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Rivet launches open-source actor orchestrator for scaling AI agents with S3-backed storage

Rivet, a Y Combinator F25 startup, has launched an orchestrator that runs AI agents as lightweight actors instead of heavyweight sandboxes. Each actor offers long-lived processes, in-memory state, WebSocket support, and durable SQLite storage, and it hibernates when idle. The company says its actors use far less memory and start much faster than sandboxes, and the platform is open source and self-hostable. Rivet stores data primarily on S3, using an SSD tier to keep write and read speeds high while cutting costs. The company cites a customer, Amp, that migrated its multiplayer agents to Rivet after running into limits on Cloudflare Durable Objects.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Bild AI, a YC W25 Startup, Is Hiring Founding Product Engineers

Bild AI, a company from the Y Combinator W25 batch, has posted job openings for founding product engineers. The listings are published on the company's page on Y Combinator's website. The source material provides little beyond the job announcement itself, so details about responsibilities, compensation, or location are not available. The post was shared on Hacker News, where it had not yet received any points or comments at the time it was captured.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Regression Tests for the Laravel TokenGuard Patch Keep the Authentication Bypass Closed

The article explains how to write regression tests that ensure the CVE-2026-114509 fix in Laravel's TokenGuard remains in place after deployment. The vulnerability involves non-string JSON credentials reaching the user lookup on MySQL, and the patched guard now rejects such values with an is_string() check before querying the provider. The recommended approach combines unit tests with a synthetic provider, integration tests on MySQL or MariaDB, and HTTP-level tests on a disposable application. It also calls for a version matrix covering the patched releases, pinned dependencies, and a non-affected database as a control. Together these layers guard against regressions from vendor changes, copied custom guards, or dependency updates.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

VRヘッドセットを視覚トレーニングに活用する設計: Amblyotubeの事例

EXOSHOCKのようなVRゲームの普及で、ヘッドセットを日常的に装着する習慣が広がりつつある。この流れを受けて、両眼に独立した映像を出せるVR機器を視覚トレーニングに応用する発想が生まれている。Seven SportsのAmblyotubeは、Meta Quest向けにYouTubeの映像を左右の目で別々に処理し、弱視や両眼協調の改善を目指す。アイパッチに比べて継続しやすく、仮想空間で視力測定の条件を一定に保てる点が特徴とされる。記事は、こうした設計判断をエンジニア視点で整理している。

0 comments Read more at DEV Community