Over 6,000 VeloCloud Orchestrators Exposed Online Amid Actively Exploited CVE-2026-93952

·2 views

CVE-2026-93952 is a maximum-severity (CVSS 10.0) vulnerability affecting on-premises VeloCloud Orchestrator (VCO), which Arista Networks has confirmed is actively being exploited in the wild. Internet scanning data from ZoomEye, queried on September 22, 2026, identified approximately 6,050 internet-reachable systems returning VeloCloud-related HTTP content, indicating significant public exposure of what should be a tightly restricted management plane. The figure reflects reachable systems bearing the VeloCloud fingerprint, not a confirmed count of vulnerable builds, as version ranges and deployment models cannot be determined from fingerprinting alone. Affected versions include VCO 5.2.3.15 and earlier, 6.1.3.7 and below, 6.4.2.7 and below, and 7.0.0.2 and below, while cloud-hosted instances were patched automatically and are not at risk. Administrators are advised to upgrade to a fixed build, restrict the VCO web interface to trusted internal networks, and audit systems for indicators of compromise such as the vcnode.js backdoor script.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

containerd 2.2 mount manager slower and buggier than manual disk setup

A developer benchmarked containerd 2.2's new mount manager against a manual four-command sequence for formatting and attaching a 200MiB ext4 image as a loopback device. The mount manager's Activate call took between 29.6ms and 47.2ms per run, while the manual approach consistently finished in 23.5 to 25.9ms. Beyond being slower, the manager also panicked once, leaked a raw BoltDB error, and left an orphaned loop device that could not be recovered. The overhead stems from BoltDB writes, symlink creation, and bookkeeping rather than any difference in the underlying formatting tools, since the manager shells out to the same mkfs.ext4 binary as the manual path. The mount manager is designed for composability within snapshotters and runtime shims, not for raw performance, and the developer tested against containerd v2.2.2 bundled with Docker Engine 29.3.1.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Lambda Durable Functions Harbor a Silent Replay Bug in AI Approval Workflows

A developer building a human-in-the-loop AI agent workflow using AWS Lambda durable functions—released in late 2025—discovered that the system executed a different action than the one a human had explicitly approved. The root cause was the replay mechanism central to how durable functions work: when a paused workflow resumes, Lambda reruns the handler from the top and reinjects checkpointed results, which can silently mismatch with runtime state if code is not structured carefully. The workflow was designed to let an AI agent propose an action, pause for human approval, then execute only the approved action—but the replay behavior caused it to execute the wrong one. The bug was not in business logic or a race condition, but in a misunderstood framework feature that can affect any multi-step workflow with external callbacks. A single structural code fix was found to reliably prevent the issue, and the author validated the solution both locally and on a live Lambda deployment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Student Builds Trade Analytics Boilerplate Using Streamlit and Plotly

An AI/ML student and freelance developer created LandedIQ, a trade analytics dashboard that calculates landed costs by combining base price, import duty, freight, and insurance. Built with Streamlit and Plotly, the project was born after the developer repeatedly rewrote the same currency conversion and charting logic across multiple client projects. Key technical decisions included using Plotly over streamlit-echarts due to Python 3.13 compatibility issues, and caching exchange rate API calls hourly to prevent redundant requests. The app is deployed on Railway, requiring a manual start command to bind to all network interfaces rather than just localhost. The developer has since packaged the project as a purchasable boilerplate, complete with documentation and a PDF setup guide, listed on Gumroad and Contra.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Paper Cuts Quantum Attack Resource Estimates, Raising Blockchain Security Urgency

A March 2026 Google Quantum AI paper, co-authored with researchers from the Ethereum Foundation and Stanford, found that Shor's algorithm could break 256-bit elliptic curve cryptography — the basis of Bitcoin and Ethereum wallet security — using roughly 10 times fewer computational resources than previously estimated. The authors used a zero-knowledge proof to validate their findings without publicly releasing the attack circuits, making the results verifiable but not independently reproducible. Experts highlight two distinct threats: a future 'Q-day' when quantum hardware becomes capable enough to break live keys, and the already-active 'harvest-now-decrypt-later' risk, where adversaries collect signed transactions today to decrypt them once hardware matures. Unlike ephemeral web traffic, blockchain transaction data is permanently public, meaning exposed public keys remain vulnerable indefinitely. Wallet infrastructure builders are urged to begin post-quantum migration planning now, regardless of uncertainty around the exact timeline for cryptographically relevant quantum computers.

0 comments Read more at DEV Community