PAGI::Server 0.002007 unifies HTTP/1.1 and HTTP/2 under a single contract

·4 views

PAGI::Server 0.002007 is the most significant release of the Perl async web server framework to date, centered on normalizing behavior across HTTP/1.1 and HTTP/2 transports. The release makes event validation mandatory and always-on, deprecating the previous opt-in validate_events flag, so malformed or out-of-sequence events now consistently fail rather than being silently ignored. Error reporting has been standardized, with socket errors now distinguished by type — such as read_error, write_error, or idle_timeout — instead of all appearing as generic client disconnections. WebSocket and response lifecycle handling has been unified across both transports, ensuring incomplete responses trigger proper abnormal closure and disconnect events fire exactly once. The release ships with 920 tests across 133 files, and benchmarking showed no performance regression from unconditional validation, with a dedicated performance-focused update already in progress.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Critical miniOrange SAML SSO flaws let attackers hijack WordPress admin accounts

Two critical authentication bypass vulnerabilities, tracked as CVE-2026-61979 and CVE-2026-15981, have been discovered in the miniOrange SAML 2.0 Single Sign On plugin across seven WordPress editions. The flaws allow attackers to forge SAML responses and obtain valid WordPress administrator session cookies without needing a password, MFA, or access to identity provider credentials. The first vulnerability exploits algorithm confusion by using the RSA public key as an HMAC secret, while the second abuses PHP's openssl_verify() returning -1 on error, which the plugin incorrectly treats as a successful verification. Real-world exploitation was detected by DigitalOcean, where an external actor obtained an admin session cookie, though further damage was prevented by network-level restrictions on the WordPress admin panel. Opportunistic scans targeting miniOrange SSO endpoints have been observed from multiple IP regions, indicating widespread, indiscriminate attack attempts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Calix GS7 Router Flaw Lets Attackers Expose Home Devices via Unauthenticated UPnP

A high-severity vulnerability, tracked as CVE-2026-75501, has been disclosed by CERT/CC affecting the Calix GS7 XGS GS5239XG residential router running EXOS 6.6.47. The flaw stems from MiniUPnPd 2.3.7 exposing UPnP controls on WAN-side TCP port 5000 without any authentication, a service normally restricted to local networks. Remote attackers can send unauthenticated SOAP requests to create persistent port forwarding rules, effectively bypassing NAT and firewall protections to reach internal cameras, NAS devices, and IoT equipment. Critically, forwarding rules set with a zero-second lease duration survive router reboots, meaning exposure persists without user awareness or notification. No active exploitation has been reported yet, and users are advised to disable UPnP on affected devices as no patch has been issued.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Maintaining a Government Custom GPT Demands More Skill Than Building It

A custom GPT built for a government ministry training program may appear complete once the training session ends, but real challenges emerge months into actual use. As procedures are revised, terminology shifts, and departments are reorganized, the tool's knowledge base quietly drifts out of sync with current reality. Unlike outright failures, this degradation is hard to detect because the system continues responding confidently even when its information is outdated. Maintenance requires periodically auditing the existing knowledge base against live source material — a more delicate task than the original build, since it must identify what has become inaccurate without disrupting what remains correct. Yet this ongoing work rarely receives the same resources or attention as initial development, as it lacks the visibility of a concrete deliverable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security Risks of Using Free Remote Servers for AI Coding Agents

A developer recently ran a coding agent on a free remote server, accidentally exposing a staging database password and personal git credentials in the run directory without realising it. The incident highlights a broader security gap: most agent workflows treat the boundary between a local machine and a remote host as if it does not exist. Free servers are typically shared, monitored, and eventually recycled, meaning users have no control over who accesses logs or how long data persists. Common mistakes include passing environment variables explicitly into run logs, reusing personal git identities for agent commits, and overlooking temporary files that may contain sensitive configuration. Security experts recommend building a minimal, isolated environment for each remote agent run — using tools like env -i to restrict what variables the agent can access — and relying only on short-lived, scoped credentials rather than production keys.

0 comments Read more at DEV Community