SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Patching CVE-2026-108452 in SharePoint Server requires forensic checks beyond the fix

0
·1 views

Microsoft's advisory describes a path traversal flaw (CWE-22) in SharePoint Server Subscription Edition that can enable code execution by an authorized network attacker, rated CVSS 8.8. Affected builds run from 16.0.0 up to below 16.0.20326.20190, and KB5002927, released October 13, 2026, provides the fix. The guidance stresses that patching alone does not show whether an exposed farm was already targeted, so responders should build a timeline, review authenticated activity, and check for unexpected server-side changes. Farms running Workflow Manager also need a prerequisite update (KB5002799) and, for classic installations, a documented debug flag step. The article notes that no public report confirms active exploitation, and that no single log query gives complete coverage.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

dotvault Keeps Every Secret Version, Allowing Rollback After Accidental Overwrites

This is part 4 of a 12-part series on dotvault, a tool for managing secrets from a laptop through CI and AI agents. In dotvault, writing a key creates a new version rather than destroying the previous value, so an accidental overwrite such as pasting a staging database URL over a dev one can be undone. The command dotvault rollback restores an earlier version, and the restore is recorded as a new version so history is preserved. Keys can be added via the console or CLI, with dotvault versions listing each version's number, timestamp, writer and value hash. The article notes that deleting a key also keeps its version history visible.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Seven Ways Trading Backtests Mislead and the Checks That Catch Them

A well-performing backtest can be misleading, often unintentionally, and traders frequently find strategies collapse once real money is involved. The article attributes this less to changing markets and more to tests that were never reliable evidence in the first place. It outlines seven common pitfalls, including testing many configurations and reporting only the best, using data unavailable at decision time, and ignoring delisted companies. It also covers unrealistic trading costs, dependence on a single favorable period, and failing to compare results against simple baseline rules. The author argues that a backtest's main value lies in filtering out losing strategies rather than confirming winners.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Data-Driven API Testing: CSV Tables in Cloud Clients vs Portable Spec Files

Data-driven testing runs the same request and assertions against many input rows instead of writing a separate test for each case. Cloud clients popularized attaching CSV tables to requests, but those tables sit inside proprietary collections that are hard to review or run in CI. Plain spec files achieve the same goal with a portable data file and a small runner, keeping cases in version control alongside the API contract. The article recommends first checking whether OpenAPI examples and schema enums already define the meaningful inputs, reserving separate data files for edge cases the contract does not enumerate. It also advises validating rows, giving each case a stable identifier, and sharing fixtures to keep large suites maintainable.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Committed Terraform plan file exposed secrets via git history, prompting credential rotation

A developer accidentally committed a Terraform plan file named 'out' to a private repository, where it sat on the remote for nine days. Existing protections such as .gitignore rules and secret scanners relied on filenames and text matching, so they failed to flag the binary zip archive. Because a plan file bundles the full Terraform state and all input variables, it contained far more sensitive data than the planned changes alone, including credentials for many resources. The author describes the difficulty of identifying and rotating those secrets across multiple environments and providers. The post warns that targeting a plan does not limit what gets saved, and that sensitive-value redaction in Terraform's display output is not encryption.

0 comments Read more at DEV Community
Patching CVE-2026-108452 in SharePoint Server requires forensic checks beyond the fix · ShortSingh