PDF encryption keys in MuPDF and Foxit had weak randomness, making them recoverable

·5 views

Security researcher Rick de Jager at V12 disclosed that some PDF implementations generate file encryption keys with insufficient randomness. MuPDF produced AES-256 file keys with only about 9 bits of effective entropy, while Foxit derived its keys from the current timestamp. In both cases the keys can be recovered without the password, in milliseconds on an ordinary laptop. The flaw lies not in the AES-256 cipher or the key derivation math, but in the randomness used to generate the file key. Because the file key protects all document content, the password and slow hashing offer no real protection when it is guessable.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

A Practical Plan for Building a Website from Scratch

The article argues that a website should be approached as a product project, starting with a clear goal and an understanding of who the site serves before any design or theme choices. It recommends defining one or two meaningful conversions and mapping pages to distinct user needs rather than creating many near-duplicate keyword pages. Essential pages such as home, services, company details, contact, and FAQs form the core, with each page given a defined purpose and next action. The piece also weighs hosted builders against content management systems and custom development, and advises careful domain selection and secure handling of account credentials. Finally, it stresses drafting real content early, since actual material shapes the final structure.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Largest Census of MCP Tool Parameter Schemas Released: 229,827 Records

A new dataset has been published cataloging 229,827 tool records from the Model Context Protocol (MCP) ecosystem, each including a machine-readable input schema describing its parameters. The records draw from 13,120 servers that expose tool-level schemas, out of 42,163 servers surveyed, with most deployed servers lacking such machine-readable parameter definitions. The publisher reports byte-verified counts, no malformed records, and SHA-256 anchoring so the bundle can be independently checked. The dataset is intended to support security research, conformance test generation, and analysis of parameter-level risks such as injection and exfiltration, and is released under a CC-BY-SA-4.0 license. Its authors note that sampling is weighted toward English-language servers and that schema quality varies, with about 29,000 servers without tool-level schemas recorded but not expanded.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

commercetools Replaces Magento and Redis Pricing Cache With Native Price Rows

A developer rebuilt B2B company pricing for the open-source Forgeline storefront, moving from a Magento and Redis setup to commercetools. The earlier system depended on a nightly ERP sync, cached per-company JSON blobs, and AJAX-loaded prices to keep full-page caching working. In the new model, ERP changes are imported as native price rows keyed by store, channel, currency, and customer group, so nothing needs runtime caching. The author recommends a distribution channel per company rather than customer groups, since buyers can switch between business units. A test script confirmed how price selection resolves for company, fallback, and group-specific rows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google DeepMind unveils Genie 4, a steerable real-time world model in research preview

Google DeepMind announced Genie 4 on 27 October 2026, a model that simulates interactive worlds in real time with synchronized visuals and audio. Users can navigate these worlds with keyboard controls, alter them through text prompts, and converse with in-world characters. The system pairs Gemini Omni for world grounding with a Gemini 3.8 Flash agent that plans, checks, and replans multi-step goals. DeepMind acknowledges that visual consistency, object permanence, and long-term coherence remain unresolved, and pricing is unconfirmed. Access is currently limited to trusted testers, with a waitlist for Google AI Ultra subscribers and select API partners.

0 comments Read more at DEV Community