Perforce patches six P4 Search flaws, including a critical default-token bypass

·11 views

Perforce released P4 Search 2026.4.2 on 5 October 2026 to fix six security defects in the search service used with its P4 source control platform. The most severe flaw, CVE-2026-100103, scored 10.0 under CVSS 4.0 because official container images reset the service authentication token to a publicly documented default. Any network-reachable party holding that default value could gain top application privileges, with no parsing bug or memory corruption required. Other fixes address an unauthenticated debug interface enabling code execution, a fail-open condition granting full access with a blank token, and several file-write and ticket-spoofing issues. Perforce reported no exploitation in the wild, and administrators are advised to upgrade, rebuild container deployments, and rotate tokens.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

The Double Headed Stack Allocator: A Memory Allocation Technique Explained

A blog post on demofox.org introduces the double-headed stack allocator, a memory management approach. The article, dated October 3, 2026, is shared on Hacker News, where it has gathered 6 points and no comments so far. The source text provided is limited to metadata, so the technical details of the allocator cannot be summarized from it. Readers would need to consult the original post for an explanation of how the design works.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why AI Zombie Love Story Videos Are Spreading Fast on Social Media

A viral autumn 2026 format, the zombie love story, shows a partner turned into a zombie while the other chooses to embrace them anyway. The trend took off after filmmaker Aytech Ashkhamakhov posted the short AI film "CHOICE" on Instagram in mid-September 2026, and many viewers initially mistook it for a real movie scene. Its shareability comes from a fixed three-beat structure with personalized faces, an emotional rather than gory tone, and a built-in tag-your-partner loop. A DEV Community write-up explains that typical photo-to-video pipelines detect and validate faces, transform one identity into a zombie while preserving recognizable features, and animate per-scene keyframes before stitching segments and adding audio. The article argues that template-driven tools with strong narrative structure tend to outperform open-ended prompt interfaces for mainstream users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agencies Face Outage Liability When Clients Pay Vendors Directly

Agencies are increasingly managing websites and digital assets whose vendor bills are paid directly by clients on their own cards. When those payments fail, the service can lapse even though the agency had no control over billing. Clients often choose this split-billed setup to satisfy procurement rules, avoid ownership concerns, or keep invoices in their own legal entity. Vendors typically limit third-party access so that managers can administer assets but cannot update payment methods. As a result, agencies may still bear the blame, reputational damage, and emergency work when an outage occurs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Claude Code Shipped Nine Releases in Eight Days, Outpacing Third-Party Interfaces

Claude Code published nine versions between October 1 and October 8, 2026, according to the npm registry, with further releases on October 9 and 14. OpenAI's Codex CLI also shipped four stable releases in five days during the same period. The article notes that new interface features, such as keyboard shortcuts, pickers and terminal status signals, appear in the vendors' own terminals on the day they ship. Tools that re-render these agents through scraped output or the SDK must redesign their screens to match, so they tend to trail the official releases. The author argues that this lag is structural rather than a one-off problem.

0 comments Read more at DEV Community