SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

ProFTPD mod_sql Flaw CVE-2026-42167 Gets Public PoC; RCE Depends on Config

0
·1 views

A public proof-of-concept exploit for CVE-2026-42167, a SQL injection vulnerability in ProFTPD's mod_sql extension, was published on Exploit-DB (EDB-ID 52658) on August 25, 2026. The flaw carries a CVSS v3.1 score of 8.1 and affects ProFTPD installations where mod_sql is configured for SQL-backed authentication or SQL logging that incorporates user-controlled input. Exploitation is post-authentication and, depending on server configuration, can lead to authentication bypass, privilege escalation, or remote code execution via a PostgreSQL backend with elevated database privileges. ProFTPD version 1.3.9a has been identified as the patched release that addresses the vulnerability. Security researchers caution that the existence of a working PoC does not mean every ProFTPD deployment is at risk, as exploitability is directly tied to how mod_sql is configured on a given system.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Token Cost of AI Tool Discovery: When Agent Context Overhead Actually Matters

A developer measured the token cost of injecting tool definitions into an AI model's context on every call, using a tokenizer-based harness without requiring a live LLM. The study found that a small three-tool server costs just 277 tokens per model call, making optimization pointless at that scale. However, costs scale linearly with tool count and description verbosity — 100 verbose tools consume over 20,000 tokens per call, totalling roughly 400,000 tokens across a 20-call agent task. Curating five relevant tools from a set of 100 cuts context cost by approximately 95 percent. The key finding is that the real cost driver is not discovery versus static manifests, but how many tool definitions sit in context and how verbosely they are written.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tiny On-Device AI Models Struggle Most With Children's Speech, Posing Product Dilemma

Developers building WhyWave, a voice companion for children aged three to five, discovered that smaller AI models — compact enough to run on a smartphone — perform significantly worse at recognising children's speech compared to adult speech. Legal constraints complicate the alternative: Apple's App Store guidelines bar kids' category apps from sending personally identifiable information to third parties, and a child's voice qualifies as such under COPPA's definition in 16 CFR § 312.2. Major AI vendors add further restrictions, with Google prohibiting use of its generative APIs in products directed at under-18s, while OpenAI and Anthropic impose strict conditions including zero data retention and age verification. Processing audio entirely on-device sidesteps these legal hurdles, since audio that never leaves the device is never 'collected' under COPPA and no third-party vendor terms apply. Recent benchmarks show on-device models like Whisper Large v3 Turbo and lightweight alternatives such as Moonshine are closing the gap with cloud systems on speed and accuracy, though their performance on children's voices remains a key unsolved challenge.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Cuts AI API Costs by 61% Using Model Routing and Fallback Logic

A developer building an AI-powered app was spending $800 per month on OpenAI API calls despite having fewer than 500 active users. After auditing a week of LLM calls, they found that 62% of requests involved simple tasks like classification that did not require expensive flagship models. They implemented task-based model routing, directing simpler workloads to cheaper models such as GPT-4o-mini or Claude Haiku, which cost roughly 10 times less per token. A fallback layer was added to handle provider outages, and an API gateway was adopted to centralize routing, key management, and retry logic. Within three weeks, monthly costs fell by 61% while reliability improved and the codebase became simpler to maintain.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

116,181 Search Impressions but Only 9 Clicks: What the Data Reveals About Web Visibility

A website intelligence platform called AuditMe recorded 116,181 Google Search impressions over three months but generated only 9 clicks, yielding a visibility gap ratio of roughly 12,909 impressions per click. During a separate 27-day period, the same site logged 1,737 AI citation events, highlighting that search engines and AI systems measure visibility in fundamentally different ways. The data illustrates that a website passes through multiple distinct layers — from crawling and indexing to surfacing, citation, and conversion — and can succeed at one layer while failing at another. Neither metric alone tells the full story: AI citations do not automatically translate into clicks or revenue, just as high impression counts do not guarantee meaningful user engagement. The findings suggest that site owners need layer-by-layer diagnostics rather than a single aggregate visibility score to understand where their web presence is actually breaking down.

0 comments Read more at DEV Community
ProFTPD mod_sql Flaw CVE-2026-42167 Gets Public PoC; RCE Depends on Config · ShortSingh