Researchers Detail QPACK Amplification Attacks Targeting HTTP/3 Servers

·1 views

A blog post from Foxio describes amplification attacks that exploit QPACK, the header compression scheme used by HTTP/3. The attacks abuse header accordion behavior to force servers into disproportionate resource use. The write-up was shared on Hacker News, where it gathered modest attention. The source material provided is limited to the article link and basic discussion metrics, so the specific technical details and scale of impact are not covered here.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

October 2026 KEV Wave Exposes Edge Device Lifecycle Gaps Beyond Patching

Between late September and mid-October 2026, CISA added a cluster of vulnerabilities in edge infrastructure from multiple vendors, including Citrix, F5, Cisco, Ivanti, Palo Alto, Atlassian, BeyondTrust and AhsayCBS, to its Known Exploited Vulnerabilities catalog. The article argues the clustering is structural: these products sit at trust boundaries, terminate untrusted sessions, hold credentials and are designed to be internet-reachable. It contends that tracking only whether an appliance is patched misses reachability, credential exposure, behavioral baselines and configuration integrity. The author recommends provisioning devices with restricted management access, inventorying held credentials, establishing outbound traffic baselines and snapshotting configurations before and after changes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Railyard adds one-command self-hosted Plausible analytics

The railyard.run team had run its site without analytics, leaving traffic questions unanswered. They used the launch command in Railyard's CLI to deploy a self-hosted Plausible instance. After the first-run sign-up, they added the website and placed the generated tracking snippet on the site. The default app URL was sufficient for both the dashboard and the tracking script, without a custom domain. The article also warns that each launch creates a separate app, which can be removed with the apps:rm command.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Converting nested JSON to CSV in Python with pandas

A common pandas recipe for JSON-to-CSV conversion produces an unnamed index column and cells full of raw dictionary text when the data is nested. The article explains that the problem lies in the JSON's structure rather than the recipe itself. It lists eight common error symptoms with their causes and fixes, most of which need only a single parameter change. For nested data, it recommends pd.json_normalize with record_path and meta, and it shows how to inspect a file's keys to choose the right approach. It also warns that pandas 3.0 treats a literal JSON string as a file path, so the string must be wrapped in StringIO.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Blog Logs 4,040 AI Crawler Requests in 30 Days, But Few Tied to Citations

A personal blog with eight posts recorded about 4,040 requests from AI crawlers over the 30 days to 20 October 2026, according to Cloudflare's count. Google's crawlers sent the most traffic, followed by Anthropic, OpenAI, Apple and Microsoft. Roughly half of the successful requests were for collecting data to train AI models, while only 26 came from an AI assistant fetching a page after a user's query. The author found that the blog's sitemap was read more often than any single post, and that ChatGPT cited the site in none of 12 test answers. The author notes that Cloudflare's AI Crawl Control lets other site owners see similar data.

0 comments Read more at DEV Community