SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Roundcube patches session parser flaw that could enable PHP object injection

0
·1 views

A malformed session key beginning with an exclamation mark in Roundcube Webmail caused its parser to lose synchronization with the data that followed. The flaw, tracked as CVE-2026-114724, affects versions before 1.6.20 and 1.7.x before 1.7.5, and both releases contain the fix. Because it is classified as untrusted deserialization, it can become a PHP object injection risk when an attacker can influence stored session data. The CVE record does not establish a universal exploit, since a reachable class path is also required. Administrators are advised to patch both release lines, verify deployed builds, and review who can write to session stores.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Email authentication can fail later without DNS changes, due to SPF lookup limits and DKIM drift

A one-time SPF and DKIM setup is only a snapshot, since authentication results can change even when published records stay the same. SPF permits at most 10 DNS-querying mechanisms per evaluation, so a provider adding its own include can push a domain over the limit, causing a permerror and an SPF failure. DKIM can break silently if a CNAME-delegated selector is removed during DNS cleanup, leaving mail from that sender failing or unsigned. Newly added third-party tools that send on a company's behalf may go unnoticed under a p=none policy but cause mail to be spammed or bounced once the policy is tightened. The article recommends recounting SPF lookups after provider changes and regularly reviewing aggregate reports sent to the rua address before enforcing stricter policies.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Customer-brought AI agents force firms to rethink security around what agents can reach

Software vendors are increasingly facing customers who connect their own AI agents to their products, leaving the vendor without control over the model, its instructions, or its connections. The article argues that since the vendor cannot govern the model's behaviour, treating its output as untrusted by default is now simply a realistic description of the situation. Conventional safety tools such as system prompts, output filters and evaluations assume the vendor runs the model, and even where they apply they only reduce the odds of harm rather than preventing it. The author therefore proposes shifting controls to limiting what the agent can access and do, illustrated by GarageManager, a workshop platform that uses scoped tokens, declared actions, forbidden actions, human sign-off and an audit record.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

DreamHost discloses two-month intrusion into its File Manager, exposing user logins

DreamHost has confirmed that attackers had access to its web-based File Manager from August until October 23. During that window, the intruders obtained FTP and SFTP credentials along with some webmail session tokens. Because the breach went undetected for roughly two months, the attackers had a long window to act. Session tokens are especially risky since they can bypass password protection entirely. Affected customers are advised to reset their FTP, SFTP, and email passwords, review their sites for unfamiliar files, and enable multi-factor authentication where available.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dify API Keys Grant Application Access, Not Full Workspace Control

Dify's API reference tells developers to send an application API key as a Bearer token and to keep it on the server rather than in client code. A ZoomEye count-only query on 2026-11-05 returned 12,968 matches for app="Dify", a figure that measures visible application surfaces rather than exposed or vulnerable deployments. The guidance stresses that each key should be tied to one application and limited to its needed operations, since keys do not carry console or administrative privileges. Recommended practices include storing keys in secret managers, masking them in logs, revoking any key found in a support bundle, and separately reviewing public embeds and the tools and data sources they can reach. Self-hosted operators are also advised that the API key does not protect database, cache, vector store, or model-provider credentials, which need their own network restrictions and monitoring.

0 comments Read more at DEV Community