Sourcehut Vulnerability Allowed Account Takeover via XSS in Build Logs

·1 views

A security researcher discovered a vulnerability in Sourcehut, the open-source software forge, that could allow attackers to take over user accounts. The flaw stemmed from a cross-site scripting (XSS) bug in ansi2html, a tool used to render build log output in the browser. By crafting malicious ANSI escape sequences in build logs, an attacker could execute arbitrary JavaScript in a victim's browser session. This could potentially be exploited to hijack authenticated user accounts on the platform. The details were disclosed publicly via a blog post by the researcher who uncovered the issue.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

SFT Stores Knowledge, RL Rewires Reasoning: Study Proves They Work Differently

A July 2026 study by Zhu et al. (arXiv:2607.19331) has provided mathematical proof that Supervised Fine-Tuning (SFT) and Reinforcement Learning with Verifiable Rewards (RLVR) alter AI model weights through fundamentally different mechanisms. Using Singular Value Decomposition analysis, researchers found that SFT modifies a model's singular value spectrum to inject new factual knowledge, vocabulary, and formatting into its representations. In contrast, RLVR leaves the singular value spectrum nearly unchanged from the base model, instead adapting the model by rotating its input and output coordinate frames. This distinction means RL does not add new facts but rather reorganizes how the model routes and applies its existing pre-trained capabilities for multi-step reasoning. The findings challenge the common assumption that SFT and RL are interchangeable steps in post-training pipelines.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev Shares Key Lessons on Building Reliable Android Reminder Systems

A developer building an Android task app called Wumilo discovered that delivering a simple reminder involves a complex chain of systems, not a single feature. Factors such as exact alarms, notification permissions, battery optimization, and device-specific manufacturer restrictions all affect whether a reminder reaches the user on time. Android's power-management features like Doze and App Standby can delay background activity, and different phone brands may behave inconsistently even when running identical code. The developer found that treating reminders as a multi-step delivery chain — rather than a single scheduling action — made debugging significantly more effective. A key takeaway is that precise alarm scheduling and successful notification delivery are related but distinct problems that must each be addressed separately.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How one developer built a Web-to-iOS app login handoff that bypasses Apple's payment cut

A developer has detailed a system that lets users pay for an app via a web funnel and then open the iOS app already authenticated, even before it is installed. The approach avoids Apple's in-app purchase commission by processing payments entirely on the web, then using a one-time login token to authenticate the user on first app launch. The token is passed to the app using AppsFlyer's deferred deep linking, which survives the App Store installation barrier. A key technical hurdle on iOS was that since iOS 14.5, only a restricted set of deep link parameters are passed to fresh installs, causing custom token fields to be silently dropped. The developer's fix was to place the token inside one of AppsFlyer's explicitly permitted parameter slots, such as deep_link_sub1, rather than a custom query parameter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Linux server was rescued after IP change left SSH unreachable for hours

A routine public IP change on a cloud server running minimized Ubuntu caused complete SSH loss and zero ping response, because the OS lacked tools like cloud-init or NetworkManager to apply the update automatically. The data center had assigned the new IP at the hypervisor switch level, but the server's network card still held the old, defunct address. Emergency access was restored via an out-of-band VNC console, where temporary ip and route commands brought the network back online instantly. A permanent fix was achieved using systemd-networkd with the GatewayOnLink flag correctly placed under the Route section, alongside cleanup of legacy IP references in configuration files. The incident also revealed that absent ICMP responses do not confirm a server is down, as the data center's anti-DDoS firewall was silently dropping ping packets while TCP connections remained fully functional.

0 comments Read more at DEV Community