Synology NAS infected via critical RCE flaw for 6 months, antivirus showed all clear

·1 views

A Synology NAS owner discovered hidden malware on his device after noticing unfamiliar scheduled tasks and investigating the system crontab. He found a concealed shell script in /etc that ran every 20 minutes as root, downloaded a disguised Linux binary, and maintained persistence across reboots. Synology's built-in Security Advisor returned three green checkmarks during a full scan, failing to detect either the dropper script or the payload, which had been present since January 2026. The malware was traced to CVE-2024-10441, a CVSS 9.8 unauthenticated remote code execution vulnerability in Synology DSM disclosed in late 2024, which the attacker had even referenced in the payload's filename. The device was running DSM 7.2.1-69057 Update 3, a version predating the patch released in Update 6, meaning it had been exposed for roughly six months.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AntigravityCI lets developers trigger AI code refactoring via GitHub PR comments

A developer has released AntigravityCI, an open-source tool that transforms GitHub Pull Request comment sections into an AI-powered command terminal. Users can tag the bot with instructions directly in a PR, and it processes the request in under 1.5 seconds. The tool uses Google Gemini Flash models to analyze code diffs, apply changes on a temporary branch, and open a new PR for review. Built with Python, Docker, and GitHub Actions, it aims to eliminate the need to manually copy code into external chatbots. The project is publicly available on GitHub, with planned additions including support for other LLM backends and automated test execution.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Practical Guide to Implementing OAuth2 and OpenID Connect in Modern Apps

A technical guide published on DEV Community explains the distinct roles of OAuth2 and OpenID Connect (OIDC), two widely used but often confused security protocols. OAuth2 is an authorization framework that grants applications limited access to user resources, while OIDC is an authentication layer built on top of OAuth2 that identifies who the user is. For web and mobile applications, the guide recommends the Authorization Code Flow with PKCE to prevent authorization code interception attacks. It also details how to validate ID Tokens — which are JWTs — by verifying the signature, issuer, audience, expiry, and nonce using a provider's public JWKS endpoint. The guide further covers protecting APIs by validating access tokens on every request, either through local JWT verification or token introspection for opaque tokens.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PostgreSQL Connection Strings Explained for Supabase, Neon, and Railway

A PostgreSQL connection string is a single URL containing the protocol, username, password, host, port, and database name needed to connect a client to a database. Supabase offers three distinct connection strings for the same database — direct, session pooler, and transaction pooler — and choosing the wrong one is a common source of silent failures, especially on IPv4-only networks or serverless environments. For serverless platforms like Vercel or AWS Lambda, the transaction pooler on port 6543 is the recommended option, as it is designed for many short-lived connections. Neon simplifies the choice by embedding pooler status directly in the hostname, with the pooler variant being the default recommendation for most use cases. Railway provides a straightforward single connection string with no pooler configuration required, and advises storing credentials in environment variables rather than in application code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sudo vs Root in Linux: Key Differences and Why It Matters for System Security

In Linux systems, root and sudo are often used interchangeably, but they represent fundamentally different concepts in system administration. Root is a superuser account with UID 0 that bypasses virtually all permission checks, granting unrestricted access to files, processes, and hardware. Sudo, by contrast, is a tool that temporarily delegates specific administrative privileges to regular users based on defined rules. Modern Linux distributions favor sudo over direct root login because it limits exposure, enforces accountability through logging, and reduces the risk of accidental or malicious system-wide damage. Understanding this distinction is considered essential knowledge for anyone managing Linux infrastructure safely.

0 comments Read more at DEV Community