Thousands of MongoDB, Memcached and CouchDB Instances Found Exposed Online

·1 views

A ZoomEye scan conducted on 22 September 2026 discovered 2,590 MongoDB, 1,469 Memcached, and 387 CouchDB instances publicly accessible on their default ports. MongoDB deployments from pre-3.0 versions often retain open configurations that allow unauthenticated access to all databases, enabling data theft, modification, and in some cases server-side code execution. Memcached lacks any built-in authentication by design, relying entirely on network isolation, meaning any publicly reachable instance exposes cached data such as session tokens and user objects. CouchDB's HTTP-based interface doubles as an administrative endpoint, and instances bound to all network interfaces with weak or absent credentials represent a full administrative compromise. Security guidance across all three services centres on restricting network exposure, enabling authentication where available, and auditing legacy deployments that predate modern secure defaults.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Build Reliable Node.js Image Processing Pipelines for Event Galleries

A technical guide outlines best practices for handling large photo batches in event gallery platforms using Node.js queues or serverless workers. Durable queues are recommended for steady, high-volume workloads requiring strict ordering and operator control, while serverless workers suit infrequent traffic spikes with minimal infrastructure overhead. The approach treats each gallery import as a parent job with individual child image items, each tracking its own processing state through a defined state machine. Cancellation is modeled as a cooperative signal that workers check at multiple processing checkpoints, preventing orphaned or stale derivatives from being published. The guide emphasizes defining output contracts — including format, quality range, and pixel dimensions — before writing any processing code to avoid downstream inconsistencies.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five Observability Controls to Catch Missed Node.js Cron Jobs in Production

A robust Node.js cron health check strategy requires an external heartbeat monitor — not just internal logs — to detect when a scheduled job never runs at all. Each scheduled task should carry a single deterministic run_id across all retry attempts, with a terminal event recording key fields like pipeline_id, status, duration, and cost_center. Logs and metrics can explain runs that did execute, but only an outside monitor can flag a job that was never invoked by the scheduler or host. Alert routing should be explicitly owned, with a dedicated worker polling for failures rather than inferring missed jobs from absent application evidence. Data minimization obligations still apply to audit logs, meaning payment credentials and personal data must be excluded from structured log fields regardless of retention needs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Monolith vs. Microservices: How to Choose the Right Architecture for Your Project

Software architects often debate monolithic versus microservices architecture, with each approach carrying distinct trade-offs rather than one being inherently superior. A monolith runs all application functionality — such as auth, payments, and notifications — as a single codebase and deployment unit, while microservices split these into independently deployable services communicating over a network. Both approaches share the same core goals: maintainability, reliability, scalability, and team productivity, but achieve them in different ways. Experts recommend that most new projects start with a monolith due to its simpler development, easier debugging, and lower operational overhead. Migrating to microservices should be considered only when a concrete problem — such as team scale or independent deployment requirements — genuinely demands it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Infrastructure Code Can Safely Manage Internal DNS Hostnames

Engineers managing internal DNS from infrastructure code must first distinguish between platform-owned and customer-owned DNS zones, as treating them as a single writable pool leads to flawed deployment models. The recommended approach stores desired DNS records in the infrastructure repository and reconciles them during each deployment, making the repo the single source of truth. Any out-of-band edits then surface as failed deployments rather than silent configuration drift. Customer-owned zones require stricter controls — the platform should only display required records unless DNS control has been explicitly delegated. Fast-changing hostnames are better handled by a service registry, and automatic deletion of records should be avoided to prevent large-scale incidents from a single malformed file.

0 comments Read more at DEV Community