Tomcat AJP port 8009 found exposed on about 2.1 million services

·7 views

ZoomEye's index counts roughly 2.1 million services reachable on port 8009, the default Apache Tomcat AJP connector port. AJP is a binary protocol that lets a front-end web server like Apache httpd or IIS forward requests to Tomcat, but many listeners appear because Docker images, Helm charts, and application server profiles publish the port by default. Tomcat's documentation recommends disabling the AJP connector when unused and binding it to loopback otherwise. Reviewers are advised to confirm the listener is restricted to the front-end address and that requiredSecret is set. The counts reflect observed reachability, not proof that any given instance is unpatched or exploitable.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why an E-Commerce Buy Button Hides Complex Business Processes

A field guide for 2026 argues that the checkout button is only the visible tip of a distributed business process. Using a coffee import example in Santiago, Chile, it shows how legality, pricing, stock, payment confirmation, tax documents and delivery must all align behind a single click. The guide notes that domain complexity differs by product category, from size variants in fashion to batch tracking and recalls in food. It cautions that AI can speed up storefront creation but cannot resolve ownership, regulatory authorization or refund logic. The material is framed as engineering guidance rather than legal or tax advice, with Chile used as a concrete regulatory example.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-source tool batch-generates and self-checks images on a laptop, with Gemma agreeing 64% of the time

A developer built Shotfill, an MIT-licensed Python tool that takes a line-by-line shot list and generates each image locally on an Intel laptop without a dedicated GPU. The system draws every shot with open models, uses Gemma 4 to check each result, and redraws the ones that miss. Shots it cannot fix are collected into a short list for the user to review later. The author tested it on a 16-image narrated-video list across three runs, with passes ranging from 5 to 13 of 16 as the code changed. The runs took between 50 and 96 minutes, and the author notes the experiments were not controlled benchmarks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Purrrfessorrr Slothhh: Open-source, local-first data analysis run by five specialist cats

A team of developers built Purrrfessorrr Slothhh, a local-first data analysis assistant that accepts CSV, TSV, and Excel files and never sends data off the user's machine. A sloth-professor persona delegates tasks to five specialist cats handling outlier detection, chart creation, plain-English explanations, Python and R code generation, and cleaning suggestions. Python performs all calculations, while the optional local Gemma 3 model via Ollama only explains results, with a filter that strips numbers not present in the real data. The app works without any model, and it refuses to connect to any model not hosted on localhost. The project was submitted to a Hacktoberfest open-source AI challenge, and its source code is available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

UUID v7 Sorts by Creation Time While UUID v4 Stays Random

This technical guide compares UUID versions 4 and 7 to help developers choose the right identifier. Version 7 embeds a millisecond Unix timestamp in its first 48 bits, so values sort chronologically, making it suitable for database primary keys and ordered event logs. Version 4 is almost entirely random, which keeps it unordered and avoids revealing when it was created, so it fits publicly exposed identifiers. The article explains the 8-4-4-4-12 format and how the version and variant digits mark each UUID's type, and it notes that RFC 9562 from 2024 formally standardized versions 6 through 8. It also stresses generating UUIDs from cryptographically secure sources, such as crypto.randomUUID() or Python's uuid4(), rather than Math.random().

0 comments Read more at DEV Community