WordPress CVE-2026-87902: an Unauthenticated Path Traversal That Escalates into Remote Code Execution

·3 views

WordPress CVE-2026-87902: an unauthenticated path traversal that escalates into remote code execution Opening A critical WordPress core vulnerability began attracting exploitation attempts within days of its disclosure, and the pattern is unusually consistent for an early campaign. CVE-2026-87902 is a path traversal issue in the template resolution logic of WordPress core, rated 9.2 on the CVSS scale. It requires no authentication and no user interaction. Public reporting attributes the first confirmed exploitation attempt to 22 September 2026 at 11:49 UTC, with 68 distinct attempts recorded b

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Route planning for Southeast Asia without self-hosting OSRM

Ask anyone who has run OSRM in production and they will tell you the same story: the routing engine is wonderful, and the server it runs on is a monster. The planet-wide graph wants 128 GB of RAM and a day of preprocessing. Even a Southeast Asia extract — the region many of us actually ship for — means tens of gigabytes of memory, multi-hour osrm-extract runs, and a recurring maintenance chore every time OpenStreetMap data is refreshed. There is a hidden tax beyond the hardware, too. Someone has to babysit the pipeline: re-run the preprocessing when the OSM extract updates, watch memory pressu

0 comments Read more at DEV Community

ProgrammingDEV Community ·

The Company Behind Cursor's Vector Search Just Killed the Vector-First Database

Last month I watched a teammate spend two days migrating 4 million embeddings from Postgres into a dedicated vector database because a benchmark blog post scared him. The migration added a second database, a sync job, and a new failure mode. His queries got 30 ms faster. Nobody using the product noticed. I thought about him when I read turbopuffer's September 30 post, RIP, vector database.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

2% bias, 98% noise: what I built, and cut, for a hackathon judging engine

2% bias, 98% noise: what I built, and cut, for a hackathon judging engine The sample event Hackathon Raptors gave us for Dogfood 2026 has 41 projects, 30 judges and 126 finished reviews. When my judging engine split the judges' disagreement into "this judge is just more generous" and everything else, generosity came out at about 2%. That number ended up deciding most of what I built and most of what I cut. Dogfood's brief was the same for every team: in 72 hours, build the submission and judging platform Raptors will run their own events on. I entered solo.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Running a Zero-Cost Social Auto-Poster on Cloudflare Workers

The 48-Runs-a-Day Problem Scheduling a social media auto-poster to run every thirty minutes results in forty-eight unattended executions per day. While setting up a basic scheduled event to call a platform API is straightforward, the naive approach fails operationally within days. Long-lived platform tokens eventually expire, cron redeliveries trigger duplicate posts, and unhandled provider errors burn through daily quotas while flooding your inbox with success alerts. For a related implementation, see Normalize Cloudflare Workflows Trigger Payloads. Running this workload reliably on a serverl

0 comments Read more at DEV Community