Z.ai Launches GLM-5.3 with 32K Token Context and AI-Powered Security Scanner

·3 views

Chinese startup Z.ai has released GLM-5.3, the latest version of its open-source coding model, initially available through its GLM Coding Plan and ZCode cloud IDE. The model supports up to 32,000 tokens per request, enabling developers to work across entire codebases in a single prompt with improved long-horizon reasoning. Z.ai trained the model on security advisories and code-review data, adding a vulnerability-aware layer that cross-references generated code against known exploit patterns. Shortly after launch, GLM-5.3's security scanner flagged a potentially serious vulnerability in Cursor, an AI-assisted IDE backed by SpaceX, involving possible unauthorized code execution via malicious extensions. Z.ai publicly disclosed the finding on X while awaiting confirmation from Cursor's team, raising broader questions about AI developers' responsibility in disclosing security flaws in third-party tools.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

New Windows RATs E4del and PINHOLE Hide Commands Inside FTP Server Banners

Security researchers at SOCRadar Threat Research Unit have identified two new Windows remote access trojans, E4del and PINHOLE, that use an unusual technique of embedding PowerShell commands inside FTP server pre-login banners to initiate infection. Victims are compromised when they open an LNK shortcut file inside a ZIP archive, which silently connects to an attacker-controlled FTP server and retrieves the hidden commands. E4del disguises itself as a Discord application using a signed Electron wrapper, offering capabilities including remote shell access, screen capture, and live streaming via WebSockets. PINHOLE employs a multi-stage loader that resolves encrypted command-and-control server details stored on legitimate platforms like Pinterest and SurveyMonkey, then proxies traffic through Cloudflare Workers before injecting the final payload into a suspended ApplicationFrameHost.exe process. Security teams are advised to block ZIP and LNK files at gateways, restrict outbound FTP traffic, and monitor for abnormal connections to Pinterest, SurveyMonkey, and Cloudflare Workers domains.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Head Mare APT Exploits TrueConf Server Flaws to Spread PhantomCore Malware

The Head Mare APT group has been actively exploiting two critical vulnerabilities, CVE-2026-72529 and CVE-2026-72530, in unpatched TrueConf Server installations to deliver the PhantomCore malware. Attackers chain the two flaws via port 4307/TCP to execute code, escape sandboxed environments, and plant a web shell granting privileged database access. They then replace the official TrueConf Windows client installer with a trojanized version, causing conference participants to unknowingly install PhantomCore alongside the legitimate client during routine updates. Kaspersky ICS CERT published its findings on August 12, 2026, and both CVEs have since been added to the CISA Known Exploited Vulnerabilities catalog. Administrators are urged to upgrade to TrueConf Server versions 5.3.9, 5.4.9, or 5.5.5 and restrict access to port 4307/TCP to trusted networks immediately.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Design a Scalable URL Shortener System Like Bit.ly

A high-level system design for a URL shortener outlines how to convert long URLs into short codes and redirect users back to the originals. The architecture relies on Base62 encoding of unique IDs — generated via auto-increment, UUID, or Snowflake — to produce 7-character codes supporting up to 3.5 trillion unique URLs. The system is built to handle roughly 11,500 reads per second at a 100:1 read-to-write ratio, with Redis caching targeting a 95% cache hit rate to minimize database load. A PostgreSQL database stores URL records and click analytics, with read replicas and automated failover ensuring high availability. Optional features include custom aliases, URL expiration, and analytics tracking clicks, referrers, and geographic data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Warns Three Russia-Linked Groups Exploit Legitimate Auth Flows to Spy

Google Threat Intelligence Group published a report on August 20, 2026, detailing three Russia-linked threat clusters — UNC6293, UNC7005, and UNC5976 — abusing legitimate authentication mechanisms to compromise targeted individuals. Rather than relying solely on fake login pages, the attackers manipulate victims into completing real actions such as creating app passwords, approving OAuth logins, or linking WhatsApp devices, then capturing the resulting credentials or tokens. In some cases, targets are lured to sites mimicking secure call or file-sharing tools, where malware like VIDAR, ATOMIC, and HEADRUSH is also deployed to steal credentials, cookies, and audio-video data. The campaigns frequently involve impersonation of diplomats or trusted contacts to make the requests appear legitimate, with post-compromise access routed through residential proxies to evade detection. Google recommends blocking app passwords, enabling advanced phishing-resistant MFA, auditing linked devices, and verifying unexpected authentication requests through independent channels.

0 comments Read more at DEV Community