Zammad local privilege escalation flaw CVE-2026-102490 added to CISA exploited list

·1 views

Zammad packages built with packager.io, in DEB and RPM form, launched service processes as root and executed files writable by the unprivileged zammad account. A local attacker with write access to that service account could plant content that root would run on the next service restart. NVD rates the flaw 7.8 under CVSS 3.1, and CISA added it to its Known Exploited Vulnerabilities catalog on 2 October 2026. The issue did not affect containerized deployments, which do not follow the same root-launch-then-drop pattern. Administrators are advised to apply the fixed build named in the vendor advisory and audit start-up paths.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Play Billing: Confirming Purchases Are Acknowledged, Not Just Unlocked

A purchase in an Android app can appear complete on screen while Google Play never receives confirmation that it was processed. For a completed purchase, the app must verify it, grant access, and acknowledge it to Play, since unacknowledged eligible purchases can be automatically refunded and entitlements revoked. Consumables are fulfilled through consumption, and pending purchases should not unlock access until they reach the PURCHASED state. Developers are advised to test with a license tester and a Play test payment method, checking both that the buyer gets the right access and that Play shows the purchase as acknowledged. Because test refund timing is accelerated, it should not be treated as the production deadline.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Oracle's October patch update fixes 1,295 flaws, six rated maximum severity

Oracle released its October 2026 Critical Patch Update on 20 October, addressing 1,295 vulnerabilities across its product lines. Six of these carry the top CVSS v3.1 score of 10.0 and can be exploited remotely without authentication. One flaw in E-Business Suite's Workflow Notification Mailer, versions 12.2.3 to 12.2.15, lets an unauthenticated attacker take over Workflow and possibly affect other products. The guidance stresses that WebLogic's T3 and IIOP protocols, which are often poorly monitored and loosely firewalled, are a common path to exposure. Administrators are advised to patch internet-facing and T3-exposed systems first and to restrict T3 and IIOP traffic at the network layer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

LazyFlow AI Turns Scattered Notes Into Tasks Using a Local Open-Weight Model

A developer has built LazyFlow AI, a productivity assistant that converts messy notes, ideas, and reminders into organized, actionable tasks. The tool summarizes notes, extracts tasks, and assigns priorities, with results viewable in a task manager. It runs locally through Ollama using the open-weight Qwen2.5 3B model, so it does not depend on a paid, closed AI API. The project uses a React and TypeScript frontend, a Python FastAPI backend, and SQLite storage, and is shared on GitHub. The developer says local inference also offers a path toward keeping personal note content on the user's own machine.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developers Defend Using Free Game Assets as a Practical Choice

An opinion piece on DEV Community argues that using free game assets such as models, sounds, and textures carries no shame and can be a sensible decision. The author notes that free does not equal low quality, and cites Kenney's CC0-licensed assets as an example of creators sharing work to help others. The piece suggests that using ready-made assets can save developers time, letting them focus on gameplay, mechanics, and polish instead. It also stresses that a downloaded asset is only a starting point, since developers still shape how it functions and fits into the game. The author concludes that free assets are useful for testing ideas quickly, while a game's identity comes from its ideas, atmosphere, and gameplay.

0 comments Read more at DEV Community