Zeek 9.0 Released as LTS Version with Cluster Streaming and Spicy 2.0

·9 views

The Zeek project released version 9.0 on September 17, 2026, designating it a long-term support (LTS) release aimed at enterprise-grade stability. The update introduces cluster-wide event streaming over a fault-tolerant bus, simplifying large multi-sensor deployments for security operations centers. A fully rewritten Spicy 2.0 parser generator delivers up to 40% faster compilation and adds support for modern protocols including QUIC-v2 and HTTP/3. The release also includes over 30 CVE-level security fixes and built-in cluster orchestration tools, with roughly 1,300 commits and 400 pull requests merged in total. The Zeek team has already outlined a 9.1 release for early 2027, which will focus on AI-assisted anomaly detection integrated directly into the event pipeline.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Graph Neural Networks Proposed for Real-Time Deep-Sea Habitat Safety Decisions

A developer and researcher explored applying probabilistic graph neural inference to deep-sea habitat engineering, treating interconnected habitat modules as nodes in a graph where structural failures can cascade across the network. The core challenge involves computing the probability of structural health states across all modules in under one second, using low-power edge hardware during time-critical rescue windows that may last only 90 minutes. Standard belief propagation methods proved unreliable on cyclic habitat topologies, prompting a shift toward learned message-passing neural networks that can amortize inference across similar scenarios. The prototype system also investigated variational inference and hybrid quantum-classical sampling to handle uncertainty under severe communication bandwidth constraints typical of deep-sea operations. The work is presented as a learning artifact rather than a production system, but offers insights into uncertainty propagation and real-time probabilistic reasoning in extreme environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Incus Lab Offers Hands-On Linux Container Environment for Network Learning

Incus Lab is an open-source project designed to help IT students learn networking concepts through direct experimentation rather than theory alone. Built on the Incus platform, it uses Linux containers such as lab-scanner and lab-target to simulate real network environments. Students can run commands like ping, nmap, and dig, and observe live results to understand how connectivity, port behaviour, and DNS lookups actually work. A command log feature displays the underlying Linux commands behind each action, bridging the gap between a graphical interface and real-world system administration. The project is still growing, with topics such as routing, packet inspection, and troubleshooting planned for future additions, and is currently available on GitHub.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How stateful replay ledgers make x402 payment gates secure against reuse attacks

Developer paygate402 is a Go middleware library built around the x402 HTTP payment protocol, which requires a server to respond with a 402 status and payment terms before a client resends the request with an X-PAYMENT header. The library deliberately delegates signature verification and fund settlement to an external facilitator component, keeping the middleware itself focused only on scheme and network matching. The critical security insight behind the design is that an X-PAYMENT header is a self-contained bearer token whose signature remains valid on any subsequent replay, meaning any proxy, log, or retry loop that captures it could reuse it indefinitely. The only defense against replay attacks is a server-side ledger that records every payment already settled, making this the sole stateful component in an otherwise stateless protocol flow. To protect the payment offer itself, the library uses a signed, nonce-bearing quote with a fixed TTL, whose signature covers fields in a canonical length-prefixed format to prevent boundary-manipulation forgery.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Flutter devs get dual-strategy YouTube playback with automatic WebView fallback

Playing YouTube videos in Flutter apps typically relies on either direct stream extraction or a WebView, each with distinct trade-offs. Stream extraction enables native playback and quality control but breaks silently when YouTube changes its internals, leaving users with a black screen. A WebView is more stable since YouTube maintains it, but developers lose control over the UI and quality settings. The recommended approach is to attempt extraction first and fall back to the WebView only when extraction fails, before anything is shown to the user. A new open-source package called omni_video_player implements this hybrid strategy, also supporting Vimeo, HLS, and local assets, though YouTube quality switching is limited to Android and WebM seeking is unsupported on iOS.

0 comments Read more at DEV Community