ZoomEye Finds Over 5 Million Internet-Reachable Elasticsearch Services on Port 9200

·7 views

A ZoomEye search for port 9200, the default HTTP interface of Elasticsearch, returned 5,079,738 matches as of 2026-09-24. The analysis notes that Elasticsearch often underpins log pipelines and internal search, where sensitive data such as credentials and personal information can be indexed. Older Elasticsearch defaults left security features unconfigured, and such deployments persist in environments built earlier or copied from outdated documentation. The article cautions that the count reflects scale rather than confirmed vulnerability, since other services also use high ports. It recommends restricting network access, enabling authentication and transport layer security, and ensuring inter-node transport ports are never exposed to the internet.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Wrong CSV Headers Cause Stock Photo Uploads to Be Rejected Before Review

A contributor to stock asset marketplaces found that batches of files were bounced within a minute because of errors in their CSV metadata headers, before any content review occurred. Platforms including Adobe Stock, Vecteezy, and Dreamstime run an automated check that verifies column count and order, and each requires a different number of columns: five for Adobe Stock, four for Vecteezy, and fifteen for Dreamstime. Common errors such as trailing commas, incorrect keyword separators, and mismatched filename extensions can cause the entire batch to fail. The contributor responded by writing a Python script that generates the correct header for each platform and a separate tracker to prevent duplicate submissions, which can trigger account flags.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Communications Deserve Their Own Service in Larger Applications

Most applications send notifications such as order confirmations, password resets, and shipping updates, usually starting with a simple email client call. For small systems this approach is often sufficient, but larger applications with separate business contexts need more deliberate design. Microsoft's .NET eShop reference application, split into Ordering, Identity, and Payment services that communicate through contracts, is used as the example. A new series adds a dedicated communications service to eShop, starting with an analysis of where that service's boundary should lie. The article argues that a message often needs data spanning several bounded contexts, so no single existing service naturally owns it.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A public web page reveals 20 test case categories before any automation begins

The article argues that a public page already exposes many testable traits, such as HTTPS support, links, form labels, headers, and load time, before any test code is written. It presents a list of 20 test categories, including functional, accessibility, security, performance, and privacy checks, each illustrated with a sample case ID. The author recommends reading the public response first and following visible same-host links a couple of levels deep. Only the test kinds a team will actually run should be kept, and each case should be paired with a named tool such as Playwright, axe-core, or Lighthouse. The piece cautions that missing security headers are signals for the owner to examine rather than proof of a breach, and that reading a public page is not a penetration test or a substitute for plans covering logged-in or high-traffic systems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BatchZero Uses FalkorDB Graph Traversal to Resolve a Tied Outbreak Source

An investigation into an outbreak of eleven illnesses found two ingredients shared by every case and two suppliers tied on exposure counts, so case data alone could not identify the source. The developers built BatchZero, a graph-based investigator using FalkorDB, to link cases, exposures, menu items, ingredients, lots, suppliers, and shipments. Genomic isolate matching provided independent evidence that favored one lot, MG-4417, while refuting the competing lettuce lot. The system also flagged an exposure record dated after symptom onset and excluded it as outside the incubation window. The project, which uses fictional outbreak data for demonstration, separates four agent roles through MCP servers to enforce workflow limits.

0 comments Read more at DEV Community