SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Oracle Releases Java 27 With Post-Quantum Cryptography and AI Performance Upgrades

Oracle has officially launched Java 27, introducing major security and performance improvements for enterprise and cloud applications. A key highlight is JEP 527, which adds post-quantum hybrid key exchange for TLS 1.3, protecting encrypted data from future quantum computing threats. The release also includes JEP 538 for improved PEM-based cryptographic object handling and JEP 536 for automatic sensitive data masking within Java Flight Recorder diagnostics. On the performance side, JEP 537 advances the Vector API to its twelfth incubator stage, accelerating AI inference and scientific computing workloads. Oracle Cloud Infrastructure is the first platform to support JDK 27, offering users access to its advanced security and management features at no extra cost.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Critical Kestra Auth Bypass CVE-2026-49869 Leaves Hundreds of Instances Exposed Online

A critical authentication bypass vulnerability, CVE-2026-49869, was discovered in Kestra OSS, affecting versions up to 1.3.20 and receiving a maximum CVSS score of 10.0. The flaw resided in the AuthenticationFilter, where any API request path ending in '/configs' bypassed Basic Authentication, allowing unauthenticated attackers to reach protected endpoints. Because Kestra ships with script execution plugins by default, an anonymous attacker could create and trigger workflows to execute arbitrary commands on the server. ZoomEye scans conducted on September 16, 2026 identified between 119 and 231 publicly exposed Kestra instances, though the figures overlap and do not confirm which versions are running. Kestra has released patched versions 1.0.45 and 1.3.21, and the vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on September 2, 2026.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

CISA Warns of Rising Cyberattacks on Internet-Exposed Water Sector PLCs

The U.S. Cybersecurity and Infrastructure Security Agency issued an alert on July 30, 2026, warning of a significant rise in cyberattacks targeting programmable logic controllers in the water and wastewater sector. Threat actors have been altering device passwords to lock out operators and changing IP addresses to disconnect equipment, resulting in boil water notices and forced manual operations. CISA urges critical infrastructure operators of all sizes to immediately disconnect PLCs from the public internet and route any remote access through VPNs or secure gateway devices. The agency also recommends enabling password protection, allowlisting known IP addresses, and maintaining clean backups of PLC images in case of lockout. Internet scan data collected in September 2026 found over 41,000 EtherNet/IP assets and nearly 38,000 Modbus assets publicly reachable, illustrating the broad exposure surface CISA's guidance aims to address.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Skip the Test First, Pay in Hours: A Hard Lesson in AI-Assisted Debugging

A developer lost a full working day after merging an AI-generated patch without writing a proper failing test beforehand, leading to a production 500 error on empty shopping carts. The core mistake was describing the bug in prose and letting the model generate both the fix and matching tests, creating a loop of circular confirmation rather than genuine verification. Compounding the problem, the developer mounted a home directory onto a free remote evaluation server, exposing secrets and a stale environment file that caused a ghost dependency failure and key rotation. The author argues that a test — called an oracle — must be written and confirmed to fail on the developer's own machine before any model or remote server is involved. Without that frozen, author-controlled oracle, AI-assisted remote evaluation produces green results that reflect the model's own story, not real correctness.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Structured Line Items, Not Free Text, Make Wholesale Quotes Reliable

A proposed design framework argues that wholesale quotation workflows should use structured line items rather than relying solely on free-text message boxes to capture buyer requests. The design separates the customer's request from the seller's offer, each with its own identifier and revision history, so that changes to quantities do not retroactively alter the meaning of earlier quotes. Each requested line should carry a stable identifier, a product reference, a specified edition or format, and a quantity with an explicit unit to avoid ambiguity. Substitution preferences must be stored separately from product references, and any seller-proposed alternatives should be explicitly linked to the original request line rather than overwriting it. Quote lines should clearly state currency, unit price, quantity, and line amount, with discount tier rules defined by explicit scope rather than inferred from total quantities.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AWS Proton Simplifies App Deployment With Standardized Infrastructure Templates

AWS Proton is a fully managed deployment service that helps teams deploy and manage containerized and serverless applications consistently. It uses environment and service templates to eliminate repetitive manual infrastructure configuration across development, testing, and production environments. Administrators create standardized templates that developers can reuse, allowing them to focus on application code rather than infrastructure setup. The service is particularly useful when multiple teams are working on different applications that require a uniform deployment structure. AWS Proton itself carries no separate service charge, though the underlying AWS resources provisioned through it are billed normally.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Connect Claude to n8n via MCP to Let AI Build and Fix Your Workflows

Automation platform n8n offers an official MCP Server Trigger node that exposes workflows as callable tools for AI agents like Claude. Claude supports remote MCP servers natively through its Connectors feature, allowing users to describe an automation in plain language and have the agent build, test, and fix workflows automatically. The setup takes roughly 30 minutes and works with a free self-hosted n8n instance, with n8n Cloud starting at around $20 per month. N8n also provides an official skills repository for coding agents such as Claude Code and Codex, helping the AI understand n8n-specific node names and expression syntax. The integration is designed so users review all changes before anything goes live, keeping humans in control of final decisions.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why AI-Generated Patches Should Never Directly Modify Schema Contract Files

A software engineering guide warns against allowing free-tier or AI-generated code drafts to directly modify schema contract files such as OpenAPI specs, database migrations, and webhook payloads. The article outlines specific conditions that should automatically block a patch from being promoted, including cases where the same model authors both the code and its tests. It introduces a classification table distinguishing change types that are allowed, require a trusted lock, or must be refused entirely for free-lane origins. A proposed Node.js gate script is described that checks changed file paths against known contract prefixes and validates file digests against a committed lockfile. The core principle is that contract-class changes demand human-reviewed, trusted pipelines to prevent silent breakage across dependent systems.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a Senior Engineer Stopped an AI Code Suggestion Before It Leaked Customer Data

During a pairing session to fix a failing webhook retry issue, an AI coding agent proposed a solution that introduced three serious problems: an unlisted dependency, an unauthorized environment key, and a console log that would have exposed customer payload data. A senior engineer identified these risks before the code was applied, noting that the surrounding environment — production config files, customer IDs in Slack, and an open model tab — posed equal or greater danger. The pair debated three ways to get a second AI opinion but rejected each: pasting into a browser chat risked leaking a merchant ID and lockfile details with no clear data retention policy, running a local model on the same laptop mixed inference with sensitive credentials, and looping the agent against existing tests would have returned false positives since the test suite never checked for logging or lockfile changes. Instead of seeking external model validation, the engineers wrote explicit constraints — no new dependency, no new env key, no payload in logs — and kept the draft as evidence rather than merging it. The session concluded that AI tools can generate plausible code quickly, but human-defined invariants and data-handling boundaries must be established before any model is consulted.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How a 'Blast-Radius Card' Can Prevent Shared Code Changes From Breaking Releases

A contributor's timeout fix to a shared helper imported by twelve modules appeared complete because unit tests passed, but a later release candidate failed when a worker called the old function signature through a separate package. Maintainers had to manually reconstruct the call graph, delaying the release and consuming valuable review time. The proposed solution is a structured markdown file called BLAST_RADIUS.md, kept in the branch and treated as a merge gate, which documents every call site, signature change, and affected test before any code is merged. The card is populated using repeatable terminal commands — such as ripgrep and git grep — so any reviewer can independently verify the full impact of a change without relying on tribal knowledge. Three rules enforce honesty: every call site must be traceable to a rerunnable command, every exclusion must cite a clear import boundary, and every intended behavior change must be described in a single sentence.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Amazon Cognito Offers Managed Authentication and Identity Management for App Developers

Amazon Cognito is an AWS service that provides user authentication and authorization for web and mobile applications, eliminating the need to build these systems from scratch. It consists of two main components: user pools, which act as a user directory managing sign-up, sign-in, and password recovery, and identity pools, which grant temporary AWS credentials to authenticated or guest users. Upon successful login, Cognito issues three types of JSON Web Tokens — ID, access, and refresh tokens — which applications use to protect APIs and user-specific resources. The service supports multiple authentication methods, including password-based login, one-time passwords, passkeys, and multi-factor authentication. By handling these complex authentication tasks, Cognito allows developers to focus on building core application features rather than managing security infrastructure.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How a SaaS Platform Scaled an AI Multi-Tenant Server to 9,800 Concurrent Tenants on Azure

A company building an AI-first SaaS platform redesigned its multi-tenant MCP server architecture to overcome the hidden costs and failure points of running one LLM worker per tenant. The production system, deployed on Azure Container Apps, used a shared stateless worker pool with per-container memory and CPU limits to balance isolation, performance, and cost. Supporting infrastructure included per-tenant Redis Enterprise for caching and quota management, Azure Cognitive Search for vector similarity, and Azure OpenAI GPT-4 Turbo with keys stored in Key Vault. After 12 months in production, the platform achieved a 95th-percentile request latency of 420 milliseconds, a 32 percent reduction in token costs through caching, and near-zero cross-tenant quota incidents at peak loads of 9,800 concurrent tenants. The case study concludes that baking tenant isolation into the MCP envelope, runtime, and observability stack from the outset is essential for achieving these results at scale.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Small Dev Teams Can Track AI Agent Runs on Shared Free Runtimes

When multiple team members share a free AI runtime and server, it becomes easy to lose track of which prompt, input, or session produced a given code output. A proposed one-page wiki SOP outlines four named roles — Pin Owner, Transcript Owner, Contention Owner, and Promotion Gate — to document each agent run before it starts. The framework requires these roles to be filled in before any agent output leaves the shared machine, with unpinned exports barred from code review. The guide is aimed at small teams where roles may overlap but accountability must still be explicit. MonkeyCode, which offers free shared model access and server hosting, published the article as part of its product outreach.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hosted PDF APIs vs Local Libraries: How to Choose for Compliance Use Cases

Developers and engineering teams face a key architectural choice between hosted PDF APIs and local libraries when building document pipelines, particularly for compliance-sensitive workflows like fintech evidence bundles. Hosted APIs offload renderer maintenance, security patching, and OS-level dependencies to the provider, while local libraries give teams full control over deployment, fonts, and processing but add operational overhead. Fidelity — covering font substitution, AcroForm fields, annotations, and page rotation — should be evaluated against the actual document corpus before considering file size or speed. Latency comparisons require tail-latency testing under load, since both hosted network queues and saturated local worker pools can produce similarly poor p95 results. The right choice depends on data residency policies, regulatory requirements for reproducible output, team bandwidth, and whether an external processing boundary is permissible under applicable compliance controls.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Infra Failures Must Be Separated From AI Coding Agent Benchmarks

A new methodology argues that benchmark scores for AI coding agents are often skewed because infrastructure failures — such as dropped SSH connections, full disks, and rate limits — are incorrectly counted as agent errors. The proposed approach requires labeling every failed or incomplete run into one of four categories: MODEL, HARNESS, INFRA, or FLAKY_TEST, before calculating any performance score. Only MODEL-labeled outcomes should factor into an agent's skill score, while INFRA and other non-agent failures are reported separately but excluded from the denominator. The method also recommends maintaining a frozen holdout task suite with clear selection rules, including negative controls and multi-file edits, to prevent inflated results. Researchers are advised to publish split metrics — such as infra censorship rate alongside resolved rate — rather than a single pass rate, so reviewers can audit the integrity of the evaluation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How Freezing a JSON Contract First Can Save Your Weekend Coding Project

A software developer's blog post advocates for defining and locking a JSON output contract before writing any parsing or AI-assisted code during a weekend project. The approach involves committing a fixed four-field schema to version control as the very first step, before any model or helper tool is invoked. A minimal validator script is then used to confirm that outputs match the frozen contract, with non-zero exit codes flagging any drift. The method is framed as a deliberate scope-control strategy, explicitly excluding features like dashboards, OAuth, and agent loops from the weekend build surface. The author argues that freezing the contract prevents AI coding assistants from expanding scope unchecked, which can consume limited weekend hours without producing a shippable demo.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Most AI 'Agents' Are Just Fancy Functions, Engineers Warn

A practitioner working in the AI industry argues that the term 'agent' is being applied so broadly that it has lost engineering precision, leading teams to over-build simple pipelines or under-build complex ones. A true AI agent, the author contends, must set its own next steps, recover from failures, and know when a goal is complete — not merely follow human-directed instructions. In practice, most successful agent deployments observed are narrow and purpose-built, handling specific tasks like customer support triage or document extraction rather than general reasoning. Teams achieving strong results focus on clean tool design, robust failure handling, and full observability of agent decision-making. Those chasing the latest frontier model without rethinking their broader system architecture are reported to see little improvement.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Python Raises UnboundLocalError and How to Fix It Correctly

Python's UnboundLocalError confuses developers because the variable in question visibly exists elsewhere in the code, yet the error still occurs. The root cause is that Python scans an entire function body before executing it, and any variable assigned anywhere inside the function is pre-marked as local throughout that function. This means a line like 'count += 1' causes Python to treat 'count' as a local variable, making the outer module-level 'count' inaccessible within that function. The cleanest fix is usually to pass the value as a parameter and return the updated result, avoiding shared mutable state altogether. When a function must modify a module-level variable, the 'global' keyword explicitly instructs Python to reference the outer scope instead of creating a local shadow.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AWS Workshop Day 1: Hands-On Training Covers S3, CloudFront, and EC2 Basics

A two-day cloud workshop focused on AWS fundamentals kicked off with its first session covering core infrastructure concepts. Participants logged into the AWS Management Console and learned how AWS Regions and Availability Zones support global reliability and low latency. The session included practical exercises with Amazon S3, where attendees created storage buckets, uploaded files, and served content via pre-signed URLs and a CloudFront CDN distribution. Learners were also introduced to Amazon EC2, launching virtual instances, connecting via SSH, and deploying the Nginx web server. The session provided a foundational overview of cloud storage, content delivery, and compute services on AWS.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Gas Audit Flags $10–30M Annual Inefficiency in Bybit's Smart Contracts

A gas-optimization audit of Bybit's on-chain smart contracts, covering Ethereum Mainnet and L2 networks Optimism, Arbitrum, and zkSync, was completed on 16 September 2026. The audit, conducted by a senior DeFi security researcher, reviewed all contract components tied to Bybit's approximately $15.1 billion TVL. A total of 29 findings were identified across categories including unbounded loops, excessive storage operations, and inefficient calldata handling, with unbounded loops posing the highest risk of transaction failures. The protocol received a gas-risk score of 3 out of 10, indicating no critical security vulnerabilities but notable inefficiencies. Left unaddressed, these issues could result in an estimated $10–30 million in avoidable gas fees annually given current transaction volumes.

0 comments Read more at DEV Community
← NewerPage 1214 of 3226Older →