SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

One Tenant's Bad Mailing List Can Drag Down Shared SES Sender Reputation

A multi-tenant SaaS running on Amazon SES shares one account and one sender reputation across all tenants, so a single tenant's poor list hygiene can affect everyone. Imported or purchased lists can cause hard bounces and spam complaints that push the account's bounce or complaint rates past SES thresholds, leading to account review or paused sending for every tenant. The author argues this is an architecture problem rather than one solved by monitoring alone. Recommended isolation measures include per-tenant sending subdomains, per-tenant configuration sets for attributed event tracking, and dedicated IP pools reserved for tenants with steady volume. Per-tenant event ledgers and suppression lists are also suggested so each tenant's reputation can be measured and enforced separately.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Open-source Flutter package transcribes speech fully on-device with no server or API key

A developer released transcribe_cpp, an MIT-licensed Flutter package for speech-to-text that runs entirely on iOS and Android phones. It requires no server, account, or API key, and it works in airplane mode, so user audio never leaves the device. The package uses voice detection to mark sentence boundaries and shows live text that settles without flickering as the user speaks. It wraps the transcribe.cpp engine, built on ggml, and runs NVIDIA's Parakeet 110M model, a roughly 90 MB download fetched on first use. The developer reports about 40 times real-time speed on a mid-range phone and says the hard work lay in the surrounding plumbing rather than the models themselves.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Shopify Next Gen Events: How to Migrate Off Webhooks Without Missing Deliveries

Shopify's Next Gen Events, generally available since 1 October 2026 under API version 2026-10, lets apps subscribe to specific field changes and receive the needed data within each delivery. The new model is more efficient but carries a risk: subscriptions that are misdeclared fail silently rather than raising errors, so deliveries can stop without warning. Classic webhooks remain operational with no sunset date, allowing developers to migrate one workflow at a time and verify each step. The guide advises testing every state change in both directions, deduplicating on Shopify-Webhook-Id, responding within five seconds, and running a reconciliation job. It also notes that Events currently covers 18 topics, with uncovered resources staying on classic webhooks.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Two Critical PHP Core Flaws Allow Unauthenticated Remote Code Execution, Patches Released

Two PHP core runtime vulnerables, CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, each scored 9.2 out of 10 under CVSS v4.0. They can let an unauthenticated attacker run arbitrary code on a server through a crafted HTTP request. The flaws affect PHP versions 5.4 through 8.5.11, and fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier are end-of-life and will not receive patches, so administrators are advised to update the runtime, rebuild containers, and isolate unpatched public-facing systems.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

APX Requires AGENTS.md and project.json Before Registering an Agent Project

A folder does not become a durable agent project just because it holds code or notes; the runtime needs guidance on how to work and a stable identity for local state. The APC and APX tools use two files for this: AGENTS.md for shared instructions and .apc/project.json for metadata, including a stable apx_id. The APX command apx project add refuses to register a project if either file is missing, so it never guesses at context or identity. Commit the shared contract with the repository, while private runtime data such as sessions, caches, and configuration stays in ~/.apx/projects/. The author argues that giving a project both instructions and identity is what makes it safe for an agent runtime to manage ongoing work.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Fixing an Empty EKS Ingress Address by Deploying a Healthy ALB

A hands-on lab walks through turning a Kubernetes Ingress with an empty ADDRESS into a working internet-facing AWS Application Load Balancer on EKS. The Ingress stays unreconciled until the AWS Load Balancer Controller is installed with IAM permissions granted through EKS Pod Identity. Terraform provisions the VPC, tagged public subnets, EKS cluster, worker nodes, and controller IAM role, while a reproduction script deploys the app and Ingress beforehand. The author reports success with HTTP 200 responses, 2 of 2 healthy ALB targets, one successful reconciliation with no errors, and cluster metrics appearing in Splunk Observability Cloud. The full reproduce-and-fix run took about 28 minutes at an estimated cost under 1 USD.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer builds SlothMode, a laptop app that rewards doing nothing and penalizes no one

A developer has created SlothMode, a free-standing laptop app designed to encourage people to rest without phones. The app's central idea is that users cannot fail: it uses the laptop webcam to check once per second whether the user is holding their phone, and only pausing the timer if they pick it up. Rather than enforcing breathing exercises or streaks, it lets users fidget, stare at walls, or rest however they like. A cartoon sloth named Momo accompanies users, and the app shows green moss growing on him over time and a flower appearing after 20 minutes of daily rest. The project was submitted as part of a Hacktoberfest open-source AI challenge themed around slowing down.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

AI-built portfolios still need developers to explain their own design decisions

A polished portfolio site and a README do not show whether a developer understands the project they built. Naming frameworks or listing tools fails to answer why specific choices were made. The author suggests explaining one decision through four prompts: what behaviour needed to change, which options existed, why one was chosen, and what a reader can inspect to verify it. A fictional example shows how a filter-state bug led to storing shareable state in URL parameters, with a reproducible check to confirm it. The piece advises documenting a rejected alternative and its project-specific reason, and avoiding invented metrics or ownership claims.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Open Finder Folders in VS Code with a Keystroke Using an Automator Quick Action

The article explains how to create a macOS Automator Quick Action that opens selected Finder folders in VS Code. The setup involves choosing Quick Action, setting the workflow to receive folders in Finder, and adding a Run Shell Script step that uses open -a with the app name. The author recommends this over the code command because it avoids PATH configuration issues and works on other machines with VS Code installed. Users can then right-click a folder to launch it or assign a keyboard shortcut in System Settings for one-keystroke access.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PHP2Shell Flaws Allow Remote Code Execution in PHP Runtime, Patches Released

The PHP Security Team issued emergency fixes on October 21, 2026, for two critical vulnerabilities collectively named PHP2Shell, both rated 9.2 out of 10 under CVSS v4.0. The flaws, CVE-2026-109618 and CVE-2026-109619, enable remote code execution through memory corruption and stale global state, requiring no user account or victim interaction. Because the issues lie in the PHP runtime itself rather than in individual plugins or frameworks, all PHP installations serving web requests are considered at risk, with Apache mod_php identified as the highest-risk configuration. Patched minimum releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, while PHP 8.1 and older are end-of-life and need upgrading or vendor backports. Administrators are advised to treat the runtime update as urgent, since application-level updates do not patch the underlying engine.

0 comments Read more at DEV Community
0
ProgrammingHacker News ·

Amazon Threat Intelligence Flags PHP2Shell Exploitation Before Public Disclosure

Amazon's threat intelligence team reported identifying exploitation of a vulnerability dubbed PHP2Shell on October 17, ahead of its public disclosure. The findings were detailed in an AWS Security blog post referencing the MadPot honeypot system. The source material provided is limited to the link and discussion metadata, so the specific technical details of the flaw and attacks are not available here. The report highlights how early detection of exploitation activity can precede broader awareness of a vulnerability.

0 comments Read more at Hacker News
0
ProgrammingHacker News ·

Several Linux kernel vulnerabilities accidentally posted to public mailing list

Details of several Linux kernel security flaws were inadvertently published to the public Linux Kernel Mailing List, according to a Phoronix report. The disclosure appears to have occurred before the vulnerabilities were intended to become public, raising concerns about exposure. The article linked from the Hacker News post covers the incident and the broader trend it reflects. The available source material is limited to the link and metadata, so further specifics about affected versions or patches are not confirmed here.

0 comments Read more at Hacker News
0
ProgrammingDEV Community ·

Hidden text in PDFs could steer AI tools reading bank statements and invoices

A PDF can contain a hidden text layer that people never see but software reads, which becomes a risk when language models process documents. Redact reported in October that WhatsApp help pages carried hidden instructions aimed at an AI, found on 80 of 545 pages, which WhatsApp attributed to a bug and said targeted Meta's own chatbot. Financial documents are a concern because users increasingly ask models to read statements and invoices, and a researcher at Snyk showed in 2025 that white text in a statement PDF could shift a model's credit rating from poor to excellent. The author, who builds a template-based bank statement extractor with no model in its extraction path, tested whether hidden content could affect their own system by planting it in copies of a test statement. The writeup notes no public production case has been found so far.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Offline-First App Uses On-Device AI to Detect Crop Diseases in Central America

Smallholder farmers in Costa Rica and Central America often work in areas with little or no cellular coverage, making cloud-based disease diagnosis impractical. To address this, developers built HealthyCropping, an open-source, non-commercial Android app that runs its core functions, including photo capture, inference, and severity assessment, without an internet connection. The app uses specialist MobileNetV3 models for coffee leaves, cacao pods, and banana leaves, quantized to under 10 MB each and executed through native TFLite runtimes in under 50 milliseconds. To prevent accuracy loss from differences between Python training and mobile preprocessing, the team built a shared fixture test suite that checks for numerical parity between the two environments. Results are stored locally and synchronized to a cloud backend once connectivity returns.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Is it a button or a div? A quick check for keyboard-accessible clickable elements

Landing pages often contain elements that look like buttons, such as menu toggles and tabs, but are built as generic tags with click handlers. Such elements are not reachable by keyboard or announced correctly by screen readers, unlike native button elements. The W3C's WCAG 4.1.2 guidance requires that custom controls expose the correct name and role to assistive technology. The author also notes that a button inside a form submits by default unless type="button" is set. A simple test is to tab through the page, check each unreachable element's tag, and verify that Enter and Space activate it.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PHP Patches Two Critical Vulnerabilities as Java, Node.js, and Railway Also Face Security Issues

On October 21, PHP released fixes for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which carry a CVSS v4.0 score of 9.2. The same day, Oracle issued an out-of-band alert for a Java vulnerability, Node.js closed ten flaws, and Railway disclosed that customer secrets had been accessed. A day earlier, a version of the OVHcloud command-line tool was found to have shipped with malware, and affected users are advised to rotate their secrets. According to the PHP Foundation, the underlying problem was first noticed in 2024 but stalled over disagreements about competing fixes before two research teams independently found a working attack path this summer. Security teams are urged to update PHP to the patched releases and restart their services, while no confirmed successful compromises have been reported so far.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Map Beats Object Literals for Lookup Tables in JavaScript

A developer previously recommended object literals over switch statements for input-to-output mapping, but a reader pointed out a flaw in that approach. Plain objects inherit properties from Object.prototype, so lookups for names like constructor or toString return unexpected values instead of fallbacks. This can silently break logic in lookup tables, command dispatchers, and state machines, especially when keys come from user input. The article argues that a Map avoids this inherited-key problem and is the safer choice for lookup tables today.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Icebreaker games for new online groups: getting strangers talking in fifteen minutes

Online groups often start in silence, with participants reluctant to speak first on a call. The article recommends low-pressure browser games that ask for nothing personal and give everyone a task. Options include Trivia Tavern for two to eight players, Draw and Guess for up to twelve, Who's the Spy for three to eight, and Snakes and Ladders for up to eight. The author, Ahmed Moaz, who builds the free Boardit site, advises keeping the session to about fifteen minutes and ending early if it goes flat. Hosts are encouraged to join as players, name each person who scores, and ask a light question afterwards.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer guide shows how to build Apple-style liquid glass effects with CSS and SVG

A DEV Community tutorial explains how to recreate the liquid glass look popularized by Apple's 2025 design across iOS, iPadOS and macOS, using only CSS and SVG. The guide breaks the effect into five layers: a tint, backdrop blur and saturation, a specular rim, a diagonal sheen, and refraction. It notes that classic glassmorphism uses only the first three layers, while true liquid glass adds the sheen and refraction. Code examples include a dark-mode card and a light-mode variant, with advice on adjusting blur and rim highlights for light backgrounds.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Quy trình 20 phút xác định search intent trước khi viết nội dung

Bài viết chỉ ra rằng nhiều brief nội dung chỉ ghi từ khóa và độ dài mà bỏ qua câu hỏi người tìm kiếm muốn làm gì tiếp theo. Tác giả đề xuất quy trình ba bước có thể ghi trực tiếp vào Google Sheet, bắt đầu từ giả thuyết intent dựa trên từ khóa. Bước tiếp theo là khảo sát kết quả SERP ẩn danh để xem loại nội dung, định dạng và góc tiếp cận đang được ưu tiên, đồng thời kiểm tra các tính năng như Local Pack, Shopping hay AI Overview. Cuối cùng, người viết xác định loại trang trên website phù hợp nhất với intent đó cùng lời kêu gọi hành động tương ứng.

0 comments Read more at DEV Community
← NewerPage 139 of 2948Older →