SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World

Programming

LatestTopDiscussed
0
ProgrammingDEV Community ·

Converting nested JSON to CSV in Python with pandas

A common pandas recipe for JSON-to-CSV conversion produces an unnamed index column and cells full of raw dictionary text when the data is nested. The article explains that the problem lies in the JSON's structure rather than the recipe itself. It lists eight common error symptoms with their causes and fixes, most of which need only a single parameter change. For nested data, it recommends pd.json_normalize with record_path and meta, and it shows how to inspect a file's keys to choose the right approach. It also warns that pandas 3.0 treats a literal JSON string as a file path, so the string must be wrapped in StringIO.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Blog Logs 4,040 AI Crawler Requests in 30 Days, But Few Tied to Citations

A personal blog with eight posts recorded about 4,040 requests from AI crawlers over the 30 days to 20 October 2026, according to Cloudflare's count. Google's crawlers sent the most traffic, followed by Anthropic, OpenAI, Apple and Microsoft. Roughly half of the successful requests were for collecting data to train AI models, while only 26 came from an AI assistant fetching a page after a user's query. The author found that the blog's sitemap was read more often than any single post, and that ChatGPT cited the site in none of 12 test answers. The author notes that Cloudflare's AI Crawl Control lets other site owners see similar data.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PHP Releases Fixes for Two Critical RCE Flaws; Public Exploit Claims Only Partly Verified

PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, to address two critical vulnerabilities, CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state across requests), both scored 9.2 under CVSS v4.0. A researcher testing a publicly circulated proof-of-concept found it did not reproduce the claimed use-after-free or remote code execution in several test builds, and found the official patches address different root causes. However, a chain combining the session.upload_progress feature with an application-level file inclusion vulnerability did achieve unauthenticated code execution in the researcher's lab. The researcher concluded that upgrading is the complete fix for the core CVEs, while applications using such a chain may remain exposed after upgrading.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

UAE PDPL and GDPR: Key Differences Companies Must Address

Data protection has become a major concern for organizations as they expand across borders, prompting closer attention to differing regulations. The UAE introduced its Personal Data Protection Law (PDPL) to strengthen data protection in the region, while the EU's GDPR, in force since May 2018, governs personal data processing across the EU and EEA. The GDPR sets out principles such as accountability, consent, and data portability, with fines reaching up to 4% of global annual revenue or €20 million. The PDPL applies to any entity operating in the UAE that processes personal data, regardless of origin, so international firms there should understand it even if they mainly follow GDPR. The two laws differ in consent requirements, the range of data subject rights recognized, and breach notification timelines, which means UAE companies must prepare for these distinct obligations.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Rocket Pool Security Audit Flags Critical Reentrancy and Access-Control Risks

A security audit covering Rocket Pool, a staking protocol with roughly $1.28 billion in total value locked, examined its v1.3.0 contracts and L2 adapters between October 1 and 15, 2024. The review identified 10 findings, including one critical reentrancy issue in the minipool withdrawal path that could let an attacker drain a minipool's balance. Auditors also reported over-privileged admin functions that a compromised DAO executor could exploit. The protocol received an overall risk score of 7.4 out of 10, rated as high. The report recommends specific code-level remediations for each identified vulnerability.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Full-width email addresses slipped past signup checks; fix normalizes input with NFKC

A developer at RoamProxy found that a verification email bounced with a 422 error because the address used full-width characters, such as ｅｘａｍｐｌｅ.tech, instead of standard ASCII. The signup form and database accepted the address, so the mismatch only surfaced when the mail provider rejected it. The team now applies Unicode NFKC normalization at the input boundary to fold compatibility characters into plain ASCII, and rejects addresses that remain non-ASCII. The change covers both email signup and Google sign-in, since both pass through the same function. Non-ASCII addresses such as user@bücher.de are now rejected, because the mail provider cannot deliver to them anyway.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a client's first vulnerability scan sets the baseline for future reports

The first vulnerability scan for a new client differs from later ones because there is no prior report for comparison, the asset inventory may be incomplete, and results often look worse than expected. A one-page scope note helps prevent surprises by defining what is included and excluded, the scan window, which credentials will be used, and written approval from an authorized party. Authorization matters because unapproved scanning can breach hosting contracts or violate the law. Scanner authentication results should be checked before trusting any numbers, since failed logins can make a credentialed scan look misleadingly clean. The initial report should show coverage, group findings into a small set of actions, prioritize a first wave of fixes, and record baseline totals that future reports will be measured against.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Internal and External Vulnerability Scans Answer Different Security Questions

Security teams often confuse external and internal vulnerability scans, though each reveals distinct risks. External scans test a client's public-facing systems, such as firewalls, VPN gateways, email servers, and websites, to show what any internet user could reach. Internal scans run from inside the network and assess workstations, servers, and devices to determine how far an intruder could move after gaining access. External scans typically produce fewer but more severe findings, while internal scans yield many more results that should be prioritized by risk. Experts recommend keeping both results in separate report sections with clear scope statements, and running external scans at least monthly and internal credentialed scans monthly.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Documenting Unfixed Vulnerabilities Through Formal Risk Acceptance

Security professionals often face clients who decline to fix known vulnerabilities, for reasons such as legacy software, vendor patch limits, or costly downtime. The article argues that such decisions should be recorded through a formal risk acceptance document rather than left as unresolved findings that lose context over time. It recommends listing the affected systems, the reason a fix isn't feasible, the realistic consequences, and compensating controls, along with a named client decision owner and clear expiry and review dates. Acceptance usually involves cheaper protective measures like network segmentation, firewall restrictions, or added monitoring rather than doing nothing. Accepted risks should be tracked separately and reviewed periodically, with earlier reconsideration if threat indicators such as known exploitation or new exposure emerge.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Verifying Vulnerability Scan False Positives Without Overlooking Real Risk

Vulnerability scanners often flag issues that turn out to be inaccurate, such as an Apache alert on a server running nginx or a patch reported missing right after an update. Common causes include guessing software versions from banners, ignoring backported fixes on Red Hat, Debian and Ubuntu, leftover files from old installs, pending reboots, shared IP addresses, and overly generic checks. The article argues that some supposed false positives are actually true findings that simply differ from expectations, and should be handled with their own remediation steps. It recommends a consistent verification process: reviewing scanner evidence, confirming directly on the host, consulting vendor advisories, and classifying each result as confirmed, false positive with proof, or true but different. Each dismissed finding should be documented with its reason, evidence, and review date so it can be audited and rechecked later.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Testing Live Watchlist Events Reliably by Modeling Presence, Not Timing

The article argues that flaky tests for a live trading watchlist stem from treating event time, batching, and delivery as timing problems rather than state. It recommends making event time an explicit dependency, flushing batches using a defined watermark, and asserting symbol presence as a state transition instead of relying on fixed sleeps. The author notes that batching delays are intentional and that transport ordering from protocols like WebRTC does not define what counts as current in the application. A deterministic reducer that tracks each symbol's latest sequence and status can be tested with an in-memory clock, while the network layer is tested separately. The approach keeps the production batching rules intact while removing sources of noise from CI runs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hearing words is not the same as understanding a request

Listening involves more than receiving words; it also requires checking understanding and making corrections usable in action. In a fictional kitchen example, a clarifying question prevents someone from handing over the wrong bowl. Research by Apperly and colleagues on adults interpreting instructions from another person's perspective is cited, though the article notes these experiments do not show how such abilities develop in childhood. The author suggests focusing clarification on differences that affect the outcome, and stating a brief summary of what was understood so mistakes can be corrected. The piece also argues that corrections should update the planned action rather than merely being recorded in memory.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Installing Python packages can run malicious code; teams urged to pin hashes and delay new releases

A recent compromised LiteLLM release on PyPI reportedly stole credentials and planted a backdoor, highlighting that installing packages can execute code. The article explains that malicious code can run before import through setup.py in source distributions, through .pth files in site-packages that execute at interpreter startup, or via transitive dependencies. Attackers typically target environment variables, cloud and SSH credentials, and CI secrets before exfiltrating them. The suggested defenses include pinning exact artifact hashes, avoiding source distributions, applying a seven-day cooldown on new releases, and running pip-audit in CI.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PHP2Shell flaws and stolen UpdraftCentral keys threaten PHP and WordPress sites

Emergency PHP patches on October 21 address two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which score 9.2 and can let unauthenticated attackers run code on web servers. Nearly all PHP versions back to 5.4 are reportedly affected, with Apache mod_php carrying the highest risk, and the bugs can also leak memory containing other users' credentials. Separately, attackers breached the developer of the UpdraftPlus WordPress backup plugin and are using stolen UpdraftCentral keys to install backdoor plugins that create hidden admin accounts. Administrators are advised to check PHP versions against fixed releases, restart services after patching, and review sites for unexpected plugins and users. Updating UpdraftPlus and removing the connection key are recommended as immediate cleanup steps.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Probabilistic graph neural networks aim to monitor aquaculture ponds under real-time policy limits

A developer built a sensor network across several fishponds in a cooperative near their city to track water quality. They found that per-sensor forecasting models missed cross-pond effects, since shared water channels let problems such as ammonia spikes spread between ponds. Treating the sensor layout as a graph, with ponds as nodes and hydrological connections as weighted edges, allowed the model to capture those dependencies. The work extends this to probabilistic inference and to enforcing regulatory constraints such as discharge limits and antibiotic restrictions in near-real time. The article describes the resulting architecture and lessons from testing it.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why a 'nothing changed' report can silently hide real problems in incremental tools

A developer describes a rotation probe that checks which project memory files changed since the last run, and notes that the tool repeatedly reported 'nothing changed' while being wrong. The probe's bookmark used a naming scheme that didn't match the register, so ten of the projects were invisible to it while the output still looked like a normal run. A timestamp format mismatch caused the same silent failure, because zero newer files is indistinguishable from a healthy result. The author fixed the parsing so unreadable stamps raise an explicit error with exit code 2 instead of a clean empty list. The same comparison can also fail when a stamp lies ahead of the clock, leaving projects permanently reported as unchanged.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Overnight Azure Kernel Upgrade Stopped MongoDB From Starting on a VM

A team found their application down one morning with no deployments or configuration changes to blame. Investigation showed MongoDB refusing to start, with logs pointing to a known incompatibility between MongoDB 8.0.29 and Linux kernel 6.19 and newer. Azure had automatically upgraded the VM's kernel overnight during a maintenance window, moving it to a version that MongoDB explicitly blocks. Early attempts to fix the problem through file permissions and lock-file removal were unsuccessful. The root cause was identified as the kernel change, not data corruption or misconfiguration.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Qwen3 4B Outperforms 0.6B on Document QA Accuracy, but the Smaller Model Runs Faster on 6 GB GPU

A developer testing local retrieval-augmented generation on a laptop with a 6 GiB RTX 3060 compared two Qwen3 models run through Ollama. The 0.6B model generated text roughly three times faster than the 4B model, while using about a third of the peak GPU memory. On six synthetic document questions, the 4B model answered all correctly, whereas the 0.6B model passed four. The smaller model's failures included combining conditions incorrectly and returning malformed output for a case with missing information. The author notes that generation speed figures include reasoning tokens and do not reflect how quickly complete answers appear.

0 comments Read more at DEV Community
← NewerPage 161 of 2963Older →