Programming

ProgrammingDEV Community ·

PHP Advisory Flags Unpatched RCE Risk in Rare Session Serialization Configurations

The PHP project has issued an advance advisory, tracked as CVE-2026-115560, describing a remote code execution risk with no patch available yet. The issue arises only in a narrow setup where the session serialize handler starts as php_binary or php_serialize, is switched to php at runtime, and session upload progress remains enabled. Organizations are urged to review their configurations and application code and to disable upload progress as a temporary mitigation. The full technical advisory is expected in a future regular release, and no real-world exploitation has been reported so far. Potential impact includes execution of arbitrary code with the privileges of the PHP process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Pleasanter CVE-2026-113438 Allows Login Without Password Under Specific LDAP Setups

A vulnerability tracked as CVE-2026-113438 has been reported in Pleasanter, affecting versions 1.1.0.0 through 1.5.9.0. Under certain LDAP configurations, crafted requests sent to the login endpoint can authenticate as a valid user without password verification. An attacker only needs a valid login ID, and the attack requires no user interaction and can be carried out over the network. Successful exploitation could let attackers view, alter, or delete business data within the compromised user's privileges. The vendor has released version 1.5.9.1 to address the issue, and organizations are advised to update or check whether their configuration is affected.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Abandoned Time4Popcorn Updater Enables Code Execution as SYSTEM or Root, CVE-2026-30612

A high-severity vulnerability, tracked as CVE-2026-30612, affects the abandoned Time4Popcorn application and its update mechanism. The background updater on Windows and macOS downloads and runs executables over plaintext HTTP without signature verification, so an attacker controlling the update domain or network traffic could run code with SYSTEM or root privileges. Android is a separate pathway that requires user interaction to install the APK. Because no vendor patch exists, researchers recommend completely uninstalling the application and checking for leftover services, launch daemons, and files. Researchers attempted to disable the updater by distributing code through the update channel, though the number of download requests does not indicate the security status of all installed devices. Some update domains have since been transferred to Shadowserver.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HPE Patches Eight Critical ArubaOS Flaws Enabling Unauthenticated Attacks

Hewlett Packard Enterprise has released updates for 72 vulnerabilities across its AOS-8 and AOS-10 wireless operating systems. Eight of these flaws are rated at the maximum CVSS score of 10.0 and can be reached over the network without authentication or user interaction. The affected products include Mobility Conductors, Controllers, Gateways, and access points. Several flaws could allow arbitrary command or code execution, while one authentication bypass in the PAPI component could grant administrator access and expose or alter sensitive data. Some of the vulnerabilities require additional conditions outside an attacker's control, and HPE has not publicly disclosed detailed exploitation specifics.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Source-labeled wiki design for fast-changing Early Access game guides

The author describes a content model for an independent guide to the Early Access game Fatal Frontier 1869, where patches can invalidate facts quickly. Every key claim is sorted into one of four categories: official, observed, reported, or unknown, with the unknown category preventing guesses from appearing as documentation. Content is split into durable strategic guidance and volatile data such as costs or thresholds, each tied to a source and verification date so updates stay small. Pages are organized around questions players ask during a run and open with a direct answer followed by context and limitations. Uncertainty is shown next to each claim rather than buried in a footer, and payout information must rely on official Terms rather than assumptions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Coordinating Multiple AI Agents: Where Multi-Agent Systems Actually Break

A developer who orchestrates several AI agents running in parallel, including researchers, implementers, and reviewers, argues that failures usually stem from the coordination layer rather than the models themselves. One incident saw a sub-agent unexpectedly overwrite a shared progress board because the update API replaced entire elements by ID, silently erasing other workstreams. Another involved reviewer agents flagging legitimate work as permission violations because each reviewer only knew its own card's allowed operations. The author's fixes include restricting sub-agents from writing shared state, using namespaced IDs, re-reading after merges, and centralizing adjudication with full visibility of parallel scopes. The core takeaway is that orchestration is a system design problem rather than a prompt problem.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rejetto HFS 3.0.0-3.2.0 Flaw Lets Attackers Forge Admin Sessions

Rejetto HFS, a widely deployed single-executable file server with a browser admin page, has a vulnerability tracked as CVE-2026-61500. Affected versions 3.0.0 through 3.2.0 derive the session cookie signing key from JavaScript's Math.random(), a non-cryptographic generator. Because its outputs are exposed during login, an attacker can reconstruct its internal state and recover the key to forge administrator sessions. Such access can escalate to code execution through the server_code feature, potentially under a local administrator account. Version 3.2.1 contains the fix, and administrators are advised to restrict admin interface exposure, reduce service privileges, and treat pre-upgrade sessions as suspect.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CS graduate joins DEV Community, plans to share Web3 and development learning

A computer science graduate has introduced themselves as a new member of the DEV Community. Their interest in tech began with web development and later extended to Web3, hackathons, and other areas of software engineering. They say they plan to explore new technologies, share their projects and challenges, and connect with other developers. The post also encourages readers to share which technology they are currently excited about.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Logging In With Owners' Passwords Alarms Banks

Developers have commonly handed their own passwords or equivalent keys to AI agents so the agents can access dashboards, cloud consoles, and banking sites. US banks are reportedly detecting unverified agentic activity on customer accounts, and Chase has warned customers against sharing credentials with third-party agents. Banks cannot easily distinguish a legitimate agent using a password from a criminal using stolen credentials, since both produce similar signals. Actions taken by an agent under a shared login are attributed to the account owner, creating accountability and fraud risks. The article recommends giving each agent its own scoped, time-limited identity with auditing and revocation, citing new products from 1Password and IDENTOS as early examples.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SlothSync Uses Gemini to Turn Task Lists into Gentle, Manageable Steps

SlothSync is an open-source Python web app that takes a cluttered list of errands and obligations and converts it into a few small next steps. It also separates out tasks that can safely wait. The backend sends the list to Google's Gemini API using a key stored in a local .env file, while the browser saves drafts and the latest plan in local storage. Because the tasks are processed through a hosted API, the app needs an internet connection and does not run an open-weight model offline, which the challenge brief asked for. The author has not yet measured how much time the tool saves.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Stateless language agents cut token use over 84% in long-horizon research tasks

Long-horizon LLM agents often consume tokens so quickly that billion-step research becomes impractical, because each call replays an ever-growing history of intermediate results. Stateless Language Agents (SLAs) address this by moving durable state into an external harness, so each worker sees only the concise evidence it needs. According to the paper, SLAs match the strongest kernel baseline's final performance while using over 84% fewer tokens, across software engineering, kernel optimization, and algorithm design tasks at budgets up to a billion tokens. The coordinating Advisor component accounts for under 0.6% of token usage. The approach depends on the harness summarizing evidence accurately, and the evaluation covers only three engineered domains, leaving its applicability to less structured research open.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Pre-flight checks for QuickBooks Online bank CSV uploads

A QuickBooks Online bank CSV should be checked before upload against both Intuit's format rules and the statement's own arithmetic. Intuit's rules cover column layout, a 350 KB and 1,000-line limit, a single date format, and leaving the unused Credit or Debit side blank rather than zero. The article's Python validator checks these rules, while also flagging headers containing the word 'amount'. Format-valid files can still be missing transactions, which typically surfaces only when reconciliation fails. A balance check confirms that the opening balance plus all signed rows equals the printed closing balance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sorta: A Local Gemma-Powered Tool That Suggests Folders for Downloaded Files

A first-year computer science student built Sorta, a Python and Streamlit app that uses Gemma 3 1B running locally through Ollama to suggest folder categories based on a file's name. Users can enter or select a filename, review the model's suggested folder, and decide what to do with the file. The project is an early prototype that only previews suggestions and does not yet move files automatically or include an undo feature. Filenames are processed by the local model rather than a hosted AI service, which the creator chose to experiment with open models. The developer plans to add user-approved file organization and a working undo function next, and has asked for feedback.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Popular PyPI Projects Claim Production Status Far More Often Than Obscure Ones

A pre-registered census of PyPI compared 3,000 top-download projects against 3,000 randomly sampled ones to see how they self-report development maturity via Trove classifiers. Among projects that declare a status, about 72% of popular projects claim Production/Stable or higher, versus roughly 23% of the long tail. The long tail instead mostly claims Beta or Alpha, and the popular projects almost never claim Planning. The author concludes the tail does not inflate its maturity claims in aggregate, though the classifier remains an unverified self-report. The study is an independent, unfunded research effort.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Offline AI Becomes Practical as On-Device Voice and Chat Tools Emerge

Several offline AI products launched within roughly two days, including a voice stack designed to run on inexpensive Android phones without internet access. VoxNexus unveiled VoxEdge in Madrid on October 23, 2026, claiming speech recognition in 36 languages, translation in 103, and speech synthesis in 45. The company says its recognition model is only 65 million parameters, a figure that has not been independently verified. The reporting argues that improved phone chips, such as MediaTek's Dimensity 9600, make such on-device systems more plausible, though frontier models and the longest contexts still depend on the cloud. The analysis concludes that local models are now usable for routine chat, coding and voice tasks, while the cloud remains necessary for the most demanding work.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six Early Decisions That Shape a Mobile App Build in the UAE

Mobile app briefs often lead with feature lists, but the article argues that a few early choices matter more for shipping on time and staying usable. It recommends using a business's own customer and analytics data to pick launch platforms, rather than relying on general market reports. The author suggests choosing between cross-platform and native development based on team skills and the next three years of maintenance. Arabic and right-to-left support, along with local formats, should be decided on day one because retrofitting them later is costly. The piece also stresses settling payment providers and cloud data region early, and defining a small first release to test real user demand.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Eight Questions to Ask Before Hiring a Legacy Modernisation Partner

A piece for technology leaders at mid-sized UAE companies argues that modernisation proposals often look similar until problems surface months later. It recommends asking vendors to name the specific staff and time they need from the client, and to explain how they will discover undocumented business rules. Buyers are advised to request an early, small production release instead of a long delay before anything ships. The article also urges scrutiny of whether a vendor's recommended approach is tailored to the system or simply a default method. Finally, it stresses confirming delivery team commitments, data residency and sector compliance, and agreed outcome-based metrics before signing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WeVisOne-VL Model Handles Detection, Segmentation and OCR in a Single Pass

Tencent's AI lab unveiled WeVisOne-VL, a vision-language model that generates bounding boxes, pixel masks and text recognition results from one unified token stream. Demonstrated on a single RTX 4090 at the WeChat OpenAI Summit in October 2026, it processed live camera input in under 120 milliseconds. The model was released on arXiv and Hugging Face on October 22, 2026. Rather than bundling separate perception modules, it treats every visual output as a token generated by one autoregressive decoder. In a warehouse scenario, the approach reportedly cut latency to 48 milliseconds and GPU memory use to 6 gigabytes compared with a three-model pipeline.

0 comments Read more at DEV Community

ProgrammingHacker News ·

OBS Studio 33.0.0 Released on GitHub

The open-source streaming and recording software OBS Studio has published version 33.0.0 as a tagged release on its GitHub repository. The announcement was shared on Hacker News, where it gained a modest level of attention. The source material provides only the release link and discussion metadata, so details of the new features and changes are not included here. Readers interested in what the update contains should consult the official release page directly.

0 comments Read more at Hacker News

ProgrammingHacker News ·

Musk Reportedly Buys $1B Stake in CNN's Parent Company

Reports indicate that Elon Musk has acquired a stake worth roughly $1 billion in the parent company of CNN. The details come from a linked news item shared on Hacker News, which has drawn only limited discussion so far. The source material provided does not include the full article text, so specifics such as the exact ownership percentage, transaction date, and stated rationale cannot be confirmed here. Further reporting would be needed to verify the terms and any official statements from the companies involved.

0 comments Read more at Hacker News

← NewerPage 45 of 2885Older →