# .conf Published articles for .conf. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## CVE-2026-57154 - OPNsense: Configuration line injection via multiple GUI text fields DevFeed: [CVE-2026-57154 - OPNsense: Configuration line injection via multiple GUI text fields]() Original publisher: [Read original article]() Author: CVEFEED.io; github.com Published: 2026-11-03T19:18:06Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [Opnsense](), [configuration](), [Network Configuration]() Tags: [2026](), [api](), [conf](), [configuration](), [cve](), [cve-2026-57154](), [denial-of-service](), [dhcp](), [execution](), [firewall](), [gui](), [ipsec](), [monit](), [multiple](), [ntp](), [openvpn](), [opnsense](), [rbac](), [sudo](), [unbound]() ### AI overview Before OPNsense 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings could insert CR or LF characters into single-line fields, adding attacker-controlled directives to privileged service configuration files. The confirmed Dnsmasq fields are rendered into /usr/local/etc/dnsmasq.conf; affected settings also span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General. Applying or restarting a service could exceed delegated permissions, create service-side files, or cause denial of service. Monit injection demonstrated root command execution, while arbitrary shell execution was not confirmed for Dnsmasq. Fixed in versions 26.1.11 and 26.4.1p1. ### Source excerpt CVE ID :CVE-2026-57154 Published : Nov. 3, 2026, 7:18 p.m. | 1 hour, 3 minutes ago Description :OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1. Severity: 8.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## CVE-2026-116247 - pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate DevFeed: [CVE-2026-116247 - pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate]() Original publisher: [Read original article]() Author: cvefeed.io Published: 2026-10-30T20:17:04Z Content type: news Language: en Sources: [Latest High/Critical Vulnerabilitiy Feed]() Topics: [certificates](), [file]() Tags: [2026](), [account](), [can](), [certificate](), [client](), [conf](), [connect](), [copy](), [crt](), [cve](), [cve-2026-116247](), [cvss](), [database](), [file](), [password](), [pgadmin](), [pgadmin-4](), [published](), [service](), [uses]() ### AI overview In pgAdmin 4 server mode before 9.19, omitted or unavailable password-file and client-certificate settings let libpq fall back to the operating-system account's own credential files or environment variables. This could let any user connect using credentials saved for the pgAdmin service account; a public certificate copy could be paired with that account's private key. A pg_service.conf entry or pg_dumpall maintenance database connection string could also reintroduce those files for utilities. The fix supplies each parameter explicitly in server mode, using the user's file or an inaccessible path, in the connection, utility environment, and --dbname string, which takes precedence over a service entry. Desktop mode is unchanged. ### Source excerpt CVE ID :CVE-2026-116247 Published : Oct. 30, 2026, 8:17 p.m. | 1 hour, 37 minutes ago Description :When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: ~/.pgpass, ~/.postgresql/postgresql.crt and postgresql.key, or PGPASSFILE, PGSSLCERT and PGSSLKEY. In server mode any user could therefore connect to a server with the service account's saved passwords or client certificate, and supplying only a copy of its public certificate was enough for libpq to pair it with the service account's private key. A pg_service.conf entry, or a maintenance database name read as a connection string by pg_dumpall, could bring the same files back for the utilities. The fix gives each of these parameters a value in server mode, the user's own file or otherwise a path that can never be opened, in the connection string, in the environment of the utilities and in the --dbname connection string that ranks above a service entry. Desktop mode is unchanged. This issue affects pgAdmin 4: before 9.19. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more... ## Source Notes: Updates from the research preview DevFeed: [Source Notes: Updates from the research preview]() Original publisher: [Read original article]() Author: Ben Haefele Published: 2026-10-28T00:00:00Z Content type: release Language: en Sources: [Webflow Blog]() Topics: [webflow](), [engineering-culture](), [Deployment-Driven Development](), [google-adk]() Tags: [agents](), [astro](), [beta](), [blocks](), [branch](), [build](), [builder](), [building-in-public](), [cli](), [cloud](), [cloud-environments](), [cms](), [code](), [coding-tools](), [collaboration](), [conf](), [inside-webflow](), [preview](), [research](), [source](), [updates]() ### AI overview Source's limited research preview has added cloud collaboration on shared GitHub-connected codebases, publishing changes to GitHub and deploying to Webflow Cloud, and a View Builder agent for custom Views. Source now supports Astro alongside Next.js; its Content View can browse, search, and inspect local Astro content collections as well as the existing Sanity integration. Visual editing adds Edit, Code, and Preview modes, styling controls, and a Navigator, with edits following a Stage -> Review -> Apply workflow. The team says the CLI was moved up the roadmap to give builders more control through their existing coding tools and begin work toward a Source SDK. Planned preview updates include sharing private custom Views, creating custom agents and skills, more specialized agents, and an initial faster Webflow CMS for creating collections, items, and reusable CMS blocks directly in Source. ### Source excerpt We promised to keep you posted as Source takes shape, so here's the first of those updates: what we've shipped, what we're learning, and what's coming next. At Webflow Conf in September, we shared the first look at Source by Webflow: a platform for modern marketing teams and agents to harness the web, grow their business, and do their best work together. ## Busy Plugin Developers Newsletter - Q3 2026 DevFeed: [Busy Plugin Developers Newsletter - Q3 2026]() Original publisher: [Read original article]() Author: Elena Kerpeleva Published: 2026-10-25T23:20:22Z Content type: news Language: en Sources: [JetBrains]() Topics: [intellij idea plugin](), [jetbrains](), [gradle-plugin](), [Developer Events](), [Tool](), [Learning](), [Windows Subsystem for Linux](), [remote-development]() Tags: [2026](), [acp](), [ai](), [broadcom](), [busy-plugin-developers](), [conf](), [dev](), [developer](), [developers](), [developing](), [event](), [experts](), [free](), [independent](), [intellij-platform](), [jetbrains](), [marketplace](), [news](), [newsletter](), [newsletters](), [online](), [plugin](), [q3]() ### AI overview The newsletter highlights several practical JetBrains plugin updates. Plugin descriptions can now be edited on Marketplace pages without uploading a new archive; Marketplace also collects UI freeze reports with thread dumps and CPU snapshots. IntelliJ Plugin Verifier 1.411 adds content-module dependency checks and uses less memory for selected checks and report generation. IntelliJ Platform Gradle Plugin 2.19.0 adds multi-platform build variants for 2026.1+, offline support, and expanded test configuration; it also removes the deprecated `setupDependencies` task, a breaking change. For pre-release testing, the newsletter recommends alpha, beta, canary, or EAP channels to share work with limited user groups without affecting the main release. Other featured resources cover plugin generation, WSL support, native calls via JNA or FFM, and persistent settings with PropertiesComponent. ### Source excerpt Your quarterly dose of plugin dev news, tools, and tips from JetBrains āš”JetBrains Plugin Developer Conf 2026 Is Coming! November 10, 2026 | Online | FreeJoin our annual free virtual event on developing plugins for JetBrains products. You'll hear talks from SAP, Broadcom, JetBrains experts, and independent plugin authors. šŸ¤– AI meets plugins: ACP and [...] ## Supply Chain Security for the Age of AI-Speed Exploits DevFeed: [Supply Chain Security for the Age of AI-Speed Exploits]() Original publisher: [Read original article]() Author: Philipp Acsany Published: 2026-10-22T14:00:00Z Content type: tutorial Language: en Sources: [Real Python]() Topics: [supply-chain-security](), [litellm supply chain attack](), [litellm attack](), [software supply-chain attack](), [software composition analysis](), [credential-based attacks](), [CI/CD](), [ai security](), [Secret Scanning](), [litellm]() Tags: [access-tokens](), [admin](), [administrator](), [agent](), [agentic](), [agentic-ai](), [agentic-ai-framework](), [agents](), [ai](), [ai-assisted](), [attacks](), [conf](), [exploits](), [habits](), [litellm](), [python](), [security](), [speed](), [supply-chain](), [supply-chain-security]() ### AI overview Python supply chain attacks can compromise projects through dependencies, build or release pipelines, and credentials. The LiteLLM incident shows how stolen GitHub CLI tokens were used to redirect a release workflow, while a `.pth` startup hook ran credential-stealing code whenever Python started; the package was available for under two hours. The tutorial gives shell and Docker checks that inspect suspect files without starting the affected Python environment, and advises isolating affected systems, preserving evidence, rebuilding from known-good images, and rotating exposed credentials. For prevention, it recommends locked dependencies, cooldowns for new releases, and vulnerability audits, while noting that cooldowns can delay fixes and clean audits do not rule out malware. It also advises requiring approval before coding agents install packages, restricting agent access to secrets, using short-lived scoped credentials, and protecting publishing workflows. The excerpt includes concrete uv and pip configuration, audit commands, and startup-hook scanning guidance. ### Source excerpt Learn Python supply chain security as AI speeds up attacks: what the LiteLLM backdoor teaches, how to check your setup, and habits that last. ## 5 Commands to Protect Critical Apps From the Linux OOM Killer DevFeed: [5 Commands to Protect Critical Apps From the Linux OOM Killer]() Original publisher: [Read original article]() Author: Ravi Saive Published: 2026-10-22T09:49:33Z Content type: tutorial Language: en Sources: [Tecmint: Linux Howtos, Tutorials & Guides]() Topics: [Linux](), [cgroups](), [Kernel]() Tags: [almalinux](), [application](), [applications](), [apps](), [apt](), [btrfs](), [cat](), [cgroups](), [chmod](), [commands](), [conf](), [database](), [debian](), [kernel](), [linux](), [linux-commands](), [linux-oom-killer](), [memory](), [oom](), [oom-score-adj](), [out-of-memory](), [process](), [systemd-memorymax]() ### AI overview The excerpt presents five ways to manage Linux out-of-memory events: inspect kernel logs and process OOM scores; adjust a running process with `choom` or persist its priority through systemd's `OOMScoreAdjust`; limit a service with cgroups v2 `MemoryHigh` and `MemoryMax`; add swap for short memory spikes; and use `systemd-oomd` to respond to sustained memory pressure. It distinguishes temporary process adjustments from persistent service settings, and explains that cgroup limits confine OOM kills to the affected service. Full immunity with `OOMScoreAdjust=-1000` can leave the kernel with no killable process and cause a system panic. The excerpt notes platform limits: Btrfs needs a specially created swap file, and Rocky Linux/RHEL may require enabling PSI before `systemd-oomd` can monitor pressure. Swap buys time but does not fix leaks; ongoing OOM events still call for addressing the cause or adding memory. ### Source excerpt The post 5 Commands to Protect Critical Apps From the Linux OOM Killer first appeared on Tecmint: Linux Howtos, Tutorials & Guides . Your database keeps disappearing overnight, and the only clue is a kernel line saying "Out of memory: Killed process". Here's The post 5 Commands to Protect Critical Apps From the Linux OOM Killer first appeared on Tecmint: Linux Howtos, Tutorials & Guides. ## Check if eMudhra CA Is Still Trusted in Your Runtime DevFeed: [Check if eMudhra CA Is Still Trusted in Your Runtime]() Original publisher: [Read original article]() Author: SitePoint Team Published: 2026-10-21T15:41:41Z Content type: tutorial Language: en Sources: [SitePoint]() Topics: [trust](), [Test automation](), [Node.js]() Tags: [2](), [2026](), [3](), [all](), [alpine](), [audit](), [ca](), [cas](), [conf](), [emudhra](), [intermediate](), [programming](), [reading](), [runtime](), [runtimes](), [store](), [test](), [trust](), [update](), [using](), [web-security](), [zip]() ### AI overview The text reports that eight eMudhra intermediate CA private keys were recoverable from their public certificates, enabling forged TLS certificates to be accepted by clients that still trust the chains. It says major browsers have blocked the intermediates, while many non-browser clients lack active revocation checks and may remain exposed. Test each outbound-TLS runtime against the incident's per-intermediate endpoints, checking both eMudhra and Sectigo cross-signed paths; a successful connection indicates trust, while a certificate verification error indicates rejection. Confirm failures are not caused by network or DNS problems. The text also recommends verifying the supplied chains.zip hash, checking chains offline against system and bundled CA stores, updating relevant CA packages and language bundles, rebuilding containers and CI images, and automating checks. Store behavior varies: Python urllib uses system roots while requests commonly uses certifi; Node.js depends on build configuration; Go uses system roots; Rust depends on rustls/webpki-roots versus native-tls. It notes macOS system tools may need separate attention from Homebrew tools. ### Source excerpt Audit runtimes for the eight compromised eMudhra intermediate CAs using the official per-chain test endpoints and chains.zip, then update every trust store. Continue reading Check if eMudhra CA Is Still Trusted in Your Runtime on SitePoint. ## LHB Linux Digest #26.15: Taming stderr, Cybersecurity Certification and More DevFeed: [LHB Linux Digest #26.15: Taming stderr, Cybersecurity Certification and More]() Original publisher: [Read original article]() Author: Abhishek Prakash Published: 2026-10-16T12:34:23Z Content type: article Language: en Sources: [Linux Handbook]() Topics: [Cybersecurity](), [Linux Kernel](), [Cryptography](), [Functional programming](), [IntelliJ IDEA](), [IOMMU](), [npm packages](), [BlueZ](), [Pinephone](), [secure web gateway](), [Service fabric](), [container images]() Tags: [2026](), [ai-coding](), [ai-coding-agents](), [certification](), [cloud](), [cloud-native](), [cloud-native-security](), [code-execution](), [code-generation](), [coding](), [coding-agents](), [collection](), [conf](), [cybersecurity](), [docker](), [driver](), [errors](), [go](), [learn](), [linux](), [newsletter]() ### AI overview This Linux Handbook newsletter covers shell output and error redirection, security certification offers, self-hosted and code search tools, and selected Linux and developer news. Its practical terminal tip explains how to redirect stdout and stderr, including piping both streams to a pager. ### Source excerpt Errors are output too. Learn where they go. ## A Modern Browser for the PlayStation Portable DevFeed: [A Modern Browser for the PlayStation Portable]() Original publisher: [Read original article]() Author: Jenny List Published: 2026-10-13T11:00:29Z Content type: article Language: en Sources: [Hackaday]() Topics: [Plover](), [WebAssembly]() Tags: [browser](), [conf](), [esp32-p4](), [espressif](), [hardware](), [javascript](), [microcontroller](), [playstation](), [playstation-hacks](), [playstation-portable](), [processor](), [psp](), [ram](), [web-browser]() ### AI overview Tilefinch is a modern web browser built for the PlayStation Portable, using Lexbor for its browser engine, QuickJS for JavaScript, and the PSP's built-in capabilities such as video decoding. The article notes that its performance has not been tested and suggests the project may point to web browsing on other limited-hardware platforms, including the ESP32-P4. ### Source excerpt The Sony PlayStation Portable, better known as the PSP, is now over two decades old. In its day it was an impressive handheld gaming machine, not least because of the ...read more ## Inside the Database Internals Talks at P99 CONF 2026 DevFeed: [Inside the Database Internals Talks at P99 CONF 2026]() Original publisher: [Read original article]() Author: Cynthia Dunlop Published: 2026-10-12T13:51:27Z Content type: article Language: en Sources: [ScyllaDB]() Topics: [scylladb](), [Distributed Systems & Parallel Computing](), [performance-engineering](), [elasticsearch]() Tags: [2026](), [benchmarking](), [c-plus-plus](), [cloud](), [cluster](), [coding](), [community](), [compaction](), [conf](), [database](), [database-performance](), [distributed](), [distributed-data](), [inside](), [p99-conf](), [performance](), [scylladb](), [systems](), [talks]() ### AI overview This article previews database internals talks at P99 CONF 2026, covering distributed databases, vector search, storage engines, query performance, concurrency, and low-latency systems. It highlights engineering approaches and performance tradeoffs from teams at ScyllaDB, TigerBeetle, DoorDash, AWS, and other organizations. ### Source excerpt Since database performance is so near and dear to ScyllaDB, we reached out to our friends across the community to ensure that a nice range of distributed data systems, approaches, and challenges would be represented at P99 CONF 2026. As you can see from our agenda, the response was overwhelming. ## Chasing AMMYY at Splunk .conf DevFeed: [Chasing AMMYY at Splunk .conf]() Original publisher: [Read original article]() Author: Adam Kilgore Published: 2026-10-08T15:00:59Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [ARKTunnel](), [Nitro Isolation Engine](), [Splunk Enterprise Security](), [Scapy]() Tags: [ai](), [cisco-secure-access](), [cisco-secure-firewall](), [cisco-talos](), [conf](), [cybersecurity](), [firewall](), [malware](), [malware-detection](), [mcp](), [packet](), [packet-capture](), [rat](), [security](), [security-operations-center](), [soc](), [splunk](), [splunk-cloud](), [splunk-enterprise-security](), [thousandeyes](), [tls](), [traffic](), [visibility]() ### AI overview At Splunk .conf, Cisco's Encrypted Visibility Engine detected Flawed AMMYY RAT traffic by comparing HTTP and HTTPS session fingerprints. The article explains how HTTP packet details raised detection confidence and how Endace packet capture showed an HTTP download request receiving a redirect to HTTPS. The initial download over HTTP was unsuccessful; further endpoint analysis would be needed to verify whether the HTTPS request succeeded or installed the file. ### Source excerpt Discover how Cisco's Encrypted Visibility Engine (EVE) and Endace PCAP uncovered Flawed AMMYY RAT traffic at Splunk .conf without breaking TLS encryption. ## Chasing AMMYY at Splunk .conf DevFeed: [Chasing AMMYY at Splunk .conf]() Original publisher: [Read original article]() Author: Adam Kilgore Published: 2026-10-08T15:00:59Z Content type: article Language: en Sources: [Security @ Cisco]() Topics: [network-intelligence](), [TLS (Transport Layer Security)](), [Cisco]() Tags: [agentic-soc](), [ai](), [capture](), [cisco](), [cisco-secure-access](), [cisco-secure-firewall](), [cisco-talos](), [command-and-control](), [conf](), [conference](), [confidence](), [confidence-score](), [cybersecurity](), [detection](), [download](), [encrypted](), [encrypted-visibility-engine](), [eve](), [http](), [mcp](), [pcap](), [rat](), [security](), [security-operations-center](), [soc](), [splunk](), [splunk-cloud](), [splunk-enterprise-security](), [thousandeyes](), [tls](), [traffic](), [visibility]() ### AI overview At Splunk .conf, Cisco EVE in Firewall Threat Defense detected Flawed AMMYY activity from paired HTTP and HTTPS connections at the same timestamp. EVE fingerprinted the encrypted session using visible destination details and assigned it confidence 82; the HTTP session exposed a requested .exe and received confidence 99. Endace packet capture showed the HTTP request followed by a 301 redirect and connection close, suggesting the endpoint then retried over HTTPS. The capture could not establish whether the download succeeded or the file was installed; the source recommends endpoint analysis to verify those points. TLS decryption could provide comparable detail for HTTPS, while EVE still offers detection from encrypted-session fingerprints without decryption. ### Source excerpt Discover how Cisco's Encrypted Visibility Engine (EVE) and Endace PCAP uncovered Flawed AMMYY RAT traffic at Splunk .conf without breaking TLS encryption. ## Admin in the Loop: Firewalls and the Agentic SOC DevFeed: [Admin in the Loop: Firewalls and the Agentic SOC]() Original publisher: [Read original article]() Author: Andrew Merica Published: 2026-10-08T15:00:58Z Content type: article Language: en Sources: [Security @ Cisco]() Topics: [Security Operations Center](), [Agentic SOC](), [Splunk Enterprise Security](), [Logging](), [Cisco]() Tags: [agentic](), [agentic-soc](), [ai-canvas](), [cisco](), [cisco-secure-firewall](), [cisco-talos](), [cloud](), [conf](), [cybersecurity](), [encrypted-visibility-engine](), [firewall](), [firewalls](), [security](), [security-operations-center](), [snort](), [soc](), [splunk](), [splunk-cloud](), [splunk-enterprise-security](), [telemetry]() ### AI overview At Splunk .conf26, Cisco describes a live SOC built around a multi-stage agentic pipeline, with firewall telemetry feeding Splunk Enterprise Security, autonomous agents accelerating triage, Cisco Cloud Control enforcing confidence gates, and analysts making response decisions. Structured firewall events and encrypted-traffic signals support investigations, while AgenticOps and AI Canvas help administrators manage policies and coordinate incident work. ### Source excerpt Discover how Cisco Secure Firewall and Cloud Control stream structured Snort 3 and EVE telemetry into Splunk ES to power the .conf26 Agentic SOC pipeline. ## Admin in the Loop: Firewalls and the Agentic SOC DevFeed: [Admin in the Loop: Firewalls and the Agentic SOC]() Original publisher: [Read original article]() Author: Andrew Merica Published: 2026-10-08T15:00:58Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Agentic SOC](), [Splunk Enterprise Security](), [Logging](), [alert triage](), [human in the loop agent]() Tags: [ai-canvas](), [cisco-cloud-control](), [cisco-secure-firewall](), [cisco-talos](), [conf](), [cybersecurity](), [encrypted-visibility-engine](), [security](), [security-operations-center](), [snort](), [soc](), [splunk](), [splunk-cloud](), [splunk-enterprise-security]() ### AI overview Cisco describes the security operations pipeline used at Splunk .conf26, where firewall telemetry fed Splunk Enterprise Security and autonomous triage agents, with confidence gates and human response decisions. The article explains structured JSON logging, Snort 3 detection, encrypted traffic analysis, and Cloud Control workflows for firewall management and collaborative investigations. ### Source excerpt Discover how Cisco Secure Firewall and Cloud Control stream structured Snort 3 and EVE telemetry into Splunk ES to power the .conf26 Agentic SOC pipeline. ## The Zero-Day Blind Spot: Why Your Agentic SOC needs Retrospective Packet Replay DevFeed: [The Zero-Day Blind Spot: Why Your Agentic SOC needs Retrospective Packet Replay]() Original publisher: [Read original article]() Author: Adam Kilgore Published: 2026-10-08T15:00:53Z Content type: article Language: en Sources: [Security @ Cisco]() Topics: [Security Operations Center](), [recording](), [network-intelligence](), [Agentic SOC](), [Internet Traffic](), [Cisco Talos]() Tags: [2026](), [agentic](), [agentic-soc](), [ai](), [ai-vulnerability-discovery](), [alert](), [analyst](), [api](), [artifactory](), [asset-management](), [attack](), [cisco](), [cisco-secure-access](), [cisco-secure-firewall](), [cisco-talos](), [conf](), [cybersecurity](), [firewall](), [mcp](), [packet](), [pcap](), [retrospective](), [rules](), [security](), [security-operations-center](), [soc](), [splunk](), [splunk-cloud](), [splunk-enterprise-security](), [thousandeyes](), [zero-day]() ### AI overview Continuous full packet capture preserves traffic that log metadata and alert-triggered selective PCAP may miss when a zero-day has no known signature. In the .conf26 Agentic SOC workflow, Endace packet captures were replayed against updated Cisco Secure Firewall Threat Defense intrusion rules informed by Cisco Talos. For a JFrog Artifactory vulnerability, Cisco Secure Firewall EVE found earlier JFrog connections; matching traffic was retrieved from Endace and replayed through a dedicated firewall interface over ERSPAN. The new rules did not fire in this test, showing a way to check historical traffic with current detections, whether to investigate a possible compromise or find no detection. The article also suggests endpoint validation and TLS decryption as possible complements. ### Source excerpt Learn how the .conf26 Agentic SOC paired Endace full PCAP with Cisco Secure Firewall and Talos rules to retrospectively replay wire data against zero-days. ## The Zero-Day Blind Spot: How Retrospective Packet Replay Checks for Past Compromise DevFeed: [The Zero-Day Blind Spot: How Retrospective Packet Replay Checks for Past Compromise]() Original publisher: [Read original article]() Author: Adam Kilgore Published: 2026-10-08T15:00:53Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Security Operations Center](), [Agentic SOC](), [Scapy](), [Cisco Talos](), [Cisco Secure Network Analytics (SNA)](), [soc 2]() Tags: [ai](), [artifactory](), [cisco](), [cisco-secure-access](), [cisco-secure-firewall](), [cisco-talos](), [conf](), [cybersecurity](), [mcp](), [pcap](), [security](), [security-operations-center](), [soc](), [splunk](), [splunk-cloud](), [splunk-enterprise-security](), [thousandeyes](), [zero-day]() ### AI overview The article describes a workflow that uses Endace full packet captures, Cisco Secure Firewall intrusion rules, and Cisco Talos threat intelligence to inspect historical network traffic after new zero-day detections become available. In a conference test involving JFrog Artifactory traffic, replaying the captured traffic against updated rules did not trigger a detection. The authors present retrospective replay as a way to investigate possible earlier compromise and recommend supplementing it with endpoint validation and TLS decryption capabilities. ### Source excerpt Learn how the .conf26 Agentic SOC paired Endace full PCAP with Cisco Secure Firewall and Talos rules to retrospectively replay wire data against zero-days. ## One Cisco in Action: Inside the Agentic SOC at .conf26 DevFeed: [One Cisco in Action: Inside the Agentic SOC at .conf26]() Original publisher: [Read original article]() Author: Jessica (Bair) Oppenheimer Published: 2026-10-08T15:00:39Z Content type: article Language: en Sources: [Security @ Cisco]() Topics: [Agentic SOC](), [Splunk Enterprise Security](), [Security Operations Center](), [Cisco](), [Cisco XDR](), [Cisco Talos]() Tags: [agentic](), [agentic-soc](), [black-hat](), [cisco](), [cisco-live](), [cisco-talos](), [conf](), [cybersecurity](), [enterprise-security](), [security](), [security-operations-center](), [soc](), [splunk](), [splunk-cloud](), [splunk-enterprise-security]() ### AI overview The article describes Cisco and Splunk's live Agentic SOC at .conf26, which used Cisco Cloud Control, Splunk Enterprise Security, security telemetry, AI agents, and packet capture to monitor event traffic. It recounts how analysts investigated and remediated a fake-Corepack infostealer incident affecting 15 venue endpoints, with AI-supported correlation and human-led containment. ### Source excerpt Read how Cisco Cloud Control and Splunk Enterprise Security powered the live Agentic SOC at .conf26 to deliver unified TDIR across live event traffic. ## One Cisco in Action: Inside the Agentic SOC at .conf26 DevFeed: [One Cisco in Action: Inside the Agentic SOC at .conf26]() Original publisher: [Read original article]() Author: Jessica (Bair) Oppenheimer Published: 2026-10-08T15:00:39Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Agentic SOC](), [Splunk Enterprise Security](), [alert triage](), [Cisco Security Cloud]() Tags: [agentic-soc](), [ai](), [ai-agents](), [cisco](), [cisco-talos](), [conf](), [cybersecurity](), [security](), [security-operations-center](), [soc](), [splunk](), [splunk-cloud](), [splunk-enterprise-security]() ### AI overview Cisco describes how its Cloud Control platform, Splunk Enterprise Security, Cisco security telemetry, and other tools supported a live Agentic SOC at .conf26. AI agents helped correlate threat indicators and gather evidence while human analysts made containment decisions. The article recounts the investigation and on-site remediation of a fake-Corepack infostealer infection. ### Source excerpt Read how Cisco Cloud Control and Splunk Enterprise Security powered the live Agentic SOC at .conf26 to deliver unified TDIR across live event traffic. ## Metro DI for Ktor Backend: From a God Object through manual DI to Constructor Injection DevFeed: [Metro DI for Ktor Backend: From a God Object through manual DI to Constructor Injection]() Original publisher: [Read original article]() Author: FunkyMuse Published: 2026-05-15T15:35:00Z Content type: article Language: en Sources: [FunkyMuse]() Topics: [Dependency injection](), [Ktor](), [constructor](), [Dagger](), [dagger-hilt](), [koin](), [IntelliJ IDEA]() Tags: [accessors](), [aggregation](), [android](), [android-development](), [annotations](), [anvil](), [api](), [auth](), [authentication](), [backend](), [conf](), [constructor](), [default-parameters](), [di](), [framework](), [kotlin](), [ktor](), [lazy](), [metro](), [object](), [var]() ### AI overview The author replaces a manually wired `BackendComponent`--whose default constructor parameters could silently pull real dependencies into tests--with Metro's compile-time constructor injection. A `BackendGraph` gathers `@ContributesTo` bindings and `@ContributesIntoSet` route and plugin registrars, so adding or removing them does not require editing a central registry; plugin installers retain an explicit order. Stateless injected classes get fresh instances, while `@SingleIn(AppScope::class)` is reserved for shared or costly objects. For integration tests, TestContainers provides PostgreSQL/PostGIS, Redis, and MinIO; tests start a real Ktor server and obtain its live Metro graph to inspect repository state. The author contrasts this with Metro's direct-construction-with-fakes approach for unit and component tests, which they do not use for this backend's integration coverage. They note that Metro's compile-time verification costs extra build time and say they miss Dagger's IDE dependency navigation. The supplied text describes a single Gradle backend module and a possible future split, not an implemented multi-module setup. ### Source excerpt The Starting Point: a God Object When Rudio was a created a few months ago it used the simplest possible DI: one big object BackendComponent with everything wired manually via by lazy and lateinit var. No framework, no annotations, no ceremony, then i started adding things and manual DI became a tedious and tiring task because everywhere i used default parameters to achieve default constructor... ## GPT-5.4 is generally available in GitHub Copilot DevFeed: [GPT-5.4 is generally available in GitHub Copilot]() Original publisher: [Read original article]() Author: Kate Catlin Published: 2026-03-05T23:36:06Z Content type: release Language: en Sources: [GitHub Changelog]() Topics: [GitHub Copilot](), [AI-assisted coding](), [gpt-6-astra]() Tags: [agentic](), [conf](), [development](), [github-cli](), [github-copilot](), [github-copilot-coding-agent](), [gpt-5](), [jetbrains](), [testing](), [visual-studio](), [visual-studio-code]() ### AI overview GPT-5.4, described as OpenAI's latest agentic coding model, is rolling out in GitHub Copilot for Pro, Pro+, Business, and Enterprise users. It can be selected across supported Copilot products, including VS Code, Visual Studio, JetBrains, Xcode, Eclipse, GitHub.com, GitHub Mobile, GitHub CLI, and Copilot Coding Agent. Business and Enterprise administrators must enable its policy in Copilot settings. The announcement says early testing showed improved results on agentic and software development tasks, logical reasoning, and multi-step tool-dependent processes. ### Source excerpt GPT-5.4, OpenAI's latest agentic coding model, is now rolling out in GitHub Copilot. In our early testing of real-world, agentic, and software development capabilities, GPT-5.4 consistently hits new rates of... ## How Vercel uses React Email for Next.js Conf DevFeed: [How Vercel uses React Email for Next.js Conf]() Original publisher: [Read original article]() Author: Krithika Yetchina Published: 2024-09-06T00:00:00Z Content type: article Language: en Sources: [Resend]() Topics: [email](), [Next.js]() Tags: [conf](), [engineering](), [making](), [react]() ### AI overview Vercel used React Email to build and maintain conference email templates for Vercel Ship and Next.js Conf. The article describes replacing manually edited HTML strings with React components and familiar development workflows, enabling component reuse, conditional formatting by ticket type, and easier onboarding. ### Source excerpt A sneak peek into how the emails for Next.js Conf and Vercel Ship are built. ## Nx Conf 2023 - Recap DevFeed: [Nx Conf 2023 - Recap]() Original publisher: [Read original article]() Author: Juri Strumpflohner Published: 2023-10-12T00:00:00Z Content type: article Language: en Sources: [Juri Strumpflohner]() Topics: [Developer Events](), [Developer Tools](), [monorepo](), [Developer experience](), [developer-relations](), [software-development](), [Tutorial](), [Discord]() Tags: [2023](), [angular](), [announcements](), [automation](), [built-in](), [channel](), [community](), [conf](), [cypress](), [developer-productivity](), [discord](), [docs](), [ecosystem](), [growth](), [monorepo](), [nx](), [recap](), [talks](), [tech](), [tooling]() ### AI overview The keynote presented Nx as an ecosystem that integrates developers' framework of choice--including Angular, React, or Vue--with tools such as ESLint, Playwright, Cypress, Webpack, ESBuild, and Vite, supporting both single-project workspaces and monorepos. It also covered reorganizing the Nx documentation around the Diataxis framework to distinguish tutorials, recipes, explanations, and reference material; video education; and moving the community from Slack to Discord, citing forums, event highlights, automation and moderation features, and more than 1,500 sign-ups within weeks. The excerpt mentions the Nx Champions program and begins to describe two announcements, but cuts off before giving their full details. ### Source excerpt Nx Conf 2023 recap - keynotes, tech talks, and community discussions on Nx ecosystem growth, tooling, and monorepo development. ## GitHub Actions Runner v2.296.3 fixes Docker environment and Windows environment variable issues DevFeed: [GitHub Actions Runner v2.296.3 fixes Docker environment and Windows environment variable issues]() Original publisher: [Read original article]() Published: 2023-01-30T16:08:41Z Content type: release Language: en Sources: [GitHub Action Runners]() Topics: [self-hosted runner](), [CI/CD](), [releases]() Tags: [arm64](), [bash](), [conf](), [self-hosted-runner](), [v2](), [windows](), [zip]() ### AI overview GitHub Actions Runner v2.296.3 fixes an issue that overwrote Docker environment variables in self-hosted environments and sanitizes Windows environment variables. The release also provides setup instructions and packages for Windows, macOS, and Linux, with SHA-256 checksums. ### Source excerpt ## Bugs - Fixed an issue where self hosted environments had their docker env's overwritten (#2107) - Sanitize Windows ENVs (#2280) ## Misc ## Windows x64 We recommend configuring the runner in a root folder of the Windows drive (e.g. "C:\actions-runner"). This will help avoid issues related to service identity folder permissions and long file path restrictions on Windows. The following snipped needs to be run on `powershell`: ``` powershell # Create a folder under the drive root mkdir \actions-runner ; cd \actions-runner # Download the latest runner package Invoke-WebRequest -Uri https://github.com/actions/runner/releases/download/v2.296.3/actions-runner-win-x64-2.296.3.zip -OutFile actions-runner-win-x64-2.296.3.zip # Extract the installer Add-Type -AssemblyName System.IO.Compression.FileSystem ; [System.IO.Compression.ZipFile]::ExtractToDirectory("$PWD\actions-runner-win-x64-2.296.3.zip", "$PWD") ``` ## OSX x64 ``` bash # Create a folder mkdir actions-runner && cd actions-runner # Download the latest runner package curl -O -L https://github.com/actions/runner/releases/download/v2.296.3/actions-runner-osx-x64-2.296.3.tar.gz # Extract the installer tar xzf ./actions-runner-osx-x64-2.296.3.tar.gz ``` ## OSX arm64 (Apple silicon) ``` bash # Create a folder mkdir actions-runner && cd actions-runner # Download the latest runner package curl -O -L https://github.com/actions/runner/releases/download/v2.296.3/actions-runner-osx-arm64-2.296.3.tar.gz # Extract the installer tar xzf ./actions-runner-osx-arm64-2.296.3.tar.gz ``` ## Linux x64 ``` bash # Create a folder mkdir actions-runner && cd actions-runner # Download the latest runner package curl -O -L https://github.com/actions/runner/releases/download/v2.296.3/actions-runner-linux-x64-2.296.3.tar.gz # Extract the installer tar xzf ./actions-runner-linux-x64-2.296.3.tar.gz ``` ## Linux arm64 ``` bash # Create a folder mkdir actions-runner && cd actions-runner # Download the latest runner package curl -O -L https://github. ## React Conf 2021 Recap DevFeed: [React Conf 2021 Recap]() Original publisher: [Read original article]() Published: 2021-12-17T00:00:00Z Content type: news Language: en Sources: [React]() Topics: [React](), [React Native](), [Web Accessibility (a11y)](), [npm]() Tags: [2021](), [accessibility](), [adopting](), [adoption](), [announcements](), [api](), [concurrent](), [conf](), [conference](), [dependencies](), [discord](), [event](), [features](), [feedback](), [first](), [free](), [full](), [future](), [react](), [recap]() ### AI overview React Conf 2021 presented React 18 as a gradual upgrade: it adds a concurrent renderer and Suspense updates without major breaking changes, with concurrent features adopted incrementally rather than through a separate "concurrent mode." The article's RC instructions are to install `react@rc` and `react-dom@rc`, then replace `ReactDOM.render` with `createRoot` and `root.render`. It also highlights Suspense-based streaming server rendering, which can stream independent app sections without blocking the rest, plus APIs refined with the React 18 Working Group, a new DevTools Timeline Profiler, and research into an auto-memoizing compiler. The article reports that the online conference was free, translated into eight languages, and drew over 50,000 registrations. ### Source excerpt This blog site has been archived. Go to react.dev/blog to see the recent posts. Last week we hosted our 6th React Conf. In previous years, we've used the React Conf stage to deliver industry changing announcements such as React Native and React Hooks. This year, we shared our multi-platform vision for React, starting with the release of React 18 and gradual adoption of concurrent features. This was the first time React Conf was hosted online, and it was streamed for free, translated to 8 different languages. Participants from all over the world joined our conference Discord and the replay event for accessibility in all timezones. Over 50,000 people registered, with over 60,000 views of 19 talks, and 5,000 participants in Discord across both events. All the talks are available to stream online. Here's a summary of what was shared on stage: React 18 and concurrent features In the keynote, we shared our vision for the future of React starting with React 18. React 18 adds the long-awaited concurrent renderer and updates to Suspense without any major breaking changes. Apps can upgrade to React 18 and begin gradually adopting concurrent features with the amount of effort on par with any other major release. This means there is no concurrent mode, only concurrent features. In the keynote, we also shared our vision for Suspense, Server Components, new React working groups, and our long-term many-platform vision for React Native. Watch the full keynote from Andrew Clark, Juan Tejada, Lauren Tan, and Rick Hanlon here: React 18 for Application Developers In the keynote, we also announced that the React 18 RC is available to try now. Pending further feedback, this is the exact version of React that we will publish to stable early next year. To try the React 18 RC, upgrade your dependencies: npm install react@rc react-dom@rc and switch to the new createRoot API: // before const container = document.getElementById('root'); ReactDOM.render(, container); // after const conta [Next page]()