1000 results for “dev_Paul”
The Machine Week ran from October 13 to 22, and it produced 5 incidents where automation or AI agents did the heavy lifting. The headline number: a nation-state actor fired 2,900 sign-in attempts per minute at 2,250 Microsoft 365 tenants using an open-source AI pentest framework, reaching privileged access in under three hours.
ConnectWise / Storm-0940: AI Agents at Machine Speed
What happened: On October 15, Storm-0940 — a China-state-aligned group Microsoft tracks since 2021 — used ARTEX, a Go-based agentic AI penetration-testing framework, to compromise ConnectWise Cloud Backup's application credentials. From there, AI agents automated password spraying at 2,900 attempts per minute across 2,250+ downstream Microsoft 365 tenants, authenticating via already-trusted ConnectWise app identities without interactive sign-in. Microsoft disclosed the attribution on October 21.
Why it matters: The headline is "nation-state attack." The real risk is that ARTEX is open source. Any actor with a stolen OAuth app credential can now compress a multi-week intrusion into hours, and your MFA won't stop an app identity that's already trusted. Audit every third-party OAuth app registered in your tenant and revoke any you can't name.
Arista VCO: The Third Zero-Day in Four Months
What happened: On October 22, Arista published Security Advisory SA 0199 for CVE-2026-114625, a SQL injection in VeloCloud Orchestrator (on-prem) rated CVSS 9.9 that lets any logged-in user — down to "Enterprise Read Only" — escalate to superuser operator. It is the third exploited VCO zero-day since July 2026. Affected builds: 5.2.x before 5.2.3.18, 6.1.x before 6.1.3.10, 6.4.x before 6.4.2.12. Arista confirmed active exploitation at the time of disclosure.
Why it matters: The headline is "patch VCO." The real risk is that three zero-days in one product within four months means the same code path is being probed repeatedly, and on-prem VCO is the control plane for your entire SD-WAN. If you can't patch within 48 hours, isolate the orchestrator from the internet.
OVHcloud CLI: 94 Minutes on GitHub
What happened: On October 19, a compromised OVHcloud developer GitHub account was used to replace the download binaries for five CLI releases (v0.11.0 through v0.15.0) with a secret-stealing trojan. The malicious builds were live for 94 minutes (14:47–16:21 UTC+2) before detection. The trojan harvested cloud credentials, SSH keys, and environment variables from the local disk.
Why it matters: The headline is "don't download OVHcloud CLI." The real risk is that any CLI you curl | sh or brew install is a supply chain target, and a 94-minute window is enough for a CI pipeline to pull it. Pin your CLI tools by SHA-256 and verify release artifacts before execution.
Patch Tuesday: 1,413 CVEs and a MotW Bypass
What happened: On October 13, Microsoft shipped the largest Patch Tuesday in its history: 1,413 CVEs, including CVE-2026-96951, an actively exploited Windows Shell security feature bypass (CVSS 8.8) that defeats Mark of the Web. CISA added it to the KEV catalog the same day with a federal remediation deadline of October 16. The same week, Palo Alto patched an exploited PAN-OS RCE and Cisco patched an exploited Secure Email Gateway flaw.
Why it matters: The headline is "patch Windows." The real risk is that MotW is the last line between a downloaded file and Office Protected View or SmartScreen. A bypass means a single malicious attachment can now land in a sandbox-less context. Verify your endpoint actually applies the October 13 cumulative update, not just the patch metadata.
The Wider Machine Week: Automation Everywhere
Plex2Shell. Four chained Plex Media Server CVEs were patched on October 16. Crypto miners and a proxy backdoor appeared within 24 hours of the proof of concept. If you run Plex at home, it's already been scanned.
Capcom. On October 22, Capcom confirmed a breach of CAPCOM ID exposing 11.7 million account email addresses. Hackers also changed login passwords for 196 accounts and leaked dates of birth for 43.
Nikkei. On October 19, Japanese media group Nikkei disclosed its third breach in a month. Attackers used stolen credentials from October 7 to access a cloud development service, exposing 1.83 million records.
Oracle Health. On October 7, Oracle reported a breach of its healthcare unit affecting nearly 20 million US patients. Compromised data includes Social Security numbers, home addresses, and medical records.
Japan NPA. On October 21, the National Police Agency said personal information for approximately 125,000 officers and staff across 20 prefectural forces was compromised through an attack on cloud provider Arcadia.
What This Means for You
If an AI agent can reach your M365 tenant, your SD-WAN control plane, and your local SSH keys through three different trust paths in the same afternoon, you don't have a patching problem — you have a trust-boundary problem.#ai #themachineweek #security #software #coding #development #engineering #inclusive #community
The Machine Week: The Week Attackers Almost Went Full Autopilot
Small coding choices can make software easier to understand and maintain. One example in C# is how we initialize string properties in DTOs.
A DTO —Data Transfer Object— carries data between parts of an application. For example, it might carry a customer’s name from an API request into the application.
Consider these two approaches:
public sealed class CreateCustomerDtoWithNull
{
public string Name { get; init; } = null!;
}
public sealed class CreateCustomerDto
{
public string Name { get; init; } = string.Empty;
}
Both avoid the compiler warning about an uninitialized non-nullable property. Both initial values can be rejected by FluentValidation.
But they create different starting states.
For required text fields where missing and empty values are treated the same, I prefer string.Empty: it gives the property an actual string value without suppressing a compiler warning.
The difference becomes clearer when we look at what each declaration means.
With nullable reference types enabled, string expresses the intention that a property should not contain null.
However:
public string Name { get; init; } = null!;
initializes that property with null.
The ! suppresses the nullable warning. It does not create a value, check anything at runtime, or guarantee that something will replace the null later. Microsoft explicitly documents that the operator has no runtime effect. Microsoft: null-forgiving operator.
With:
public string Name { get; init; } = string.Empty;
the property starts with "": an actual string containing zero characters. It is different from " ", which contains a space. Microsoft: String.Empty.
This makes the initial state more consistent with the declared type. We have a string; we still need to check whether its content is acceptable.
“FluentValidation can catch both” is correct.
For example:
using FluentValidation;
public sealed class CreateCustomerDtoValidator
: AbstractValidator
{
public CreateCustomerDtoValidator()
{
RuleFor(x => x.Name)
.NotEmpty()
.WithMessage("Name is required.");
}
}
For strings, NotEmpty() rejects all of these:
Value Result
null Rejected
"" Rejected
" " Rejected
"Maria" Accepted
This behavior is documented by FluentValidation and can also be checked in its implementation. FluentValidation documentation, NotEmptyValidator source code.
The preference for string.Empty therefore concerns the object’s starting state and the clarity of the code.
It separates two responsibilities:
Also, validation does not fill in the missing name. It reports the problem so the application can reject the request.
In an ASP.NET Core application using Clean Architecture, a straightforward execution flow is:
API receives the request
→ DTO is created
→ Application validates the input
→ Domain creates a valid customer
→ Infrastructure saves the customer
The Application layer can execute validation before continuing:
await validator.ValidateAndThrowAsync(dto, cancellationToken);
// Continue with customer creation only after validation succeeds.
The API must then translate validation failures into an appropriate response, such as HTTP 400 with useful error messages.
The Domain should also protect its own essential rules when creating a customer. This keeps those rules effective when data arrives through another route.
Clean Architecture supports this separation of responsibilities. It does not prescribe a particular DTO initializer. Microsoft: common application architectures.
For a manager, the practical benefit is straightforward: clear starting states reduce the assumptions developers need to make. Reviewers can see what the object initially contains and where unacceptable input is rejected.
There are limits to this preference.
First, string.Empty only sets the initial value. Depending on serializer settings, an incoming JSON value such as "name": null can replace it. External input still needs validation. Microsoft: nullable annotations in System.Text.Json.
Second, sometimes null carries useful information. If a DTO should accurately represent missing input, a nullable property can be more appropriate:
public string? Name { get; init; }
The business rule can still require a name. The nullable type acknowledges that an incoming request may fail to provide one.
There are other reasonable designs too. Maarten Balliauw discourages using default! to silence warnings in JSON DTOs and discusses alternatives such as nullable properties, constructors, and required. His article supports avoiding hidden assumptions, rather than a universal preference for empty strings. Maarten Balliauw: nullable warnings in JSON models.
Ian Griffiths provides a useful counterargument: an empty string can also hide missing meaningful data if it is added simply to silence the compiler. This matters especially when objects are expected to be valid immediately after construction. Ian Griffiths: defeating the point with empty strings.
My preferred team convention is therefore:
For input DTOs where missing and empty text have the same meaning, use string.Empty and validate required content with NotEmpty(). Use nullable properties when absence matters. Use null! when there is a specific, justified initialization guarantee.
The aim is to keep the declared intention, actual starting value, and validation rules consistent—and easy for the next person to understand.
[email protected]#coding #csharp #dotnet #softwaredevelopment #software #development #engineering #inclusive #community
Why I Prefer string.Empty Over null! in Input DTOs