971 results for “dev_lenchen”
CVE-2026-89077 for platform teams: what to instrument before and after the upgrade
Platform teams inherit vulnerabilities with a different mandate than security teams. Neither party can hand the other a clean decision, and the CVE becomes an instrumentation project that must be finished before the patch window opens.
The two facts that drive instrumentation
CVE-2026-89077 is an incorrect implementation of an authentication algorithm in the SFTP module of Progress MOVEit Transfer, classified CWE-303, with a CVSS v3.1 vector of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H and a base score of 7.5.
Two fields matter for instrumentation. Network attack vector means reachability determines who can attempt exploitation. Low privileges required means an attacker needs a valid identity, and identity usage is something a platform team can observe if the logging exists.
Baseline the identity population
Before the upgrade, produce a list of every SFTP identity on each affected host. Include the authentication method and the last observed authentication.
Where the platform does not log authentication events with sufficient detail, that gap becomes the first project item. A flaw in validation produces a successful authentication as its observable outcome, and success events without identity and source detail are not analysable.
The list has a second use. After the upgrade, the same list is the input to credential review, and any identity that has not authenticated in a year becomes a candidate for removal rather than a permanent resident.
Instrument reachability
Reachability from untrusted networks is a property of the deployment, not the CVE. Record for each host which network paths can reach the SFTP listener and which partner address ranges are admitted.
This is the input that turns a global CVE into a local priority. An affected host with no inbound SFTP reachability is patched on the normal cycle. An affected host accepting connections from the public internet is patched in the next window.
Instrument the patch state
Track version per node, not per deployment. Clustered MOVEit installations can have members at different builds, and the load balancer hides the difference. A record that says "MOVEit, patched" without node-level detail cannot answer the question the next audit will ask.
The target versions are 2025.1.6 for the 2025.1 branch and 2026.0.4 for the 2026.0 branch. Affected ranges are before 2025.1.6 and from 2026.0.0 before 2026.0.4.
Instrument the verification, not just the change
A change record with a build number and no behavioural confirmation is an assertion. Add two fields to the change template: the identity used for the known-good authentication test and its result, and the date the partner confirmed a successful transfer.
Those two fields convert a claim into evidence, and they cost minutes per host when collected during the window rather than weeks later during an audit.
After the upgrade
Keep authentication logging enabled at the detail level used for the investigation. The flaw is fixed on the patched host, and the log data answers a different question: whether any authentication occurred during the exposure window that policy did not expect.
Retaining that data for the exposure period plus a reasonable margin is the difference between reconstructing events and guessing at them.
The handoff
Security teams decide when a CVE matters. Platform teams produce the evidence that decision depends on: who holds identities, what reaches the listener, which nodes run which build, and what changed after the upgrade. CVE-2026-89077 is a 7.5 that becomes urgent or routine based on that evidence, and the evidence only exists if someone instruments for it.#infrastructure #monitoring #security #sre #software #coding #development #engineering #inclusive #community
CVE-2026-89077 for platform teams: what to instrument before and after the upgrade
Hey everyone! 👋💚
I’m Himanshi, a 2nd-semester B.Tech CSE student, excited to be a part of Hacktoberfest! 🚀
I enjoy working with C++, exploring DSA, building projects, and learning more about AI/ML. I’m here to contribute to open source, improve my coding skills, learn from the community, and connect with fellow developers.
I’m still learning, but I believe every contribution counts! 🌱
Looking forward to learning, collaborating, and building something awesome with you all. Let’s make this Hacktoberfest count! ✨
Hacktoberfest #OpenSource #DeveloperCommunity #Cplusplus #DSA #WomenWhoCode
#beginners #hacktoberfest #learning #opensource #software #coding #development #engineering #inclusive #community
Intro
This audit takes the nine daily buybacks FlapJax describes out of the project's own statement and rebuilds them from BNB Smart Chain logs only: every transaction, block, BNB amount, FLAPJAX amount and recipient below comes from a public BSC node, not from the project's posts.
Scope and window
token0() returns the FLAPJAX address, token1() returns WBNB 0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c and fee() returns 10000 (1.00%).Method
Transfer log for the window (topic 0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef, address = token) with eth_getLogs, in 5,000-block chunks because the public endpoints cap the range. The window returns 223 Transfer logs across 215 transactions, which is a small enough set to account for in full.eth_getTransactionReceipt to take the FLAPJAX amount from the token's own Transfer log (not from the router's swap event), the WBNB amount sent into the pool, the transaction sender, the nonce and the status.The nine buyback buys
#Time (UTC)BlockBNB into poolFLAPJAX receivedBNB per FLAPJAXFLAPJAX per BNBTransaction12026-10-09 18:30:53126,684,1510.0124,052,995.3082715235650539404.157486363688403e-102,405,299,530.830xbeefabdc89f9148f9daaef6082d34a60dc5b4b612972ca0fd39d6bd4eb03b4b022026-10-10 18:27:56126,875,7010.0123,979,958.5573956370353698734.170148991736230e-102,397,995,855.740x8ce8e8578da26f8c7acb0f44c6ca0d0b8dcba868cafe2d729bb48562863f2d6232026-10-11 18:30:35127,067,7130.0123,907,253.9655899889767169954.182830874007163e-102,390,725,396.560x82d01172ae26f1c86287643e123af1675ca5c18b984b7740c1a0c1647d2801eb42026-10-12 18:46:27127,261,2460.0123,834,879.5217638909816741944.195532010501203e-102,383,487,952.180x9afdc96e3ca876b5b617a26ba5105012ed8c33e805c77b1616bf48c198d5cbf152026-10-13 18:41:15127,452,4540.0123,762,833.2300240881741046914.208252401218347e-102,376,283,323.000xc94de373d1fb00093431224a97475b3b2b48b9a4962d15acbe9d9c5c016d720c62026-10-14 18:32:29127,643,2120.0123,691,113.1095371469855308534.220992046158599e-102,369,111,310.950x172349c64ed3c45663650049f9e2ad3d763b1243c5c849b7d66f144f221d318672026-10-17 02:00:51128,086,7170.0123,669,235.4659212306141853334.224893539294041e-102,366,923,546.590xc999000f16f326e8868fe37f83871219be1a63f98043b0aef9ee57f46923215682026-10-17 13:29:27128,178,4950.0123,597,938.3497227318584918984.237658329214804e-102,359,793,834.970x6ec66780e0518da7c3c8b55d13b66d57400046f89ebe9df479c3c878f7b3311f92026-10-18 13:28:39128,370,3390.0123,506,585.1566972099244594574.254127059859617e-102,350,658,515.670x05a9acf81b0eae4b7ff9a12168aead25964b6b2c0a16d3d1e667b7db6f17ad99
Every row has the same shape: the transaction is sent by the treasury, to is the PancakeSwap router 0x1B81D678ffb9C0263b24A97847620C99d213eB14, the value is 0.010000000000000000 BNB, the receipt carries exactly one WBNB Transfer of 0.010000000000000000 from the router into the pool and exactly one FLAPJAX Transfer from the pool to the treasury. All nine receipts are status 1. Nonces run 30, 47, 72, 87, 104, 137, 162, 179, 216 on the treasury account, which is consistent with the buys being spread across other treasury activity rather than batched.
Totals and price
Day-by-day coverage
The programme is described as "one a day except 10-15". The nine buys do not land on one calendar date per UTC day: the buy dated 2026-10-16 in US Eastern time (22:00 EDT) is 2026-10-17 02:00:51 UTC.
Read on UTC days there are two empty dates, 10-15 and 10-16; read on US Eastern days there is exactly one, 10-15. The schedule also moves: six buys run between 18:27 and 18:46 UTC, then the programme shifts to two buys on 10-17 and one on 10-18, both near 13:29 UTC. That is a five-hour change of the daily slot, not a missed day, and it is the only thing in the data that could be read as a second gap.
Whether the 10-15 make-up buy now "owed on 10-23" already happened is a matter of the programme's internal calendar, and it cannot be settled from the chain: the treasury made one extra buy on 10-17 (two buys in 11 hours 29 minutes) and the statement does not say which obligation that buy discharged. What the chain does show is nine buys in ten days against ten scheduled dates, with 10-15 carrying none.
Third-party swaps in the same pool and window
The pool is not treasury-only. Three buys by other addresses and six sells into the pool occurred in the window; none of them is a treasury buyback buy and none is counted above.
Buys by other addresses (FLAPJAX out of the pool, WBNB in):
FLAPJAX sold into the pool, 64,163,738.18660752 in total, all from wallets that are not the treasury:
Treasury FLAPJAX flows and the balance check
Over the window the treasury received exactly nine FLAPJAX transfers, all from the pool, totalling 214,002,792.664923451883644637 FLAPJAX, and sent out 191 transfers totalling 114,630,000 exactly. The change is +99,372,792.66492346.
balanceOf(treasury) read on the token contract at the two window edges:
The difference is 99,372,792.66492346, which equals inflow minus outflow to the last digit. The Transfer log list is therefore complete for the treasury: no transfer in the window is missing from this account.
Statement verdicts
Reproducing this
Any public BSC node returns the same numbers. The scan used chunked eth_getLogs with {"address":"0x90c8889f428F9Ebb77BB8f15CAD3a50a9aC680df","topics":["0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef"],"fromBlock":"0x78ac996","toBlock":"0x78ac996"} walking 0x78ac996 (126,536,086) to 0x7a80f5a (128,454,490) in 5,000-block steps; then eth_getTransactionByHash and eth_getTransactionReceipt for each of the nine transactions above; then eth_call fee() (0xddca3f43), token0() (0x0dfe1681) and token1() (0xd21220a7) against the pool; then balanceOf (0x70a08231) against the token at both edge blocks. Amounts are raw wei divided by 1e18, and every price is the ratio of two raw wei values, so rounding never enters.
Limitations
Prepared by ourauto, 2026-10-19, from BNB Smart Chain logs only.#bsc #defi #blockchain #audit #software #coding #development #engineering #inclusive #community
FlapJax buyback program, 9-18 October 2026: nine buys re-derived from BNB Smart Chain