1000 results for “engineer”
A Subdomain Field That Became a Credential Harvester: SAP Cloud SDK CVE-2026-89111
SAP scores CVE-2026-89111 at 10.0. That is an unusual number for a server-side request forgery, and the reason is scope: the bug does not merely send a request to the wrong host, it hands the attacker the credentials needed to complete that request themselves. The affected package is the SAP Cloud SDK for Python, and the fix shipped in two parts, months apart, with a regression between them.
The mechanism
The SDK builds an OAuth2 token URL for the client credentials flow. Part of that URL comes from a caller-supplied value named tenant_subdomain, which the SDK substitutes into the URL by string replacement.
Whoever controls tenant_subdomain controls the destination host. When fetch_token runs, it sends grant_type, client_id and client_secret in the form body to whatever host that value points at. An attacker who can set the field to a host they operate receives the client secret directly, with no parsing trick required.
Those credentials buy a real access token from the legitimate endpoint. The token carries whatever permissions the original client held, and the documented Destination configuration stores third-party system credentials. The blast radius runs from one subdomain parameter to the credentials of every system that SDK integrated with.
Two fixes, and a window in between
The advisory lists affected versions below 0.45.2, with the fix in 0.45.2. According to the vendor, that is the whole story.
In practice it is not. Researchers tested each release and found that the module migration work in 0.53.0 reintroduced the flaw, which remained present through 0.55.0. Version 0.55.1 re-fixed it; the current release line is 0.58.5.
The per-version behaviour is reproducible. 0.45.0 and 0.45.1 send the secret to the attacker host, 0.45.2 blocks it, 0.53.0 and 0.55.0 send it again, and 0.55.1 and 0.58.5 block it. One test run against 0.53.0 captured two separate credential sets from a single request flow.
That gap is the finding worth carrying away. Anyone who patched to 0.45.2 and later upgraded to 0.53.0 for unrelated reasons became exploitable again, and no advisory said so. A version-range check driven by the vendor advisory alone would report those hosts as fixed.
Disclosure context
The issue was published at SAP Security Patch Day on 13 October 2026 alongside 19 other vulnerabilities: 4 critical, 3 high, and 4 that had been pre-published on GitHub. No in-the-wild exploitation has been reported.
Other items in the same batch matter for anyone tracking SAP exposure broadly. CVE-2026-89110 is a broken access control issue in NetWeaver Visual Composer. CVE-2026-89107 is code injection in S/4HANA. CVE-2026-89108 is a missing authorization check in Manufacturing Integration and Intelligence, scored between 9.9 and 9.1 depending on the source.
What to do
tenant_subdomain against the values your integrations actually use. It is a narrow control, but it addresses the injection point itself.The lesson that outlasts the CVE
Advisories describe the versions the maintainer knew about when the advisory was written. A regression introduced later, during a refactor, is invisible to an advisory-based scanner and to any team whose remediation reads as an instruction to upgrade past the listed version.
For a library that handles credentials, the durable control is a negative test in your own pipeline: point tenant_subdomain at a host you control, run the token fetch, and assert that no secret leaves. That test survives version changes, module migrations, and advisory text nobody has updated.
References
#sap #oauth2 #ssrf #credentialleak #software #coding #development #engineering #inclusive #community
A Subdomain Field That Became a Credential Harvester: SAP Cloud SDK CVE-2026-89111
I run the WooCommerce store behind a small online clothing shop. Most of the orders are made to order and ship from print partners in several countries, so the delivery promise differs by destination. Google's merchant listings can show that promise, and the return window, right in search results, but only if the product markup says so. WooCommerce's built-in Product schema does not.
This post walks through adding hasMerchantReturnPolicy and shippingDetails to the offer that WooCommerce already prints, without a plugin.
What WooCommerce outputs by default
WooCommerce prints JSON-LD for each product through the WC_Structured_Data class. The offer part comes from generate_product_data(), and before it is added to the markup it passes through a filter:
apply_filters( 'woocommerce_structured_data_product_offer', $markup_offer, $product );
That filter is the cleanest place to hook in. It receives one offer array and the WC_Product, and whatever you return becomes the offer in the final JSON-LD.
The return policy
Schema.org models returns as a MerchantReturnPolicy. For a fixed return window, Google wants the country it applies to, the category of the policy and the number of days. The shop in this example accepts returns for 30 days.
function shop_return_policy() {
return array(
'@type' => 'MerchantReturnPolicy',
'applicableCountry' => 'US',
'returnPolicyCategory' => 'https://schema.org/MerchantReturnFiniteReturnWindow',
'merchantReturnDays' => 30,
'returnMethod' => 'https://schema.org/ReturnByMail',
);
}
Add returnFees only if you can state it truthfully for every product. Leaving out a property is better than guessing.
Shipping details per destination
Delivery time is split into handling time (the days before the parcel leaves) and transit time. Here processing takes 1 to 5 business days, and transit depends on the region, so the code builds one OfferShippingDetails entry per country:
function shop_shipping_details() {
$transit = array(
'US' => array( 8, 15 ),
'CA' => array( 8, 15 ),
'GB' => array( 8, 15 ),
'AU' => array( 10, 20 ),
);
$details = array();
foreach ( $transit as $country => $days ) {
$details[] = array(
'@type' => 'OfferShippingDetails',
'shippingDestination' => array(
'@type' => 'DefinedRegion',
'addressCountry' => $country,
),
'shippingRate' => array(
'@type' => 'MonetaryAmount',
'value' => SHOP_SHIPPING_RATE, // your real rate for this destination
'currency' => 'USD',
),
'deliveryTime' => array(
'@type' => 'ShippingDeliveryTime',
'handlingTime' => array(
'@type' => 'QuantitativeValue',
'minValue' => 1,
'maxValue' => 5,
'unitCode' => 'DAY',
),
'transitTime' => array(
'@type' => 'QuantitativeValue',
'minValue' => $days[0],
'maxValue' => $days[1],
'unitCode' => 'DAY',
),
),
);
}
return $details;
}
The rate is a constant here on purpose. If the rate differs by country or by cart total, read it from your shipping zones instead of hard-coding one number for everything.
Hooking it in
add_filter( 'woocommerce_structured_data_product_offer', function ( $offer, $product ) {
if ( ! $product instanceof WC_Product || ! $product->is_purchasable() ) {
return $offer;
}
$offer['hasMerchantReturnPolicy'] = shop_return_policy();
$offer['shippingDetails'] = shop_shipping_details();
return $offer;
}, 10, 2 );
Put this in a small site plugin or in the child theme's functions.php. A site plugin survives a theme switch, which is why I prefer it.
Checking the result
View the page source of a product and search for application/ld+json. WooCommerce prints the block near the end of the page. Then paste the product URL into Google's Rich Results Test and into the Schema Markup Validator at validator.schema.org. The first tells you whether the page is eligible for merchant listing features, and the second catches typos in types and property names.
After a few days, the Merchant listings report in Search Console shows whether Google has picked the fields up across the catalog, along with any products that are missing a required property.#woocommerce #wordpress #php #seo #software #coding #development #engineering #inclusive #community
Adding return and shipping details to WooCommerce product schema
Small detail that made me write this: when I asked Perplexity "How do I check if ChatGPT recommends my product?" on 24 Oct 2026, 2 of its 10 sources were dev.to posts. Not mine, other authors. So if you write about this topic here, you are on a platform that actually gets pulled into answers.
Here is the method I use to check that week over week, without a paid tool. It is boring on purpose. Boring is reproducible.
Why bother logging at all
I ran 8 fixed buyer questions on ChatGPT, Gemini and Perplexity on 17 Oct and 24 Oct. Two things stood out in the data:
If the answers move that much, a single check tells you very little. You need the same questions, asked the same way, logged the same way, repeatedly.
(And yes, for transparency: my own stuff appeared in 0 of 40 answers across both weeks. The method works fine for measuring zero.)
Step 1: freeze your questions
Write 8 to 20 questions a buyer would type, without your brand name in them. All three engines recommended testing somewhere between 10 and 50 prompts, so pick a number you will actually keep up.
Then freeze them. Put them in a file, give each an ID, and never reword. Mine look like this:
Q1 | How do I check if ChatGPT recommends my product?
Q3 | What tools can I use to see if AI assistants cite my site?
Q8 | What are cheap or free tools to monitor my brand's visibility in AI answers?
If you change the wording in week 3, you cannot compare week 3 to week 1. That is the whole game.
Step 2: control the session
Record the session state as data, because it changes the answer:
Perplexity's own answer to Q1 recommended running each prompt 3 times in a clean session, on different days. Gemini said 3 to 5 runs in a temporary chat the week before. I currently do one run per question per engine, which is the weak point of my setup. If you have the time, do 3 and record the run number.
Step 3: log with a fixed schema
This is the header of my log.csv, plus a run column I recommend adding:
date,engine,question_id,run,web_search_or_sources_shown,cited_urls,brands_tools_named,our_presence,note
A few rules that saved me later:
blocked. Missing data you documented is still data.Keep the raw answer for each row in its own text file (raw/2026-10-24/perplexity-Q1.txt). The CSV is for counting, the raw file is for rereading.
Step 4: compute two simple numbers
You do not need a dashboard. Two numbers per week are enough:
The second one is underrated. It tells you how stable the "slot" you are trying to win actually is.
Step 5 (optional): the GA4 side
Logging answers tells you if you are cited. It does not tell you if anyone clicks. On the two GA4 questions, all three engines gave essentially the same answer both weeks: use GA4's AI Assistant channel, check session source/medium, and build a custom channel group above Referral with a regex. Perplexity's version of the filter:
chatgpt\.com|chat\.openai\.com|openai\.com|perplexity\.ai
Two caveats the engines themselves gave: some AI visits land as Direct, and Perplexity traffic can still show up under Referral even with the AI Assistant channel. I do not have my own GA4 numbers to share here, so treat this as the consensus answer, not my results.
What the engines will not tell you
Every engine now recommends a manual spreadsheet, alongside tools like Otterly, Peec, Profound and the HubSpot AI Search Grader. The method is not a secret. What the free advice skips is discipline: frozen wording, controlled sessions, exact URLs, week-over-week comparison.
I am on week 2 of doing this in public. If you run the same kind of log, I would genuinely like to compare overlap numbers in the comments.#seo #ai #analytics #tutorial #software #coding #development #engineering #inclusive #community
A reproducible way to log whether ChatGPT, Gemini and Perplexity cite you (with the CSV I use)
Android & Kotlin Deep Dive Package (Manifest Android Interview + Practical Kotlin Deep Dive) by Jaewoong is the featured bundle of ebooks 📚 on Leanpub!
The ultimate guide to cracking Android technical interviews and unlocking the 'How' and 'Why' behind Kotlin fundamentals and internal mechanisms.
Link: https://leanpub.com/b/android-kotlin-deep-dive
#Computer_programming #Android #Kotlin #Engineering #Software
This video tells the story of Malone Lam, a 20-year-old from Singapore who helped steal over $230 million worth of Bitcoin through an elaborate social engineering scam. No sophisticated hacking tools or complex code, just deception, impersonation, and a convincing scheme.
From scamming Minecraft players to tricking a wealthy cryptocurrency investor into handing over access to his Bitcoin, Lam's activities escalated into one of the largest cryptocurrency thefts in history. The stolen fortune funded an extravagant lifestyle filled with luxury cars, lavish mansions, private jets, and nightclub bills reaching hundreds of thousands of dollars.
But the spending spree eventually attracted the attention of federal investigators, leading to arrests and a sprawling investigation into where the stolen Bitcoin went, much of which remains unaccounted for.
Video Credit: youtube.com/@InVoyceYT