Issue #117
Two auth bypasses hit Nginx-UI, plus overlooked stdlib corners
Nginx-UI picks up a pair of advisories worth paying attention to if it is anywhere in your stack: TOTP and passkey enrolment skip re-authentication, which turns into persistent account takeover, and the Casdoor SSO callback ships a constant state parameter that opens the door to login CSRF. Away from the security tracker, there is a quieter piece on small standard-library features backend developers forget exist, which is a reasonable antidote to reaching for another dependency this week.
Tuesday, October 20, 2026 · Issue #117
🐿️ Two auth bypasses hit Nginx-UI, plus overlooked stdlib corners
Nginx-UI picks up a pair of advisories worth paying attention to if it is anywhere in your stack: TOTP and passkey enrolment skip re-authentication, which turns into persistent account takeover, and the Casdoor SSO callback ships a constant state parameter that opens the door to login CSRF. Away from the security tracker, there is a quieter piece on small standard-library features backend developers forget exist, which is a reasonable antidote to reaching for another dependency this week.
Discussions 2
Show HN: Erlang Concepts in Golang
Read on Hacker News I’ve always been facinated by talks on erlang and elixir. It was intriguing to me how Erlandson was used to do amazing fault-tolerant deployments of cell phone technology, how it could do live softw
Articles 5
Browser Cookies: What Are They, How Are They Used, and How Can They Be Stolen?
Read on Dev.to In this post, I’ll cover: What cookies are When and why cookies are used How cookies can be...
Managing AI Agents and your ‘Claws’
Read on Medium TLDR: This article is introducing the problem space of security for AI Agents and describes a project I have recenly vibe coded that helps… Continue reading on Medium »
From Overdue Tasks to Dynamic Rewards: Redesigning Knowledge Allocation in Web3 Architecture
Read on Medium From Overdue Tasks to Dynamic Rewards: Redesigning Knowledge Allocation in Web3 Architecture Continue reading on Medium »
Small Go Features Most Backend Developers Forget Exist
Read on Medium Four standard library gems that save you from writing custom helpers or pulling third-party deps. Continue reading on Level Up Coding »
Your org chart read 55,987 rows to draw the first 43
Read on Medium It worked in dev · Episode 15 · technique: level order with a queue Continue reading on Level Up Coding »
Videos 5
Golang Microservices Full Course | gRPC, Fiber, RabbitMQ, PostgreSQL & Docker
Read on YouTube JOIN ACEDEVHUB COURSE WAITLIST FOR FREE ▭▭⭐ https://acedevhub.com/courses ⭐▭▭ DOWNLOAD SOURCE ...
Go vs Rust vs Zig in 2026: Which Language Should You Actually Use?
Read on YouTube Three powerful programming languages. Three different engineering philosophies. Go prioritizes simplicity, fast development, ...
Modul 2 : Struct, Pointer, & Interface - Belajar Golang 2026
Read on YouTube Lanjut ke Modul 2 dari series "Belajar Golang 2026"! Di video kali ini, kita bakal bedah 3 "senjata utama" di bahasa Go: Struct ...
IEEE TSE: "GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement"
Read on YouTube New paper accepted: "GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement" Authors: ...
Why Go Runs the Cloud ☁️ #golang
Read on YouTube Go is the language behind Kubernetes, Docker and much of modern cloud infrastructure. Simple, readable syntax, compiled to ...
Trending 5
Security 3
TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
Read on Go Vulnerabilities TOTP / passkey enrolment requires no re-authentication, enabling persistent account takeover in github.com/0xJacky/Nginx-UI
Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI
Read on Go Vulnerabilities Casdoor SSO callback uses a constant state parameter (login CSRF) in github.com/0xJacky/Nginx-UI
Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core
Read on Go Vulnerabilities Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core
Social 3
Preview: New SIMD #compression mode in #golang minlz that uses pivco entropy cod
Read on Bluesky Preview: New SIMD compression mode in golang minlz that uses pivco entropy coding on top of LZ matching. Compression like ZStandard with 2-5x faster decompression. Currently implemented with AVX2, AVX
The monotonic clock used on Windows by time.Now will have a resolution of 100 na
Read on Bluesky The monotonic clock used on Windows by time.Now will have a resolution of 100 nanoseconds starting in Go 1.28 🥳. Previously, its resolution was on the order of milliseconds . This will improves the
yzma 1.30 is over 2.6 times faster at embeddings than Ollama or @docker.com Mode
Read on Bluesky yzma 1.30 is over 2.6 times faster at embeddings than Ollama or @docker.com Model Runner! New benchmarks here: yzma.ai/docs/referen... llamacpp golang localAI ollama dmr