CVE-2026-48710 (BadHost): How a Malformed Host Header Bypasses Starlette Path Authorization

Why the model won't call your tool

Your tool is registered. It appears in tools/list . The model never calls it, or calls a different one instead. There are six reasons this happens.

3h ago ·dev.to

I Built UpstreamWitness to Track What Happens After You Submit a Fix

When you submit a pull request, bounty fix, or public security report, the hard part is often not the submission itself. The hard part comes later: Did upstream actually change in a materially related…

3h ago ·dev.to

BDD in Kotlin: The Options, and How to Choose

I've been writing acceptance tests on the JVM since 2009. Concordion first, then Cucumber on the teams around me, then Yatspec, and eventually I wrote my own.

• Choose BDD framework based on audience: developers read output, testers/analysts need artefact.
• Spek provides refactoring support and test result output for Kotlin-native projects.

3h ago ·dev.to

Why Most SOCs Alert on the Wrong Things (and How to Fix It)

If you've worked inside a Security Operations Center for more than a few months, you already know the feeling: hundreds of alerts a day, most of them noise, and the one alert that actually mattered…

• Most SIEM deployments start with vendor-supplied correlation rules, leading to alert overload.
• Improvement requires shifting focus to meaningful attacker behavior patterns and proper rule tuning.

3h ago ·dev.to