[F] [mOved] Mon langage est mieux que le tien - Page 171

https://thenewstack.io/20-years-in-the-making-gnucobol-is-ready-for-industry/
After 20 years of development, the open source GnuCOBOL “has reached an industrial maturity and can compete with proprietary offers in all environments,” said OCamlPro founder and GnuCOBOL contributor Fabrice Le Fessant, in a FOSDEM talk about the technology.

GnuCOBOL turns COBOL source code into executable applications. It is very cross-platform, running Linux, BSD, many proprietary Unixes, macOS, and Windows, even Android. And the latest version, v.32, is being used in many commercial settings.

The French DGFIP federal agency moved from a GCOS mainframe to GnuCOBOL, with the help of Le Fessant’s firm.

Several big businesses have published source code that incorporates a software package previously hallucinated by generative AI.

Not only that but someone, having spotted this reoccurring hallucination, had turned that made-up dependency into a real one, which was subsequently downloaded and installed thousands of times by developers as a result of the AI's bad advice, we've learned. If the package was laced with actual malware, rather than being a benign test, the results could have been disastrous.

Developers seethe as Google surfaces buggy AI-written codewww.theregister.comPulumi claims it has culled bad infrastructure-as-code samples

Analysis Google has indexed inaccurate infrastructure-as-code samples produced by Pulumi AI – a developer that uses an AI chatbot to generate infrastructure – and the rotten recipes are already appearing at the top of search results.

This mess started with Pulumi's decision to publish the result of its users' prompts on a curated AI Answers page. Google's crawlers indexed the resulting robo-responses – but when users find them, the AI answers are often inaccurate.

"It has happened," wrote developer Arian van Putten in a social media post over the weekend. "The number one Google result was an official Pulumi documentation page that was clearly written by an LLM (it had a disclaimer that it was) and hallucinated an AWS feature that didn't exist. This is the beginning of the end."

Nasty bug with very simple exploit hits PHP just in time for the weekendArs TechnicaWith PoC code available and active Internet scans, speed is of the essence.

It turns out that, as part of unicode processing, PHP will apply what’s known as a ‘best fit’ mapping, and helpfully assume that, when the user entered a soft hyphen, they actually intended to type a real hyphen, and interpret it as such. Herein lies our vulnerability—if we supply a CGI handler with a soft hyphen (0xAD), the CGI handler won’t feel the need to escape it, and will pass it to PHP. PHP, however, will interpret it as if it were a real hyphen, which allows an attacker to sneak extra command line arguments, which begin with hyphens, into the PHP process.

Uther (./5126) :
Heureusement, ca fait un moment que la plupart des serveur PHP ne passent plus par CGI, sinon ça serait l'apocalypse.