PVS-Studio

Happy Halloween! #memes #programminghumor

A junior developer ventured out to his first developer conference. Far away from home he was for the very first time, and everything seemed so alien. The morning was calm, and the road ahead promised no horrors. Still, the dev felt anxious, as if something bad were looming over his head, like a hex or an evil curse… But who could've cursed him? Suddenly, the yellow, four-wheeled beast that had carried our hero to the train station had lost its sense of direction and collided with another four-wheeled creature. Thankfully, the little dev was unharmed, but the train left the station without him. Later than sooner the dev arrived to his destination, mere ten minutes before his own conference talk. Alas, not a single living soul showed up. The only audience he had were two half-dead flies lazily buzzing by the window. He stood there, listening to the buzzing and watching the empty conference hall. The empty conference hall watched him back. Unable to bear the sad sight, he turned his gaze to the projector… and immediately froze in terror. The version of the presentation he prepared for his talk was outdated! And the worst part of all that? He gave the talk on Friday. Yes, you guessed it right: it was Friday the 13th! #halloween #spookystories #development #developeradvocate #devrel #devlife

C++ gives you full control over memory, and bit fields take it down to a single bit. However, when it comes to saving memory, order and predictability end. Let’s see how bit fields actually work. pvs-studio.com/en/blog/posts… #Cpp #Programming #ProgrammingTips #Compiler

In the ancient halls of FFmpeg, a vulnerability lay sleeping. For sixteen years it lingered, hidden in the H.264 codec, while fuzzers and mortal reviewers searched the shadows in vain. FFmpeg was no ordinary relic: one of the world's most thoroughly tested software projects, it had endured millions of randomly generated video files, each a fresh attempt to awaken some lurking horror. Yet suddenly, the newborn synthetic creature, Claude Mythos Preview, found what others had missed. Deep within the decoder, a sentinel stood guard with a fatal flaw. Feed it a single frame containing 65,536 slices, and the number 65,535 would collide with the marker for an empty space. A nonexistent neighbor would appear real, memory would be written out of bounds, and the process would crash. Thankfully, this was no world-ending curse: the flaw was not considered critical, and turning it into a working exploit would likely prove difficult. The chilling discovery was only the beginning, though: after several hundred runs costing roughly $10,000, Mythos Preview uncovered more vulnerabilities across FFmpeg's H.264, H.265, and AV1 codecs. Three have been fixed in FFmpeg 8.1, while others await responsible disclosure. Sixteen years in the dark, countless eyes searching, but the monster was there all along… Real story is here > anthropic.com/research/mytho… #Halloween #DevStroies

How not to confuse SAST, DAST, and IAST? Application Security Testing (AST) is a crucial part of DevSecOps. But with different testing approaches available, how do you use them effectively? •SAST (Static Application Security Testing) analyzes source code to detect vulnerabilities early in development and integrates into CI workflows. •DAST (Dynamic Application Security Testing) tests applications while they run. Contrary to common misconceptions, advanced DAST solutions can also run in CI/CD pipelines. •IAST (Interactive Application Security Testing) combines advantages and drawbacks of both SAST and DAST. Although integrating it into the software development lifecycle can be more complicated, its versatility makes the effort worthwhile. No single solution guarantees 100% security. Combining testing approaches at appropriate development stages helps improve source code security and catch vulnerabilities before they become real threats. Don't overlook third-party components, either. Proprietary or open-source, none comes with a guarantee of security. Full article > pvs-studio.com/en/blog/posts… #CybersecurityAwarenessMonth

That's the place where the PVS-Studio analyzer has detected the error. Can you find what happened here? Answer: pvs-studio.com/en/blog/posts… #Golang #PVS_Task #Debugging

Once upon a midnight dreary, while the npm kingdom slumbered, a familiar horror stirred in the dark. Shai-Hulud, the hideous worm, had returned. This time, it brought a new nightmare: CHAINDROP. The key maintainer fell prey to unseen hands, and stolen npm credentials became the worm's wicked keys. Through a cursed preinstall hook, it slithered into packages, spreading its poisoned code to every repository within its grasp. More than four hundred npm packages lay compromised with two billion downloads. Yet the worm hungered for more than code. It prowled developers' machines, hunting credentials for AI tools, cloud services, GitHub, and beyond—further and further. Then, beneath the cover of obfuscated scripts, it encrypted its stolen treasures and sent them into the night. And should a developer open an infected repository? The nightmare might unfold without a single further touch. So, fear the gifts arriving from the npm registry. Let new releases linger before inviting them into your sacred builds. Head the warning: revoke compromised tokens, rotate exposed secrets, and enable two-factor authentication! For in the haunted halls of the software supply chain, not every package comes in peace… Real story > elastic.co/security-labs/thr… #Halloween #DevStroies #programminghumor #npm #cybersecurity #ShaiHuludAttack

Could the C++ community end up stuck maintaining nothing but legacy code? We’ll get into that on the podcast. Full video > pvs-studio.com/en/blog/video… #Cpp #LegacyCode #C++2026 #Development #Programming

🎃 Some bugs don’t show up until the lights go out. This Halloween, we’re sharing a few spooky dev stories all week👻 Deep in the night, a developer wrote a plugin. In the dev build, everything worked flawlessly. He tested it again and again, and the code obeyed his every command. Then he downloaded the build from the server. The plugin launched… and froze. Functions vanished; entities no longer recognized one another. Everything that had worked just yesterday crumbled to dust. In horror, the developer went back to the source code, but everything was still there. He rebuilt the plugin, and it worked. He downloaded the server build again, and it broke once more. He ran the build a third time. It broke again. Then the developer understood. Someone had tied the logic to depend on entity names instead of proper object references. The obfuscator had quietly renamed those entities to meaningless strings of characters, and the code no longer recognized them. From that day on, the developer feared server builds more than any compiler error. #Halloween #DevStroies #programminghumor

🧵We ran PVS-Studio on the Create mod for #Minecraft (written in Java) and found a logging crash. Here's the client-server train movement package handler. The condition triggers in two cases:

like a knife to the heart... 💔 #memes #programminghumor

Our Developer Advocate shows the example of a Trojan Source Attack, a vulnerability that exploits formatting characters. Full video: youtu.be/gdF_AObnq6Y Subscribe to our newsletter: pvs-studio.com/en/subscribe/… #TrojanSource #CybersecurityAwarenessMonth #Compiler

Another chapter of Game++ is live on our website! Why a simpler solution that delivers slightly less performance is the better engineering decision? Sergei Kushnirenko explores this and other game engine optimization trade-offs. pvs-studio.com/en/blog/posts… #gamedev #GameOptimization #cpp

Hey, did you forget? GTA III turns 25 while we wait for GTA VI. Congrats to the devs @RockstarGames, and from us too. 😍 #GTAIII #GTAVI #GameDev