pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Search
Search results for “GitHub Enterprise Cloud billing”
Find published research by company, product, platform or technology.
Showing 181–200 of 345 dossiers
tinyjs fixes a string of capability escapes in its lightweight desktop runtime
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
Nuxt 4.6 decouples server APIs from Nitro and rebuilds typed fetch
The October Nuxt release lays groundwork for server-engine portability and addresses TypeScript scaling problems in large route graphs without claiming Nitro has already been replaced.
Tailcat exposes Tailscale’s WireGuard data plane without the Tailscale control plane
Tailcat remains useful as a small encrypted peer-connectivity primitive, but its first documented malware adoption changes the operational context: Kothamine can use Tailcat to avoid a conventional command-and-control domain that defenders would otherwise block.
npm v12 makes install scripts opt-in — while publishing automation gets a stage-only trust boundary
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
Laravel Vet puts a trust gate in front of Composer dependency updates
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
Homebrew 7.0 turns package vulnerability checks into a built-in workflow — after closing a sudo-capable cask flaw
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
InfluxDB’s Docker `latest` tag now jumps from v2 to v3 Core
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
Qwen3.8-27B brings stronger agentic coding into a locally deployable 27B model
The post-release evidence sharpens the original story. Qwen3.8-27B can retain useful agentic-coding performance at practical 4-bit sizes, but local model quality is not a property of the checkpoint alone: quantization, reasoning effort, context handling and the agent harness can materially change the result.
GitSpawn shows how a repository’s own Git config can escape AI coding-agent safety boundaries
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
Artificial IntelligenceWeb DevelopmentBrowsers & Web StandardsInference & APIsDeveloper ToolsActive dossier
SwarmLLM splits a 27B model across browser tabs with WebGPU and WebRTC
SwarmLLM does not route whole prompts to separate machines; it pipelines one model across browser tabs. A MacBook and iPhone can jointly hold Qwen 3.8 27B even when neither device can hold the full 15GB quantized model alone, with no inference server in the loop.
Chrome patches a V8 zero-day already being exploited in the wild
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
Omarchy 4 replaces its Linux desktop stack with a programmable Quickshell shell
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
Funes gives coding agents a local memory that can follow you across tools and machines
Funes treats agent memory as user-owned data rather than a hosted account feature: retrieval and reranking run locally, provenance stays attached to recalled passages, and cross-machine sharing is optional. The main risk is that publishing session-derived memory can still expose secrets if redaction misses them.
Tencent Hy4 preview brings a 770B open-weight model to coding and long-context knowledge work
Hy4 preview is a very large sparse model with public full and FP8 weights, native speculative decoding and a 1M-token context path. Its open release makes Tencent’s claims testable, while the 1.56TB full checkpoint keeps self-hosting firmly in server-scale territory.
Qwen3.8-Flash-Next open-sources the architecture Alibaba plans to use for Qwen4
The release is more interesting than another Qwen3.8 size point because Qwen is deliberately exposing the next architectural generation early. QSA sparse attention, gated residual streams and offloadable n-gram embeddings are now testable before the full Qwen4 family arrives.
Next.js patches two unauthenticated critical RCEs in 16.3.3 and 15.5.24
The previously pre-announced Next.js security release is now available. Teams on affected versions should upgrade to 16.3.3 or 15.5.24; the disclosed flaws can lead to unauthenticated remote code execution under specific image-optimization or Windows-hosting conditions.
OpenAI’s Codex client exposes a GenUI layer for refreshable interfaces inside conversations
RuntimeWire found a generic `genui` message path, a server-directed widget refresh endpoint and 467 versioned Learning Block manifests inside OpenAI’s Codex desktop client. The material development is not another visualization feature: it is evidence of a reusable interface layer beneath conversational answers, with important limits around what is actually public or enabled.
WordPress 7.0.4 fixes an Author-level file upload path to remote code execution
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
Ghost 7 will retire Ghost-CLI and make Docker Compose the official self-hosting path
Ghost is turning its Docker Compose preview into the default self-hosting architecture for Ghost 7 and ending normal Ghost-CLI maintenance. Existing self-hosters will need to migrate deployment assumptions, not just upgrade the CMS package.