GitLab patches a CVSS 10.0 CI/CD regex RCE — and five more high-severity flaws
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
Search
Search results for “private package automation”
Find published research by company, product, platform or technology.
Showing 181–200 of 258 dossiers
Node.js fixes Brotli code-execution risk and TLS hostname bypasses in October security release
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
Laravel discloses critical TokenGuard account takeover flaw and a separate data-loss bug
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
WordPress 7.1.1 closes Click2Shell’s forced-theme-install path to code execution
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
GitHub Actions is moving `ubuntu-latest` to Ubuntu 26.04 — test before October 19
GitHub-hosted Actions jobs that use `ubuntu-latest` are about to change operating-system generation without a YAML edit; teams can test on `ubuntu-26.04` now or pin 24.04 while they migrate.
K2 Horizon opens more than model weights — including training data, code and intermediate checkpoints
K2 Horizon is notable less for another benchmark claim than for reproducibility: IFM is publishing model weights, architecture, training code, data or construction recipes, evaluation resources and intermediate training material instead of stopping at a final checkpoint.
Web DevelopmentMarketing & DistributionBrowsers & Web StandardsDeveloper ToolsMarketplaces & PlatformsActive dossier
Chrome Web Store now defaults publishers to two extension slots and is retiring Featured badges
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
Google is writing positive-only review summaries inside Search ads — and advertisers cannot edit them
Google Ads now documents positive-only AI review summaries inside Search ads in the US, UK, Australia and India. Advertisers cannot customise the text; source, opt-out and reporting controls remain unclear.
GitHub Copilot adds model-judged permissions to its GA agent sandbox — with unattended-run traps
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
Google Performance Max enables sourced videos by default — and may switch on existing campaigns
A new Performance Max sourced-videos setting can add up to ten crawled videos per asset group, uploaded to a Google-owned branded YouTube channel. It is on by default for new campaigns, but sources require approval.
Artificial IntelligenceWeb DevelopmentAI AgentsWordPressBrowsers & Web StandardsDeveloper ToolsActive dossier
WebMCP gives websites a structured tool layer for browser agents
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Artificial IntelligenceWeb DevelopmentSaaSIndie BusinessAI SaaSAI CodingProduct EconomicsDeveloper ToolsActive dossier
Cloudflare cuts AI code-review cost 68% by fixing cache misses and testing model effort
A detailed engineering case study links a 68% AI-review cost reduction to prompt-cache structure and effort tuning, with security-review trade-offs still unresolved.
pgBackRest 2.60 makes corrupt-page checks block restores and backup expiry by default
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
Forgejo 17.0 expands self-hosted CI — but existing Actions webhooks need manual migration
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
Google Ads API shifts to twice-monthly releases without doubling migrations
Google Ads API v26 begins a twice-monthly update cadence. Minor releases remain additive and sunset with their major version, so developers need a faster discovery workflow rather than twice as many breaking migrations.
Fitbit’s legacy Web API shuts down October 30 — integrations must move to Google Health API
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
Web DevelopmentCloud & InfrastructureCompute & AI InfrastructureDeployment & DevOpsDeveloper ToolsActive dossier
OpenSSH 10.6 turns on hybrid post-quantum signatures and disables compression to cut side-channel risk
The release is more than routine maintenance. OpenSSH is changing cryptographic defaults, sacrificing some compression effectiveness for side-channel safety, and warning that AI-assisted security reports are pushing it toward a faster release cadence.
SaaSCloud & InfrastructureIndie BusinessMarketing & DistributionIndie SaaSEmail & LifecycleSaaS OperationsDatabases & StorageActive dossier
Buttondown cut its database from 2TB to 750GB by deleting three legacy tables
Buttondown’s 'Great Pruning' is a small-SaaS operations story about deleting architecture rather than adding it. The company removed duplicated or over-retained request and email-event data after changing how those workloads were processed.
beehiiv raises paid-plan prices as newsletters expand into an all-in-one creator platform
The pricing change is also a packaging change: beehiiv is charging more for paid tiers while putting newsletters, websites, podcasts, community and digital products across the plan family and extending self-serve scale.
Artificial IntelligenceCloud & InfrastructureAI AgentsCloud PlatformsDatabases & StorageActive dossier
Supabase acquires Turso as AI agents become database creators
The funding headline is less interesting than the workload signal: Supabase says agents now create most new databases on its platform, and it is buying Turso to handle higher-volume database creation for those workloads.