Find published research by company, product, platform or technology.
Showing 201–220 of 233 dossiers
SnapStart previously covered only selected managed runtimes; extending it to container images changes the latency-versus-packaging trade-off for teams shipping large dependencies or standard container bases, with regional exclusions and runtime-specific guidance still applying.
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
YouTube’s 2027 YPP restructuring changes entry, ongoing Shorts earnings and channel-activity rules. Since August 24, public views count from the first frame, while earnings and eligibility still depend on engaged or qualified views.
Patreon is no longer only a destination for fans who already know a creator: most creators now have access to a discovery feed and public-post funnel, with vendor-reported membership gains suggesting distribution inside Patreon is becoming a meaningful acquisition channel.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
Stalwart 1.0.1 fixes local credential-file permissions and a tenant isolation bug, but changes Prometheus/OTLP metrics and leaves some migration WebUI cache pitfalls.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Bun 1.4.4 introduces bun fmt, accelerates bun check and preserves Yarn Berry lockfiles during migration. Teams should test formatter output and unsupported plugins before replacing Prettier in CI.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
The RC2/GA schedule has not changed. A PostgreSQL committer now explains why review and backpatch workload overwhelmed the release process, with caveats around attributing every extra bug to AI.
PQ GeoKey Manager uses hybrid cryptography, regional root keys and fail-closed key unwrapping. General availability is planned for Q1 2027; CDN integration and independent assurance remain outstanding.