Cloudflare Tunnel will normalize Access-protected paths by default in January 2027
Cloudflare Tunnel changes how Access-protected ingress rules match dot segments and repeated slashes. Opt in now; test before the January 25 default flip.
Search
Search results for “Polymarket October 2026 breach”
Find published research by company, product, platform or technology.
Showing 201–220 of 558 dossiers
Grafana Marketplace opens a paid plugin channel for specialist observability developers
At ObservabilityCON 2026, Grafana opened paid plugin distribution to verified partners. Cloud customers can trial and subscribe to integrations on their Grafana bill; partner maintenance and security requirements are part of the model.
Reddit is moving third-party apps off its Public Data API and onto Developer Platform
Reddit has moved the $1,000 Developer Platform app-porting bounty cutoff to November 30 in its live portal. The separate API migration deadlines remain January 12 and March 2027, with RSS ending November 13.
GitHub Spark is shutting down August 31 — export code now and replace broken `llm()` calls
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
Artificial IntelligenceCloud & InfrastructureCompute & AI InfrastructureInference & APIsActive dossier
OpenAI says its Jalapeño chip reached tape-out in nine months with AI-assisted design
Jalapeño is working first-party silicon rather than a roadmap item, and OpenAI now says AI itself materially accelerated the design process. The distinction still matters: tape-out means the design was finalized for manufacturing; it does not mean fleet-scale production qualification or API deployment is complete.
GitHub restores repository star-history analytics without exposing individual stargazers
Repository growth tools can measure when star counts changed again without rebuilding individual-user histories. The new API deliberately separates aggregate popularity data from stargazer identity, so integrations need to distinguish trend analytics from user-level community data.
Sign in with Apple is moving new relay addresses to private.icloud.com
Apple has narrowed an earlier plan to unify Sign in with Apple and iCloud+ Hide My Email domains: only new Sign in with Apple relay addresses are moving to `private.icloud.com`, while Hide My Email stays on `icloud.com`. Existing relay addresses continue working, making this a compatibility migration rather than an address replacement.
WordPress 7.0.4 fixes an Author-level file upload path to remote code execution
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
ChatGPT Ads adds Sponsored Agents — turning ad clicks into branded AI conversations
ChatGPT Ads expands into 26 more countries. An October 29 default-on creative-enhancement change creates an immediate advertiser decision: review account and campaign opt-outs before automatically generated variations run.
Rust 1.98.1 and 1.99.1 fix separate compiler miscompilations — rebuild affected binaries
The October 15 Rust 1.99.1 release fixes a separate FFI bool miscompilation after September's 1.98.1 vtable bug. Check toolchain pins and rebuild artifacts produced by either affected compiler.
Web DevelopmentSaaSCloud & InfrastructureProduct & GrowthDeployment & DevOpsSaaS OperationsDeveloper ToolsActive dossier
Formbricks 6.1 ships scoped surveys and a breaking single-use-link migration after SpiceDB switch
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
Chartist 2.2 revives a mature SVG charting library with composable layers, SSR and terminal output
Chartist 2.x replaces its SVG charting internals with layers and server rendering, while retaining 1.x wrappers. New 2.1–2.2 export moves require migration checks.
PostgreSQL retires RHEL 9.6 and 10.0 RPM repositories, ending package updates on those minor releases
PGDG's 20 October repository retirement requires RHEL, Rocky and AlmaLinux 9.6/10.0 operators to update their OS minor release or deliberately switch to the frozen archive. Rolling EL9 and EL10 repository packages are unaffected.
PHPUnit hardens agent-read test output and repairs machine-readable XML reports
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsActive dossier
GitLab extends Flow Creator with goal-driven agent orchestration through review, tests and approvals
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
PostHog starts measuring WebMCP agent tool calls inside websites — not all bot visits
WebMCP tools can now emit PostHog's standard `$mcp_tool_call` event through posthog-js. The implementation adds privacy redaction and omits arguments/results, but only works for sites that enable the feature and initialise instrumentation before registering tools.
E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
SaaSCloud & InfrastructureMarketing & DistributionHostingEmail & LifecycleSaaS OperationsActive dossier
Stalwart 1.0.1 fixes credential exposure and tenant isolation — 1.0 migration still needs care
Stalwart 1.0.1 fixes local credential-file permissions and a tenant isolation bug, but changes Prometheus/OTLP metrics and leaves some migration WebUI cache pitfalls.
WordPress 7.1.4 fixes upgrade-window RCE, three stored-XSS paths and eMudhra trust roots
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
Ollama Cloud replaces its Free tier with Pay as you go and triples entry-level concurrency
The new $0-subscription tier no longer lists starter credits, while three simultaneous requests are now permitted. Builders should check prepaid balance, model prices and queues before relying on the service.