Find published research by company, product, platform or technology.
Showing 221–240 of 271 dossiers
Cloudflare's logs are no longer an Enterprise-only export capability. Small sites can send 25GB a month to internal destinations and another 25GB externally before overage charges, but destination costs and separate Workers/OTel meters still matter.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
Developers can now profile a deployed Worker or a specific Durable Object without reproducing production traffic locally. Captures require an active isolate and measure allocations during the capture window, not retained memory.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
This is a compatibility boundary for old Windows build hosts, not the end of Rust support for 32-bit Windows applications.
The consequential change in Formbricks 6 isn't its new charts: self-hosted operators need a separate authorization service, a maintenance window and verified migration before enabling v6 traffic. Existing follow-up automations also have a December deadline.
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
The October release is more than a version bump: PHP server operators should patch document-root and header risks, then test worker/thread budgets and stricter proxy defaults before upgrading.
The break is narrow but concrete: scripts and CI/CD calling the old route paths can fail, while monitoring code that expected `connections` inline must fetch it separately.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
GitHub’s credential-response story now has both discovery and containment: enterprise owners can export SSH keys, PATs, OAuth and GitHub App tokens with ownership, scope and last-use metadata, then use selective revocation rather than invalidating every credential a user holds.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
The GA matters less as a label than as an architecture boundary. New Cloudflare WAN and Magic Transit deployments are now recommended onto a single routing fabric spanning Cloudflare One Client, Tunnel, IPsec, GRE and CNI, while legacy routing lacks several of the newer traffic-steering capabilities.
Google must build Prebid integrations, let rival publisher ad servers receive real-time AdX bids, make publisher data portable and stop preferential AdWords bidding under a six-year court-supervised remedy.
GitHub-hosted Actions jobs that use `ubuntu-latest` are about to change operating-system generation without a YAML edit; teams can test on `ubuntu-26.04` now or pin 24.04 while they migrate.
Cloudflare’s crawler controls now distinguish between refusing AI training and refusing the crawler itself. The new Disallow AI Training option is designed to keep search discoverability while expressing a training opt-out to operators that meet Cloudflare’s Accountable requirements.
The useful change is operational rather than a new PostgreSQL feature: Railway is packaging major-version migration into a managed workflow while keeping the two dangerous boundaries explicit — downtime during the upgrade and post-upgrade writes lost if you revert.
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
The distribution shift matters beyond another sales-channel integration: product discovery, checkout, attribution and analytics can now happen off the merchant’s own storefront, and some familiar client-side pixels and checkout customizations do not travel with the order.