Find published research by company, product, platform or technology.
Showing 221–240 of 241 dossiers
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
This is a compiler-correctness fix rather than a routine patch. Code built with Rust 1.98.0 can be wrong even when the source is valid, so teams that adopted that stable release should update and rebuild affected artifacts.
The settlement has crossed from proposed agreement to approved operating constraint. Meta now says the two-hour limit counts activity across Facebook, Instagram and detected multiple accounts, while teens also gain controls for non-algorithmic feeds and autoplay; most terms are required to remain in place for ten years.
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
The checkout ScriptTag shutdown already had an earlier deadline; this is the separate storefront cutoff. Pinning an old Admin API version will not preserve write access after October, and any feature still depending on an injected storefront script stops working in March.
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
For deals and store transfers from August 10, Shopify partners can earn both subscription revenue share and a slice of merchant GMV, while the earning window becomes four years instead of perpetual.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
GitHub Issues now gives agent automations confidence levels, rationales and optional approvals, letting teams automate routine triage while holding uncertain changes for review.
From September and October, Copilot Business and Enterprise seat access becomes more tightly coupled to upfront payment. A separate September 28 policy migration enables a unified Copilot experience by default, retains github.com chat data for the life of the account and changes code review’s default effort from Lite to Balanced.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Gemini 4 Argon is now available through Google's paid API and eligible subscriptions. The introductory $2 input/$10 output rates double on December 1, and its 1M-token continuation feature requires special integration.
Haiku 5.5 resets the economics of high-volume classification, extraction and agent sub-tasks, while Anthropic also cuts Sonnet 5.5 cache-read prices and introduces API credits for Max/Team subscribers.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.