Find published research by company, product, platform or technology.
Showing 221–240 of 254 dossiers
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
The August warning is now an operational requirement for new integrations and tests, not merely an upcoming migration. Older integrations remain on a later, unannounced enforcement timetable.
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
The multi-retailer cart, previously previewed in May, is now available in the US. Price alerts, promo-code suggestions and Google Pay or merchant checkout could reshape how ecommerce sellers measure product discovery and conversion.
The practical change is that debugging a Cloudflare-backed application no longer has to stop at the Worker boundary: one trace can follow security, cache, routing, Worker and origin handling, while logs and traces move toward one query and pricing model.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Jalapeño is working first-party silicon rather than a roadmap item, and OpenAI now says AI itself materially accelerated the design process. The distinction still matters: tape-out means the design was finalized for manufacturing; it does not mean fleet-scale production qualification or API deployment is complete.
Muse Voice Transcribe gives voice-app builders one streaming model for transcription, speaker separation and turn detection instead of stitching those stages together. Its low published price is notable, but Meta’s benchmark claims still need workload-specific validation.
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
The interesting part is not another AI scanner. Cloudflare is connecting source-code evidence to what is actually deployed and being attacked at the edge, validating findings outside the model, then preparing both a code patch and, where appropriate, a narrowly scoped WAF mitigation for customer review.
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
beehiiv has moved AI crawler policy from a voluntary robots.txt signal to an enforceable publisher control for Max and Enterprise custom-domain sites. Its new dashboard tracks 22 AI and search crawlers, while separate structured-data and llms.txt features target AI discovery rather than access control.
Cloudflare Workflows now prices steps and persisted state on paid plans, making workflow structure and retention part of the cost calculation for durable jobs and AI automation.
Render is reshaping Workflows economics as it reaches GA: most small and I/O-heavy tasks should get cheaper under Flex, while task-state retention becomes a new line item and fixed-size Pro tiers remain for heavier compute.
DynamoDB vector indexes add native similarity search through SearchVectors and now have clear per-GB write, search and storage pricing, plus published throughput quotas.
The incidents do not have a proven common attacker. Wiz's forensic evidence shows downstream abuse and resale of stolen keys, not that every platform breach caused the same misuse.
Cloudflare Private Origins is GA, but not a one-click option for every account: it needs a private-network connection, entitlement and routing setup, and Argo Smart Routing and Aegis remain unsupported.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
The new Turso 0.8 results add a concrete performance datapoint to the earlier MVCC preview, but benchmark workloads, transaction conflicts and production durability still require independent verification.