Find published research by company, product, platform or technology.
Showing 221–240 of 348 dossiers
Stripe expands Global Payouts and EU stablecoin issuing; its subsequent $1B internal migration provides practical lessons about payout validation, reconciliation and route-specific eligibility.
Staging tests found acme.sh 3.0.7 with --days 80 scheduled renewal 15 days after a 64-day certificate expired. Newer acme.sh and Certbot behaved differently; audit versions and overrides rather than assuming your cron is safe.
WebMCP tools can now emit PostHog's standard `$mcp_tool_call` event through posthog-js. The implementation adds privacy redaction and omits arguments/results, but only works for sites that enable the feature and initialise instrumentation before registering tools.
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
ChatGPT Ads' new default-on AI creative system can adapt ad copy and landing-page destinations using conversation context. Advertisers should audit account and campaign settings and ensure pages remain accurate.
Publishers can opt out of AI model training without necessarily leaving traditional search or AI citations. Microsoft's new page-level grounding controls introduce a migration trap for sites relying on legacy NoArchive/NoCache settings.
Reddit's Q3 shareholder disclosures set a direction towards logged-in browsing, not an immediate worldwide login wall. Q4 non-US tests follow declining search referrals, with consequences for community discovery, advertising and access to public conversations.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
Q3 Cloudflare telemetry: 18.2 million network-layer attacks, 96% under ten minutes, but far fewer terabit-scale floods.
Shopify theme authors can now bundle one paid app add-on per theme listing, opening a new monetisation route with app review and ownership restrictions.
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
GitHub Apps can now authenticate Copilot SDK workloads without a user's credentials. Organisation admins control installation permissions, usage attribution and budgets.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.