Find published research by company, product, platform or technology.
Showing 241–260 of 324 dossiers
The useful shift is architectural: agent permissions no longer have to depend only on the model or harness behaving correctly. OpenShell puts policy enforcement in the execution environment, while Sentry is designed to keep watching from a separate hardware trust domain.
Railway has not confirmed every customer was breached. Precautionary all-customer rotation guidance, revoked API tokens and deployment disruption make this actionable for builders.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Small SaaS teams can now move supported Paddle setup and billing tasks into Claude Code, Codex and similar agent workflows, but production account writes still require careful access control; native metered billing is not generally available.
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
Clairic joins Clef as a specialised one-pass model on Workers AI; typed extraction has a different failure model from LLM-generated JSON, with vendor-only benchmarks and preview limitations.
The interesting signal is segmentation, not 'seat pricing is dead': vertical SaaS operators expect payments and finance to become a larger part of revenue, while horizontal platforms expect usage and hybrid software charges to lead. The survey is vendor-produced and forward-looking.
The new AI-music labels change metadata and listener-facing disclosure for labels, distributors and creators, but do not by themselves establish lost monetisation, algorithmic suppression or reliable automated detection.
Private ingress joins existing private egress for Scaleway Serverless Containers. The new option can isolate services inside a VPC, but private DNS, TLS, authentication, cold-start and network-scope constraints still matter.
Developers get another paid web retrieval option for coding agents and applications; the introductory harness exemption expires October 31.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Production integrations using GPT-4o, GPT-4o mini, GPT-4.1 or GPT-4.1 mini dated snapshots need model inventory, tool-call regression testing and migration before January 14, 2027.
Stripe expands Global Payouts to 160 stablecoin markets and 100-plus fiat markets, with stablecoin-backed Issuing cards launching in 27 EU countries; the announcement is about financial-product infrastructure, not ordinary subscription checkout.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
The existing coverage-first mode keeps more query detail at the cost of possible series growth. Cost-first applies all reductions but only restores detail within the same series budget; it is a guardrail against metric-cardinality spikes, not a guarantee of a fixed bill.