Find published research by company, product, platform or technology.
Showing 261–280 of 354 dossiers
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
The change makes heavier frameworks and dependency trees deployable to Workers without plan-specific compressed-size ceilings, but it also changes what builders need to measure: the operative limit is now uncompressed Total Upload rather than the gzip number they may have optimized around.
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
With no planned installation banner, apps should identify affected merchants and handle the migration proactively; Shopify's alternative theme app embeds still require activation on the published theme.
The change is both a media-buying default and an API migration. Advertisers that want online-only Shopping campaigns must move that intent into listing scope or the inventory filter instead of relying on `ShoppingSetting.enable_local=false`.
Sentry has completed a breaking alerting migration. Legacy alert APIs are gone; metric detection now lives in Monitors while notification routing lives in Alerts, and old direct integrations must use the replacement endpoints.
Astro 7.2’s experimental incremental-build mode attacks the page-generation phase rather than only bundling speed. Large static sites can opt routes into cache-aware reuse, but teams must choose correct cache keys and persist Astro’s cache directory in CI to benefit safely.
The change is not about where database rows live; Cloud SQL already has regional instance placement. It changes where API control traffic is processed, reducing dependence on global frontend infrastructure and making data-in-transit boundaries easier to align with sovereignty requirements.
OpenSSH 10.6p2 and Alpine backports address a critical musl/no-PAM password bypass; operators must restart sshd after upgrading.
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
Python 3.15.1 supersedes the 3.15.0 launch with an urgent certificate-trust update. New installers alone do not update existing virtualenvs: update pip, uv and certifi where applicable.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.