Find published research by company, product, platform or technology.
Showing 261–280 of 543 dossiers
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
CVE-2026-119741 affects rsync through 3.5.1. The 3.5.2 fix bounds checksum work; a hostile receiver can otherwise drive CPU exhaustion on senders, including through repeated daemon connections.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
ParticleDB's claimed ACID guarantees failed Jepsen tests: acknowledged writes disappeared, queries returned wrong rows, and even healthy single-node tests exposed integrity faults.
The incidents do not have a proven common attacker. Wiz's forensic evidence shows downstream abuse and resale of stolen keys, not that every platform breach caused the same misuse.
The affected-customer count and entry point remain unconfirmed. Revoking keys at the issuing provider matters more than simply changing a platform variable.
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
MLflow CrewAI autologging silently logged API keys; 3.17.0 patches it, but previously exported traces and keys still need remediation.
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
Google released DV360 API v5 in public beta on October 22. Integrators need to remap inventory deals and auction packages, update Demand Gen/YouTube audience logic, and move Customer Match writes to the Data Manager API.
Getty Images filed Chapter 11 to implement an agreed restructuring, not to shut down its image marketplace. The plan includes up to $533m of new equity, up to $143m of financing and a proposed move to private ownership.
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Effect 4's performance and LTS claims remain, but 4.0.2 explicitly marks some formerly unlabelled APIs unstable without changing their current behavior, signatures or types.
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
The interesting signal is segmentation, not 'seat pricing is dead': vertical SaaS operators expect payments and finance to become a larger part of revenue, while horizontal platforms expect usage and hybrid software charges to lead. The survey is vendor-produced and forward-looking.
A new buyer survey connects the shift from SaaS seats to agent usage with real budget anxiety: 46% report higher-than-expected agent costs and 45% say oversight eats more than a quarter of expected productivity gains. Preferences are not purchasing outcomes.
Google is moving source links higher in AI answers, testing prominent official-site panels and expanding news carousels, while Preferred Sources use has grown more than sevenfold in 2026.
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.