Six of eight SVG sanitizers failed PortSwigger's tests — browser parsing makes upload safety harder
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Search
Search results for “human-in-the-loop autonomy”
Find published research by company, product, platform or technology.
Showing 261–280 of 524 dossiers
Ghostty 1.4 fixes seven terminal security flaws and sharply reduces scrollback memory
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
Shopify sets offline-token cutoff dates and adds IP restrictions for public apps
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Google tells platforms to keep link-only generated pages out of Search by default
Google now advises noindex or crawl blocking for user-created pages meant for direct sharing, plus Search Console and platform-level spam monitoring.
Web DevelopmentSaaSCloud & InfrastructureProduct & GrowthDeployment & DevOpsSaaS OperationsDeveloper ToolsActive dossier
Formbricks 6.1 ships scoped surveys and a breaking single-use-link migration after SpiceDB switch
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
Artificial IntelligenceCloud & InfrastructureCloud PlatformsCompute & AI InfrastructureInference & APIsActive dossier
Cloudflare's Workers AI leaked 155 cross-tenant responses through SGLang KV cache — operators should patch
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
SaaSCloud & InfrastructureMarketing & DistributionHostingEmail & LifecycleSaaS OperationsActive dossier
Stalwart 1.0 stabilises self-hosted mail storage — but existing servers need a one-time migration
Stalwart 1.0 ships stable mail storage, new search and performance improvements; existing v0.16 installations need a migration tool, and clustered setups need Redis.
Chartist 2.2 revives a mature SVG charting library with composable layers, SSR and terminal output
Chartist 2.x replaces its SVG charting internals with layers and server rendering, while retaining 1.x wrappers. New 2.1–2.2 export moves require migration checks.
Wails 3.0 reaches stable release with a new Go desktop architecture — mobile remains experimental
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
Artificial IntelligenceCloud & InfrastructureCompute & AI InfrastructureOpen ModelsInference & APIsActive dossier
TorchNeuron makes AWS Trainium a native PyTorch device — with substantial beta operator gaps
TorchNeuron changes the software portability equation for Trainium, making it easier to test non-NVIDIA AI accelerators without rewriting the model stack. Beta gaps still demand model-by-model verification.
Google Performance Max enables sourced videos by default — and may switch on existing campaigns
A new Performance Max sourced-videos setting can add up to ten crawled videos per asset group, uploaded to a Google-owned branded YouTube channel. It is on by default for new campaigns, but sources require approval.
Bun 1.4.4 adds a built-in formatter that reads Prettier configs — but output is not always identical
Bun 1.4.4 introduces bun fmt, accelerates bun check and preserves Yarn Berry lockfiles during migration. Teams should test formatter output and unsupported plugins before replacing Prettier in CI.
NativePHP Mobile patches seven security flaws — rebuilding and app-store releases are required
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Anthropic’s public IPO filing confirms $16.3B H1 revenue and $80.7B loss dominated by financing marks
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
WooCommerce 11.3 will retire its MCP endpoint — store agents need new credentials and tools
WooCommerce 11.3 removes /wp-json/woocommerce/mcp, REST-key MCP authentication and REST-derived abilities. Migrate clients to the WordPress MCP Adapter plugin, application passwords and explicit ability metadata before upgrading.
OpenBSD 8.0 ships major platform changes — and urgent IPsec, DNS and kernel errata
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
Cloudflare tests post-quantum regional key fencing — but CDN protection is not ready yet
PQ GeoKey Manager uses hybrid cryptography, regional root keys and fail-closed key unwrapping. General availability is planned for Q1 2027; CDN integration and independent assurance remain outstanding.
NVIDIA moves AI-agent containment below the model layer with OpenShell and Sentry
The useful shift is architectural: agent permissions no longer have to depend only on the model or harness behaving correctly. OpenShell puts policy enforcement in the execution environment, while Sentry is designed to keep watching from a separate hardware trust domain.
LaunchDarkly AgentControl now versions and deploys agent skills without application releases
Agent skills join prompts and models as managed runtime configurations; approvals and pinned versions make changing agent behaviour auditable rather than an untracked edit to skill files.
Stripe Radar now bills more screened renewals and payment methods — without raising the per-screen rate
Stripe Radar Standard, Plus and Pro merchants need to recheck renewal-screening settings and invoice volume. Radar Lite remains included with standard processing, and only transactions actually screened incur paid-tier screening fees.