Find published research by company, product, platform or technology.
Showing 261–280 of 339 dossiers
The practical change is that debugging a Cloudflare-backed application no longer has to stop at the Worker boundary: one trace can follow security, cache, routing, Worker and origin handling, while logs and traces move toward one query and pricing model.
The security shift is deeper than running application containers as non-root: the node stack itself can now live inside a user namespace. The feature is enabled by default in 1.37, but clusters do not become rootless automatically and CNI/CSI compatibility still needs testing.
AWS is changing how Lambda introduces managed runtimes: Node.js 26 and Python 3.15 are available in public preview before GA, with normal runtime identifiers that automatically graduate when the runtimes become production-ready.
The pilot attacks a persistent evaluation trade-off: labs do not want to reveal frontier-model internals, while evaluators do not want benchmark prompts leaking back to the model provider. DeepMind says a Singapore AI Safety Institute pilot kept both sides’ sensitive assets hidden during execution.
The Assistants API shutdown date has passed. OpenAI’s deprecation documentation lists August 26, 2026 as the removal date and directs developers to Responses and Conversations for replacement workloads.
Google’s September Search changes now form a broader migration story: legacy campaign-level Broad Match and standalone Automatically Created Assets settings will be converted into AI Max, while language targeting stops affecting Search delivery and related API mutations begin failing.
This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots.
Shopify theme authors can now bundle one paid app add-on per theme listing, opening a new monetisation route with app review and ownership restrictions.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
Preact's long-awaited major release brings concrete rendering changes and a packaging break. Most modern projects should migrate easily, but old import paths and CommonJS tooling need attention.
WordPress 7.1.4 is a new security release; 7.1.3 is no longer the latest patched 7.1 build. Operators should update promptly.
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
16.4 fills gaps in the new navigation/caching model and adds ensureStatic checks, while preserving a separate migration path for existing routes.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
DV360's new bulk-campaign file format isn't a drop-in CSV upgrade: targeting expands, YouTube vendor columns change, and API support lags the interface. Integrators should audit parsers before migrating.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.