Find published research by company, product, platform or technology.
Showing 281–300 of 354 dossiers
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
Oracle's Visual Builder availability change closes two hosted app-building routes to new customers, but it is not a shutdown or migration deadline for existing deployments.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
This is a platform architecture migration rather than a user-facing feature. Pantheon says no action is required, but builders operating storage-sensitive WordPress or Drupal workloads should know when their tier moves and verify backup, restore and file-handling behavior around the change.
The DuckLabs deal separates company ownership from project governance: AWS gets the team behind DuckDB, while the DuckDB Foundation keeps stewardship and the MIT license stays in place. Builders should watch whether that separation remains meaningful as AWS integrates the Duck Stack into its analytics services.
Apple has narrowed an earlier plan to unify Sign in with Apple and iCloud+ Hide My Email domains: only new Sign in with Apple relay addresses are moving to `private.icloud.com`, while Hide My Email stays on `icloud.com`. Existing relay addresses continue working, making this a compatibility migration rather than an address replacement.
This is a platform migration with a real rewrite boundary. Existing HTML games need to be rebuilt through Unity, Cocos or Laya, then have login, ads, purchases and other TikTok capabilities reintegrated and retested before relaunch.
CVE-2026-119741 affects rsync through 3.5.1. The 3.5.2 fix bounds checksum work; a hostile receiver can otherwise drive CPU exhaustion on senders, including through repeated daemon connections.
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
Workers KV Instant is built for hot-path flags, not general storage: Cloudflare quotes 1.62ms p99 reads, $0.20 per million reads, $0.10 per write and $100 per MB each month. Private beta limits are strict.
Shopify is turning off its old cross-merchant catalog REST API on November 2. The replacement is a UCP-compatible MCP server, not a renamed URL: agents must remap tools, payloads and saved-catalog identifiers.
WooCommerce is removing unnecessary block bootstrap work from non-rendering requests. The performance gain is concrete, but extension authors need to understand the new registration boundary rather than assuming Woo blocks are always initialized.