Video.js 10.1 adds a Scaffold skin and simpler v8 migration paths after its ground-up rewrite
The follow-up clarifies package upgrade behavior and provides a practical migration starting point for developers moving away from v8.
Search
Search results for “AIPREF AI training control”
Find published research by company, product, platform or technology.
Showing 281–300 of 380 dossiers
tinyjs fixes a string of capability escapes in its lightweight desktop runtime
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
WordPress 7.1.2 patches core RCE path as attackers move from probes to active exploitation
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
WordPress 7.1.1 closes Click2Shell’s forced-theme-install path to code execution
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
Cloudflare makes post-quantum origin TLS automatic — and cuts p90 handshake latency by more than 150ms
The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort.
Amplitude can now run web experiments before consent without writing to the visitor’s device
Amplitude’s new consent gating separates the visible experiment experience from persistence and measurement. Sites can avoid experiment flicker before a consent decision, but denied users’ buffered impressions are discarded and Analytics consent still has to be handled separately.
Google expands Demand Gen into messaging, travel offers and automated video creation
Demand Gen is becoming a broader acquisition system rather than only a visual campaign type: advertisers can test conversational lead capture, travel offers tied to destination context and AI-assisted horizontal/vertical video production from one campaign surface.
Indie BusinessMarketing & DistributionBootstrappingIndie SaaSTiny TeamsProduct EconomicsMarketplaces & PlatformsActive dossier
Zigpoll’s founder says agency-focused packaging lifted revenue per account 24% without a price increase
Zigpoll is a useful tiny-team pricing case because the claimed gain came from segment fit rather than simply charging everyone more. The founder says moving integrations down to the standard plan removed friction for agencies managing many client stores; current product pricing remains tiered primarily by survey-response volume.
Woodpecker CI 3.20.1 tightens runner credentials and tenant isolation — avoid the 3.20.0 regression
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
Railway automates CVE patch redeploys and credential-reference refreshes
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
Google expands AI Mode ads to 10 markets, including New Zealand, and launches US follow-up ads
AI Mode ads are expanding internationally, including New Zealand, and appearing in US follow-up conversations — with aggregate reporting and no AI-only campaign switch.
GitLab's CVSS 10 CI regex flaw targeted Alpine Linux — custom Ruby images can remain vulnerable after GitLab upgrades
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Ghostty 1.4 fixes seven terminal security flaws and sharply reduces scrollback memory
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
RevenueCat's 4,964-app study finds Black Friday offers lift sign-ups — not necessarily customer value
Holiday subscription offers correlate with more payers, but lower revenue per buyer and substantial selection bias complicate the economics. Christmas-only offers show no clear advantage.
Google will extract landing-page images for new Performance Max campaigns by default — even when accounts opt out
Google is changing the default for Performance Max image extraction on December 4, 2026. Existing campaigns keep their settings, but new campaigns will opt in regardless of an account-level opt-out; agencies and SaaS ad tools need a campaign-level override and careful handling of repeated asset settings.
Stripe Radar now bills more screened renewals and payment methods — without raising the per-screen rate
Stripe Radar Standard, Plus and Pro merchants need to recheck renewal-screening settings and invoice volume. Radar Lite remains included with standard processing, and only transactions actually screened incur paid-tier screening fees.
Tailscale MagicRoute beta changes how private networks select routers and service backends
Tailscale's new MagicRoute beta lets eligible organisations choose priority-based routes per client rather than regional grouping. It affects multi-region subnet access, service hosts and exit-node recommendations.
Google Preferred Sources now influences publisher visibility in AI Overviews and AI Mode
Google is moving source links higher in AI answers, testing prominent official-site panels and expanding news carousels, while Preferred Sources use has grown more than sevenfold in 2026.
Turso concurrent writes move from Cloud preview to a 0.8 engine release with new contention benchmarks
The new Turso 0.8 results add a concrete performance datapoint to the earlier MVCC preview, but benchmark workloads, transaction conflicts and production durability still require independent verification.