Find published research by company, product, platform or technology.
Showing 281–300 of 568 dossiers
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
The integration brings Amazon’s catalog into YouTube’s native shopping layer. It reduces the gap between product recommendation and purchase compared with description links, but access currently requires both YouTube and Amazon affiliate eligibility and is still limited to a select group of creators.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Muse packages persistent autonomous execution, credentials, payments, app access and memory into a mainstream consumer product. A September macOS hotfix now provides an early real-world lesson: agent containment has to protect not only the cloud runtime but also the local control path into the agent.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries.
The September 17 GA changes the economics of Neon's backend: free allowances remain, but object storage, function execution and model calls are now metered on paid plans. November 2 adds an OAuth Provider plugin, still labelled beta.
The useful shift is architectural: agent permissions no longer have to depend only on the model or harness behaving correctly. OpenShell puts policy enforcement in the execution environment, while Sentry is designed to keep watching from a separate hardware trust domain.
Developers can now profile a deployed Worker or a specific Durable Object without reproducing production traffic locally. Captures require an active isolate and measure allocations during the capture window, not retained memory.
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
PIE 1.5.5 and 1.4.12 fix a low-severity temporary-file issue in the PHP extension installer that could expose long failed-build logs to other local users.
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
The August migration continues, and October's Google Ads API v26 lets eligible integrators create Local Services Performance Max campaigns and link leads. This adds a concrete API path but does not restore old LSA reports or bidding controls.