Find published research by company, product, platform or technology.
Showing 281–300 of 410 dossiers
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
Notion Workers are now metered inside the same credits system as Custom Agents. The important builder shift is that schedules, webhook fan-out and agent tool-call counts now directly affect cost.
Small SaaS teams can now move supported Paddle setup and billing tasks into Claude Code, Codex and similar agent workflows, but production account writes still require careful access control; native metered billing is not generally available.
A detailed engineering case study links a 68% AI-review cost reduction to prompt-cache structure and effort tuning, with security-review trade-offs still unresolved.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
The interesting change is economic as much as benchmark-driven. Anthropic is compressing capability that previously justified its larger Fable tier into Opus pricing, while cutting Opus list prices and expanding immediate availability across the major clouds.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
The counting-rule change is no longer theoretical. Early post-cutover data suggests public views can materially outpace Engaged views, with the size of the gap varying by channel size, category and discovery surface.
This is not a normal container refresh. InfluxDB 3 is a ground-up architecture change with different query and storage assumptions, and Flux is not supported. Treating `latest` as a harmless moving patch tag can therefore turn an ordinary image pull into an unplanned database migration.
Microsoft's October 13 Topics Portfolio beta shows AI-grounding queries that cite rivals but not your site, grouped by theme with approximate demand and competition measures; access depends on sufficient site data.
Holiday subscription offers correlate with more payers, but lower revenue per buyer and substantial selection bias complicate the economics. Christmas-only offers show no clear advantage.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
New SaaS cohort data challenges the habit of waiting six months to pitch an upgrade. The strongest seat and plan expansion window is the first month, while year-one renewal creates a second chance; AI-native customers are more likely to reactivate after churn.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
gopls 0.24.0 and VS Code Go 0.56.0 ship interactive refactorings for struct tags and interface implementations; the broader Language Server Protocol extension is still a proposal, with cross-file moves in preview.