Six of eight SVG sanitizers failed PortSwigger's tests — browser parsing makes upload safety harder
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Search
Search results for “AI publisher economics”
Find published research by company, product, platform or technology.
Showing 321–340 of 558 dossiers
Tailscale 1.104.4 fixes Tailworm SSH root-escalation path — headscale needs separate review
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
Google tells platforms to keep link-only generated pages out of Search by default
Google now advises noindex or crawl blocking for user-created pages meant for direct sharing, plus Search Console and platform-level spam monitoring.
Safari 27 blocks email-based identity resolvers at the network layer — first-party personalisation remains
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
OpenBSD 8.0 ships major platform changes — and urgent IPsec, DNS and kernel errata
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
Shopify Polaris 2.0 is stable, but embedded apps must opt in to match the redesigned admin
Polaris Web Components 2.0 reaches stable CDN channels, with explicit opt-in, React Router and TypeScript integration changes, and migration checks for apps that still use Polaris React.
Umami 3.4.1 urges self-hosters to patch Next.js RCE and MCP OAuth leakage
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
Shopify will stop storefront ScriptTags in March 2027 — new writes fail from October
With no planned installation banner, apps should identify affected merchants and handle the migration proactively; Shopify's alternative theme app embeds still require activation on the published theme.
Symfony Language Tools reaches 0.24 with richer Twig analysis, CI caching and Windows editor packages
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
SQLite 3.54.1 fixes a 32-bit heap-buffer overflow after major 3.54 CLI and authorizer changes
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Python 3.15 makes lazy imports and UTF-8 defaults real — with a new profiler and free-threaded ABI
Python 3.15.1 supersedes the 3.15.0 launch with an urgent certificate-trust update. New installers alone do not update existing virtualenvs: update pip, uv and certifi where applicable.
EDG opens its industrial C++ compiler front end under Apache 2.0 after three decades
The EDG front end moved from commercial licences to a public repository and C++ Alliance stewardship on September 30. A fresh October 20 statement confirms permissive commercial reuse, experienced maintainers and work still needed on reflection, coroutines and back ends.
WordPress 7.2 Beta 1 adds a Secrets API so plugins can stop storing API keys as plaintext options
WordPress 7.2 Beta 1 landed October 20 with wp_set_secret and wp_get_secret, encrypted storage, current/previous versions and pluggable back ends. Existing plugin credentials do not migrate automatically; the final release is scheduled for December 8.
ChatGPT's October referral-tracking bug was fixed — but October 8–15 attribution remains distorted
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
Tailscale MagicRoute beta changes how private networks select routers and service backends
Tailscale's new MagicRoute beta lets eligible organisations choose priority-based routes per client rather than regional grouping. It affects multi-region subnet access, service hosts and exit-node recommendations.
Scaleway Serverless Containers now support private-only ingress inside a VPC
Private ingress joins existing private egress for Scaleway Serverless Containers. The new option can isolate services inside a VPC, but private DNS, TLS, authentication, cold-start and network-scope constraints still matter.
WordPress 7.2 will disable MySQL NO_BACKSLASH_ESCAPES for its own connections
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
pgBackRest 2.60 makes corrupt-page checks block restores and backup expiry by default
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
Shopify Hydrogen 2026-10 goes GA as a framework-neutral commerce library
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Firefox Enterprise 158 puts browser policy, data controls and AI governance on customer-run infrastructure
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.