Find published research by company, product, platform or technology.
Showing 321–340 of 520 dossiers
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
New paid Gemini API projects now default to store=true on generateContent, streaming and batch calls; older projects retain their settings. Developers can opt out per request or project.
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
A Linux IPv4 TCP use-after-free can be exploitable through network-facing Go services even when their own dependencies are current. Check the running kernel and vendor patch status; a GODEBUG setting does not remove the kernel flaw.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
Three new GitHub webhook CIDR blocks can break deliveries to tightly firewalled endpoints unless static allowlists are updated.
The October 15 Rust 1.99.1 release fixes a separate FFI bool miscompilation after September's 1.98.1 vtable bug. Check toolchain pins and rebuild artifacts produced by either affected compiler.
GitHub's 2026 platform data shows agent-started PRs rising sharply. The implications concern code review, security and multi-model workflows, not proof of higher software quality.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
TorchNeuron changes the software portability equation for Trainium, making it easier to test non-NVIDIA AI accelerators without rewriting the model stack. Beta gaps still demand model-by-model verification.
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
Google is changing the default for Performance Max image extraction on December 4, 2026. Existing campaigns keep their settings, but new campaigns will opt in regardless of an account-level opt-out; agencies and SaaS ad tools need a campaign-level override and careful handling of repeated asset settings.
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Google Cloud customers gain a new route to OpenAI models with unified governance and cloud-commitment billing, but broad availability and some privacy features are still forthcoming.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
Cloudflare and VoidZero are developing tsrs under Oxc with the TypeScript team. The early Rust checker claims up to 8x speed and 70% lower memory than TypeScript 7.0 under matched worker counts, but is not a drop-in stable compiler yet.