Find published research by company, product, platform or technology.
Showing 341–360 of 444 dossiers
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
The issue is software time-zone data, not changed stored timestamps. A fixed-offset workaround can affect historical date conversions.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
A Linux IPv4 TCP use-after-free can be exploitable through network-facing Go services even when their own dependencies are current. Check the running kernel and vendor patch status; a GODEBUG setting does not remove the kernel flaw.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
HTML-in-Canvas is moving from trial to Chrome Stable, enabling accessible live HTML in 2D/WebGL/WebGPU scenes. Early adopters must migrate method names and test real library versions; other browsers still need fallbacks.
Three new GitHub webhook CIDR blocks can break deliveries to tightly firewalled endpoints unless static allowlists are updated.
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
The October 15 Rust 1.99.1 release fixes a separate FFI bool miscompilation after September's 1.98.1 vtable bug. Check toolchain pins and rebuild artifacts produced by either affected compiler.
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
Google now advises noindex or crawl blocking for user-created pages meant for direct sharing, plus Search Console and platform-level spam monitoring.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
TorchNeuron changes the software portability equation for Trainium, making it easier to test non-NVIDIA AI accelerators without rewriting the model stack. Beta gaps still demand model-by-model verification.
Bun 1.4.4 introduces bun fmt, accelerates bun check and preserves Yarn Berry lockfiles during migration. Teams should test formatter output and unsupported plugins before replacing Prettier in CI.