WordPress 7.1.4 patches an upgrade-window RCE — sites on 7.1.3 should update
WordPress 7.1.4 is a new security release; 7.1.3 is no longer the latest patched 7.1 build. Operators should update promptly.
Search
Search results for “AI-assisted open source”
Find published research by company, product, platform or technology.
Showing 361–380 of 531 dossiers
GitLab's CVSS 10 CI regex flaw targeted Alpine Linux — custom Ruby images can remain vulnerable after GitLab upgrades
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
GitHub Enterprise now offers Copilot with no extra seat fee — but no included AI credits
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
Tailscale 1.104.4 fixes Tailworm SSH root-escalation path — headscale needs separate review
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
Safari 27 blocks email-based identity resolvers at the network layer — first-party personalisation remains
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
Bun 1.4.4 adds a built-in formatter that reads Prettier configs — but output is not always identical
Bun 1.4.4 introduces bun fmt, accelerates bun check and preserves Yarn Berry lockfiles during migration. Teams should test formatter output and unsupported plugins before replacing Prettier in CI.
WooCommerce 11.3 will retire its MCP endpoint — store agents need new credentials and tools
WooCommerce 11.3 removes /wp-json/woocommerce/mcp, REST-key MCP authentication and REST-derived abilities. Migrate clients to the WordPress MCP Adapter plugin, application passwords and explicit ability metadata before upgrading.
Google loosens AdSense video placement rules for floating and sticky players
AdSense's October 22 policy revision changes where publishers can put accompanying video and how sticky players may start, without removing other video-ad safeguards or guaranteeing higher revenue.
PHP2Shell actively exploited before disclosure, as emergency PHP fixes race into production
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
Coolify rushes security fixes to all v4 lines after PHP2Shell and dependency vulnerabilities
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
Cloudflare WAF can now correlate malicious requests with origin responses and block the reply
Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules.
Laravel discloses critical TokenGuard account takeover flaw and a separate data-loss bug
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
Google Analytics can now reject ghost traffic with hostname allowlists
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
Stripe's 200-platform survey finds AI pushing SaaS beyond seats — but vertical businesses favour embedded finance
The interesting signal is segmentation, not 'seat pricing is dead': vertical SaaS operators expect payments and finance to become a larger part of revenue, while horizontal platforms expect usage and hybrid software charges to lead. The survey is vendor-produced and forward-looking.
Marketing & DistributionSEO & SearchGEO & AI SearchPaid AcquisitionConversion & AnalyticsActive dossier
Google starts testing AI Mode ads for users who connect Gmail and Photos context
Google reversed its earlier ad-free approach to Personal Intelligence in AI Mode. Connected-app-derived insights may influence ads, with testing scope and advertiser controls still unclear.
Gorgias' live-store benchmark finds ecommerce AI support automation is not the same as answer quality
Vendor-run live-store testing exposes the trade-off between containment, quality and response speed. Store configuration matters, and the evaluator's commercial conflict requires care.
Stripe extends Global Payouts to 160 markets and stablecoin card issuing across the EU
Stripe expands Global Payouts to 160 stablecoin markets and 100-plus fiat markets, with stablecoin-backed Issuing cards launching in 27 EU countries; the announcement is about financial-product infrastructure, not ordinary subscription checkout.
Docker Hub's GhostPat flaw let one account mint registry access as another for two years
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
SaaSMarketing & DistributionProduct & GrowthMarketplaces & PlatformsConversion & AnalyticsActive dossier
Google launches Universal Cart in US Search and Gemini, shifting shopping decisions into its own interface
The multi-retailer cart, previously previewed in May, is now available in the US. Price alerts, promo-code suggestions and Google Pay or merchant checkout could reshape how ecommerce sellers measure product discovery and conversion.
Go 1.27 quietly makes HTTP/1 clients faster by reusing connections after early Close
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.