Find published research by company, product, platform or technology.
Showing 21–40 of 95 dossiers
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
The useful lesson is broader than one coding assistant: repository indexing can quietly become a data-export boundary. ZCode’s response improves inspectability going forward, but builders using AI coding tools still need to know exactly which indexing, wiki and memory features send source code or Git metadata off-device.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
This is not a normal ranking update. Google is changing the structure of commercial search results in the EEA under the Digital Markets Act, creating explicit result surfaces for vertical search services and suppliers that do not appear the same way elsewhere.
The previously reported Stripe–OpenRouter deal is now official. The companies have announced an acquisition agreement, removing the dossier’s main uncertainty; the next questions are closing, product independence, pricing and how deeply Stripe integrates token routing with billing.
Jev, CLM and GLiNER2.5-Decide made bounded software decisions look like a distinct model category. OpenAI is now validating the same architectural split with a Luna-powered API designed to answer finite questions rather than generate open-ended prose.
The August opt-out is over. App Engine's current documentation warns of permanent legacy-TLS blocks and directs affected operators to Support; hostname-specific tests remain essential.
The broad result survives a meaningful refresh of the living dataset: observable SaaS pricing is still not predominantly per-seat, but the exact model mix moved enough that the old 41% flat/platform figure should no longer be quoted as current.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
The important change is at the gateway boundary, not just inference placement. OpenRouter says prompts can now stay in-region from decryption through provider execution and supported server tools, while teams can enforce the rule per workspace, team or API key.
Audience-management systems can now fail with `SEGMENT_LIMIT_EXCEEDED`, while old geography identifiers begin returning invalid-field errors after August 31. LinkedIn also opened the Matched Audiences API to applications from qualified developers, increasing the importance of handling these limits correctly.
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules.
Redis-compatible cache and queue costs have fallen across Render's 1GB-plus Key Value plans, with two new memory tiers and automatic repricing for existing customers.