Pgpool-II patches seven watchdog and certificate-authentication vulnerabilities
Pgpool-II operators should upgrade to the October 1 security releases and review watchdog network exposure and certificate-authentication configuration.
Search
Search results for “Developer platform security”
Find published research by company, product, platform or technology.
Showing 21–40 of 342 dossiers
Cloudflare gives Free and Pro sites a full month of traffic and security analytics
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
Woodpecker CI 3.19 moves agent trust rules to the server and fixes clone-step environment injection
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
PostgreSQL JDBC 42.7.14 closes authentication and SQL-data leakage flaws
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
tinyjs fixes a string of capability escapes in its lightweight desktop runtime
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
FrankenPHP 1.13 fixes five vulnerabilities and makes configuration reloads fail safe
The October release is more than a version bump: PHP server operators should patch document-root and header risks, then test worker/thread budgets and stricter proxy defaults before upgrading.
Fastly puts model routing, AI budgets and prompt-injection controls into the edge request path
The interesting part of Fastly’s AI launch is consolidation: model gateway economics, LLM security and agent-to-API authorization now sit in the same request path as the CDN/WAF infrastructure many applications already use.
npm v12 makes install scripts opt-in — while publishing automation gets a stage-only trust boundary
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
Gemini CLI 0.60 hardens the boundaries around extensions, sandboxes and MCP OAuth
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
Homebrew 7.0 turns package vulnerability checks into a built-in workflow — after closing a sudo-capable cask flaw
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
Web DevelopmentMarketing & DistributionWordPressDeveloper ToolsMarketplaces & PlatformsActive dossier
WordPress.org can now stop high-risk plugin updates before they reach sites
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
Postmark can now restrict API email sending to trusted IP ranges
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
Next.js patches two unauthenticated critical RCEs in 16.3.3 and 15.5.24
The previously pre-announced Next.js security release is now available. Teams on affected versions should upgrade to 16.3.3 or 15.5.24; the disclosed flaws can lead to unauthenticated remote code execution under specific image-optimization or Windows-hosting conditions.
Adobe Commerce’s August patch fixes an unauthenticated account-takeover flaw already seeing exploitation attempts
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Google opens a direct Search ingestion pipeline for large forums and social platforms
Large forums and social platforms can apply to push trending public posts and interaction counts to Google via OAuth and JSON-LD. Stable public URLs, attribution, moderation and fast updates are required; indexing and ranking are not guaranteed.
ChatGPT Ads adds Sponsored Agents — turning ad clicks into branded AI conversations
ChatGPT Ads is expanding both in format and reach: selected advertisers can test branded conversational agents after an ad click, while the platform now spans more than 60 countries and OpenAI says it passed a $1 billion annualized revenue run rate by the end of August.
beehiiv raises paid-plan prices as newsletters expand into an all-in-one creator platform
The pricing change is also a packaging change: beehiiv is charging more for paid tiers while putting newsletters, websites, podcasts, community and digital products across the plan family and extending self-serve scale.
NVIDIA moves AI-agent containment below the model layer with OpenShell and Sentry
The useful shift is architectural: agent permissions no longer have to depend only on the model or harness behaving correctly. OpenShell puts policy enforcement in the execution environment, while Sentry is designed to keep watching from a separate hardware trust domain.
Web DevelopmentCloud & InfrastructureCloud PlatformsDeveloper ToolsDatabases & StorageActive dossier
Cloudflare makes Python Workers GA — with Hyperdrive and first-class platform bindings
The Hyperdrive integration was the practical database unlock; the larger September 21 change is that Python Workers themselves are now GA. Cloudflare is explicitly positioning Python as a production language on Workers, with native platform bindings and framework support rather than an experimental compatibility layer.
Kubernetes 1.37 moves more cluster operations into the core platform
The release consolidates several recurring cluster-management jobs into core APIs and controllers. HPA scale-to-zero is now default-on Beta, storage-version migration and Pod Certificates are Stable, DRA can satisfy existing extended-resource requests, and large etcd reads gain a streaming path that reduces peak memory pressure.