Find published research by company, product, platform or technology.
Showing 21–40 of 528 dossiers
The 10GB Hobby storage cap has not changed, but the consequence of crossing it has. Vercel has removed the previous 30-day grace period for non-exempt deployments, shrinking the rollback and preview history free-plan builders can assume will remain available.
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort.
The change makes heavier frameworks and dependency trees deployable to Workers without plan-specific compressed-size ceilings, but it also changes what builders need to measure: the operative limit is now uncompressed Total Upload rather than the gzip number they may have optimized around.
Memory-bound agents, retrieval systems and stateful services can now choose 2-, 4-, 8- and 12-CPU Render plans with much wider RAM ratios. Existing plan prices and legacy IDs stay compatible; the new choices change the cost trade-off for workloads that previously had to overbuy CPU to get enough memory.
Google did not announce a new spam policy with the August update, but early independent measurement shows unusually large ranking displacement across 20 industries. The data is useful for diagnosing timing and scale, not proof that any individual site was demoted for spam.
Private SaaS teams now have a fresher efficiency baseline: median ARR per employee rose to $141,125, and bootstrapped businesses lead equity-backed peers on the metric across company sizes. The same survey family shows bootstrapped $3M–$20M SaaS companies growing more slowly but generally operating with stronger cost discipline.
Codex 0.149.0 includes the async-message tool, delivery metadata and removal of the client-side feature gate that BTN previously tracked only on main. Parallel human-agent work is now in a stable client, but late replies can still race with decisions and model capability metadata remains the final exposure gate.
Copilot Projects can coordinate agents, files and recurring tasks across repositories or non-code work; review and permissions remain human responsibilities.
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
The latest figures strengthen the case for a sustained ChatGPT citation shift, not a transient August dip; they remain vendor-observed samples rather than platform-wide internal data.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
Developers can now train and evaluate adapters through custom code while Together runs the GPU-heavy operations. The flexibility comes with B200-only support, a $100 credit threshold and ongoing charges for idle ready resources.
Existing Vercel Pro customers have a concrete October 23 deadline to preserve older deployment history, plus new storage charges that begin on team-specific dates.
Caddy 2.11.6 could crash HTTP/2 proxies and sever SSE streams at 60 seconds. Version 2.11.7 fixes both and adds RFC 10036 incremental streaming support.
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
Developers can now profile a deployed Worker or a specific Durable Object without reproducing production traffic locally. Captures require an active isolate and measure allocations during the capture window, not retained memory.
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.