Find published research by company, product, platform or technology.
Showing 21–40 of 305 dossiers
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort.
The change makes heavier frameworks and dependency trees deployable to Workers without plan-specific compressed-size ceilings, but it also changes what builders need to measure: the operative limit is now uncompressed Total Upload rather than the gzip number they may have optimized around.
Memory-bound agents, retrieval systems and stateful services can now choose 2-, 4-, 8- and 12-CPU Render plans with much wider RAM ratios. Existing plan prices and legacy IDs stay compatible; the new choices change the cost trade-off for workloads that previously had to overbuy CPU to get enough memory.
Google did not announce a new spam policy with the August update, but early independent measurement shows unusually large ranking displacement across 20 industries. The data is useful for diagnosing timing and scale, not proof that any individual site was demoted for spam.
Private SaaS teams now have a fresher efficiency baseline: median ARR per employee rose to $141,125, and bootstrapped businesses lead equity-backed peers on the metric across company sizes. The same survey family shows bootstrapped $3M–$20M SaaS companies growing more slowly but generally operating with stronger cost discipline.
Codex 0.149.0 includes the async-message tool, delivery metadata and removal of the client-side feature gate that BTN previously tracked only on main. Parallel human-agent work is now in a stable client, but late replies can still race with decisions and model capability metadata remains the final exposure gate.
The useful part is not the 800,000-line headline. GitHub has published unusually detailed receipts for a production-scale agent-assisted migration: roughly $120,000 of token spend, 14.5 weeks of incremental releases, dozens of regressions, extensive compatibility tests and a workload-specific jump from 7.55 to 120 session lifecycles per second.
K2 Horizon is notable less for another benchmark claim than for reproducibility: IFM is publishing model weights, architecture, training code, data or construction recipes, evaluation resources and intermediate training material instead of stopping at a final checkpoint.
Google's distributed SQL database can now run in production beyond Google Cloud, but 'deploy anywhere' doesn't mean free or fully managed. Spanner Omni GA brings security, backup and paid commercial licensing, with important limits on its developer edition.
Training experiments and batch inference can use Together AI's discounted preemptible GPUs in existing clusters. Workloads must checkpoint or requeue on interruption, and at least one standard node is required.
Self-Hosted Machines changes the architecture of Cursor’s Cloud Agents more than another model option would. Teams can keep code, build outputs, secrets and terminal/browser actions on infrastructure they control, but the planning/inference loop remains a Cursor service and enterprise teams become responsible for worker images, scaling, secrets and production validation.
Redis-compatible cache and queue costs have fallen across Render's 1GB-plus Key Value plans, with two new memory tiers and automatic repricing for existing customers.
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
GLM-5.3-Flash combines open weights, multimodal coding/agent capability and an 18B-active sparse architecture with a large anonymous pre-launch trial. Z.ai has already issued a chat-template correction for early downloads, showing that day-one self-hosted deployments need artifact-level validation as well as model benchmarking.
Groq 3 LPX is moving from architecture announcement to manufactured infrastructure. Artificial Analysis measured about 3,400 output tokens/s at both 10K and 100K context on an NVIDIA-hosted private endpoint, but the single-concurrency benchmark does not yet establish public-cloud price, multi-tenant throughput or end-to-end agent speed.
Getty Images filed Chapter 11 to implement an agreed restructuring, not to shut down its image marketplace. The plan includes up to $533m of new equity, up to $143m of financing and a proposed move to private ownership.