Find published research by company, product, platform or technology.
Showing 21–40 of 112 dossiers
Computer Use is now GA in both Gemini APIs, but it is an action-planning tool, not a hosted remote desktop: clients execute clicks and keystrokes and must handle safety decisions.
Wiz now tracks twelve reported incidents around October's AI developer-platform breaches, but the three additions have not supplied technical indicators.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
DV360's new bulk-campaign file format isn't a drop-in CSV upgrade: targeting expands, YouTube vendor columns change, and API support lags the interface. Integrators should audit parsers before migrating.
The architecture matters as much as the voice quality: developers can replace a chained speech-to-text → LLM → text-to-speech loop with one full-duplex conversational model while keeping their own choice of backend reasoning model, tools and agent harness.
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Vet turns dependency updates from an implicit trust decision into an explicit, reviewable one for Laravel, Symfony, WordPress and plain PHP projects, with optional local coding-agent review layered underneath the human trust decision.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
WordPress 7.1 is now generally available. Its always-iframed post editor removes a long-standing split between iframe and non-iframe contexts, while browser-side image processing moves more media work out of PHP and into WebAssembly.
No workload-data access observed, Northflank says, but independent forensics continue and the secret-rotation warning remains.
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
The latest DRAM-driven increase forces makers, edge deployments and small teams to re-evaluate whether high-RAM single-board computers still offer the right economics.
Staging tests found acme.sh 3.0.7 with --days 80 scheduled renewal 15 days after a 64-day certificate expired. Newer acme.sh and Certbot behaved differently; audit versions and overrides rather than assuming your cron is safe.
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules.