Find published research by company, product, platform or technology.
Showing 21–40 of 54 dossiers
Docker VMM gives Docker direct control over Desktop’s hidden Linux-VM layer and is still targeted to become the default for new installs at GA. The August 24 Desktop 4.88 release is an important beta signal: it fixes a severe inbound-network-throughput regression and removes a 28 GiB Mac memory ceiling, reinforcing the need for workload-specific testing before standardisation.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
Teams upgrading for five 1.13.0 security fixes should use 1.13.1: it repairs Nextcloud and Symfony breakage, crashes and shutdown failures while retaining the earlier Caddy/Mercure compatibility changes.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
The security shift is deeper than running application containers as non-root: the node stack itself can now live inside a user namespace. The feature is enabled by default in 1.37, but clusters do not become rootless automatically and CNI/CSI compatibility still needs testing.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
GitHub Copilot can now turn Slack or Teams threads into collaborative cloud-agent sessions. Teammates can add context and steer the work in public, while repository permissions, agent budgets and optional extra PR approvals remain the main control boundaries.
A search-engine maintenance release carries intentional relevance and API compatibility changes that operators should test.
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
The useful change is where enforcement happens. Teams can now make unresolved leaked credentials a branch-policy failure, with organization and enterprise rollout plus API configuration for large repository fleets.
WooCommerce is removing unnecessary block bootstrap work from non-rendering requests. The performance gain is concrete, but extension authors need to understand the new registration boundary rather than assuming Woo blocks are always initialized.
Azure’s old PostgreSQL versions do not switch off on September 1, but they do become a paid legacy choice. Extended Support is automatic, billed by vCore-hour for running servers, and cannot be declined while an unsupported engine version remains in use.
Edge Scripts no longer have to sit behind bunny.net’s automatic cache. New pre-cache hooks can execute before cache lookup, while a separate Cache API lets scripts read, write and delete regional cache entries under application control.
The interesting change is not another desktop-shell release. Noctalia has moved plugin logic away from the older QML-centric model into isolated scripting runtimes, creating a clearer extension boundary while still treating plugins as trusted code.
Always-on RAM-heavy Fly Machines cost more from October, while bursty Sprites get much cheaper. CPU pricing for Machines and Managed Postgres plans stay unchanged.
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
The workflow shift is continuity rather than another model upgrade: one Kiro agent session can outlive the laptop that started it. Cloud configuration can also carry agent setup across environments, although enterprise governance is not identical between local and web/cloud surfaces.
Beam makes a large agent-focused model commercially reusable without a bespoke licence, but the open weights are not a small local download.
Stripe's new Postgres destination gives SaaS teams a managed payment-data mirror, not a zero-latency replacement for every webhook.