Find published research by company, product, platform or technology.
Showing 21–40 of 471 dossiers
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
The practical change is that debugging a Cloudflare-backed application no longer has to stop at the Worker boundary: one trace can follow security, cache, routing, Worker and origin handling, while logs and traces move toward one query and pricing model.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
This is a platform architecture migration rather than a user-facing feature. Pantheon says no action is required, but builders operating storage-sensitive WordPress or Drupal workloads should know when their tier moves and verify backup, restore and file-handling behavior around the change.
The post-release evidence sharpens the original story. Qwen3.8-27B can retain useful agentic-coding performance at practical 4-bit sizes, but local model quality is not a property of the checkpoint alone: quantization, reasoning effort, context handling and the agent harness can materially change the result.
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Google Ads' new channel-priority controls offer a way to test Search partners and Display without giving them unrestricted budget, but the limits are not guarantees and Demand Gen has no allocation caps.
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
Cloudflare’s first half-year DDoS report records 935 network-layer attacks above 1 Tbps and a 519% Q1-to-Q2 increase, but says 96.62% of attacks stayed below 500 Mbps and 90.60% ended within 10 minutes. The figures are Cloudflare-network telemetry, not a neutral census of the internet.
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
The checkout ScriptTag shutdown already had an earlier deadline; this is the separate storefront cutoff. Pinning an old Admin API version will not preserve write access after October, and any feature still depending on an injected storefront script stops working in March.
YouTube’s 2027 YPP restructuring changes entry, ongoing Shorts earnings and channel-activity rules. Since August 24, public views count from the first frame, while earnings and eligibility still depend on engaged or qualified views.
Private SaaS teams now have a fresher efficiency baseline: median ARR per employee rose to $141,125, and bootstrapped businesses lead equity-backed peers on the metric across company sizes. The same survey family shows bootstrapped $3M–$20M SaaS companies growing more slowly but generally operating with stronger cost discipline.
The incident affects certificate validation, not TLS encryption. Website operators with certificates under the affected root and developers shipping custom trust stores must assess and migrate; disabling verification is not a fix.
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
PHP operators have advance notice to schedule urgent updates, but no verified affected-version list, exploit path or workaround yet. Check official release notes before acting on speculative vulnerability claims.