Find published research by company, product, platform or technology.
Showing 21–40 of 436 dossiers
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
Funes treats agent memory as user-owned data rather than a hosted account feature: retrieval and reranking run locally, provenance stays attached to recalled passages, and cross-machine sharing is optional. The main risk is that publishing session-derived memory can still expose secrets if redaction misses them.
Omacom expands in-kind AI and compute patronage and reports nearly 1,500 Greptile-reviewed PRs. Pledges are not audited cash revenue.
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
AI image and social-app developers face clearer moderation and review obligations; hiding features can threaten an entire developer account.
Google appears to have completed a talent-focused Mechanize deal: the startup still exists, but much of the team that builds coding-agent training environments and evaluations has moved into Google’s model-development work.
Hy4 preview is a very large sparse model with public full and FP8 weights, native speculative decoding and a 1M-token context path. Its open release makes Tencent’s claims testable, while the 1.56TB full checkpoint keeps self-hosting firmly in server-scale territory.
GLM-5.3-Flash combines open weights, multimodal coding/agent capability and an 18B-active sparse architecture with a large anonymous pre-launch trial. Z.ai has already issued a chat-template correction for early downloads, showing that day-one self-hosted deployments need artifact-level validation as well as model benchmarking.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
The Agent Host’s environment boundary has moved from local Dev Containers to remote development hosts, making persistent coding-agent sessions more portable across real remote projects.
tinyjs 0.63.0 closes another dangerous wrapper boundary: a remote site could previously launch downloaded local programs. Signed updates and platform-target checks add further defence, but operators need to enable signing themselves.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Applications using the PostgreSQL ODBC driver should upgrade to 18.00.0006 and review where client or server-supplied names, ODBC escape sequences and driver logs cross trust boundaries.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.