Find published research by company, product, platform or technology.
Showing 21–40 of 101 dossiers
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
Retention-locked backups are gaining a project-level consequence: Google Cloud plans to create automatic liens that can block project deletion while protected backups remain. Infra teams need to account for this in teardown automation, IAM and recovery design.
AdSense's October 22 policy revision changes where publishers can put accompanying video and how sticky players may start, without removing other video-ad safeguards or guaranteeing higher revenue.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
Meta Muse Spark Open is genuinely downloadable, unlike a promised future weight release. But 42B active parameters do not make its 816B weights cheap to host, and the Muse Model License is not Apache or MIT: model-as-a-service operators over $20M in affiliated annual gross revenue need a separate agreement.
OpenAI’s internal data turns “agents make researchers faster” into a measurable operating model: heavy concurrent agent use, record experiment throughput and rising task complexity, alongside high token spend and persistent human intervention on longer work.
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
The latest figures strengthen the case for a sustained ChatGPT citation shift, not a transient August dip; they remain vendor-observed samples rather than platform-wide internal data.
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
Effect 4's performance and LTS claims remain, but 4.0.2 explicitly marks some formerly unlabelled APIs unstable without changing their current behavior, signatures or types.
Vendor-run live-store testing exposes the trade-off between containment, quality and response speed. Store configuration matters, and the evaluator's commercial conflict requires care.
The material issue is not ordinary model distillation. Anthropic’s evidence suggests a customer-facing AI product may have used a rival model as an undisclosed backend while simultaneously harvesting those interactions for training, turning routing architecture into a privacy and trust boundary.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
YouTube’s 2027 YPP restructuring changes entry, ongoing Shorts earnings and channel-activity rules. Since August 24, public views count from the first frame, while earnings and eligibility still depend on engaged or qualified views.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
WooCommerce 11.3 removes /wp-json/woocommerce/mcp, REST-key MCP authentication and REST-derived abilities. Migrate clients to the WordPress MCP Adapter plugin, application passwords and explicit ability metadata before upgrading.