FrankenPHP 1.13.5 patches 17 flaws, including uploaded-file PHP execution
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.
Search
Search results for “path traversal”
Find published research by company, product, platform or technology.
Showing 21–40 of 351 dossiers
Google is moving Local Services Ads into Performance Max pay-per-lead campaigns
The August migration continues, and October's Google Ads API v26 lets eligible integrators create Local Services Performance Max campaigns and link leads. This adds a concrete API path but does not restore old LSA reports or bidding controls.
GitHub Copilot code review can now approve pull requests
Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.
Laravel Private Cloud now supports HIPAA workloads with dedicated infrastructure and BAAs
HIPAA support moves Laravel Cloud into a class of regulated workloads that shared application hosting could not safely claim. Private Cloud supplies dedicated tenancy, encryption, SSO/SAML, backups and a BAA path, while application-level access control, audit logging and PHI handling remain the developer’s responsibility.
Cloudflare retires its legacy Registrar API — domain-management integrations need new endpoints
The replacement is not a drop-in path rename: Cloudflare separates domain search, availability checks and registration operations into newer endpoints, so old registrar automation can break after the cutoff.
OpenAI has shut down the Sora 2 API — with no replacement video model
This is a hard capability removal rather than a routine model migration. Products built on OpenAI’s video-generation API now need another provider or a redesigned video path because the official deprecation table offers no successor endpoint.
Web DevelopmentMarketing & DistributionBrowsers & Web StandardsDeveloper ToolsMarketplaces & PlatformsClosed dossier
Chrome removes the last Manifest V2 extensions from the Web Store, ending updates and reinstalls
Manifest V2 was already disabled for modern Chrome users. The August 31 change closes the remaining Web Store path, turning any still-pinned legacy install into an effectively frozen artifact with no Store update or reinstall route.
Dependabot’s private GitHub Packages access is back — now as fallback authentication
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
Cloud SQL regional API endpoints are now GA across MySQL, PostgreSQL and SQL Server
The change is not about where database rows live; Cloud SQL already has regional instance placement. It changes where API control traffic is processed, reducing dependence on global frontend infrastructure and making data-in-transit boundaries easier to align with sovereignty requirements.
Paddle brings recurring Pix payments to SaaS subscriptions in Brazil
Brazilian customers can authorize Pix Automático mandates for Paddle subscriptions without a separate early-access application. The path broadens local-payment access for SaaS, while delayed renewals, fixed mandate amounts and re-authorisation requirements still create implementation caveats.
Homebrew 7.0 turns package vulnerability checks into a built-in workflow — after closing a sudo-capable cask flaw
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
SaaSCloud & InfrastructureMarketing & DistributionHostingEmail & LifecycleSaaS OperationsActive dossier
Stalwart 1.0.3 adds blob encryption and fixes OAuth role permissions after risky 1.0.2 upgrade
Stalwart 1.0.3 adds blob encryption/compression and a role-permissions repair switch; the previous 1.0.2 mail-at-rest reset still needs explicit administrator action.
Kimi K3.1 Pro ships open weights with a 1M context window and 2.8T parameters
Kimi K3.1 Pro's full open-weight release is now public. Its 2.8T-parameter MoE has 104B active per token and a 1M-token context; local hosting requires serious infrastructure and checking Moonshot's specific licence.
Caddy 2.11.9 fixes PHP directory regressions and FastCGI security bypasses
The immediate follow-up to 2.11.8 restores trailing-slash PHP directory indexes and hardens FastCGI script selection and authentication boundaries.
rsync 3.5.2 closes receiver-triggered CPU exhaustion in backup and mirroring senders
CVE-2026-119741 affects rsync through 3.5.1. The 3.5.2 fix bounds checksum work; a hostile receiver can otherwise drive CPU exhaustion on senders, including through repeated daemon connections.
SvelteKit 3 moves framework configuration into Vite and requires a runtime migration
SvelteKit 3's Vite and #lib migration remains the main upgrade boundary; 3.1.1 now also fixes security-sensitive server-only module and cross-origin path handling, so deploy a patched 3.x build.
Cloudflare makes private origins generally available — public WAF and Workers without a public origin IP
Cloudflare Private Origins is GA, but not a one-click option for every account: it needs a private-network connection, entitlement and routing setup, and Argo Smart Routing and Aegis remain unsupported.
PostgreSQL Anonymizer 3.3 patches 12 masking bypasses — upgrades require more than a version bump
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
GitHub Copilot adds model-judged permissions to its GA agent sandbox — with unattended-run traps
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
Chrome 155 stops firing unload by default after a years-long rollout — sites must use page lifecycle alternatives
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.