Find published research by company, product, platform or technology.
Showing 21–40 of 186 dossiers
Cloud Run instances sit between autoscaling serverless services and a small VM. They run one individually addressable container continuously, can be stopped and restarted, and use shared CPU economics; Google’s launch example prices 1 vCPU plus 1 GiB running for 30 days at $5.70.
The change creates an authentication compatibility boundary for server-to-server Gemini integrations: an architecture that works in an existing project may not be reproducible with a newly introduced service account, and Google has not published an end date for the restriction.
The three-maintainer TanStack AI project has reached stable 1.0 for its core SDK, with 23 providers; its long-running agent harness is not yet stable.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules.
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
Tailscale's new MagicRoute beta lets eligible organisations choose priority-based routes per client rather than regional grouping. It affects multi-region subnet access, service hosts and exit-node recommendations.
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
Developers get another paid web retrieval option for coding agents and applications; the introductory harness exemption expires October 31.
Void SDK adds server routes and typed data access to Vite, Void CLI provisions Workers resources, and Void Platform provides a controlled multi-user deployment surface. The convenience comes with Cloudflare runtime dependencies and real deployment limits.
Shopify is turning off its old cross-merchant catalog REST API on November 2. The replacement is a UCP-compatible MCP server, not a renamed URL: agents must remap tools, payloads and saved-catalog identifiers.
Google's agent-accessible data toolkit has moved beyond its August launch: GA expands support to Bigtable, BigQuery Graph and Spark, with IDE/CLI integration, IAM enforcement and no separate kit fee. Underlying Google Cloud usage still costs money.
Two pgJDBC vulnerabilities affect different older driver ranges and only specific connection or binary-write configurations. Upgrade and verify the affected paths rather than treating this as a PostgreSQL server vulnerability.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
The useful shift is not another AI wrapper around CI. sem-ai exposes CI/CD as structured, self-describing operations that Claude Code, Codex and other MCP-aware agents can call directly, including failure diagnosis and pre-push testing in CI.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
Google must build Prebid integrations, let rival publisher ad servers receive real-time AdX bids, make publisher data portable and stop preferential AdWords bidding under a six-year court-supervised remedy.