Inertia.js 3.9 fixes cached protected pages resurfacing after logout
Inertia.js 3.9 flushes prefetch entries when history is cleared, preventing a previously visited protected page from reappearing from client cache after logout.
Search
Search results for “Content Security Policy”
Find published research by company, product, platform or technology.
Showing 41–60 of 296 dossiers
pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Let's Encrypt's 64-day TLS certificates arrive February 10 — test renewals from October 14
The certificate lifetime change is not a new CA or endpoint. It is a renewal-timing deadline for operators whose cron jobs assume 90-day certificates.
Laravel AI SDK patches an SSRF path in its Vercel and AG-UI file adapters
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Cloudflare Containers exposed previous tenants’ disk data through unzeroed blocks
This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots.
GitHub AI Scan no longer needs CodeQL default setup
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
Rust 1.98.1 fixes a compiler miscompilation that can emit undefined behavior
This is a compiler-correctness fix rather than a routine patch. Code built with Rust 1.98.0 can be wrong even when the source is valid, so teams that adopted that stable release should update and rebuild affected artifacts.
WordPress 7.0.4 fixes an Author-level file upload path to remote code execution
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
GitHub’s OAuth apps get short-lived tokens, multiple callbacks — and a wildcard setting worth auditing
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
Indie BusinessMarketing & DistributionGEO & AI SearchContent & PublishingProduct EconomicsActive dossier
Google News AI licensing pilot reaches 400 publishers — but it is not the AI Contribution Pilot
Google's News AI pilot now includes 400+ publishers worldwide. The negotiated content-delivery licensing deals are separate from its Search Console AI Contribution Pilot, and payment terms remain private.
Google wins dismissal of publisher antitrust suits over AI Overviews
The ruling does not decide whether AI Overviews hurt publisher traffic or whether reuse of publisher content is fair. It narrows one legal route for challenging that shift: these complaints did not turn the search-for-content relationship into an antitrust agreement, and the court said broader economic dislocation is a question for lawmakers.
Indie BusinessMarketing & DistributionGEO & AI SearchContent & PublishingProduct EconomicsActive dossier
Google’s AI Contribution Pilot puts publisher payouts inside Search Console
The notable shift is not another AI visibility report. Google is testing a direct payment loop between content used to ground generative answers and the publishers that supplied it, with the payout surfaced inside Search Console.
YouTube Music starts labelling AI-made tracks — disclosure without a recommendation ban
The new AI-music labels change metadata and listener-facing disclosure for labels, distributors and creators, but do not by themselves establish lost monetisation, algorithmic suppression or reliable automated detection.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
Cloudflare Browser Run can now hard-limit agent sessions to approved hostnames
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
beehiiv gives publishers edge-enforced control over individual AI crawlers
beehiiv has moved AI crawler policy from a voluntary robots.txt signal to an enforceable publisher control for Max and Enterprise custom-domain sites. Its new dashboard tracks 22 AI and search crawlers, while separate structured-data and llms.txt features target AI discovery rather than access control.
Plugin4Shell breaks SHA-pinned plugin trust across major AI coding agents
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
Twilio now blocks new Toll-Free messaging verifications without public privacy and terms URLs
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
TRACE gives AI agents a portable, hardware-attested runtime evidence format
TRACE targets a gap between audit promises and what an AI agent actually did at runtime. Its v0.2 developer preview can bind model, policy, data and tool-use claims to confidential-computing attestation, but it is still pre-ratification and explicitly not ready to treat as a production compliance guarantee.
Meta’s Muse Glimmer puts a 30B multimodal agent model on 24GB-class hardware
Meta’s Muse Glimmer 30B combines tool use, coding, vision and agentic task completion with official local-runtime artifacts. A 17GB GGUF build targets 24GB-VRAM machines, but Meta also attaches a separate usage policy, so builders should distinguish weight availability from unrestricted use.
Marketing & DistributionSEO & SearchGEO & AI SearchPaid AcquisitionConversion & AnalyticsActive dossier
Google starts testing AI Mode ads for users who connect Gmail and Photos context
Google reversed its earlier ad-free approach to Personal Intelligence in AI Mode. Connected-app-derived insights may influence ads, with testing scope and advertiser controls still unclear.