X Numbers turn a closed XChat inbox into a revocable contact channel
XChat now has a second address layer beyond the public @handle: a shareable, revocable code that can grant direct inbox access without opening message requests to everyone.
Search
Search results for “Measurement ID abuse”
Find published research by company, product, platform or technology.
Showing 41–60 of 373 dossiers
Keycloak patches a critical password-reset flaw that can let unauthenticated attackers take over any account
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
A maintainer’s infected Mac pushed XCSSET into legitimate Flutter packages on pub.dev
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
Gmail launches a verified political-sender deliverability program with a 0.3% spam-rate ceiling
The new program creates a specialized Gmail deliverability path for verified political senders, but it is not an inbox guarantee: recipients can still mark mail as spam, block senders or unsubscribe, and non-compliant domains can be suspended or removed.
Android Studio Quail 4 makes curated agent skills and offline Gemma 4 production-stable
Android Studio’s agent layer has crossed an important boundary from preview features into the stable channel: domain-specific skills are preloaded and auto-selected, while Gemma 4 can execute tool-calling code tasks locally without sending source code to a cloud model.
AWS Lambda adds a pre-GA runtime channel for Node.js and Python
AWS is changing how Lambda introduces managed runtimes: Node.js 26 and Python 3.15 are available in public preview before GA, with normal runtime identifiers that automatically graduate when the runtimes become production-ready.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
AWS moves AgentCore Memory tenant isolation into OAuth and Cedar policy
The two August 28 changes move a common production-agent problem out of bespoke application code: builders can derive memory boundaries from authenticated JWT claims, enforce them with Cedar policy, and organize the stored memory using runtime tenant dimensions.
Google has shut down Imagen 4 API endpoints
The Imagen 4 shutdown is now effective, not merely scheduled. Builders still calling the old model IDs need to migrate to current Gemini image generation, where model names and interaction patterns differ enough to warrant explicit compatibility testing.
Artificial IntelligenceSaaSMarketing & DistributionAI AgentsProduct & GrowthConversion & AnalyticsActive dossier
Mixpanel AI can now investigate why a product metric changed and return the result as a working Board
Product teams can launch a root-cause investigation from an Insights report, an alert or Mixpanel Agent instead of manually trying breakdown after breakdown. The result is operationally useful, but it remains an automated statistical diagnosis rather than proof of causation.
LinkedIn Ads API adds a 1,000-segment audience cap as Legacy Geo shuts down August 31
Audience-management systems can now fail with `SEGMENT_LIMIT_EXCEEDED`, while old geography identifiers begin returning invalid-field errors after August 31. LinkedIn also opened the Matched Audiences API to applications from qualified developers, increasing the importance of handling these limits correctly.
Chrome 152 lets websites put the browser behind a network allowlist
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
Render decouples memory from CPU with new compute plans up to 96GB RAM
Memory-bound agents, retrieval systems and stateful services can now choose 2-, 4-, 8- and 12-CPU Render plans with much wider RAM ratios. Existing plan prices and legacy IDs stay compatible; the new choices change the cost trade-off for workloads that previously had to overbuy CPU to get enough memory.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsDatabases & StorageActive dossier
Supabase makes MCP access centrally governed through enterprise SSO
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
Cloudflare adds shadow-MCP detection and Portal-only enforcement
Cloudflare’s new MCP controls turn TLS-inspected Gateway traffic into an inventory and policy surface for remote MCP use, while explicitly leaving local stdio, off-network and uninspected traffic outside visibility.
Artificial IntelligenceSaaSCloud & InfrastructureAI AgentsInference & APIsSaaS OperationsActive dossier
Wiz's October AI platform incident tracker now adds Kernel and Blacksmith: at least 14 reports
Two further platform incidents broaden Wiz's tally from twelve to at least fourteen, including Kernel's stolen logging credentials and Blacksmith's CI job-log store breach.
Northflank traces October secret exposure to hours before its first alert; key rotation remains urgent
Northflank clarifies the October 30 secret-exposure window and alert-to-patch timeline; an affected customer confirms database credentials were at risk, although its own logs show no unauthorised access.
UK competition watchdog investigates Meta's publisher-content terms after rollout pause
The UK CMA is investigating Meta's website-content terms for publishers and advertisers. Proposed changes are paused, not approved or found unlawful.
Google tells platforms to keep link-only generated pages out of Search by default
Google now advises noindex or crawl blocking for user-created pages meant for direct sharing, plus Search Console and platform-level spam monitoring.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsActive dossier
GitLab extends Flow Creator with goal-driven agent orchestration through review, tests and approvals
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
YouTube’s first-frame view change is inflating headline counts — and early data shows by how much
The counting-rule change is no longer theoretical. Early post-cutover data suggests public views can materially outpace Engaged views, with the size of the gap varying by channel size, category and discovery surface.