Find published research by company, product, platform or technology.
Showing 41–60 of 112 dossiers
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
The LSP is still pre-1.0, but shipped releases now cover wider Symfony frameworks and more developer environments, with improved caching and diagnostics.
WordPress 7.2 Beta 1 landed October 20 with wp_set_secret and wp_get_secret, encrypted storage, current/previous versions and pluggable back ends. Existing plugin credentials do not migrate automatically; the final release is scheduled for December 8.
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
The change moves maintenance work earlier in the contribution funnel: instead of filing a report and waiting for a maintainer to reproduce it, package users are being asked to arrive with an executable patch candidate. It is a real workflow experiment, but Otwell's prediction that this becomes the norm should remain a founder/maintainer view rather than an industry fact.
HIPAA support moves Laravel Cloud into a class of regulated workloads that shared application hosting could not safely claim. Private Cloud supplies dedicated tenancy, encryption, SSO/SAML, backups and a BAA path, while application-level access control, audit logging and PHI handling remain the developer’s responsibility.
Reprise was already Symfony’s recommended modern bundler integration, but 1.0 changes the adoption decision: applications can now depend on a documented compatibility contract rather than an experimental 0.x API, while Encore remains available in low-maintenance mode.
Laravel now has a framework-native approval flow for AI tools: approvable tools can pause an agent, surface arguments and reasons, then resume the same persisted conversation after a human decision.
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.