Find published research by company, product, platform or technology.
Showing 41–60 of 96 dossiers
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
The newer `critical=false` daemon control changes ECS Managed Instances from an all-daemons-are-instance-critical model to an explicit reliability trade-off: logging, metrics or security agents can fail without forcing application workloads off the host, while ECS still emits health events and action logs.
Codex 0.149.0 includes the async-message tool, delivery metadata and removal of the client-side feature gate that BTN previously tracked only on main. Parallel human-agent work is now in a stable client, but late replies can still race with decisions and model capability metadata remains the final exposure gate.
The October Shopify API is now production-stable. Apps adopting it must audit financial mutations, removed GraphQL fields, customer-segment filters and discount rollout schedules rather than relying on the earlier release-candidate checklist.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
For deals and store transfers from August 10, Shopify partners can earn both subscription revenue share and a slice of merchant GMV, while the earning window becomes four years instead of perpetual.
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
Google has separated personal app installation from public app publishing: an AI Studio-built Android app can launch through Play without a developer account, but sharing and public distribution remain restricted.
Stripe is seeing more new SaaS-style platform businesses, not fewer: new platform launches rose more than 180% year over year, and recent cohorts are reaching meaningful payment volume faster. The dataset is vendor-produced, but unusually concrete.
16.4 fills gaps in the new navigation/caching model and adds ensureStatic checks, while preserving a separate migration path for existing routes.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
The distribution shift matters beyond another sales-channel integration: product discovery, checkout, attribution and analytics can now happen off the merchant’s own storefront, and some familiar client-side pixels and checkout customizations do not travel with the order.
The interesting part of Fastly’s AI launch is consolidation: model gateway economics, LLM security and agent-to-API authorization now sit in the same request path as the CDN/WAF infrastructure many applications already use.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
GitHub has moved local Copilot sandboxes from preview to GA. Enterprises can now combine centrally managed approval policies with operating-system-enforced limits on what coding agents can actually reach.
Canvas moves AI store building into production theme code, but the official requirements make the maintenance boundary clearer: entering Canvas can cut off normal theme downloads and upstream theme updates.
AI image and social-app developers face clearer moderation and review obligations; hiding features can threaten an entire developer account.