Let's Encrypt's 64-day TLS certificates arrive February 10 — test renewals from October 14
The certificate lifetime change is not a new CA or endpoint. It is a renewal-timing deadline for operators whose cron jobs assume 90-day certificates.
Search
Search results for “edge security”
Find published research by company, product, platform or technology.
Showing 41–60 of 206 dossiers
Laravel AI SDK patches an SSRF path in its Vercel and AG-UI file adapters
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Cloudflare Containers exposed previous tenants’ disk data through unzeroed blocks
This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots.
GitHub AI Scan no longer needs CodeQL default setup
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
Rust 1.98.1 fixes a compiler miscompilation that can emit undefined behavior
This is a compiler-correctness fix rather than a routine patch. Code built with Rust 1.98.0 can be wrong even when the source is valid, so teams that adopted that stable release should update and rebuild affected artifacts.
WordPress 7.0.4 fixes an Author-level file upload path to remote code execution
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
GitHub’s OAuth apps get short-lived tokens, multiple callbacks — and a wildcard setting worth auditing
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
Artificial IntelligenceWeb DevelopmentAI AgentsWordPressBrowsers & Web StandardsDeveloper ToolsActive dossier
WebMCP gives websites a structured tool layer for browser agents
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Web DevelopmentCloud & InfrastructureJavaScriptDeveloper ToolsObservabilityDatabases & StorageActive dossier
Supabase fixes broken client trace propagation and now preserves trace IDs even for unsampled requests
supabase-js 2.112.3 materially improves the tracing rollout BTN covered earlier: unsampled requests now still carry traceparent for backend log correlation, tracing misconfiguration produces warnings, and browser Edge Function calls need current CORS headers to admit W3C trace context.
Cloud CDN adds standards-based CDN-Cache-Control support
Cloud CDN can now honor CDN-Cache-Control separately from browser-facing Cache-Control. That gives builders a standards-based way to set shared-cache behavior at the edge while preserving different client-side caching rules.
Chrome 155 enables JPEG XL by default, moving the format toward mainstream web delivery
JPEG XL now ships by default in Chrome 155 and Firefox 158; Safari supports still images, but Edge, installed-version lag and format tooling still warrant fallback delivery.
Liquid’s LFM2.5 DSpark checkpoints make speculative decoding deployable in llama.cpp and SGLang
LFM2.5-DSpark adds roughly 300M-parameter draft models for LFM2.5 1.2B, 2.6B and 8B-A1B. Liquid reports large throughput gains on H100 and M4 Max, but the gains vary sharply by model and workload and current llama.cpp integration still has practical edge cases.
Google Ads has changed how budget-limited target bidding behaves
Google Ads has changed a long-standing edge case in automated bidding: budget-constrained campaigns now aim more consistently at their configured target instead of sometimes materially overachieving it.
Web DevelopmentCloud & InfrastructureCompute & AI InfrastructureDeployment & DevOpsDeveloper ToolsActive dossier
OpenSSH 10.6 turns on hybrid post-quantum signatures and disables compression to cut side-channel risk
The release is more than routine maintenance. OpenSSH is changing cryptographic defaults, sacrificing some compression effectiveness for side-channel safety, and warning that AI-assisted security reports are pushing it toward a faster release cadence.
Adobe ships an emergency hotfix for an actively exploited Magento RCE affecting current 2.4.x lines
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
Grafana Marketplace opens a paid plugin channel for specialist observability developers
At ObservabilityCON 2026, Grafana opened paid plugin distribution to verified partners. Cloud customers can trial and subscribe to integrations on their Grafana bill; partner maintenance and security requirements are part of the model.
Artificial IntelligenceWeb DevelopmentSaaSIndie BusinessAI SaaSAI CodingProduct EconomicsDeveloper ToolsActive dossier
Cloudflare cuts AI code-review cost 68% by fixing cache misses and testing model effort
A detailed engineering case study links a 68% AI-review cost reduction to prompt-cache structure and effort tuning, with security-review trade-offs still unresolved.
Web DevelopmentSaaSCloud & InfrastructureProduct & GrowthDeployment & DevOpsSaaS OperationsDeveloper ToolsActive dossier
Formbricks 6.1 ships scoped surveys and a breaking single-use-link migration after SpiceDB switch
Formbricks 6.1 adds survey-level access, v3 Responses API and Embedded Data V2, but a security fix breaks old encrypted single-use links. The tested upgrade path is 6.0.2 to 6.1.0.
Firefox Enterprise 158 puts browser policy, data controls and AI governance on customer-run infrastructure
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.
GitHub makes enterprise licence compliance a pull-request merge gate — with an API for coding agents
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.