Find published research by company, product, platform or technology.
Showing 41–60 of 89 dossiers
Manifest V2 was already disabled for modern Chrome users. The August 31 change closes the remaining Web Store path, turning any still-pinned legacy install into an effectively frozen artifact with no Store update or reinstall route.
Northflank clarifies the October 30 secret-exposure window and alert-to-patch timeline; an affected customer confirms database credentials were at risk, although its own logs show no unauthorised access.
November 5 Formbricks 6.1.4 restores AuthZed projection delivery after Redis interruptions, adds optional SMTP_REQUIRE_TLS and tightens auth request handling; 6.0/5.4 backports differ.
OpenShell 0.1.6 and 0.1.7 harden gateway access and adjust sandbox supervision, DNS checks and audit compatibility. Operators must configure auth and migrate OCSF consumers; these releases do not prove Sentry's hardware quarantine independently.
PIE 1.5.5 and 1.4.12 fix a low-severity temporary-file issue in the PHP extension installer that could expose long failed-build logs to other local users.
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
The RC2/GA schedule has not changed. A PostgreSQL committer now explains why review and backpatch workload overwhelmed the release process, with caveats around attributing every extra bug to AI.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
MLflow CrewAI autologging silently logged API keys; 3.17.0 patches it, but previously exported traces and keys still need remediation.
Agent skills join prompts and models as managed runtime configurations; approvals and pinned versions make changing agent behaviour auditable rather than an untracked edit to skill files.
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Google Cloud customers gain a new route to OpenAI models with unified governance and cloud-commitment billing, but broad availability and some privacy features are still forthcoming.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
WordPress 7.2 Beta 1 landed October 20 with wp_set_secret and wp_get_secret, encrypted storage, current/previous versions and pluggable back ends. Existing plugin credentials do not migrate automatically; the final release is scheduled for December 8.
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
Private ingress joins existing private egress for Scaleway Serverless Containers. The new option can isolate services inside a VPC, but private DNS, TLS, authentication, cold-start and network-scope constraints still matter.
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.