Find published research by company, product, platform or technology.
Showing 41–60 of 104 dossiers
Together Link connects six existing coding-agent/desktop harnesses to open models with reversible profiles, per-session routing and cost receipts. The important shift is portability at the harness boundary, not Together's unverified savings claim.
AI image and social-app developers face clearer moderation and review obligations; hiding features can threaten an entire developer account.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
Cloudflare saw roughly 22,000 weak-chain TLS handshakes, about 160 unusual forged certificates and 50 million skewed challenge-page probes. The data indicate continuing exposure, not 22,000 successful attacks.
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
Two further platform incidents broaden Wiz's tally from twelve to at least fourteen, including Kernel's stolen logging credentials and Blacksmith's CI job-log store breach.
Google Ads now documents positive-only AI review summaries inside Search ads in the US, UK, Australia and India. Advertisers cannot customise the text; source, opt-out and reporting controls remain unclear.
With no planned installation banner, apps should identify affected merchants and handle the migration proactively; Shopify's alternative theme app embeds still require activation on the published theme.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Repository growth tools can measure when star counts changed again without rebuilding individual-user histories. The new API deliberately separates aggregate popularity data from stargazer identity, so integrations need to distinguish trend analytics from user-level community data.
The newer `critical=false` daemon control changes ECS Managed Instances from an all-daemons-are-instance-critical model to an explicit reliability trade-off: logging, metrics or security agents can fail without forcing application workloads off the host, while ECS still emits health events and action logs.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Shopify's App Pricing migration is now clearer: directly matching subscriptions can move through plan setup, while usage-based and price-mismatched subscriptions stay on the Billing API until a separate Migration API arrives.
A November 6 tinyjs patch repairs Windows builds broken by 0.71.0. Because affected apps cannot launch their updater, operators must rebuild and redistribute them.
Project Rubicon uses object storage, disposable replicas and a reference transaction service to accommodate agent-driven parallel Git writes; access remains limited.
November 5 Formbricks 6.1.4 restores AuthZed projection delivery after Redis interruptions, adds optional SMTP_REQUIRE_TLS and tightens auth request handling; 6.0/5.4 backports differ.
LiteLLM 1.107.0 remains a known compromised release. Its October 30 security review now sets out why signing failed to protect users and which fixes are complete versus only promised.
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.