Find published research by company, product, platform or technology.
Showing 41–60 of 81 dossiers
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
Jalapeño is working first-party silicon rather than a roadmap item, and OpenAI now says AI itself materially accelerated the design process. The distinction still matters: tape-out means the design was finalized for manufacturing; it does not mean fleet-scale production qualification or API deployment is complete.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
Stripe expands Global Payouts to 160 stablecoin markets and 100-plus fiat markets, with stablecoin-backed Issuing cards launching in 27 EU countries; the announcement is about financial-product infrastructure, not ordinary subscription checkout.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
Cloudflare Computer 0.7 makes agent code resumable and interruptible. The important catch: recovery replays code, and unrecorded external actions can be repeated even if they already succeeded.
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Python 3.15.1 supersedes the 3.15.0 launch with an urgent certificate-trust update. New installers alone do not update existing virtualenvs: update pip, uv and certifi where applicable.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.