Find published research by company, product, platform or technology.
Showing 41–60 of 82 dossiers
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
Postmark’s new IP Allowlisting creates an extra sending boundary around API credentials: trusted infrastructure can send normally, while requests from outside configured ranges fail even if the token itself is valid. SMTP is not covered.
OpenAI’s August 21 control moves processing-region choice into request routing: a single Global project can send eligible calls to regional base URLs. That simplifies multi-region SaaS architecture, but builders still need to enforce residency policy in code and account for support, retention and pricing constraints.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Ghost is turning its Docker Compose preview into the default self-hosting architecture for Ghost 7 and ending normal Ghost-CLI maintenance. Existing self-hosters will need to migrate deployment assumptions, not just upgrade the CMS package.
New AI-search data highlight the value of original product information while showing why one-size-fits-all GEO advice is risky.
ChatGPT Ads is expanding both in format and reach: selected advertisers can test branded conversational agents after an ad click, while the platform now spans more than 60 countries and OpenAI says it passed a $1 billion annualized revenue run rate by the end of August.
Google appears to have completed a talent-focused Mechanize deal: the startup still exists, but much of the team that builds coding-agent training environments and evaluations has moved into Google’s model-development work.
Microsoft’s Search automation has moved from a limited test into a default campaign-creation path. Advertisers can still switch AI Max off, but new Search campaigns now begin with a suite that can expand queries, creative and landing-page routing beyond the manually supplied keyword-and-ad structure.
The study moves the AI-search traffic debate beyond observational correlations: participants were randomly assigned to current Google Search, a version with AI features hidden, or AI Mode-only search during ordinary browsing. It is still a preprint and does not establish effects for every query or publisher.
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
16.4 fills gaps in the new navigation/caching model and adds ensureStatic checks, while preserving a separate migration path for existing routes.
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
The notable shift is not another AI visibility report. Google is testing a direct payment loop between content used to ground generative answers and the publishers that supplied it, with the payout surfaced inside Search Console.
The distribution shift matters beyond another sales-channel integration: product discovery, checkout, attribution and analytics can now happen off the merchant’s own storefront, and some familiar client-side pixels and checkout customizations do not travel with the order.
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
The August 20 tagging overhaul collapses Google’s lightweight tag and GTM into one platform, changing how marketers manage measurement code without requiring existing Google tags to behave differently on-page.