Find published research by company, product, platform or technology.
Showing 41–60 of 381 dossiers
Cloudflare saw roughly 22,000 weak-chain TLS handshakes, about 160 unusual forged certificates and 50 million skewed challenge-page probes. The data indicate continuing exposure, not 22,000 successful attacks.
ParticleDB's claimed ACID guarantees failed Jepsen tests: acknowledged writes disappeared, queries returned wrong rows, and even healthy single-node tests exposed integrity faults.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
DV360's new bulk-campaign file format isn't a drop-in CSV upgrade: targeting expands, YouTube vendor columns change, and API support lags the interface. Integrators should audit parsers before migrating.
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
The architecture matters as much as the voice quality: developers can replace a chained speech-to-text → LLM → text-to-speech loop with one full-duplex conversational model while keeping their own choice of backend reasoning model, tools and agent harness.
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
The UK CMA is investigating Meta's website-content terms for publishers and advertisers. Proposed changes are paused, not approved or found unlawful.
Stalwart 1.0.1 fixes local credential-file permissions and a tenant isolation bug, but changes Prometheus/OTLP metrics and leaves some migration WebUI cache pitfalls.
HTML-in-Canvas is moving from trial to Chrome Stable, enabling accessible live HTML in 2D/WebGL/WebGPU scenes. Early adopters must migrate method names and test real library versions; other browsers still need fallbacks.
The DNS root's scheduled October 11, 2026 KSK rollover exposes old or incorrectly restored validating resolvers. Check KSK-2024 trust-anchor adoption; this is not a change to website DNS records or a confirmed global outage.
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
Notion Workers are now metered inside the same credits system as Custom Agents. The important builder shift is that schedules, webhook fan-out and agent tool-call counts now directly affect cost.
Ahrefs tracked roughly 37,500 cited websites for 20 days and found high daily citation churn, frequent recoveries and major differences between AI tools.
Safari 27 blocks third-party email-to-ID resolvers by domain. First-party personalisation remains allowed; the affected vendor list and measured advertising impact remain unverified.
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Google is changing the default for Performance Max image extraction on December 4, 2026. Existing campaigns keep their settings, but new campaigns will opt in regardless of an account-level opt-out; agencies and SaaS ad tools need a campaign-level override and careful handling of repeated asset settings.