Find published research by company, product, platform or technology.
Showing 61–80 of 449 dossiers
Cloudflare’s new MCP controls turn TLS-inspected Gateway traffic into an inventory and policy surface for remote MCP use, while explicitly leaving local stdio, off-network and uninspected traffic outside visibility.
Retention-locked backups are gaining a project-level consequence: Google Cloud plans to create automatic liens that can block project deletion while protected backups remain. Infra teams need to account for this in teardown automation, IAM and recovery design.
DynamoDB vector indexes add native similarity search through SearchVectors and now have clear per-GB write, search and storage pricing, plus published throughput quotas.
DuckDB's agent-aware CLI aims to make tool output safer and more compact for coding agents. Its own experiment showed 59% fewer CLI-output tokens but only about 0.5% lower total input cost, so practical gains need careful interpretation.
Rashomon's experimental local recorder can expose discrepancies between a coding agent's closing claims and its tool execution. It is an observability aid, not a sandbox or tamper-proof security product.
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
The useful part of Smaug Agentic is not another frontier-style benchmark claim. Abacus.AI is publishing a drop-in Kimi K3 derivative that targets a specific production failure mode in coding agents: long runs that burn the reasoning budget without converging. The weights and model card are public, but the training data is not disclosed and the benchmark gains remain vendor-produced.
This is not a normal ranking update. Google is changing the structure of commercial search results in the EEA under the Digital Markets Act, creating explicit result surfaces for vertical search services and suppliers that do not appear the same way elsewhere.
Hy4 preview is a very large sparse model with public full and FP8 weights, native speculative decoding and a 1M-token context path. Its open release makes Tencent’s claims testable, while the 1.56TB full checkpoint keeps self-hosting firmly in server-scale territory.
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
Sentence Transformers 6 now has both unified multi-vector inference and a documented end-to-end training workflow. A new project-authored benchmark shows fast domain adaptation on a single GPU, but the result is workload-specific and index costs remain high.
Aurora Serverless can now add roughly 12 ACUs in the first second of a scale-up event on platform versions 3 and 4. The change is automatic and is most useful for bursty SaaS, API, batch and agent workloads, but it does not remove the separate resume delay when a database has scaled all the way to zero.
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
The 61st OpenBSD release improves virtualization, arm64 and RISC-V support, kernel memory layout and package hardening. Operators should read the official 8.0 upgrade notes and errata rather than assume an in-place upgrade is risk-free.