Find published research by company, product, platform or technology.
Showing 61–80 of 281 dossiers
A graph, an HTML Preview and a trusted virtual-keyboard message listener combined to bypass ChatGPT's iframe boundary. The fix is reported shipped, but the incident offers a practical warning to anyone embedding untrusted interactive content.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
With no planned installation banner, apps should identify affected merchants and handle the migration proactively; Shopify's alternative theme app embeds still require activation on the published theme.
Stripe Radar Standard, Plus and Pro merchants need to recheck renewal-screening settings and invoice volume. Radar Lite remains included with standard processing, and only transactions actually screened incur paid-tier screening fees.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
Developers can now train and evaluate adapters through custom code while Together runs the GPU-heavy operations. The flexibility comes with B200-only support, a $100 credit threshold and ongoing charges for idle ready resources.
Google's News AI pilot now includes 400+ publishers worldwide. The negotiated content-delivery licensing deals are separate from its Search Console AI Contribution Pilot, and payment terms remain private.
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.
Haiku 5.5 resets the economics of high-volume classification, extraction and agent sub-tasks, while Anthropic also cuts Sonnet 5.5 cache-read prices and introduces API credits for Max/Team subscribers.
Google must build Prebid integrations, let rival publisher ad servers receive real-time AdX bids, make publisher data portable and stop preferential AdWords bidding under a six-year court-supervised remedy.
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
This is a platform migration with a real rewrite boundary. Existing HTML games need to be rebuilt through Unity, Cocos or Laya, then have login, ads, purchases and other TikTok capabilities reintegrated and retested before relaunch.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
Jalapeño is working first-party silicon rather than a roadmap item, and OpenAI now says AI itself materially accelerated the design process. The distinction still matters: tape-out means the design was finalized for manufacturing; it does not mean fleet-scale production qualification or API deployment is complete.