Find published research by company, product, platform or technology.
Showing 61–80 of 108 dossiers
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
The affected-customer count and entry point remain unconfirmed. Revoking keys at the issuing provider matters more than simply changing a platform variable.
The useful finding is not that BRIN is bad: it is that a table can still report strong column correlation while update churn has destroyed the physical range locality BRIN actually depends on. DeepSQL published the full Docker/SQL harness so teams can reproduce the failure mode on their own workloads.
Supabase has implemented MCP Enterprise-Managed Authorization using identity-provider assertions, short-lived tokens and existing Supabase role boundaries. It gives organizations a central on/off switch for approved AI clients while keeping access scoped to the individual employee rather than sharing a powerful organization token.
R2’s new `us` jurisdiction gives object-storage users an explicit US data-residency guarantee, with jurisdiction-specific S3 endpoints and Workers bindings. Existing unrestricted buckets cannot simply be flipped into the new jurisdiction because jurisdiction is immutable after creation.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Railway has not confirmed every customer was breached. Precautionary all-customer rotation guidance, revoked API tokens and deployment disruption make this actionable for builders.
PGDG's 20 October repository retirement requires RHEL, Rocky and AlmaLinux 9.6/10.0 operators to update their OS minor release or deliberately switch to the frozen archive. Rolling EL9 and EL10 repository packages are unaffected.
WordPress 7.2 Beta 1 landed October 20 with wp_set_secret and wp_get_secret, encrypted storage, current/previous versions and pluggable back ends. Existing plugin credentials do not migrate automatically; the final release is scheduled for December 8.
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
A search-engine maintenance release carries intentional relevance and API compatibility changes that operators should test.
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
The two August 28 changes move a common production-agent problem out of bespoke application code: builders can derive memory boundaries from authenticated JWT claims, enforce them with Cedar policy, and organize the stored memory using runtime tenant dimensions.
supabase-js 2.112.3 materially improves the tracing rollout BTN covered earlier: unsampled requests now still carry traceparent for backend log correlation, tracing misconfiguration produces warnings, and browser Edge Function calls need current CORS headers to admit W3C trace context.
The incidents do not have a proven common attacker. Wiz's forensic evidence shows downstream abuse and resale of stolen keys, not that every platform breach caused the same misuse.
Stalwart 1.0.1 fixes local credential-file permissions and a tenant isolation bug, but changes Prometheus/OTLP metrics and leaves some migration WebUI cache pitfalls.
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Bun 1.4.4 introduces bun fmt, accelerates bun check and preserves Yarn Berry lockfiles during migration. Teams should test formatter output and unsupported plugins before replacing Prettier in CI.