Find published research by company, product, platform or technology.
Showing 61–80 of 106 dossiers
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
Google's distributed SQL database can now run in production beyond Google Cloud, but 'deploy anywhere' doesn't mean free or fully managed. Spanner Omni GA brings security, backup and paid commercial licensing, with important limits on its developer edition.
The third-party pgx-bm25 1.0 extension gives PostgreSQL 17 and 18 native-index BM25 ranked retrieval with ordered scans and no external engine, but it is not built into PostgreSQL core and has important planner and RLS caveats.
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
Studio Code was already available in WordPress Studio, but the August 24 redesign changes the default workflow: the coding agent now sits at the center of the desktop app beside a live local WordPress preview, with point-and-annotate feedback and one-click hosting sync. The beta also ends the earlier unlimited-free framing by introducing a credit limit and paid top-ups.
Ghost is turning its Docker Compose preview into the default self-hosting architecture for Ghost 7 and ending normal Ghost-CLI maintenance. Existing self-hosters will need to migrate deployment assumptions, not just upgrade the CMS package.
Caddy 2.11.8 adds a substantial set of PHP/FastCGI, reverse-proxy, TLS and security-hardening fixes after the 2.11.7 streaming repairs.
The November 2 follow-up supersedes 4.6.3 as the security upgrade target, with behaviour changes affecting custom dev hostnames, cached responses and route rules.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
The self-hosted deployment platform's November 2 release changes how teams delegate infrastructure control. Existing integrations using write-only tokens for deletions may fail until explicitly reauthorised.
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
Staging tests found acme.sh 3.0.7 with --days 80 scheduled renewal 15 days after a 64-day certificate expired. Newer acme.sh and Certbot behaved differently; audit versions and overrides rather than assuming your cron is safe.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
The issue is software time-zone data, not changed stored timestamps. A fixed-offset workaround can affect historical date conversions.
Cloudflare Tunnel changes how Access-protected ingress rules match dot segments and repeated slashes. Opt in now; test before the January 25 default flip.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.