Find published research by company, product, platform or technology.
Showing 61–80 of 182 dossiers
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
The important change is enforcement. WordPress.org already had a release cooldown and automated scanning, but high-risk results can now stop a plugin update automatically instead of waiting for the Plugins Team to intervene.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
X’s replacement creator program is now live enough to expose a new dependency: U.S. creators must route Original Content Rewards payouts through X Money, and one X Money account can connect to only one X account. Eligibility and qualified-impression rules remain unchanged.
The October major release simplifies SvelteKit's architecture but breaks familiar config files and legacy imports. Teams should run the codemod and verify adapters and deployments.
The 10GB Hobby storage cap has not changed, but the consequence of crossing it has. Vercel has removed the previous 30-day grace period for non-exempt deployments, shrinking the rollback and preview history free-plan builders can assume will remain available.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.
The pricing change is also a packaging change: beehiiv is charging more for paid tiers while putting newsletters, websites, podcasts, community and digital products across the plan family and extending self-serve scale.
Tailcat remains useful as a small encrypted peer-connectivity primitive, but its first documented malware adoption changes the operational context: Kothamine can use Tailcat to avoid a conventional command-and-control domain that defenders would otherwise block.
beehiiv has documented the economics and guardrails behind its rebuilt Recommendation Network, including the 20% fee on paid recommendations, verified-subscriber charging, quality-based auto-pause rules and more granular control over recommendation slots and partner selection.
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
GitHub's October 14 editor's correction confirms Actions workflow lockfiles are available on Free and Team as well as Enterprise Cloud—not enterprise-only as initially reported.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
Vercel KMS gives Functions OIDC-authenticated access to managed RSA, ECDSA and EdDSA signing keys. Builders can scope grants by project and environment, constrain JWT claims with JSON Schema, rotate keys centrally and publish standard OIDC/JWKS metadata for verification outside Vercel.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
Coolify 4.4.0 adds opt-in proxy traffic analytics, external secret managers, OIDC login, audit trails, Cloudflare DNS and experimental SQLite. Operators need to account for proxy restarts, Caddy redeploys and feature maturity.
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.