Find published research by company, product, platform or technology.
Showing 61–80 of 80 dossiers
The October release is more than a version bump: PHP server operators should patch document-root and header risks, then test worker/thread budgets and stricter proxy defaults before upgrading.
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
DeepSeek V4.1 Flash supersedes the old Flash and Vision-Exp API lines with native multimodality, lower pricing and new architecture. Unlike those retired Flash aliases, the current DeepSeek API changelog and rate card still show V4 Pro as a distinct service.
The October major release simplifies SvelteKit's architecture but breaks familiar config files and legacy imports. Teams should run the codemod and verify adapters and deployments.
The useful signal is not that every SaaS company should add usage billing. Stripe/Metronome says hybrid pricing went from barely used to roughly one in six qualifying Stripe users, while many AI products are hiding token metering behind credits or output units so customer invoices describe value rather than model cost.
Pi’s first stable release is interesting less for another coding-agent version number than for what its deliberately minimal core now considers mature enough to include: MCP, code-driven tool orchestration and model routing.
The useful shift is not another AI wrapper around CI. sem-ai exposes CI/CD as structured, self-describing operations that Claude Code, Codex and other MCP-aware agents can call directly, including failure diagnosis and pre-push testing in CI.
MiMo-V2.6 is more useful than another benchmark launch because builders get both capable multimodal weights and a rare view into the reinforcement-learning machinery that produced them: code, environments, run costs and even failure notes from the training cluster.
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The security shift is deeper than running application containers as non-root: the node stack itself can now live inside a user namespace. The feature is enabled by default in 1.37, but clusters do not become rootless automatically and CNI/CSI compatibility still needs testing.
The new processor can vary sample rates by trace fingerprint and target either a traffic percentage or throughput budget. It is usable now in Honeycomb’s Collector distribution, while the upstream OpenTelemetry component is still working toward alpha.
This is a platform architecture migration rather than a user-facing feature. Pantheon says no action is required, but builders operating storage-sensitive WordPress or Drupal workloads should know when their tier moves and verify backup, restore and file-handling behavior around the change.
The new request-level controls make email measurement a per-send decision: an application can keep one SES configuration set while disabling open or click tracking for recipients who should not be measured. The override wins over the configuration-set default and adds no separate feature charge.
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
A 50M+ subscription cohort gives AI SaaS builders a more useful retention benchmark than conversion anecdotes: high-retention monthly apps renew 57.9% of subscribers at the first opportunity versus 30.2% for low retainers, with the gap narrowing later. The study is observational, not causal.
Private Safety Processing is OpenAI’s attempt to reconcile stronger multi-turn safety monitoring with Zero Data Retention. Early customers are testing it now, with rollout and a technical white paper planned for September; important implementation details remain unpublished.
Ada has added code tools that run a restricted Python subset inside agent conversations. They can transform API responses, perform deterministic calculations and call allowlisted domains, while MCP-authored changes can be staged and reviewed before promotion.
Email open tracking is becoming a consent-controlled data source rather than a default analytics primitive. Klaviyo’s new controls can remove opens from reporting, attribution, segments and flow triggers for recipients who should not be tracked.