Find published research by company, product, platform or technology.
Showing 81–100 of 297 dossiers
This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots.
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort.
Estuary’s new runtime is less about an AI label than a data-correctness problem: the same pipeline is meant to move from millisecond streams to large backfills without exposing downstream systems to partial transactions or requiring separate batch reconciliation.
Publishers can opt out of AI model training without necessarily leaving traditional search or AI citations. Microsoft's new page-level grounding controls introduce a migration trap for sites relying on legacy NoArchive/NoCache settings.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
The break is narrow but concrete: scripts and CI/CD calling the old route paths can fail, while monitoring code that expected `connections` inline must fetch it separately.
Search Console now separates both generative-AI visibility and multimodal image-led searches, giving publishers a clearer first-party view of how content is discovered outside conventional typed queries.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The AI Compute Partnership tied Nvidia more directly to the capital structure and utilization risk of emerging cloud providers. Reuters says the initiative is now paused amid concerns about circular demand, control over partners and antitrust exposure, although Nvidia says the broader compute-access model continues to evolve.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Caddy 2.11.8 adds a substantial set of PHP/FastCGI, reverse-proxy, TLS and security-hardening fixes after the 2.11.7 streaming repairs.
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
The release is more than routine maintenance. OpenSSH is changing cryptographic defaults, sacrificing some compression effectiveness for side-channel safety, and warning that AI-assisted security reports are pushing it toward a faster release cadence.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.