Find published research by company, product, platform or technology.
Showing 81–100 of 153 dossiers
RuntimeWire found a generic `genui` message path, a server-directed widget refresh endpoint and 467 versioned Learning Block manifests inside OpenAI’s Codex desktop client. The material development is not another visualization feature: it is evidence of a reusable interface layer beneath conversational answers, with important limits around what is actually public or enabled.
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
Ghost is turning its Docker Compose preview into the default self-hosting architecture for Ghost 7 and ending normal Ghost-CLI maintenance. Existing self-hosters will need to migrate deployment assumptions, not just upgrade the CMS package.
Sentry has completed a breaking alerting migration. Legacy alert APIs are gone; metric detection now lives in Monitors while notification routing lives in Alerts, and old direct integrations must use the replacement endpoints.
Codex 0.149.0 includes the async-message tool, delivery metadata and removal of the client-side feature gate that BTN previously tracked only on main. Parallel human-agent work is now in a stable client, but late replies can still race with decisions and model capability metadata remains the final exposure gate.
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
WordPress 7.1.4 is a new security release; 7.1.3 is no longer the latest patched 7.1 build. Operators should update promptly.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
LFM2.5-DSpark adds roughly 300M-parameter draft models for LFM2.5 1.2B, 2.6B and 8B-A1B. Liquid reports large throughput gains on H100 and M4 Max, but the gains vary sharply by model and workload and current llama.cpp integration still has practical edge cases.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.
pg_ivm 1.17 fixes restore state, duplicated incremental-maintenance triggers and upgrade metadata handling, plus index inference and LATERAL crash bugs.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Early HTML-in-Canvas adopters need Chrome-version compatibility checks and a migration for renamed WebGL/WebGPU methods, drawable DOM markup and accessibility geometry; the feature remains an origin trial.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
An October 14 study tests package-manager integrity against a malicious registry. Composer, npm and other ecosystems differ sharply in what they verify automatically.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.