Find published research by company, product, platform or technology.
Showing 81–100 of 548 dossiers
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Computer Use is now GA in both Gemini APIs, but it is an action-planning tool, not a hosted remote desktop: clients execute clicks and keystrokes and must handle safety decisions.
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.
The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date.
Stalwart's new encryption gateway is substantial, but its 1.0.2 upgrade resets existing per-account encryption-at-rest settings. Operators must restore keys, check admin permissions and test newly received mail.
The November 2 follow-up supersedes 4.6.3 as the security upgrade target, with behaviour changes affecting custom dev hostnames, cached responses and route rules.
A free open-source video editor gains a scriptable, headless editing surface: import and trim clips, apply effects, inspect contact sheets, export and hand projects back to a human. Auto-Optimize separately speeds up 4K editing without lowering final output quality.
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
New RevenueCat growth tools bring web funnels, AI paywalls and early payouts into one subscription platform, with important eligibility and fee caveats.
OpenAI's new API credit grants can lower the cost of prototyping apps and agents, but eligibility, expiration, API limits and excluded Codex usage matter.
Three new GitHub webhook CIDR blocks can break deliveries to tightly firewalled endpoints unless static allowlists are updated.
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
Shopify theme authors can now bundle one paid app add-on per theme listing, opening a new monetisation route with app review and ownership restrictions.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
Bun 1.4.4 introduces bun fmt, accelerates bun check and preserves Yarn Berry lockfiles during migration. Teams should test formatter output and unsupported plugins before replacing Prettier in CI.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
WooCommerce 11.3 removes /wp-json/woocommerce/mcp, REST-key MCP authentication and REST-derived abilities. Migrate clients to the WordPress MCP Adapter plugin, application passwords and explicit ability metadata before upgrading.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.