pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Search
Search results for “Nix Lix security October 2026”
Find published research by company, product, platform or technology.
Showing 81–100 of 446 dossiers
Artificial IntelligenceWeb DevelopmentSaaSPricing & BillingAI AgentsAI SaaSDeveloper ToolsActive dossier
Atlassian will meter Rovo MCP and Teamwork Graph context calls from December 3
From December 3, agent workflows that ask Atlassian's Teamwork Graph for cross-product context will need a cost budget. Most enriched tool calls use 1–10 Rovo credits, with paid overages at $0.01 per credit.
OpenAI expands its rogue-agent incident review to third-party notifications and access-control failures
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
A 3,846-product SaaS census still puts flat platform pricing ahead of pure per-seat billing
The broad result survives a meaningful refresh of the living dataset: observable SaaS pricing is still not predominantly per-seat, but the exact model mix moved enough that the old 41% flat/platform figure should no longer be quoted as current.
SaaSIndie BusinessMarketing & DistributionSEO & SearchGEO & AI SearchIndie SaaSProduct & GrowthConversion & AnalyticsActive dossier
DocsBot says better customers are barely offsetting a shrinking signup funnel
The useful small-SaaS lesson is not that SEO is dead or AI search has won. DocsBot’s own numbers show how a channel can remain the largest share of conversions while the total funnel underneath it shrinks, and how 'Direct' can conceal the discovery path that actually influenced a sale.
Stripe says hybrid pricing has crossed from AI experiment to real adoption
The useful signal is not that every SaaS company should add usage billing. Stripe/Metronome says hybrid pricing went from barely used to roughly one in six qualifying Stripe users, while many AI products are hiding token metering behind credits or output units so customer invoices describe value rather than model cost.
Stripe says new SaaS platform launches are up more than 180% year over year
Stripe is seeing more new SaaS-style platform businesses, not fewer: new platform launches rose more than 180% year over year, and recent cohorts are reaching meaningful payment volume faster. The dataset is vendor-produced, but unusually concrete.
WordPress 7.1.2 patches core RCE path as attackers move from probes to active exploitation
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
Cloudflare retires its legacy Registrar API — domain-management integrations need new endpoints
The replacement is not a drop-in path rename: Cloudflare separates domain search, availability checks and registration operations into newer endpoints, so old registrar automation can break after the cutoff.
The Events Calendar exposes 600,000+ WordPress sites to two comment-preview RCE chains
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
Google must open AdX and DFP to Prebid under six-year ad-tech remedies
Google must build Prebid integrations, let rival publisher ad servers receive real-time AdX bids, make publisher data portable and stop preferential AdWords bidding under a six-year court-supervised remedy.
GitHub has switched off SHA-1 HTTPS support — old Git and API clients can now fail
The deadline is no longer theoretical: browsers, Git HTTPS backends and API clients that still depend on SHA-1-era TLS algorithms can now lose connectivity to GitHub.com.
Keycloak patches a critical password-reset flaw that can let unauthenticated attackers take over any account
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
Twilio now blocks new Toll-Free messaging verifications without public privacy and terms URLs
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
Azure Document Intelligence v2.0 API retires August 31 — old integrations need a version migration
Azure Document Intelligence v2.0 reaches retirement on August 31, 2026. Microsoft recommends moving workloads to the current v4.0 API; the post-v2 REST surface was redesigned, so teams should verify the actual api-version their SDK or HTTP client sends rather than assuming a package upgrade is enough.
Stripe Revenue Recognition users must pick a subscription plan by August 19
Stripe says Revenue Recognition users covered by its pricing transition must select a subscription plan by August 19, 2026. If they have not switched by August 20, Stripe will automatically turn the product off until they subscribe.
TikTok has retired HTML mini games — developers must rebuild them for its native runtime
This is a platform migration with a real rewrite boundary. Existing HTML games need to be rebuilt through Unity, Cocos or Laya, then have login, ads, purchases and other TikTok capabilities reintegrated and retested before relaunch.
Adobe ships an emergency hotfix for an actively exploited Magento RCE affecting current 2.4.x lines
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
Super Forms’ 13,000-site WordPress flaw is being exploited at scale despite its smaller install base
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
Elementor Pro’s unauthenticated file-upload flaw is now being actively exploited
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.