E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
Search
Search results for “Wiz Black October”
Find published research by company, product, platform or technology.
Showing 81–100 of 271 dossiers
RevenueCat expands app monetisation with AI paywalls, web funnels and early payouts
New RevenueCat growth tools bring web funnels, AI paywalls and early payouts into one subscription platform, with important eligibility and fee caveats.
SaaSCloud & InfrastructureMarketing & DistributionHostingEmail & LifecycleSaaS OperationsActive dossier
Stalwart 1.0.1 fixes credential exposure and tenant isolation — 1.0 migration still needs care
Stalwart 1.0.1 fixes local credential-file permissions and a tenant isolation bug, but changes Prometheus/OTLP metrics and leaves some migration WebUI cache pitfalls.
Reddit plans login-first browsing as search referrals fall — Q4 tests will restrict open access
Reddit's Q3 shareholder disclosures set a direction towards logged-in browsing, not an immediate worldwide login wall. Q4 non-US tests follow declining search referrals, with consequences for community discovery, advertising and access to public conversations.
WordPress 7.1.4 fixes upgrade-window RCE, three stored-XSS paths and eMudhra trust roots
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
Ollama Cloud replaces its Free tier with Pay as you go and triples entry-level concurrency
The new $0-subscription tier no longer lists starter credits, while three simultaneous requests are now permitted. Builders should check prepaid balance, model prices and queues before relying on the service.
Chrome 157 takes HTML-in-Canvas stable — early trial code and 3D libraries need compatibility checks
HTML-in-Canvas is moving from trial to Chrome Stable, enabling accessible live HTML in 2D/WebGL/WebGPU scenes. Early adopters must migrate method names and test real library versions; other browsers still need fallbacks.
GitHub Copilot Projects gives coding agents persistent goals across repositories
Copilot Projects can coordinate agents, files and recurring tasks across repositories or non-code work; review and permissions remain human responsibilities.
Shopify opens Flow automation management to external AI agents — but not third-party apps
Shopify Flow becomes agent-operable for store owners, but its automation APIs are not a general third-party app integration.
Web DevelopmentMarketing & DistributionDeveloper ToolsMarketplaces & PlatformsConversion & AnalyticsActive dossier
Shopify lets apps put their own metrics inside merchant Analytics reports
Shopify apps can now expose standard and custom activity in merchant Analytics, with 30-day attribute breakdowns and 365-day aggregate metrics.
Cloudflare's Q3 DDoS report: short attacks surge as giant floods fall 69%
Q3 Cloudflare telemetry: 18.2 million network-layer attacks, 96% under ten minutes, but far fewer terabit-scale floods.
Google opens Connected Apps Platform preview for MCP tools inside Search and Gemini
Developers can submit tool integrations to Google Search and Gemini using MCP, but access is phased, users must connect apps, and Google reviews submissions.
GitLab's CVSS 10 CI regex flaw targeted Alpine Linux — custom Ruby images can remain vulnerable after GitLab upgrades
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
GitHub Enterprise now offers Copilot with no extra seat fee — but no included AI credits
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
PostgreSQL Anonymizer 3.3 patches 12 masking bypasses — upgrades require more than a version bump
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Coolify 4.5.3 repairs access controls, deployment healthchecks and retry hazards after 4.5 launch
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
GitHub Copilot Fusion goes GA with multi-model routing, effort tiers and experimental local inference
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
PingCAP confirms TiDB Cloud customer records exposed through internal credentials — rotate management keys
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
GitHub Copilot SDK gains organisation-owned server-to-server authentication for agents
GitHub Apps can now authenticate Copilot SDK workloads without a user's credentials. Organisation admins control installation permissions, usage attribution and budgets.
Shopify sets offline-token cutoff dates and adds IP restrictions for public apps
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.