PHPUnit hardens agent-read test output and repairs machine-readable XML reports
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
Search
Search results for “browser automation security”
Find published research by company, product, platform or technology.
Showing 81–100 of 326 dossiers
PgBouncer 1.26.1 closes a SCRAM authentication bypass that can reach database superusers
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.
WordPress rewrites wp_kses around the HTML API — plugin sanitisation output can change
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
Inertia.js 3.9 fixes cached protected pages resurfacing after logout
Inertia.js 3.9 flushes prefetch entries when history is cleared, preventing a previously visited protected page from reappearing from client cache after logout.
pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Let's Encrypt's 64-day TLS certificates arrive February 10 — test renewals from October 14
The certificate lifetime change is not a new CA or endpoint. It is a renewal-timing deadline for operators whose cron jobs assume 90-day certificates.
Laravel AI SDK patches an SSRF path in its Vercel and AG-UI file adapters
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Cloudflare Containers exposed previous tenants’ disk data through unzeroed blocks
This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots.
GitHub AI Scan no longer needs CodeQL default setup
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
WordPress 7.0.4 fixes an Author-level file upload path to remote code execution
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
GitHub’s OAuth apps get short-lived tokens, multiple callbacks — and a wildcard setting worth auditing
GitHub OAuth apps can now use eight-hour access tokens with rotating refresh tokens, register up to 10 callback URLs, and explicitly control wildcard callback matching. New apps default to expiring tokens, while existing single-callback apps should review a legacy wildcard setting GitHub has now made visible.
GitHub is turning agent confidence into a workflow control for Issues
GitHub Issues now gives agent automations confidence levels, rationales and optional approvals, letting teams automate routine triage while holding uncertain changes for review.
Bun 1.4 rewrites the runtime in Rust and moves closer to Node.js 26 compatibility
Bun 1.4 combines an implementation-language rewrite with a larger built-in standard library and a substantial Node-compatibility push. For teams already running Bun, the practical task is to validate native addons, runtime behavior and workload-specific performance rather than treating this as a drop-in minor upgrade.
Google Analytics can now reject ghost traffic with hostname allowlists
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
Chrome and Firefox are moving major releases to two-week cycles
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
Cloud CDN adds standards-based CDN-Cache-Control support
Cloud CDN can now honor CDN-Cache-Control separately from browser-facing Cache-Control. That gives builders a standards-based way to set shared-cache behavior at the edge while preserving different client-side caching rules.
Shopify sets offline-token cutoff dates and adds IP restrictions for public apps
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Grafana Adaptive Metrics adds cost-first auto-apply to prevent metrics-series growth
The existing coverage-first mode keeps more query detail at the cost of possible series growth. Cost-first applies all reductions but only restores detail within the same series budget; it is a guardrail against metric-cardinality spikes, not a guarantee of a fixed bill.
Cloudflare retires its legacy Registrar API — domain-management integrations need new endpoints
The replacement is not a drop-in path rename: Cloudflare separates domain search, availability checks and registration operations into newer endpoints, so old registrar automation can break after the cutoff.
Cloudflare makes post-quantum origin TLS automatic — and cuts p90 handshake latency by more than 150ms
The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort.