Find published research by company, product, platform or technology.
Showing 81–100 of 299 dossiers
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
The first rollout turns developer identity into an Android-level distribution requirement across Google Play and six partner stores. It does not mean every sideloaded app is blocked today, but it materially changes the direction of non-Play Android distribution.
Cursor has become a concrete example of coding-tool supplier risk: a corporate acquisition can trigger a frontier-model provider’s change-of-control rights and remove a major model family from the product even when the coding tool itself remains operational.
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.
The November 2 follow-up supersedes 4.6.3 as the security upgrade target, with behaviour changes affecting custom dev hostnames, cached responses and route rules.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
This is a hard managed-database migration rather than a soft deprecation. IONOS says automatic migration is impossible, v1 instances are switched off, and applications need new v2 endpoints even though Valkey remains compatible with standard Redis clients.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort.
Cloud Storage project deletion no longer necessarily destroys every soft-deleted bucket immediately. Google’s August 17 change makes bucket retention part of project-recovery behavior, affecting disaster recovery, teardown assumptions and ongoing storage cost.
Google's agent-accessible data toolkit has moved beyond its August launch: GA expands support to Bigtable, BigQuery Graph and Spark, with IDE/CLI integration, IAM enforcement and no separate kit fee. Underlying Google Cloud usage still costs money.
Android Studio’s agent layer has crossed an important boundary from preview features into the stable channel: domain-specific skills are preloaded and auto-selected, while Gemma 4 can execute tool-calling code tasks locally without sending source code to a cloud model.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
MLflow CrewAI autologging silently logged API keys; 3.17.0 patches it, but previously exported traces and keys still need remediation.
The previously reported NVIDIA–Hugging Face deal is now a definitive agreement rather than an unconfirmed report. The most important new detail for builders is not only the price: NVIDIA has put multi-model and multi-silicon openness into its public and regulatory framing, while the acquisition still faces closing conditions and regulatory approval.