GitLab patches a CVSS 10.0 CI/CD regex RCE — and five more high-severity flaws
CVE-2026-97229 carries GitLab's maximum 10.0 CVSS score. The 19.3 patch line requires 19.3.5, not the initially issued 19.3.4, because of an Ona integration regression.
Search
Search results for “small-site indexing”
Find published research by company, product, platform or technology.
Showing 81–100 of 190 dossiers
Google Analytics can now reject ghost traffic with hostname allowlists
The useful change is not another reporting dimension. GA properties can now discard events whose hostname is not approved, directly addressing Measurement-ID abuse and ghost traffic while reducing the maintenance burden of chasing new spam domains.
Shopify turns Meta into a direct AI checkout channel — with product sharing on by default
The distribution shift matters beyond another sales-channel integration: product discovery, checkout, attribution and analytics can now happen off the merchant’s own storefront, and some familiar client-side pixels and checkout customizations do not travel with the order.
WordPress Playground can now boot WordPress 0.7 through 6.2 in the browser
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
Vercel makes production deployment authentication free on every plan
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
Reddit Ads API is changing campaign objectives and retiring onsite lead forms in September
The technical migration is unchanged, but Reddit's documentation has proven unusually volatile. Integrations should now treat September 21 as the current objective/form readiness date and December 8 as the current published cutoff for HOUR reports longer than seven days—while continuing to recheck the live docs before each deadline.
Firefox Enterprise 158 puts browser policy, data controls and AI governance on customer-run infrastructure
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.
DNS root key rollover puts stale validating resolvers at risk after October 11
The DNS root's scheduled October 11, 2026 KSK rollover exposes old or incorrectly restored validating resolvers. Check KSK-2024 trust-anchor adoption; this is not a change to website DNS records or a confirmed global outage.
Anthropic expands Claude incident disclosures and cuts live web access from internal evaluations
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Meta blocks TikTok-linked advertising across seven markets, including third-party campaigns
The October 8 policy closes a paid cross-platform acquisition route, including indirect TikTok-link campaigns, while leaving the wider boundaries for independent creators and non-ByteDance destinations unclear.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsActive dossier
Lightpanda 1.0 makes a Zig headless browser production-ready for agents and crawlers
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
Chrome 155 enables JPEG XL by default, moving the format toward mainstream web delivery
JPEG XL is leaving the experimental-browser niche. Chrome 155 now decodes it by default, but Edge, older installed browsers and Safari's partial feature set still require fallbacks.
WordPress 7.1.3 patches seven core security flaws — including pending-comment XSS and WXR SQL injection
The October 6 release is broader than WordPress 7.1.2's single critical RCE fix: it closes seven separate core flaws, including stored XSS through pending comments, second-order SQL injection in WXR exports and unauthenticated disclosure of comments on private posts.
Artificial IntelligenceWeb DevelopmentMarketing & DistributionAI CodingDeveloper ToolsMarketplaces & PlatformsActive dossier
Shopify Canvas lets Sidekick rewrite the live theme behind an entire storefront
Canvas moves AI store building into production theme code, but the official requirements make the maintenance boundary clearer: entering Canvas can cut off normal theme downloads and upstream theme updates.
Cloudflare makes Unified Routing the default path for new WAN and Magic Transit networks
The GA matters less as a label than as an architecture boundary. New Cloudflare WAN and Magic Transit deployments are now recommended onto a single routing fabric spanning Cloudflare One Client, Tunnel, IPsec, GRE and CNI, while legacy routing lacks several of the newer traffic-steering capabilities.
GPT-6 Astra reaches broad API rollout with 1.05M context — and enterprise computer-use controls
Astra's adoption question is no longer only model capability. Builders can now model its long-context economics and task-level efficiency, while enterprises get a more explicit control plane for computer use. The same release also raises the cyber-safety boundary: OpenAI says Astra is its first model to reach the Preparedness Framework's Critical cybersecurity capability threshold.
OpenRouter can now fail AI requests rather than let regulated data leave the US or EU
The important change is at the gateway boundary, not just inference placement. OpenRouter says prompts can now stay in-region from decryption through provider execution and supported server tools, while teams can enforce the rule per workspace, team or API key.
Google is auto-expanding some AI Overviews into full AI answers before organic results
For some queries, Google is no longer waiting for a user to open a longer AI Overview. The system can expand it automatically, creating a larger zero-click answer surface and moving traditional results further down the page.
Artificial IntelligenceCloud & InfrastructureCompute & AI InfrastructureInference & APIsActive dossier
Cerebras CS-4 turns Nexus into a multi-generation rack-scale inference platform
CS-4 combines three WSE-3 Turbo wafers with Cerebras’ Nexus rack design. The practical shift is architectural: compute, power and I/O become modular, while Cerebras now says the same platform is intended to support CS-5 in 2027 and a 3D-memory CS-6 generation after that.
Ahrefs is making a Google-derived AI demand estimate the default in Brand Radar
Ahrefs is standardising Brand Radar on an estimated AI-demand metric because major AI platforms do not publish prompt volume. The new number can improve relative weighting between prompts and platforms, but it remains a modelled proxy rather than a count of how many people actually asked an AI system a question.