E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
Search
Search results for “verification workflows”
Find published research by company, product, platform or technology.
Showing 81–100 of 225 dossiers
PingCAP confirms TiDB Cloud customer records exposed through internal credentials — rotate management keys
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
Artificial IntelligenceCloud & InfrastructureAI AgentsCloud PlatformsDeployment & DevOpsActive dossier
Cloudflare Computer 0.7 lets agent code survive crashes and pause for approval — but replay can repeat writes
Cloudflare Computer 0.7 makes agent code resumable and interruptible. The important catch: recovery replays code, and unrecorded external actions can be repeated even if they already succeeded.
Wails 3.0 reaches stable release with a new Go desktop architecture — mobile remains experimental
The stable Go/WebView desktop framework introduces a major architectural migration and richer native capabilities; Android/iOS are experimental and embedded untrusted frames remain a security concern.
DuckDB 2.0 LTS ships Quack client/server, async I/O and a breaking storage format
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
Artificial IntelligenceWeb DevelopmentAI CodingBrowsers & Web StandardsDeveloper ToolsActive dossier
Safari 27 gives coding agents a local MCP path into live browser debugging
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
Stripe can now keep a Postgres copy of payments and subscriptions up to date — without webhook plumbing
Stripe's new Postgres destination gives SaaS teams a managed payment-data mirror, not a zero-latency replacement for every webhook.
Anthropic opens Claude watermark detection API in restricted private preview
A restricted private-preview detector changes the compliance workflow, but Claude watermarking still cannot prove authorship or reliably detect short or lightly edited passages.
Anthropic expands Claude incident disclosures and cuts live web access from internal evaluations
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
Reddit Ads API is changing campaign objectives and retiring onsite lead forms in September
The technical migration is unchanged, but Reddit's documentation has proven unusually volatile. Integrations should now treat September 21 as the current objective/form readiness date and December 8 as the current published cutoff for HOUR reports longer than seven days—while continuing to recheck the live docs before each deadline.
Neon's branchable backend reaches GA with metered Functions, Object Storage and AI Gateway
The September 17 GA changes the economics of Neon's backend: free allowances remain, but object storage, function execution and model calls are now metered on paid plans. November 2 adds an OAuth Provider plugin, still labelled beta.
GitHub Spark is shutting down August 31 — export code now and replace broken `llm()` calls
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
Android Studio Quail 4 makes curated agent skills and offline Gemma 4 production-stable
Android Studio’s agent layer has crossed an important boundary from preview features into the stable channel: domain-specific skills are preloaded and auto-selected, while Gemma 4 can execute tool-calling code tasks locally without sending source code to a cloud model.
Gemini 3.5 Transcribe gives developers separate live and file speech-to-text APIs at about $0.009 and $0.005 per minute
Gemini 3.5 Transcribe turns Google’s audio understanding into a purpose-built developer surface: low-latency live transcription costs roughly $0.009/minute at Google’s published assumptions, while file transcription is roughly $0.005/minute and supports richer metadata.
Gemini Omni Flash goes GA with video extension, interpolation and 4K output controls
Gemini Omni Flash has crossed from preview into a production API with a broader editing surface. Builders can extend existing clips and interpolate between images, but preview integrations now have a September migration deadline.
Web DevelopmentCloud & InfrastructureMarketing & DistributionDeployment & DevOpsConversion & AnalyticsActive dossier
Polymarket's $2.7m script attack traced to a reported DNS hijack as 726 wallets are identified
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Jepsen finds 96 ParticleDB faults, including lost committed writes on a single node
ParticleDB's claimed ACID guarantees failed Jepsen tests: acknowledged writes disappeared, queries returned wrong rows, and even healthy single-node tests exposed integrity faults.
Omarchy expands AI-credit patronage with Grok tokens and Greptile PR reviews
Omacom expands in-kind AI and compute patronage and reports nearly 1,500 Greptile-reviewed PRs. Pledges are not audited cash revenue.
WordPress 7.1.4 fixes upgrade-window RCE, three stored-XSS paths and eMudhra trust roots
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
PostgreSQL Anonymizer 3.3 patches 12 masking bypasses — upgrades require more than a version bump
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.