Find published research by company, product, platform or technology.
Showing 81–100 of 166 dossiers
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
The previously pre-announced Next.js security release is now available. Teams on affected versions should upgrade to 16.3.3 or 15.5.24; the disclosed flaws can lead to unauthenticated remote code execution under specific image-optimization or Windows-hosting conditions.
Holiday subscription offers correlate with more payers, but lower revenue per buyer and substantial selection bias complicate the economics. Christmas-only offers show no clear advantage.
The useful change is operational rather than a new PostgreSQL feature: Railway is packaging major-version migration into a managed workflow while keeping the two dangerous boundaries explicit — downtime during the upgrade and post-upgrade writes lost if you revert.
eMudhra is leaving global TLS certificate issuance after its weak-key incident. Existing certificates and custom trust stores still require audit and migration; Indian DSC and eSign operations are not part of the announced exit.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
Pgpool-II operators should upgrade to the October 1 security releases and review watchdog network exposure and certificate-authentication configuration.
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
Vendor-run live-store testing exposes the trade-off between containment, quality and response speed. Store configuration matters, and the evaluator's commercial conflict requires care.
A 50M+ subscription cohort gives AI SaaS builders a more useful retention benchmark than conversion anecdotes: high-retention monthly apps renew 57.9% of subscribers at the first opportunity versus 30.2% for low retainers, with the gap narrowing later. The study is observational, not causal.
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Void SDK adds server routes and typed data access to Vite, Void CLI provisions Workers resources, and Void Platform provides a controlled multi-user deployment surface. The convenience comes with Cloudflare runtime dependencies and real deployment limits.
Microsoft's October 13 Topics Portfolio beta shows AI-grounding queries that cite rivals but not your site, grouped by theme with approximate demand and competition measures; access depends on sufficient site data.
Shopify's new Events system can send the change and the data your app needs in one delivery. It's a significant alternative to classic webhooks, but not a forced shutdown or universal replacement yet.