PHPUnit hardens agent-read test output and repairs machine-readable XML reports
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
Search
Search results for “Railway credential incident”
Find published research by company, product, platform or technology.
Showing 101–120 of 145 dossiers
Shopify opens Shop MCP shopping and checkout to any AI agent
A new public MCP endpoint lets agents search without an API key and complete shopper-authorised purchases. It is separate from the Global Catalog REST API retirement and earlier browser-only WebMCP checkout; webhooks are not available at launch.
VS Code’s Agent Host can now run Dev Container sessions on remote SSH, Tunnel and WSL projects
The Agent Host’s environment boundary has moved from local Dev Containers to remote development hosts, making persistent coding-agent sessions more portable across real remote projects.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsAI CodingDeployment & DevOpsDeveloper ToolsActive dossier
Semaphore gives coding agents a native CI/CD control surface with sem-ai
The useful shift is not another AI wrapper around CI. sem-ai exposes CI/CD as structured, self-describing operations that Claude Code, Codex and other MCP-aware agents can call directly, including failure diagnosis and pre-push testing in CI.
Fastly puts model routing, AI budgets and prompt-injection controls into the edge request path
The interesting part of Fastly’s AI launch is consolidation: model gateway economics, LLM security and agent-to-API authorization now sit in the same request path as the CDN/WAF infrastructure many applications already use.
Claude Code Projects turns one engineering goal into parallel cloud-agent branches
The important change is not simply that Claude can run several agents. Projects now owns decomposition, shared context, branch isolation and progress coordination across full Claude Code sessions, while the trade-offs become usage burn, cloud-only execution and ordinary merge conflicts when parallel work overlaps.
GitHub Spark is shutting down August 31 — export code now and replace broken `llm()` calls
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
Neon’s branchable backend reaches Europe as Functions and Object Storage expand to Frankfurt
Neon is extending database branching into a broader backend stack and now into a second geography. The Frankfurt expansion improves latency and data-location choices, but Functions and Object Storage remain beta products with pricing and production boundaries still unsettled.
Cursor turns cloud agents into event-driven workers — and now lets teams choose where they execute
Self-Hosted Machines changes the architecture of Cursor’s Cloud Agents more than another model option would. Teams can keep code, build outputs, secrets and terminal/browser actions on infrastructure they control, but the planning/inference loop remains a Cursor service and enterprise teams become responsible for worker images, scaling, secrets and production validation.
Gmail will stop sending as third-party addresses in January 2027
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
WordPress Studio is making an agentic build loop the default desktop experience
Studio Code was already available in WordPress Studio, but the August 24 redesign changes the default workflow: the coding agent now sits at the center of the desktop app beside a live local WordPress preview, with point-and-annotate feedback and one-click hosting sync. The beta also ends the earlier unlimited-free framing by introducing a credit limit and paid top-ups.
DeadTag turns abandoned website scripts into an iPhone spyware delivery network
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
Paddle opens billing operations to coding agents — usage-based billing remains a 2027 preview
Small SaaS teams can now move supported Paddle setup and billing tasks into Claude Code, Codex and similar agent workflows, but production account writes still require careful access control; native metered billing is not generally available.
Web DevelopmentCloud & InfrastructureCloud PlatformsDeployment & DevOpsDeveloper ToolsActive dossier
Google Application Integration run-as identities are now enforced for new workflows and tests
The August warning is now an operational requirement for new integrations and tests, not merely an upcoming migration. Older integrations remain on a later, unannounced enforcement timetable.
HTTP/3 QPACK amplification can exhaust servers: patched quiche and quic-go, exposed Bun and h3
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
Google Analytics can now reject ghost traffic with hostname allowlists
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.
GitHub can now require authentication for public Git clones during traffic protection
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
GitHub makes enterprise licence compliance a pull-request merge gate — with an API for coding agents
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
Chrome Email Verification expands to Android and embedded SDKs — with new token checks
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
PgBouncer 1.26.1 closes a SCRAM authentication bypass that can reach database superusers
PgBouncer operators should update to 1.26.1: the release closes CVE-2026-107350 and two unauthenticated DoS issues, with a small startup-parameter compatibility change.