Zeabur shuts down hosting by December 31 after second breach — migrate before December 1
The closure combines a credential-rotation emergency with a mandatory migration. December 31 is not a guarantee individual servers stay online until then.
Search
Search results for “database client vulnerabilities”
Find published research by company, product, platform or technology.
Showing 101–120 of 229 dossiers
Neon opens live SQL subscriptions in Realtime beta — but row-level security is not ready
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.
DeadTag turns abandoned website scripts into an iPhone spyware delivery network
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
Artificial IntelligenceWeb DevelopmentSaaSCloud & InfrastructureAI AgentsSaaS OperationsDeveloper ToolsObservabilityActive dossier
MLflow CrewAI tracing leaked API keys into telemetry — upgrading does not remove old secrets
MLflow CrewAI autologging silently logged API keys; 3.17.0 patches it, but previously exported traces and keys still need remediation.
OpenBSD 8.0 ships major platform changes — and urgent IPsec, DNS and kernel errata
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
tinyjs fixes a string of capability escapes in its lightweight desktop runtime
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
The Events Calendar exposes 600,000+ WordPress sites to two comment-preview RCE chains
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
Adobe Commerce’s August patch fixes an unauthenticated account-takeover flaw already seeing exploitation attempts
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Cloud SQL connectors can now follow SQL Server primary failover through one write endpoint
Cloud SQL’s SQL Server HA path is becoming more transparent to applications: supported proxies and connectors can target one write endpoint and be redirected when the primary changes. Teams still need retry-safe connection handling around the failover itself.
Neon's branchable backend reaches GA with metered Functions, Object Storage and AI Gateway
The September 17 GA changes the economics of Neon's backend: free allowances remain, but object storage, function execution and model calls are now metered on paid plans. November 2 adds an OAuth Provider plugin, still labelled beta.
Web DevelopmentSaaSCloud & InfrastructureSaaS OperationsDeveloper ToolsDatabases & StorageActive dossier
Canada's November 1 time-zone change leaves Cloud SQL and Looker an hour behind
The issue is software time-zone data, not changed stored timestamps. A fixed-offset workaround can affect historical date conversions.
Laravel discloses critical TokenGuard account takeover flaw and a separate data-loss bug
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
Web DevelopmentCloud & InfrastructureCloud PlatformsDeployment & DevOpsFrameworksDeveloper ToolsActive dossier
Cloudflare opens Void: a Vite SDK, CLI and self-hosted deployment platform
Void SDK adds server routes and typed data access to Vite, Void CLI provisions Workers resources, and Void Platform provides a controlled multi-user deployment surface. The convenience comes with Cloudflare runtime dependencies and real deployment limits.
Supabase Pipelines brings managed Postgres-to-BigQuery CDC into public alpha
Supabase Pipelines turns Postgres WAL into a managed analytics feed for BigQuery. It isolates analytical workloads from production, but public-alpha pricing, Frankfurt-hosted pipeline infrastructure and destination constraints matter before adoption.
Turso concurrent writes move from Cloud preview to a 0.8 engine release with new contention benchmarks
The new Turso 0.8 results add a concrete performance datapoint to the earlier MVCC preview, but benchmark workloads, transaction conflicts and production durability still require independent verification.
Shopify sets offline-token cutoff dates and adds IP restrictions for public apps
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Gmail will stop sending as third-party addresses in January 2027
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
Web DevelopmentCloud & InfrastructureDeployment & DevOpsDeveloper ToolsDatabases & StorageActive dossier
PostgreSQL 19's AI-discovered bug backlog helps explain its November release delay
The RC2/GA schedule has not changed. A PostgreSQL committer now explains why review and backpatch workload overwhelmed the release process, with caveats around attributing every extra bug to AI.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureDeployment & DevOpsInference & APIsDeveloper ToolsActive dossier
LiteLLM 1.107.0 was backdoored on PyPI and Docker: startup hooks stole credentials even without an import
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
pg_vault_tde 1.7.2 fixes encrypted PostgreSQL corruption — but upgrades require table rewrites
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.