Find published research by company, product, platform or technology.
Showing 101–120 of 186 dossiers
PingCAP reports an internal-systems breach affecting TiDB Cloud account and SQL-editor records; customers should rotate management keys and credentials shared in support tickets.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
Linux app developers no longer face an outright AI-generated-code exclusion, but they must identify affected code and documentation, write manifests without AI assistance and keep agents out of the submission workflow.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
Cursor has become a concrete example of coding-tool supplier risk: a corporate acquisition can trigger a frontier-model provider’s change-of-control rights and remove a major model family from the product even when the coding tool itself remains operational.
GLM-5.3-Flash combines open weights, multimodal coding/agent capability and an 18B-active sparse architecture with a large anonymous pre-launch trial. Z.ai has already issued a chat-template correction for early downloads, showing that day-one self-hosted deployments need artifact-level validation as well as model benchmarking.
Codex 0.149.0 includes the async-message tool, delivery metadata and removal of the client-side feature gate that BTN previously tracked only on main. Parallel human-agent work is now in a stable client, but late replies can still race with decisions and model capability metadata remains the final exposure gate.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
Private ingress joins existing private egress for Scaleway Serverless Containers. The new option can isolate services inside a VPC, but private DNS, TLS, authentication, cold-start and network-scope constraints still matter.
The GA matters less as a label than as an architecture boundary. New Cloudflare WAN and Magic Transit deployments are now recommended onto a single routing fabric spanning Cloudflare One Client, Tunnel, IPsec, GRE and CNI, while legacy routing lacks several of the newer traffic-steering capabilities.
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
Cloudflare’s new MCP controls turn TLS-inspected Gateway traffic into an inventory and policy surface for remote MCP use, while explicitly leaving local stdio, off-network and uninspected traffic outside visibility.
PostgreSQL operators gain per-statement and per-transaction estimated-cost limits across versions 14–18, useful for runaway reports and ORMs. The guard is disabled by default and can be bypassed by users allowed to change planner cost parameters.
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Cloudflare Tunnel changes how Access-protected ingress rules match dot segments and repeated slashes. Opt in now; test before the January 25 default flip.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
Live SQL subscriptions, a React/TypeScript SDK and scale-to-zero integration are available in four regions. Realtime is free during beta, but compute and egress still cost money, row-level security is absent, and the protocol is changing.