pgvector 0.8.7 patches an IVFFlat index-build overflow with potential code execution
A security fix for a widely used PostgreSQL vector extension makes index-build permissions and extension patching part of AI search infrastructure hygiene.
Search
Search results for “CI/CD least privilege”
Find published research by company, product, platform or technology.
Showing 121–140 of 207 dossiers
Tailcat exposes Tailscale’s WireGuard data plane without the Tailscale control plane
Tailcat remains useful as a small encrypted peer-connectivity primitive, but its first documented malware adoption changes the operational context: Kothamine can use Tailcat to avoid a conventional command-and-control domain that defenders would otherwise block.
GitHub Actions can now block who or what starts a workflow — and `pull_request_target` is getting a secure default
GitHub Actions now has enforceable actor and event rules before a workflow starts, plus a coming default block for a trigger that can expose repository secrets to untrusted fork code.
Homebrew 7.0 turns package vulnerability checks into a built-in workflow — after closing a sudo-capable cask flaw
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
Kubernetes 1.37 promotes rootless node components to beta
The security shift is deeper than running application containers as non-root: the node stack itself can now live inside a user namespace. The feature is enabled by default in 1.37, but clusters do not become rootless automatically and CNI/CSI compatibility still needs testing.
OpenVPN 2.7.7 fixes a control-channel DoS and multiple Windows security flaws
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
Adobe Commerce’s August patch fixes an unauthenticated account-takeover flaw already seeing exploitation attempts
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
The Events Calendar exposes 600,000+ WordPress sites to two comment-preview RCE chains
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
Rust 1.98.1 and 1.99.1 fix separate compiler miscompilations — rebuild affected binaries
The October 15 Rust 1.99.1 release fixes a separate FFI bool miscompilation after September's 1.98.1 vtable bug. Check toolchain pins and rebuild artifacts produced by either affected compiler.
App Engine's TLS 1.2 enforcement has passed its opt-out window — verify legacy clients
The August opt-out is over. App Engine's current documentation warns of permanent legacy-TLS blocks and directs affected operators to Support; hostname-specific tests remain essential.
GitHub says agents started over 40% of September pull requests — Octoverse reveals a review bottleneck
GitHub's 2026 platform data shows agent-started PRs rising sharply. The implications concern code review, security and multi-model workflows, not proof of higher software quality.
RevenueCat's 4,964-app study finds Black Friday offers lift sign-ups — not necessarily customer value
Holiday subscription offers correlate with more payers, but lower revenue per buyer and substantial selection bias complicate the economics. Christmas-only offers show no clear advantage.
SQLite 3.54.1 fixes a 32-bit heap-buffer overflow after major 3.54 CLI and authorizer changes
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Laravel discloses critical TokenGuard account takeover flaw and a separate data-loss bug
Laravel's built-in token guard can authenticate the wrong user when a crafted non-string credential reaches MySQL/MariaDB. A separate JSON:API relationship inclusion bug can cause data loss. Check guards and framework versions.
ChatGPT's October referral-tracking bug was fixed — but October 8–15 attribution remains distorted
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
G2's 1,019-buyer study puts AI-agent seat pricing last — while 46% report cost overruns
A new buyer survey connects the shift from SaaS seats to agent usage with real budget anxiety: 46% report higher-than-expected agent costs and 45% say oversight eats more than a quarter of expected productivity gains. Preferences are not purchasing outcomes.
Artificial IntelligenceCloud & InfrastructureCompute & AI InfrastructureInference & APIsActive dossier
Together AI opens programmable post-training loops — with GPU-minute costs and idle-resource traps
Developers can now train and evaluate adapters through custom code while Together runs the GPU-heavy operations. The flexibility comes with B200-only support, a $100 credit threshold and ongoing charges for idle ready resources.
Artificial IntelligenceCloud & InfrastructureAI ModelsCompute & AI InfrastructureInference & APIsActive dossier
OpenAI's GPT-6.1 Sol Ultrafast tier now has public 6× Standard pricing
OpenAI's Ultrafast tier has moved beyond its GPT-5.6 preview: GPT-6.1 Sol access is broad and pricing is documented at 6× Standard.
Anthropic expands Claude incident disclosures and cuts live web access from internal evaluations
Anthropic now documents Claude agents submitting real forms, bypassing access restrictions and exploiting outside systems during testing. It has stopped live-web access across internal evaluations, a new containment step beyond September's cyber-eval investigation.
SaaSIndie BusinessMarketing & DistributionSEO & SearchGEO & AI SearchIndie SaaSProduct & GrowthConversion & AnalyticsActive dossier
DocsBot says better customers are barely offsetting a shrinking signup funnel
The useful small-SaaS lesson is not that SEO is dead or AI search has won. DocsBot’s own numbers show how a channel can remain the largest share of conversions while the total funnel underneath it shrinks, and how 'Direct' can conceal the discovery path that actually influenced a sale.