Find published research by company, product, platform or technology.
Showing 121–140 of 176 dossiers
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
Reddit's two-feed home screen separates recommendation-driven discovery from subscribed communities. The change matters to publishers and moderators, but any reach uplift is still unproven.
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
Cloudflare saw roughly 22,000 weak-chain TLS handshakes, about 160 unusual forged certificates and 50 million skewed challenge-page probes. The data indicate continuing exposure, not 22,000 successful attacks.
The RC2/GA schedule has not changed. A PostgreSQL committer now explains why review and backpatch workload overwhelmed the release process, with caveats around attributing every extra bug to AI.
OpenAI's new API credit grants can lower the cost of prototyping apps and agents, but eligibility, expiration, API limits and excluded Codex usage matter.
Three new GitHub webhook CIDR blocks can break deliveries to tightly firewalled endpoints unless static allowlists are updated.
The October 15 Rust 1.99.1 release fixes a separate FFI bool miscompilation after September's 1.98.1 vtable bug. Check toolchain pins and rebuild artifacts produced by either affected compiler.
Q3 Cloudflare telemetry: 18.2 million network-layer attacks, 96% under ten minutes, but far fewer terabit-scale floods.
The trillion-parameter Mistral Large 4 is no longer API-only; builders can self-host, but must assess licence and hardware limits.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
Jev, CLM and GLiNER2.5-Decide made bounded software decisions look like a distinct model category. OpenAI is now validating the same architectural split with a Luna-powered API designed to answer finite questions rather than generate open-ended prose.
Polaris Web Components 2.0 reaches stable CDN channels, with explicit opt-in, React Router and TypeScript integration changes, and migration checks for apps that still use Polaris React.
The useful shift is architectural: agent permissions no longer have to depend only on the model or harness behaving correctly. OpenShell puts policy enforcement in the execution environment, while Sentry is designed to keep watching from a separate hardware trust domain.
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Getty Images filed Chapter 11 to implement an agreed restructuring, not to shut down its image marketplace. The plan includes up to $533m of new equity, up to $143m of financing and a proposed move to private ownership.
PGDG's 20 October repository retirement requires RHEL, Rocky and AlmaLinux 9.6/10.0 operators to update their OS minor release or deliberately switch to the frozen archive. Rolling EL9 and EL10 repository packages are unaffected.
At ObservabilityCON 2026, Grafana opened paid plugin distribution to verified partners. Cloud customers can trial and subscribe to integrations on their Grafana bill; partner maintenance and security requirements are part of the model.
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.