Find published research by company, product, platform or technology.
Showing 141–160 of 291 dossiers
The previously pre-announced Next.js security release is now available. Teams on affected versions should upgrade to 16.3.3 or 15.5.24; the disclosed flaws can lead to unauthenticated remote code execution under specific image-optimization or Windows-hosting conditions.
Ahrefs is standardising Brand Radar on an estimated AI-demand metric because major AI platforms do not publish prompt volume. The new number can improve relative weighting between prompts and platforms, but it remains a modelled proxy rather than a count of how many people actually asked an AI system a question.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
WordPress 7.1 is now generally available. Its always-iframed post editor removes a long-standing split between iframe and non-iframe contexts, while browser-side image processing moves more media work out of PHP and into WebAssembly.
The technical-preview feature separates Copilot CLI from GitHub Cloud for core coding, shell and repository workflows, giving regulated and isolated environments a supported agent path while leaving cloud-dependent capabilities such as GitHub-hosted model selection and web search unavailable.
A follow-up security fix shows why wrapper capabilities need path restrictions as well as origin checks: tinyjs 0.48.0 now confines direct PDF writes and requires user confirmation for other locations.
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
Gemini 3.8 Flash keeps 3.7 Flash’s promotional per-token rate and Flash-tier latency, but early independent analysis suggests harder reasoning can increase tokens consumed per task. A separate 3.8 Flash Cyber model is available only through Google’s Fairwind defensive-security program.
Microsoft Advertising is taking Max CPC out of new standalone automated campaigns from October 1. Existing capped campaigns and portfolio strategies retain the control for now, but advertisers creating new campaigns will need to rely more heavily on conversion targets, budgets and portfolio bidding.
Google's agent-accessible data toolkit has moved beyond its August launch: GA expands support to Bigtable, BigQuery Graph and Spark, with IDE/CLI integration, IAM enforcement and no separate kit fee. Underlying Google Cloud usage still costs money.
The migration is now much safer for background-only and bulk-installed apps: a timed-out direct conversion no longer automatically strands the store. The retry window is bounded and can end earlier after the issued pair is refreshed or another token acquisition supersedes it.
The change separates three things that are often bundled together: the harness, the subscription that pays for it, and the sandbox that executes it. Builders can switch among supported coding agents behind one interface while reusing existing subscription access and reducing credential exposure inside agent runtimes.
The two August 28 changes move a common production-agent problem out of bespoke application code: builders can derive memory boundaries from authenticated JWT claims, enforce them with Cedar policy, and organize the stored memory using runtime tenant dimensions.
Jev made bounded decision models visible; Strands Decider makes the pattern reproducible inside an agent stack. AWS replaced Qwen3.5-2B's language-generation head with a small scoring head and released the recipe, creating a local alternative for decisions that do not need a full generative model.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
Google Ads' new channel-priority controls offer a way to test Search partners and Display without giving them unrestricted budget, but the limits are not guarantees and Demand Gen has no allocation caps.
Go 1.27 automatically drains up to 256 KiB or 50 ms after an HTTP/1 response body is closed, enabling reuse without custom drain code.
Tailcat remains useful as a small encrypted peer-connectivity primitive, but its first documented malware adoption changes the operational context: Kothamine can use Tailcat to avoid a conventional command-and-control domain that defenders would otherwise block.
The practical change is bigger than another package-manager version. Homebrew can now tell operators whether vulnerabilities are actually outstanding in the formula revisions they installed, while its own recent advisories show why package-manager metadata, uninstall paths and build isolation deserve the same scrutiny as package contents.
Agent checkout builders using UCP 2026-08-25 can now negotiate consent options, propagate customer choices and handle missing-data warnings instead of hardcoding merchant privacy defaults.