Find published research by company, product, platform or technology.
Showing 141–160 of 505 dossiers
This is a platform architecture migration rather than a user-facing feature. Pantheon says no action is required, but builders operating storage-sensitive WordPress or Drupal workloads should know when their tier moves and verify backup, restore and file-handling behavior around the change.
Cursor has become a concrete example of coding-tool supplier risk: a corporate acquisition can trigger a frontier-model provider’s change-of-control rights and remove a major model family from the product even when the coding tool itself remains operational.
Cloud Run sandboxes now cover all resource types. The August 5 expansion matters for builders whose agents or automation run in batch jobs or continuously pulling workers rather than HTTP services, while the feature remains pre-GA and shares CPU and memory with the host container.
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
Woodpecker's agent labels were self-reported and unsuitable for authorization. Version 3.19 adds server-held filters and patches a clone-step environment-variable leak; administrators should verify their worker policies.
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
Sentence Transformers 6 now has both unified multi-vector inference and a documented end-to-end training workflow. A new project-authored benchmark shows fast domain adaptation on a single GPU, but the result is workload-specific and index costs remain high.
Aurora Serverless can now add roughly 12 ACUs in the first second of a scale-up event on platform versions 3 and 4. The change is automatic and is most useful for bursty SaaS, API, batch and agent workloads, but it does not remove the separate resume delay when a database has scaled all the way to zero.
The three-maintainer TanStack AI project has reached stable 1.0 for its core SDK, with 23 providers; its long-running agent harness is not yet stable.
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.
GitHub Enterprise customers can trade Copilot seat fees for usage-only billing. The key catch: zero included credits, staged eligibility and voluntary migration.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
GitHub's multi-model coding orchestration is now GA, with admin-controlled model pools and per-model charges. Local routing remains experimental and cloud-dependent.
GitHub Apps can now authenticate Copilot SDK workloads without a user's credentials. Organisation admins control installation permissions, usage attribution and budgets.
Holiday subscription offers correlate with more payers, but lower revenue per buyer and substantial selection bias complicate the economics. Christmas-only offers show no clear advantage.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.