Find published research by company, product, platform or technology.
Showing 141–160 of 242 dossiers
A safer default can surprise an incident-response runbook: pgBackRest 2.60 aborts restores with invalid page checksums and refuses certain backup expirations. Here's what operators should test.
Public Shopify apps must migrate legacy offline tokens by January 1, 2027. Enforcement now has explicit stages and new developer security controls.
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
Cloud Storage project deletion no longer necessarily destroys every soft-deleted bucket immediately. Google’s August 17 change makes bucket retention part of project-recovery behavior, affecting disaster recovery, teardown assumptions and ongoing storage cost.
Hy4 preview is a very large sparse model with public full and FP8 weights, native speculative decoding and a 1M-token context path. Its open release makes Tencent’s claims testable, while the 1.56TB full checkpoint keeps self-hosting firmly in server-scale territory.
Cloudflare Workflows now prices steps and persisted state on paid plans, making workflow structure and retention part of the cost calculation for durable jobs and AI automation.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
This is a platform architecture migration rather than a user-facing feature. Pantheon says no action is required, but builders operating storage-sensitive WordPress or Drupal workloads should know when their tier moves and verify backup, restore and file-handling behavior around the change.
Cloudflare’s RUM measurement model now distinguishes hard navigations, native soft navigations and routing-API fallbacks. For React, Vue, Angular, Svelte and other client-routed sites, the immediate consequence is a metric discontinuity: pageviews and Core Web Vitals can shift without an underlying traffic change.
The existing coverage-first mode keeps more query detail at the cost of possible series growth. Cost-first applies all reductions but only restores detail within the same series budget; it is a guardrail against metric-cardinality spikes, not a guarantee of a fixed bill.
AWS is changing how Lambda introduces managed runtimes: Node.js 26 and Python 3.15 are available in public preview before GA, with normal runtime identifiers that automatically graduate when the runtimes become production-ready.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
gopls 0.24.0 and VS Code Go 0.56.0 ship interactive refactorings for struct tags and interface implementations; the broader Language Server Protocol extension is still a proposal, with cross-file moves in preview.
A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them.
The platform now offers an objective-oriented /goal interface as well as Custom Flows; availability depends on GitLab 19.3+, Duo CLI 9.17+ and eligible tiers.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.