Find published research by company, product, platform or technology.
Showing 141–160 of 466 dossiers
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
The scanner itself is not the new part. The September 16 change removes the CodeQL-default-setup gate that GitHub’s July rollout originally required, making AI-assisted vulnerability detection easier to add to repositories with different code-scanning configurations.
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
Fusion is interesting less as another routing feature than as a different agent-cost architecture: two persistent model contexts divide planning, review and execution instead of making one expensive model handle every token. The practical question for builders is shifting from token price to cost per completed task.
The useful lesson is architectural rather than vendor-specific: coding agents inherit execution paths from ordinary developer tooling. If an agent shells out to Git without sanitising repository-local configuration, a hidden `.git/config` can become a host-level command channel that bypasses the controls users think govern the model.
Google appears to have completed a talent-focused Mechanize deal: the startup still exists, but much of the team that builds coding-agent training environments and evaluations has moved into Google’s model-development work.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
X’s replacement creator program is now live enough to expose a new dependency: U.S. creators must route Original Content Rewards payouts through X Money, and one X Money account can connect to only one X account. Eligibility and qualified-impression rules remain unchanged.
The interesting change is not another desktop-shell release. Noctalia has moved plugin logic away from the older QML-centric model into isolated scripting runtimes, creating a clearer extension boundary while still treating plugins as trusted code.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
The release consolidates several recurring cluster-management jobs into core APIs and controllers. HPA scale-to-zero is now default-on Beta, storage-version migration and Pod Certificates are Stable, DRA can satisfy existing extended-resource requests, and large etcd reads gain a streaming path that reduces peak memory pressure.
The interesting part is not another sponsorship total. DHH says Omarchy Quattro is already being built heavily with coding agents, and the token pledges are intended for debugging, security work and a 1,600-plus pull-request backlog. The dollar values are foundation-reported pledged credits, not audited cash spend.
The change moves maintenance work earlier in the contribution funnel: instead of filing a report and waiting for a maintainer to reproduce it, package users are being asked to arrive with an executable patch candidate. It is a real workflow experiment, but Otwell's prediction that this becomes the norm should remain a founder/maintainer view rather than an industry fact.
The technical migration is unchanged, but Reddit's documentation has proven unusually volatile. Integrations should now treat September 21 as the current objective/form readiness date and December 8 as the current published cutoff for HOUR reports longer than seven days—while continuing to recheck the live docs before each deadline.
Muse Spark 1.3 is more than a routine model refresh: Meta is pairing stronger agent behavior with lower vendor-reported tool/token use at the same published unit price. Independent testing supports a capability gain, but max reasoning can consume substantially more reasoning tokens.
The previously reported NVIDIA–Hugging Face deal is now a definitive agreement rather than an unconfirmed report. The most important new detail for builders is not only the price: NVIDIA has put multi-model and multi-silicon openness into its public and regulatory framing, while the acquisition still faces closing conditions and regulatory approval.
Self-Hosted Machines changes the architecture of Cursor’s Cloud Agents more than another model option would. Teams can keep code, build outputs, secrets and terminal/browser actions on infrastructure they control, but the planning/inference loop remains a Cursor service and enterprise teams become responsible for worker images, scaling, secrets and production validation.