Caddy 2.11.9 fixes PHP directory regressions and FastCGI security bypasses
The immediate follow-up to 2.11.8 restores trailing-slash PHP directory indexes and hardens FastCGI script selection and authentication boundaries.
Search
Search results for “hosting free tiers”
Find published research by company, product, platform or technology.
Showing 141–160 of 190 dossiers
Nuxt 4.6.4 fixes eleven Nuxt and Nitro security advisories after the 4.6 overhaul
The November 2 follow-up supersedes 4.6.3 as the security upgrade target, with behaviour changes affecting custom dev hostnames, cached responses and route rules.
Coolify 4.6 makes API and MCP access resource-scoped — and breaks write-only deletion
The self-hosted deployment platform's November 2 release changes how teams delegate infrastructure control. Existing integrations using write-only tokens for deletions may fail until explicitly reauthorised.
Raspberry Pi 5's 16GB model climbs to $385 as memory shortages reshape edge-compute costs
The latest DRAM-driven increase forces makers, edge deployments and small teams to re-evaluate whether high-RAM single-board computers still offer the right economics.
Gitea 28.3 fixes OAuth account takeover and Actions secret-exposure flaws across 20 security issues
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
Web DevelopmentCloud & InfrastructureMarketing & DistributionDeployment & DevOpsConversion & AnalyticsActive dossier
Polymarket's $2.7m script attack traced to a reported DNS hijack as 726 wallets are identified
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Google tells platforms to keep link-only generated pages out of Search by default
Google now advises noindex or crawl blocking for user-created pages meant for direct sharing, plus Search Console and platform-level spam monitoring.
Artificial IntelligenceCloud & InfrastructureCloud PlatformsCompute & AI InfrastructureInference & APIsActive dossier
Cloudflare's Workers AI leaked 155 cross-tenant responses through SGLang KV cache — operators should patch
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
Umami 3.4.1 urges self-hosters to patch Next.js RCE and MCP OAuth leakage
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
LaunchDarkly AgentControl now versions and deploys agent skills without application releases
Agent skills join prompts and models as managed runtime configurations; approvals and pinned versions make changing agent behaviour auditable rather than an untracked edit to skill files.
Node.js fixes Brotli code-execution risk and TLS hostname bypasses in October security release
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
WordPress 7.2 Beta 1 adds a Secrets API so plugins can stop storing API keys as plaintext options
WordPress 7.2 Beta 1 landed October 20 with wp_set_secret and wp_get_secret, encrypted storage, current/previous versions and pluggable back ends. Existing plugin credentials do not migrate automatically; the final release is scheduled for December 8.
WordPress 7.2 will disable MySQL NO_BACKSLASH_ESCAPES for its own connections
WordPress 7.2 adds NO_BACKSLASH_ESCAPES to wpdb's incompatible SQL modes. It's a targeted fix for escaping failures, not a server-wide setting or blanket SQL injection cure.
Google opens a direct Search ingestion pipeline for large forums and social platforms
Large forums and social platforms can apply to push trending public posts and interaction counts to Google via OAuth and JSON-LD. Stable public URLs, attribution, moderation and fast updates are required; indexing and ranking are not guaranteed.
Xiaomi opens MiMo-V2.6 weights and the RL machinery behind its frontier-scale training run
MiMo-V2.6 is more useful than another benchmark launch because builders get both capable multimodal weights and a rare view into the reinforcement-learning machinery that produced them: code, environments, run costs and even failure notes from the training cluster.
GitHub Spark is shutting down August 31 — export code now and replace broken `llm()` calls
GitHub Spark stops being available to existing users on August 31, 2026. Deployed apps are meant to keep running, but owners should export code to a repository now; Spark apps using `llm()` need a separate inference provider because the underlying GitHub Models service retired July 30.
Artificial IntelligenceWeb DevelopmentAI AgentsAI CodingInference & APIsDeveloper ToolsActive dossier
OpenAI turns the Codex harness into a managed Agents API
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
OpenRouter can now fail AI requests rather than let regulated data leave the US or EU
The important change is at the gateway boundary, not just inference placement. OpenRouter says prompts can now stay in-region from decryption through provider execution and supported server tools, while teams can enforce the rule per workspace, team or API key.
Elementor Pro’s unauthenticated file-upload flaw is now being actively exploited
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
Gmail will stop sending as third-party addresses in January 2027
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.