Find published research by company, product, platform or technology.
Showing 161–180 of 290 dossiers
The Zig headless browser's October 23 follow-up adds security and web-compatibility work that matters when agents browse untrusted pages. It still cannot replace Chrome for visual workflows.
Stripe expands Global Payouts and EU stablecoin issuing; its subsequent $1B internal migration provides practical lessons about payout validation, reconciliation and route-specific eligibility.
New paid Gemini API projects now default to store=true on generateContent, streaming and batch calls; older projects retain their settings. Developers can opt out per request or project.
WebMCP tools can now emit PostHog's standard `$mcp_tool_call` event through posthog-js. The implementation adds privacy redaction and omits arguments/results, but only works for sites that enable the feature and initialise instrumentation before registering tools.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Self-hosted CI teams should upgrade to 3.20.1, audit runner and secret boundaries, and test workflow selection and substitution after the 3.20.0 regression.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
New RevenueCat growth tools bring web funnels, AI paywalls and early payouts into one subscription platform, with important eligibility and fee caveats.
A Linux IPv4 TCP use-after-free can be exploitable through network-facing Go services even when their own dependencies are current. Check the running kernel and vendor patch status; a GODEBUG setting does not remove the kernel flaw.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
The October 28 security release is more than an upgrade-window RCE fix. WordPress has now documented affected blocks, note access and root certificate changes; no confirmed active exploitation is established by the announcement.
GitHub's 2026 platform data shows agent-started PRs rising sharply. The implications concern code review, security and multi-model workflows, not proof of higher software quality.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
MLflow CrewAI autologging silently logged API keys; 3.17.0 patches it, but previously exported traces and keys still need remediation.
Copilot now offers model-reviewed action approvals between manual and Allow All. Unlike OS sandboxing, this probabilistic gate can approve unsafe operations; unattended CLI flags may leave unexpectedly broad permissions.
A new Performance Max sourced-videos setting can add up to ten crawled videos per asset group, uploaded to a Google-owned branded YouTube channel. It is on by default for new campaigns, but sources require approval.
Bun 1.4.4 introduces bun fmt, accelerates bun check and preserves Yarn Berry lockfiles during migration. Teams should test formatter output and unsupported plugins before replacing Prettier in CI.
With no planned installation banner, apps should identify affected merchants and handle the migration proactively; Shopify's alternative theme app embeds still require activation on the published theme.
The concrete API price and access limits close a key gap in the October launch: developers can cost Wonder through Model API but must not confuse maximum reasoning effort with Wonder Full.