Find published research by company, product, platform or technology.
Showing 161–180 of 263 dossiers
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
The DuckLabs deal separates company ownership from project governance: AWS gets the team behind DuckDB, while the DuckDB Foundation keeps stewardship and the MIT license stays in place. Builders should watch whether that separation remains meaningful as AWS integrates the Duck Stack into its analytics services.
The compromised DebugBear RUM script drained $2.7m. New follow-up reporting describes 726 affected wallets, 689 refunded by October 30, and a preliminary DNS-registrar compromise rather than a confirmed application-server breach.
Google now advises noindex or crawl blocking for user-created pages meant for direct sharing, plus Search Console and platform-level spam monitoring.
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
Agent skills join prompts and models as managed runtime configurations; approvals and pinned versions make changing agent behaviour auditable rather than an untracked edit to skill files.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
Clairic joins Clef as a specialised one-pass model on Workers AI; typed extraction has a different failure model from LLM-generated JSON, with vendor-only benchmarks and preview limitations.
Stripe's new Postgres destination gives SaaS teams a managed payment-data mirror, not a zero-latency replacement for every webhook.
Caddy 2.11.6 could crash HTTP/2 proxies and sever SSE streams at 60 seconds. Version 2.11.7 fixes both and adds RFC 10036 incremental streaming support.
Large forums and social platforms can apply to push trending public posts and interaction counts to Google via OAuth and JSON-LD. Stable public URLs, attribution, moderation and fast updates are required; indexing and ranking are not guaranteed.
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
MiMo-V2.6 is more useful than another benchmark launch because builders get both capable multimodal weights and a rare view into the reinforcement-learning machinery that produced them: code, environments, run costs and even failure notes from the training cluster.
The useful part of Smaug Agentic is not another frontier-style benchmark claim. Abacus.AI is publishing a drop-in Kimi K3 derivative that targets a specific production failure mode in coding agents: long runs that burn the reasoning budget without converging. The weights and model card are public, but the training data is not disclosed and the benchmark gains remain vendor-produced.
The important shift is that agent orchestration itself becomes a managed API surface: context compaction, tool discovery, programmatic tool calls and subagent coordination can now come from OpenAI’s maintained Codex harness rather than an application team rebuilding those layers.
The important change is at the gateway boundary, not just inference placement. OpenRouter says prompts can now stay in-region from decryption through provider execution and supported server tools, while teams can enforce the rule per workspace, team or API key.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
WordPress 7.0.4 fixes CVE-2026-65640, a CVSS 8.8 remote code execution flaw affecting installations that process malicious PostScript uploads through Imagick and Ghostscript. Fixes have also been backported to branches as old as 4.7.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.