Find published research by company, product, platform or technology.
Showing 161–180 of 243 dossiers
The bug is a useful warning for AI application plumbing: turning a user-supplied URL into a model attachment also turns the application server into a network client unless the adapter enforces an outbound trust boundary.
Azure Document Intelligence v2.0 reaches retirement on August 31, 2026. Microsoft recommends moving workloads to the current v4.0 API; the post-v2 REST surface was redesigned, so teams should verify the actual api-version their SDK or HTTP client sends rather than assuming a package upgrade is enough.
Railway’s managed MySQL path can now gain automatic failover without rebuilding the database elsewhere. The trade-off is real operational complexity: conversion briefly drops connections, hard-coded URLs need manual repair, replicas are for failover rather than read scaling, and each extra database/proxy node consumes billable resources.
For deals and store transfers from August 10, Shopify partners can earn both subscription revenue share and a slice of merchant GMV, while the earning window becomes four years instead of perpetual.
Cloudflare’s new MCP controls turn TLS-inspected Gateway traffic into an inventory and policy surface for remote MCP use, while explicitly leaving local stdio, off-network and uninspected traffic outside visibility.
A search-engine maintenance release carries intentional relevance and API compatibility changes that operators should test.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
gopls 0.24.0 and VS Code Go 0.56.0 ship interactive refactorings for struct tags and interface implementations; the broader Language Server Protocol extension is still a proposal, with cross-file moves in preview.
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
pg_ivm 1.17 fixes restore state, duplicated incremental-maintenance triggers and upgrade metadata handling, plus index inference and LATERAL crash bugs.
The incidents do not have a proven common attacker. Wiz's forensic evidence shows downstream abuse and resale of stolen keys, not that every platform breach caused the same misuse.
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
WordPress 7.2 Beta 1 landed October 20 with wp_set_secret and wp_get_secret, encrypted storage, current/previous versions and pluggable back ends. Existing plugin credentials do not migrate automatically; the final release is scheduled for December 8.
A new public MCP endpoint lets agents search without an API key and complete shopper-authorised purchases. It is separate from the Global Catalog REST API retirement and earlier browser-only WebMCP checkout; webhooks are not available at launch.
The May Antigravity agent ID is retired. Managed Agents now require the September preview ID and default to Gemini 3.8 Flash, alongside hooks, token budgets and scheduled sandboxes.
The pricing change is also a packaging change: beehiiv is charging more for paid tiers while putting newsletters, websites, podcasts, community and digital products across the plan family and extending self-serve scale.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately.
The first rollout turns developer identity into an Android-level distribution requirement across Google Play and six partner stores. It does not mean every sideloaded app is blocked today, but it materially changes the direction of non-Play Android distribution.
Agent Identity is moving from a standalone credential boundary into a mainstream serverless runtime. Cloud Run can now assign agent identities and register agents/MCP servers automatically, reducing custom discovery and identity plumbing while keeping the runtime integration itself in Preview.