Find published research by company, product, platform or technology.
Showing 161–180 of 386 dossiers
Gemini Omni Flash has crossed from preview into a production API with a broader editing surface. Builders can extend existing clips and interpolate between images, but preview integrations now have a September migration deadline.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Hydrogen 2026-10 is generally available as a JavaScript commerce library with React Router and Next.js starters and examples for other frameworks. Existing Hydrogen storefronts still work; migration is optional.
The interesting part is not another AI scanner. Cloudflare is connecting source-code evidence to what is actually deployed and being attacked at the edge, validating findings outside the model, then preparing both a code patch and, where appropriate, a narrowly scoped WAF mitigation for customer review.
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
The October 8–15 ChatGPT referral dip was a tagging fault, according to an Adobe analyst who says OpenAI confirmed it privately. Mark the reporting gap; the lost attribution will not automatically reappear.
GitHub's October 19 traffic protection can make previously reliable anonymous public-repo fetches fail; the change is selective, not a blanket private-repo requirement.
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.
Buttondown’s 'Great Pruning' is a small-SaaS operations story about deleting architecture rather than adding it. The company removed duplicated or over-retained request and email-event data after changing how those workloads were processed.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
The Hyperdrive integration was the practical database unlock; the larger September 21 change is that Python Workers themselves are now GA. Cloudflare is explicitly positioning Python as a production language on Workers, with native platform bindings and framework support rather than an experimental compatibility layer.
Microsoft’s Search automation has moved from a limited test into a default campaign-creation path. Advertisers can still switch AI Max off, but new Search campaigns now begin with a suite that can expand queries, creative and landing-page routing beyond the manually supplied keyword-and-ad structure.
Ahrefs is standardising Brand Radar on an estimated AI-demand metric because major AI platforms do not publish prompt volume. The new number can improve relative weighting between prompts and platforms, but it remains a modelled proxy rather than a count of how many people actually asked an AI system a question.
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
A six-month real-world comparison shows AI code-review agents and specialised fuzzers find substantially different V8 vulnerabilities. Replacing fuzzing with agents would leave gaps, and cost per bug remains unknown.