E-Maj 5.0.1 closes a PostgreSQL superuser escalation path for extension administrators
E-Maj 5.0.1 patches an emaj_adm-to-superuser escalation flaw in a niche but security-sensitive PostgreSQL rollback extension.
Search
Search results for “E-Maj extension security”
Find published research by company, product, platform or technology.
Showing 1–20 of 553 dossiers
Gemini CLI 0.60 hardens the boundaries around extensions, sandboxes and MCP OAuth
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
PIE 1.5 turns PHP extension installs into repeatable multi-package deployment steps
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
Gemini Omni Flash goes GA with video extension, interpolation and 4K output controls
Gemini Omni Flash has crossed from preview into a production API with a broader editing surface. Builders can extend existing clips and interpolate between images, but preview integrations now have a September migration deadline.
Web DevelopmentMarketing & DistributionBrowsers & Web StandardsDeveloper ToolsMarketplaces & PlatformsActive dossier
Chrome Web Store now defaults publishers to two extension slots and is retiring Featured badges
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
Railway turns PostgreSQL major upgrades into a one-click migration with rollback
The useful change is operational rather than a new PostgreSQL feature: Railway is packaging major-version migration into a managed workflow while keeping the two dangerous boundaries explicit — downtime during the upgrade and post-upgrade writes lost if you revert.
OpenBSD 8.0 ships major platform changes — and urgent IPsec, DNS and kernel errata
OpenBSD 8.0 operators should apply the first signed errata or syspatch updates promptly, especially where IPsec AES-GMAC and NSD are used.
Indie BusinessMarketing & DistributionContent & PublishingProduct EconomicsMarketplaces & PlatformsActive dossier
Getty Images enters prepackaged Chapter 11: $533m equity deal reshapes a major creator marketplace
Getty Images filed Chapter 11 to implement an agreed restructuring, not to shut down its image marketplace. The plan includes up to $533m of new equity, up to $143m of financing and a proposed move to private ownership.
DuckDB 2.0 LTS ships Quack client/server, async I/O and a breaking storage format
DuckDB 2.0 is now stable, but older versions cannot read databases newly created in 2.0. Test a shadow deployment before upgrading and check extension/client compatibility.
Web DevelopmentMarketing & DistributionBrowsers & Web StandardsDeveloper ToolsMarketplaces & PlatformsActive dossier
Chrome removes the last Manifest V2 extensions from the Web Store, ending updates and reinstalls
Manifest V2 was already disabled for modern Chrome users. The August 31 change closes the remaining Web Store path, turning any still-pinned legacy install into an effectively frozen artifact with no Store update or reinstall route.
Agent Plugins 1.0 now has a concrete cross-client compatibility layer for Skills and MCP
Agent Plugins 1.0 now has documented support across VS Code, Cursor, GitHub Copilot, ChatGPT/Codex, Kiro and several open-source agents. That makes the format materially more useful for cross-client distribution, but portable components remain limited to Agent Skills and MCP servers while permissions, hooks, commands and host UX stay client-specific.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureCompute & AI InfrastructureOpen ModelsDeveloper ToolsActive dossier
PyTorch 2.15 release candidate brings FP8 and major Metal fixes to local AI on Macs
The PyTorch 2.15 RC changes what Apple-silicon developers can run locally: FP8, faster MPS decoding, new GPU operators and a video VAE memory fix. The reported 5–6.5x gain is not universal.
SQLite 3.54.1 fixes a 32-bit heap-buffer overflow after major 3.54 CLI and authorizer changes
SQLite 3.54 adopters on 32-bit targets should move to 3.54.1 rather than staying on 3.54.0; users on 64-bit builds should assess the other maintenance fixes and compatibility changes.
Plugin4Shell breaks SHA-pinned plugin trust across major AI coding agents
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
Chrome and Firefox are moving major releases to two-week cycles
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
pgAdmin 4 9.19 patches 15 security flaws — server operators must check a one-time command migration
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Node.js fixes Brotli code-execution risk and TLS hostname bypasses in October security release
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
PHP security release fixes an IPv6 FastCGI ACL bypass across every supported branch
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
Firefox plans to stagger security fixes so AI attackers cannot combine unpatched browser bugs
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Ghostty 1.4 fixes seven terminal security flaws and sharply reduces scrollback memory
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.