Find published research by company, product, platform or technology.
Showing 1–20 of 358 dossiers
This is not one headline vulnerability fix. Gemini CLI 0.60 is a coordinated hardening pass across the plumbing that lets extensions, sandboxes, filesystem paths and MCP authentication influence an agent’s execution environment.
Developers can submit tool integrations to Google Search and Gemini using MCP, but access is phased, users must connect apps, and Google reviews submissions.
The multi-retailer cart, previously previewed in May, is now available in the US. Price alerts, promo-code suggestions and Google Pay or merchant checkout could reshape how ecommerce sellers measure product discovery and conversion.
Gemini 4 Argon is now available through Google's paid API and eligible subscriptions. The introductory $2 input/$10 output rates double on December 1, and its 1M-token continuation feature requires special integration.
Gemini 3.8 Flash keeps 3.7 Flash’s promotional per-token rate and Flash-tier latency, but early independent analysis suggests harder reasoning can increase tokens consumed per task. A separate 3.8 Flash Cyber model is available only through Google’s Fairwind defensive-security program.
The change creates an authentication compatibility boundary for server-to-server Gemini integrations: an architecture that works in an existing project may not be reproducible with a newly introduced service account, and Google has not published an end date for the restriction.
Gemini 3.5 Transcribe turns Google’s audio understanding into a purpose-built developer surface: low-latency live transcription costs roughly $0.009/minute at Google’s published assumptions, while file transcription is roughly $0.005/minute and supports richer metadata.
Gemini Omni Flash has crossed from preview into a production API with a broader editing surface. Builders can extend existing clips and interpolate between images, but preview integrations now have a September migration deadline.
Google is changing Gemini Notebook’s packaging from feature-style quotas toward a compute budget. That gives users more flexibility but makes the effective cost of one request less predictable and ties premium upgrades more directly to computational intensity.
Google is tying licensed commercial content directly to an AI workspace: book ownership becomes the access control for grounded AI use. That gives publishers a new distribution path while keeping paid-source entitlement inside the AI experience.
Retailers and commerce-tool developers can now query first-party UCP shopping funnels rather than infer agentic checkout performance from traffic alone, but the alpha API needs careful query design.
The Imagen 4 shutdown is now effective, not merely scheduled. Builders still calling the old model IDs need to migrate to current Gemini image generation, where model names and interaction patterns differ enough to warrant explicit compatibility testing.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Operators of FrankenPHP 1.13.x should upgrade promptly: 1.13.4 closes seven server flaws, including a worker-mode denial of service and request-isolation leaks.
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.