Find published research by company, product, platform or technology.
Showing 1–20 of 555 dossiers
A Linux IPv4 TCP use-after-free can be exploitable through network-facing Go services even when their own dependencies are current. Check the running kernel and vendor patch status; a GODEBUG setting does not remove the kernel flaw.
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires.
Codex 0.149.0 includes the async-message tool, delivery metadata and removal of the client-side feature gate that BTN previously tracked only on main. Parallel human-agent work is now in a stable client, but late replies can still race with decisions and model capability metadata remains the final exposure gate.
Python 3.15.1 supersedes the 3.15.0 launch with an urgent certificate-trust update. New installers alone do not update existing virtualenvs: update pip, uv and certifi where applicable.
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
Cloudflare's logs are no longer an Enterprise-only export capability. Small sites can send 25GB a month to internal destinations and another 25GB externally before overage charges, but destination costs and separate Workers/OTel meters still matter.
Neon now includes 100 separate free Postgres projects with 1GB each, 100 compute-unit hours per project and branching. It is a meaningful per-project allowance increase, not an unrestricted production database tier.
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
The interesting change is security economics rather than another hosting feature. A control that previously sat behind a $150/month add-on is now free across plans, changing the cost boundary for private dashboards, internal tools and pre-launch production domains.
The limits themselves were already documented; the material change is enforcement. Free-tier D1 workloads that previously relied on soft overage behavior now need query-cost awareness, indexes and a plan for temporary failures or paid migration.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Quattro’s unified programmable shell is a real architecture change rather than a theme refresh. Omarchy 4.0.2 now hardens package, installer, SSH and input paths, while current user reports of Quickshell crashes and a runaway-memory event illustrate the new central shell’s blast radius.
TRACE targets a gap between audit promises and what an AI agent actually did at runtime. Its v0.2 developer preview can bind model, policy, data and tool-use claims to confidential-computing attestation, but it is still pre-ratification and explicitly not ready to treat as a production compliance guarantee.
Computer Use is now GA in both Gemini APIs, but it is an action-planning tool, not a hosted remote desktop: clients execute clicks and keystrokes and must handle safety decisions.
The live census still finds flat/platform pricing ahead of per-seat, but its latest 31% share, 1,855 priced-company denominator and 96% sampled extraction audit supersede the October 2 dossier's figures.
Formbricks 6.1 changes single-use-link compatibility and survey permissions; October 27 security backports now address Next.js server actions, email invites and link-survey access.
Chrome 155 no longer fires unload handlers by default. Sites relying on unload for saves, analytics or cleanup should migrate to visibilitychange, pagehide and resilient delivery paths.
GitHub Actions dependency lockfiles are now GA, turning the October preview into a supported workflow-integrity control across eligible plans.
The new $0-subscription tier no longer lists starter credits, while three simultaneous requests are now permitted. Builders should check prepaid balance, model prices and queues before relying on the service.