Find published research by company, product, platform or technology.
Showing 1–20 of 154 dossiers
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
The technical-preview feature separates Copilot CLI from GitHub Cloud for core coding, shell and repository workflows, giving regulated and isolated environments a supported agent path while leaving cloud-dependent capabilities such as GitHub-hosted model selection and web search unavailable.
Tor Browser 16.0 makes the annual Firefox ESR migration real: Linux ARM64 reaches stable, 32-bit Linux support ends and privacy hardening comes with explicit accessibility trade-offs.
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.
The faster browser cadence is no longer just a published schedule. Firefox 155 is live and Chrome 153 has begun staged Stable rollout, leaving web teams with materially less time between major compatibility boundaries.
TorchNeuron changes the software portability equation for Trainium, making it easier to test non-NVIDIA AI accelerators without rewriting the model stack. Beta gaps still demand model-by-model verification.
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
JPEG XL now ships by default in Chrome 155 and Firefox 158; Safari supports still images, but Edge, installed-version lag and format tooling still warrant fallback delivery.
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Railway now patches and redeploys affected workloads for known CVEs and refreshes dependent services after credential rotation—but only when those credentials use Railway variable references.
A 15-CVE pgAdmin update also changes how server-mode password commands are migrated, with a potentially irreversible first-start consequence.
A Linux IPv4 TCP use-after-free can be exploitable through network-facing Go services even when their own dependencies are current. Check the running kernel and vendor patch status; a GODEBUG setting does not remove the kernel flaw.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores.
Cloudflare discloses cross-tenant GLM-5.3 Workers AI responses caused by a KV-cache rejection bug; SGLang v0.5.22 is recommended for disaggregated inference operators.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Umami v3.4.1 fixes a critical Next.js next/og RCE, image-optimisation SSRF, cache poisoning, an MCP OAuth credential leak and other dependency flaws. Self-hosted users should upgrade and rebuild or pull fresh Docker images; no migration is required.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
HTTP/3 isn't automatically safe from compressed-header denial of service. Check the exact QUIC/QPACK library and version behind your proxy or app, upgrade fixed stacks and limit or disable vulnerable HTTP/3 endpoints.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.