Find published research by company, product, platform or technology.
Showing 1–20 of 112 dossiers
The Anthropic procurement fight changed materially on September 25: a 2–1 federal appeals-court ruling backed the Pentagon’s supply-chain-risk designation. Builders serving defense customers should no longer rely on the August district-court ruling as evidence that the Claude procurement barrier is gone.
The unusual risk is that Python startup hooks execute without an application importing LiteLLM, while the public source tag lacked the malicious files. Check the exact installed wheel or image digest, not just the repository.
Pollora changes the WordPress build workflow for Laravel teams, but developers must accept PHP 8.4 requirements, dual boot costs and compatibility testing.
PIE 1.5.5 and 1.4.12 fix a low-severity temporary-file issue in the PHP extension installer that could expose long failed-build logs to other local users.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
PHPUnit's October 16 fixes extend output integrity from terminal text into XML logs, which could previously be malformed by test-controlled strings.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
The dangerous detail is the delivery path: WordPress gives an unauthenticated commenter a moderation-preview URL for their own pending comment, and The Events Calendar can process attacker-controlled block markup from that preview before a moderator approves anything.
FrankenPHP users should upgrade to 1.13.5 and audit upload locations, PHP path handling, HTTP/2 host trust and worker-thread exhaustion exposure.
Herd Studio integrates existing CLI agents with local previews, isolated workspaces and optional database clones; Laravel Cloud deployment is built into Herd 2.
The immediate follow-up to 2.11.8 restores trailing-slash PHP directory indexes and hardens FastCGI script selection and authentication boundaries.
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
Old third-party JavaScript includes can become a live supply-chain attack when their domains expire. DeadTag shows why removing abandoned tags and monitoring what scripts load is operational security, not housekeeping.
CVE-2026-105445 moved personal access tokens across Docker Hub identities without rotating their secrets. Affected users were notified and tokens deactivated after the September 30 fix, but the two-year exposure illustrates a container supply-chain trust boundary.
The important failure is not another prompt injection. Plugin4Shell breaks the mechanism intended to guarantee that an AI-agent plugin is still the exact code a marketplace reviewed.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.
The corrected rollout matters for supply-chain configuration: teams can still remove PATs for qualifying GitHub Packages, but GitHub changed the precedence model after some npm update jobs were mistakenly routed through GitHub Packages.
Cloudflare saw roughly 22,000 weak-chain TLS handshakes, about 160 unusual forged certificates and 50 million skewed challenge-page probes. The data indicate continuing exposure, not 22,000 successful attacks.