Find published research by company, product, platform or technology.
Showing 1–20 of 127 dossiers
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
The resilience improvement fixes one distributed-systems failure mode, not every token-exchange failure. Existing public apps migrating legacy tokens need stricter handling because the initial non-expiring-to-expiring conversion can still orphan an installation and require merchant reauthorization.
Agents and operations tooling can inspect HA health, trigger switchovers, restore to a timestamp and change connection pooling from one machine-readable surface. That increases automation power, but recovery actions still create real operational boundaries such as brief failover interruption and forked PITR services.
Cloud Storage project deletion no longer necessarily destroys every soft-deleted bucket immediately. Google’s August 17 change makes bucket retention part of project-recovery behavior, affecting disaster recovery, teardown assumptions and ongoing storage cost.
The migration turns integration identity from an implicit platform detail into an operational dependency. Teams may need new run-as accounts and `Service Account User` grants not only for runtimes but also for editors, publishers, approvers and deployment automation.
The change creates an authentication compatibility boundary for server-to-server Gemini integrations: an architecture that works in an existing project may not be reproducible with a newly introduced service account, and Google has not published an end date for the restriction.
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Zigpoll is a useful tiny-team pricing case because the claimed gain came from segment fit rather than simply charging everyone more. The founder says moving integrations down to the standard plan removed friction for agencies managing many client stores; current product pricing remains tiered primarily by survey-response volume.
Retention-locked backups are gaining a project-level consequence: Google Cloud plans to create automatic liens that can block project deletion while protected backups remain. Infra teams need to account for this in teardown automation, IAM and recovery design.
The shift is broader than another Ads dashboard metric. Google is connecting first-party data pipelines, conversion-recovery estimates, open-source marketing-mix modeling and causal geo experiments into one measurement stack — useful, but still heavily dependent on Google’s own modeling and internal benchmark claims.
Estuary’s new runtime is less about an AI label than a data-correctness problem: the same pipeline is meant to move from millisecond streams to large backfills without exposing downstream systems to partial transactions or requiring separate batch reconciliation.
Supabase Pipelines turns Postgres WAL into a managed analytics feed for BigQuery. It isolates analytical workloads from production, but public-alpha pricing, Frankfurt-hosted pipeline infrastructure and destination constraints matter before adoption.
X’s replacement creator program is now live enough to expose a new dependency: U.S. creators must route Original Content Rewards payouts through X Money, and one X Money account can connect to only one X account. Eligibility and qualified-impression rules remain unchanged.
Cloudflare’s crawler controls now distinguish between refusing AI training and refusing the crawler itself. The new Disallow AI Training option is designed to keep search discoverability while expressing a training opt-out to operators that meet Cloudflare’s Accountable requirements.
Approved apps can move from the standard 20%/25% non-recurring service-fee rates to 15%/20% for new/existing installs from September 30, before any applicable billing fee. Current enrollment is limited to developer account groups with at least $1 million in earnings over the previous 12 months.
From January 2027, Gmail will no longer send mail as non-Google addresses or fetch third-party accounts through Gmailify/POP on the web. Forwarding into Gmail and third-party accounts in the mobile app remain available, so small-business and custom-domain users need to distinguish the affected desktop workflow from Gmail’s broader mail protocols.
Search Console can now treat supported social and video accounts as properties, exposing Google impressions, clicks, queries and post-level performance for Instagram, TikTok, X and YouTube content.
This is more than a routine quarterly version bump. Several 2026-10 changes require code updates or can change order economics and checkout behavior, so Shopify apps need to test against the release candidate before production traffic begins moving to the new stable version.
Stripe says Revenue Recognition users covered by its pricing transition must select a subscription plan by August 19, 2026. If they have not switched by August 20, Stripe will automatically turn the product off until they subscribe.
The important signal is the infection path. A trusted maintainer can unknowingly become the supply-chain carrier when malware modifies project and build files before a normal package publish, so publisher identity alone does not prove the artifact matches the maintainer’s intent.