Find published research by company, product, platform or technology.
Showing 1–20 of 168 dossiers
The exploitation signal has strengthened again: CISA added CVE-2026-87902 to KEV on September 25. That turns earlier vendor and security-company telemetry into formal U.S. government confirmation of in-the-wild exploitation.
This is a useful reminder that exploitation pressure does not scale neatly with plugin popularity: Wordfence says it has blocked more than 250,000 attempts against a plugin with a five-figure install base.
The important development is active exploitation, not the original vulnerability disclosure. WordPress operators running Elementor Pro 4.2.1 or earlier should treat this as an immediate patch-and-hunt event, especially on sites with public forms that include optional file uploads.
Adobe Commerce and Magento merchants should treat CVE-2026-71362 as an urgent patch: independent security telemetry reports exploitation attempts even though Adobe’s bulletin still says it has not observed exploitation in the wild.
Node 26 is now production LTS. Teams using floating LTS selectors should test which major their CI, containers and native modules actually run.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
Meta Muse Spark Open is genuinely downloadable, unlike a promised future weight release. But 42B active parameters do not make its 816B weights cheap to host, and the Muse Model License is not Apache or MIT: model-as-a-service operators over $20M in affiliated annual gross revenue need a separate agreement.
This is a patch-and-hunt event rather than a routine Commerce security release. Exploitation began before the vendor fix existed, and Adobe plus independent responders recommend remediation that goes beyond installing the hotfix when compromise is suspected.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
GLM-5.3-Flash combines open weights, multimodal coding/agent capability and an 18B-active sparse architecture with a large anonymous pre-launch trial. Z.ai has already issued a chat-template correction for early downloads, showing that day-one self-hosted deployments need artifact-level validation as well as model benchmarking.
Alpine rebuilt its GitLab after attempted exploitation and warns that upgrading GitLab alone may not patch custom containers using unpatched Ruby.
Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules.
This is not a speculative browser bug. The vulnerable code sits in Chrome’s JavaScript and WebAssembly engine, exploitation is confirmed, and the remediation boundary is concrete: desktop Chrome needs the September 3 patched build or later.
Beam makes a large agent-focused model commercially reusable without a bespoke licence, but the open weights are not a small local download.
The existing coverage-first mode keeps more query detail at the cost of possible series growth. Cost-first applies all reductions but only restores detail within the same series budget; it is a guardrail against metric-cardinality spikes, not a guarantee of a fixed bill.
Developers can now profile a deployed Worker or a specific Durable Object without reproducing production traffic locally. Captures require an active isolate and measure allocations during the capture window, not retained memory.
Automated promotions make the advertiser's own website a source for ad assets. Google can find an offer, validate it and surface it without a marketer manually creating the promotion.
The useful signal is not that every SaaS company should add usage billing. Stripe/Metronome says hybrid pricing went from barely used to roughly one in six qualifying Stripe users, while many AI products are hiding token metering behind credits or output units so customer invoices describe value rather than model cost.
The non-Plus checkout migration is now an active compatibility boundary rather than an approaching deadline. Orders can continue while old post-purchase scripts, pixels or widgets stop working, making end-to-end conversion and app-behavior checks important after the cutover.
The August 28 transition is now active, and Railway’s current documentation removes an earlier ambiguity about new services in existing projects. Config as Code is legacy-only from here; production users should migrate and validate `.railway/railway.ts` before the December hard cutoff.