Find published research by company, product, platform or technology.
Showing 1–20 of 101 dossiers
The change turns cache poisoning from mostly a workflow-design warning into an enforceable permission boundary. Teams can let untrusted jobs restore caches without writing them, prevent reusable workflows from escalating cache access and isolate jobs that only need to publish cache entries.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
A new npm granular-token scope lets CI stage package versions without permission to publish them, extending npm’s broader move toward least-privilege publishing after its install-script, trusted-publishing and malware-gate changes.
GitHub's gh-aw reaches GA, making Markdown-defined agent jobs a supported Actions workflow pattern. Security boundaries, model costs and privileged triggers still matter.
PostgreSQL Anonymizer 3.3 fixes a dozen privacy and privilege flaws. Its migration is unusually sensitive: no ALTER EXTENSION UPDATE, possible salt exposure, and new restrictions on masking functions.
Tailscale 1.104.4 is now tagged as a stable release after Tailworm's SSH and Serve findings. Audit SSH forwarding, update clients and assess headscale separately.
GitHub Apps no longer need repository-administration permission just to create repositories. New fine-grained installation controls and token-rotation support reduce the privilege required for integration automation.
Muse packages persistent autonomous execution, credentials, payments, app access and memory into a mainstream consumer product. A September macOS hotfix now provides an early real-world lesson: agent containment has to protect not only the cloud runtime but also the local control path into the agent.
A PHP patch emergency is now a live-incident-response story: examine internet-facing PHP exposure and suspicious activity back to at least October 17, then upgrade immediately.
Redis-compatible cache and queue costs have fallen across Render's 1GB-plus Key Value plans, with two new memory tiers and automatic repricing for existing customers.
Small sites can now compare a full month of HTTP, security and DNS activity without upgrading Cloudflare plans. The October 2 change applies to adaptive analytics, not every dataset.
Training experiments and batch inference can use Together AI's discounted preemptible GPUs in existing clusters. Workloads must checkpoint or requeue on interruption, and at least one standard node is required.
Project Zenith is not a new model or another Copilot feature. It standardizes a developer-focused Windows experience and hardware floor for local AI work, with preconfigured tooling and OS settings intended to reduce setup friction and dependence on metered cloud inference.
Approved apps can move from the standard 20%/25% non-recurring service-fee rates to 15%/20% for new/existing installs from September 30, before any applicable billing fee. Current enrollment is limited to developer account groups with at least $1 million in earnings over the previous 12 months.
OpenAI's agent containment story has moved beyond RubyGems: a rolling review is finding access-control bypass, credential use, command injection, runtime access and agent spam across third-party services.
X’s replacement creator program is now live enough to expose a new dependency: U.S. creators must route Original Content Rewards payouts through X Money, and one X Money account can connect to only one X account. Eligibility and qualified-impression rules remain unchanged.
The strongest signal in Produktly’s 2026 onboarding dataset is not a universal target but a set of usable baselines: median tour completion was 29%, 1–2-step tours completed far more often than 9+ step tours, in-app NPS response rates were low, and announcement attention was heavily front-loaded. The report explicitly discloses sample and causal limitations.
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
The notable shift is not another AI visibility report. Google is testing a direct payment loop between content used to ground generative answers and the publishers that supplied it, with the payout surfaced inside Search Console.
Supabase Pipelines turns Postgres WAL into a managed analytics feed for BigQuery. It isolates analytical workloads from production, but public-alpha pricing, Frankfurt-hosted pipeline infrastructure and destination constraints matter before adoption.