Find published research by company, product, platform or technology.
Showing 1–20 of 81 dossiers
The new program creates a specialized Gmail deliverability path for verified political senders, but it is not an inbox guarantee: recipients can still mark mail as spam, block senders or unsubscribe, and non-compliant domains can be suspended or removed.
After Chrome 153's signed-JSON migration, Chrome 154 brings Android and third-party origin-trial support and changes the issuance request's Sec-Fetch-Dest value. Chrome 156 will reject provider tokens whose email claim does not exactly match the submitted address.
Financial advertisers in the US and Canada face a new Google Ads verification gate in 2027. Google will announce accepted registries and onboarding details before enforcement; it is not a current blanket ad ban.
A previously preparatory compliance field is now an operative delivery gate. Builders automating Toll-Free onboarding need to collect, validate and submit policy URLs as part of registration rather than treating them as optional metadata.
The first rollout turns developer identity into an Android-level distribution requirement across Google Play and six partner stores. It does not mean every sideloaded app is blocked today, but it materially changes the direction of non-Play Android distribution.
The change turns webhook reliability from a mostly passive retry problem into an inspectable operational surface: configuration tests, event-specific failure state, owner alerts and health endpoints give email systems earlier warning when downstream integrations are broken.
Email operations can now query Resend’s deliverability and engagement data directly through `/emails/metrics`. The API makes bounce and complaint thresholds, domain-level trends and campaign reporting usable by internal dashboards, scheduled checks and agents.
PHP's official extension installer can now install multiple packages in one command and select missing project extensions without prompting. PIE 1.5 also improves attestation verification for its own updates.
TorchNeuron changes the software portability equation for Trainium, making it easier to test non-NVIDIA AI accelerators without rewriting the model stack. Beta gaps still demand model-by-model verification.
eMudhra is leaving global TLS certificate issuance after its weak-key incident. Existing certificates and custom trust stores still require audit and migration; Indian DSC and eSign operations are not part of the announced exit.
The coordinated Nix/Lix advisory now lists five CVE identifiers, three shared across Nix and Lix and two Nix-specific. The privilege-escalation and sandbox exposure, affected versions and operational patch guidance remain central.
Developers get another paid web retrieval option for coding agents and applications; the introductory harness exemption expires October 31.
The new Turso 0.8 results add a concrete performance datapoint to the earlier MVCC preview, but benchmark workloads, transaction conflicts and production durability still require independent verification.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
This is an identity-system failure rather than an application bug: a vulnerable Keycloak deployment can let an attacker turn the legitimate “forgot password” flow into full account takeover without credentials or victim interaction. Upgrade is the proper fix; disabling Forgot Password in every realm is Red Hat’s temporary mitigation.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
Vercel KMS gives Functions OIDC-authenticated access to managed RSA, ECDSA and EdDSA signing keys. Builders can scope grants by project and environment, constrain JWT claims with JSON Schema, rotate keys centrally and publish standard OIDC/JWKS metadata for verification outside Vercel.
Holiday subscription offers correlate with more payers, but lower revenue per buyer and substantial selection bias complicate the economics. Christmas-only offers show no clear advantage.
The now-public S-1 confirms extraordinary revenue growth and financing-related accounting losses; its actual operating result, infrastructure exposure and concentrated founder control matter more than the headline net loss.
The useful shift is architectural: agent permissions no longer have to depend only on the model or harness behaving correctly. OpenShell puts policy enforcement in the execution environment, while Sentry is designed to keep watching from a separate hardware trust domain.