Find published research by company, product, platform or technology.
Showing 1–20 of 386 dossiers
The migration turns integration identity from an implicit platform detail into an operational dependency. Teams may need new run-as accounts and `Service Account User` grants not only for runtimes but also for editors, publishers, approvers and deployment automation.
Teams upgrading for five 1.13.0 security fixes should use 1.13.1: it repairs Nextcloud and Symfony breakage, crashes and shutdown failures while retaining the earlier Caddy/Mercure compatibility changes.
The October 6 release is broader than WordPress 7.1.2's single critical RCE fix: it closes seven separate core flaws, including stored XSS through pending comments, second-order SQL injection in WXR exports and unauthenticated disclosure of comments on private posts.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
The October 15 Gateway/Workers integration turns a secure web gateway into an application-specific programmable proxy. Teams gain custom request/response handling, but must account for inspection order, WebSocket exclusions and standard Workers billing.
A small but foundational JavaScript HTTP framework has reached v2 with a web-standards rewrite. Builders must test route wildcards, forwarded-header trust and explicit response returns before migrating.
The October 15 Forgejo 17.0 release strengthens self-hosted Git and CI workflows, but webhook receivers need a migration because the new workflow-run events change headers and payload semantics. The release is non-LTS.
Microsoft's October 13 Topics Portfolio beta shows AI-grounding queries that cite rivals but not your site, grouped by theme with approximate demand and competition measures; access depends on sufficient site data.
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Fitbit API integrations have less than a month to migrate. The replacement changes authentication and API surface, while Google is still restricting onboarding for new Health API projects.
Automated promotions make the advertiser's own website a source for ad assets. Google can find an offer, validate it and surface it without a marketer manually creating the promotion.
SwarmLLM does not route whole prompts to separate machines; it pipelines one model across browser tabs. A MacBook and iPhone can jointly hold Qwen 3.8 27B even when neither device can hold the full 15GB quantized model alone, with no inference server in the loop.
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
Manifest V2 was already disabled for modern Chrome users. The August 31 change closes the remaining Web Store path, turning any still-pinned legacy install into an effectively frozen artifact with no Store update or reinstall route.
Amplitude’s new consent gating separates the visible experiment experience from persistence and measurement. Sites can avoid experiment flicker before a consent decision, but denied users’ buffered impressions are discarded and Analytics consent still has to be handled separately.
Chrome extension publishers now face individualized publication caps, with two slots as the default for new or low-history accounts. Existing extensions remain published, increases can be requested, and Google is also retiring the Featured badge while making recent reviews more important to ratings.
Cloudflare’s RUM measurement model now distinguishes hard navigations, native soft navigations and routing-API fallbacks. For React, Vue, Angular, Svelte and other client-routed sites, the immediate consequence is a metric discontinuity: pageviews and Core Web Vitals can shift without an underlying traffic change.