Find published research by company, product, platform or technology.
Showing 1–20 of 455 dossiers
zlib 1.4 fixes CVE-2026-85091 in nonblocking gzwrite, an inflateGetDictionary overwrite of up to 8 MB beyond a 32 KB buffer, and minizip path traversal. It also includes breaking build and API-behaviour changes.
Google's News AI pilot now includes 400+ publishers worldwide. The negotiated content-delivery licensing deals are separate from its Search Console AI Contribution Pilot, and payment terms remain private.
NativePHP mobile 4.6.1 and 3.3.11 fix seven flaws; developers must regenerate, rebuild and distribute app updates, while older 1.x/2.x lines are unsupported.
Mozilla reports more than seven times as many Firefox security fixes as a year earlier, while adopting weekly releases, confidential regression tests and a proposed strategy to avoid overlapping exploit-chain patch gaps.
The most broadly relevant issue lets attackers potentially drive TLS retransmission state into unbounded behavior or acknowledge packets that cannot be outstanding. Several additional fixes narrow local or configuration-dependent Windows attack paths.
The Meilisearch 1.55/1.56 lines received recommended security upgrades after maintainers fixed pathological filter parsing and a nested-field panic.
Holiday subscription offers correlate with more payers, but lower revenue per buyer and substantial selection bias complicate the economics. Christmas-only offers show no clear advantage.
Meta Muse Spark Open is genuinely downloadable, unlike a promised future weight release. But 42B active parameters do not make its 816B weights cheap to host, and the Muse Model License is not Apache or MIT: model-as-a-service operators over $20M in affiliated annual gross revenue need a separate agreement.
Groq 3 LPX is moving from architecture announcement to manufactured infrastructure. Artificial Analysis measured about 3,400 output tokens/s at both 10K and 100K context on an NVIDIA-hosted private endpoint, but the single-concurrency benchmark does not yet establish public-cloud price, multi-tenant throughput or end-to-end agent speed.
The strongest signal in Produktly’s 2026 onboarding dataset is not a universal target but a set of usable baselines: median tour completion was 29%, 1–2-step tours completed far more often than 9+ step tours, in-app NPS response rates were low, and announcement attention was heavily front-loaded. The report explicitly discloses sample and causal limitations.
tinyjs 0.63.0 closes another dangerous wrapper boundary: a remote site could previously launch downloaded local programs. Signed updates and platform-target checks add further defence, but operators need to enable signing themselves.
Composer's optional cooldown can delay malicious releases, but it can also withhold a genuine security fix; 2.11 removes dist-to-source fallback too.
Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment.
Ghostty 1.4 addresses malicious Kitty graphics, tmux output crashes, OSC 52 and macOS links. Update terminal installations and verify shell integration.
Self-hosted Coolify operators need to check their exact v4 branch: patched versions are 4.0.1, 4.1.3, 4.2.1, 4.3.24 and 4.4.7, but maintainers recommend 4.4.7 for fuller coverage.
The October 21 Node.js security update addresses Brotli, TLS, DNS and Permission Model flaws across supported release lines. Upgrade production, CI and container runtimes.
The sharpest operational trap is CVE-2026-91768: PHP-FPM’s listen.allowed_clients can treat an allowed IPv6 address as an entire /96 prefix. Teams relying on that ACL should patch rather than assuming the configured address restriction is exact.
AWS’s agentic pentesting service can run multiple security tasks in parallel, so billable task-hours may exceed wall-clock test duration. New per-run task-hour limits stop a test gracefully at the ceiling and preserve findings, while targeted revalidation checks specific fixes without rerunning the entire pentest.
Node.js shipped v22.23.2, v24.18.1 and v26.5.1 to close a set of runtime vulnerabilities including an HTTP/2 use-after-free and a Permission Model path-matching bug that can over-grant filesystem access.
The important part of pg_vault_tde's 1.7.2 release is the operational migration: v4 rows can still be read after upgrade, but UPDATE can crash until they are rewritten.