Ideas for building
better software.

HTTPS certificate industry phasing out less secure domain validation methods

Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the validation process and issuance practices behind it. Recently, the Chrome Root Program and the CA/Browser Forum have taken decisive steps toward a more secure internet by adopting new security requirements for HTTPS certificate issuers. These initiatives, driven by Ballots SC-080, SC-090, and SC-091, will sunset 11 legacy methods for Domain Control Valida

Node.js 24.12.0 (LTS)

Vercel launches partner certification

We're proud to introduce the inaugural cohort of Vercel Certified Solution Partners. These eleven industry-leading teams share our commitment to create a faster, more accessible, and more innovative web. This program is designed not only to validate partner expertise, but also to help customers confidently choose teams who understand their needs, technical requirements, and the experiences they aim to deliver. Through partner certification, customers are matched with teams proven to deliver ex

Node.js 24 LTS is now available on Sandbox

Vercel Sandbox now supports Node.js version 24. To run a Sandbox with Node.js 24, upgrade to version or above and set the property to :@vercel/sandbox1.1.0runtimenode24 Read our to learn more.Sandbox documentation Read more

The Fragile Lock: Novel Bypasses For SAML Authentication

TLDR This post shows how to achieve a full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting several parser-level inconsistencies: including attribute pollution, namespace confusi

Strengthening cyber resilience as AI capabilities advance

OpenAI is investing in stronger safeguards and defensive capabilities as AI models become more powerful in cybersecurity. We explain how we assess risk, limit misuse, and work with the security community to strengthen cyber resilience.

AI Crawl Control - Pay Per Crawl (Private beta) - Discovery API, custom pricing, and advanced configuration

Pay Per Crawl is introducing enhancements for both AI crawler operators and site owners, focusing on programmatic discovery, flexible pricing models, and granular configuration control. For AI crawler operators Discovery API A new authenticated API endpoint allows verified crawlers to programmatically discover domains participating in Pay Per Crawl. Crawlers can use this to build optimized crawl queues, cache domain lists, and identify new participating sites. This eliminates the need to discove

WAF - WAF Release - 2025-12-10 - Emergency

This additional week's emergency release introduces improvements to our existing rule for React – Remote Code Execution – CVE-2025-55182 - 2, along with two new generic detections covering server-side function exposure and resource-exhaustion patterns. Key Findings Enhanced detection logic for React – RCE – CVE-2025-55182, added Generic – Server Function Source Code Exposure, and added Generic – Server Function Resource Exhaustion. Impact These updates strengthen protection against React RCE exp