October 2026 Summaries

Qase patched all cloud environments, including US and EU regions and dedicated clusters, after PHP released updates on October 21, 2026, for two critical PHP engine vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2 and capable of enabling unauthenticated remote code execution. Following advance notice from the PHP Foundation, Qase identified affected systems, applied a recommended temporary mitigation before patches became available, verified the updated PHP build, and completed deployment of PHP 8.4.27 across its hosted infrastructure within hours. Post-update monitoring found no unusual activity, attack indicators, errors, or evidence that either vulnerability had been exploited against Qase. Qase reporters, SDKs, and the qase.io website were unaffected because they do not rely on the vulnerable PHP deployment, while customers using Qase cloud need take no action; organizations operating their own PHP systems are advised to update promptly.

Qase’s September updates focused on reducing QA coordination work, expanding customization, and improving platform scalability. Test case reviews now provide word-level diffs, suite-path visibility, default and multiple reviewers, optional auto-merge after required approvals, and configurable in-app and email notifications. GitHub Access Control lets administrators restrict repository visibility by Qase project on Teams and Enterprise plans, while the Jira Cloud integration is being automatically migrated from Atlassian Connect to Forge. A new Custom Widget Builder enables users to create dashboard charts and tables from test cases, results, defects, runs, and requirements, and QQL widgets can now group by custom fields with some current limitations. Per-workspace API rate limits were introduced to manage rising automated traffic, alongside performance improvements for test runs and results endpoints. Additional releases expanded the MCP server, updated the qasectl CLI, added Quality Supervisor skills for change-impact analysis and quality reporting, fixed a Windows safety-hook gap, and improved signup handling by directing eligible users toward existing company workspaces rather than empty trials.

Qase has introduced a Custom Widget Builder that lets teams create dashboard visualizations around their own testing questions rather than relying solely on predefined widgets. Users can select entities such as test cases, run results, defects, test runs, and requirements, then apply filters, custom fields, grouping, and live chart previews. Each widget can contain up to five blocks for comparing different entities or filtered datasets, with up to 10 shared segmentation properties for side-by-side breakdowns. Widgets can be displayed as bar, line, donut, or table views, configured with color and time-range options, and saved to a shared workspace library where edits update all uses. Test plans and formulas are not yet supported, though formulas are planned, while existing QQL and predefined widgets remain available.

A QA team used Qase MCP, Claude Code, and a rule-based AI workflow to audit 1,209 manual test cases that had accumulated over years, reducing an estimated month of manual work for three engineers to about one week for a single engineer. The agent examined case steps and expected results, traced relevant product code, searched tests across E2E, API, integration, unit, frontend, and component layers, and recorded evidence-based coverage verdicts in a custom field. The audit identified cases already covered by automation, including backend tests not reflected in E2E coverage, found 27 duplicate cases by comparing their actual scenarios rather than titles, and marked seven cases as deprecated only after confirming their features no longer existed in the codebase. To limit AI errors, especially false claims of coverage, the team required named assertions, verified every linked test, restricted editable fields, trialed the first write in each batch, prohibited deletion, and used a low-confidence outcome when evidence was insufficient. The approach emphasizes that AI can efficiently perform repetitive repository analysis, while people retain responsibility for irreversible decisions such as deleting duplicates or archiving cases.

Tiden is a new product from the team behind Qase designed to independently verify that AI agent-generated code meets intended requirements throughout the software development lifecycle. It creates version-controlled requirements from repositories, tests, and documentation, captures intent before coding begins, and requires each promise associated with a change to be supported by test evidence before a session or merge can close. The company argues that AI-assisted development has increased code and pull request volume faster than teams can review, test, release, and maintain specifications, creating a “generative ratification loop” in which agents validate their own code against tests and documentation they also generated. Tiden seeks to break this loop by acting as an external judge, mapping product behavior, scoping verification to affected changes, linking production incidents to releases and requirements, and requiring human approval for unresolved decisions. The product, which has been tested internally and with early customers, is available through GitHub integration at tiden.ai and is also listed on Product Hunt.