Releases, API changes, AI features, deals and analyst reports — checked against the primary source every week.
Highlights
Adobe published maintenance release 28871 for AEM as a Cloud Service. For Assets it adds a large set of OpenAPI endpoints: tagging, collection management, asynchronous copy and metadata export, task search and download status. It also changes one existing behaviour, as the Folders API now excludes hidden folders. Separately, a security researcher showed that C2PA "exclusion ranges" let a malicious signer produce a valid signature and trusted timestamp over an image that can then be edited freely. DAMs that display Content Credentials should not treat a valid manifest alone as proof. No vendor press release, M&A, funding or analyst report was found in the period.
AEM as a Cloud Service maintenance release 28871: new Assets APIs for tags, collections, async copy and export
Release 28871 replaces 28386 and is the largest Assets maintenance drop in recent months. New or extended APIs cover tagging (including asynchronous bulk tag creation), collections (item updates, delete, search, smart-collection and collection metadata), asynchronous asset copy and metadata export, task search, download job status, deletion of named renditions, and metadata-driven prompt permissions. Author OpenAPI asset searches and metadata updates, deletions and moves now emit events, and Dynamic Media viewer presets can be set through OpenAPI. Among the fixes, the Folders API now excludes hidden folders, asset identifiers are kept when an asset is replaced, and the Assets Admin UI shows a Content Credentials indicator. The page lists no known issues.
Why it mattersIntegrations that list folders through the API may return fewer results after this release. The new tagging, collection and async endpoints can replace custom workarounds built on older AEM APIs.
C2PA exclusion ranges let a signer validate an image that can be edited afterwards (catch-up)
Security researcher David Buchanan showed that a C2PA signer can mark the whole file as an "exclusion range". The claim signature and the RFC 3161 trusted timestamp then cover an empty string, and the image can be changed after signing without breaking either. His demo used a lottery-ticket photo edited after the draw, and he reports that the C2PA verification tools he tested did not flag it. He argues that the fix is for the specification to state, format by format, which parts of a file may be excluded, and for verifiers to enforce that. The weakness of large exclusion ranges had already been raised in 2025 and in academic analyses. No C2PA response or CVE was found.
Why it mattersDAMs are starting to display Content Credentials (AEM Assets added an indicator this week), and a valid manifest alone does not prove that the pixels were not altered. Admins should check what exclusion ranges a manifest declares before relying on provenance badges.
Short period: this issue covers 2026-10-09 → 2026-10-12, the days since the W41 digest (a Friday-to-Monday window). One security item dated 2026-10-02 was missed by the W41 research and is included here as catch-up.
Highlights
Adobe published maintenance release 28871 for AEM as a Cloud Service. For Assets it adds a large set of OpenAPI endpoints: tagging, collection management, asynchronous copy and metadata export, task search and download status. It also changes one existing behaviour, as the Folders API now excludes hidden folders. Separately, a security researcher showed that C2PA "exclusion ranges" let a malicious signer produce a valid signature and trusted timestamp over an image that can then be edited freely. DAMs that display Content Credentials should not treat a valid manifest alone as proof. No vendor press release, M&A, funding or analyst report was found in the period.
Items
AEM as a Cloud Service maintenance release 28871: new Assets APIs for tags, collections, async copy and export
Date: 2026-10-10 (release notes page last updated that day; the release day itself is left as "October X, 2026" on the page Unverified)
Solutions:adobe-aem-assets
Category: api-change
Summary: Release 28871 replaces 28386 and is the largest Assets maintenance drop in recent months. New or extended APIs cover tagging (including asynchronous bulk tag creation), collections (item updates, delete, search, smart-collection and collection metadata), asynchronous asset copy and metadata export, task search, download job status, deletion of named renditions, and metadata-driven prompt permissions. Author OpenAPI asset searches and metadata updates, deletions and moves now emit events, and Dynamic Media viewer presets can be set through OpenAPI. Among the fixes, the Folders API now excludes hidden folders, asset identifiers are kept when an asset is replaced, and the Assets Admin UI shows a Content Credentials indicator. The page lists no known issues.
Why it matters: Integrations that list folders through the API may return fewer results after this release. The new tagging, collection and async endpoints can replace custom workarounds built on older AEM APIs.
C2PA exclusion ranges let a signer validate an image that can be edited afterwards (catch-up)
Date: 2026-10-02
Solutions:market
Category: security
Summary: Security researcher David Buchanan showed that a C2PA signer can mark the whole file as an "exclusion range". The claim signature and the RFC 3161 trusted timestamp then cover an empty string, and the image can be changed after signing without breaking either. His demo used a lottery-ticket photo edited after the draw, and he reports that the C2PA verification tools he tested did not flag it. He argues that the fix is for the specification to state, format by format, which parts of a file may be excluded, and for verifiers to enforce that. The weakness of large exclusion ranges had already been raised in 2025 and in academic analyses. No C2PA response or CVE was found.
Why it matters: DAMs are starting to display Content Credentials (AEM Assets added an indicator this week), and a valid manifest alone does not prove that the pixels were not altered. Admins should check what exclusion ranges a manifest declares before relying on provenance badges.
Keepeek: Web search found nothing in the period. The blog URL that was tried (/fr/blog) returned 404.
Aprimo: Newsroom checked. The newest item is still CPM (2026-09-22).
Sitecore Content Hub: Changelog RSS checked. The newest Content Hub entries are still dated 2026-10-02 (covered in W41).
Canto: Web search found nothing. The release-notes site was not re-checked, as it returned 403 in the last two runs.
Brandfolder: Web search found no Brandfolder or Smartsheet news in the period.
Bynder: Press page (latest 2026-07-28) and API changelog 2026 (latest entry September 2026) checked. The support article "Upload API Response Changes (Q3–Q4 2026)" still returns 403 Unverified. Search snippets match the W41 summary (gateway URL instead of raw S3 URL, S3-derived fields not to be used for URLs, Asset API beta recommended). Its date and rollout date remain unknown, so it is still not reported as an api-change item.
Adobe Experience Manager Assets: Current release notes (updated 2026-10-09) and deprecated/removed features page (updated 2026-10-09) checked. Neither has a new entry beyond the Java 25 timeline already noted in W41. The maintenance release is reported above.
Orange Logic: Press-release page checked. The newest entry is still dated 2026-09-22.
Wedia / Lyvio: Web search found nothing newer than January 2026 blog posts.
Frontify: Product news checked. The latest roundup is still "August 2026" (2026-09-02).
Acquia DAM: Release notes index checked. The latest entry is still the acquia_dam Drupal module 1.1.16 (2026-07-27).
Cloudinary: Newsroom (latest press release 2026-08-05) and Programmable Media release notes (latest 2026-08-31) checked. The Assets release-notes URL that was tried (dam_release_notes) returned 404.
MediaValet: News page checked (undated). The newest item is still Custom Homepage. The /newsroom URL returned 404.
Brandworkz: Nothing found.
IntelligenceBank: News page checked. The latest item is still dated 2026-08-24.
Portfolio DAM (Axle AI): Nothing found.
Hyland Nuxeo: Search found no public trace of the October 2026 customer newsletter (possible lifecycle deprecation). It is still unverified Unverified.
OpenText DAM: Nothing found. The latest release found is still 26.2.
MediaBeacon: Nothing found.
Xinet: Nothing found.
Tenovos: Web search found nothing. The /news URL that was tried returned 404.
Market: DAM News checked. The only posts dated 2026-10-08 → 2026-10-12 are a contribution on digital waste in DAM (2026-10-08) and a job ad (2026-10-09). Wire searches (Business Wire / PR Newswire / GlobeNewswire) found no DAM release in the period. Searches for DAM M&A (only a 2024 Papirfly–Adgistics deal and an unrelated SPAC surfaced), funding, analyst reports and DAM MCP launches found nothing dated in the period. C2PA search surfaced the catch-up item above.