Researchers Infiltrate Microsoft Tech Support Scam Operation
A large-scale scam operation impersonating Microsoft uses a malicious traffic distribution system (TDS) run by a Russian organization and abuses thousands of Cloudflare links.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
375 matching stories — announcement, in API Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Secure Sensitive Data with Cyera and Akamai Guardicore Segmentation
Protect sensitive data by pairing Cyera's data discovery with Akamai Guardicore Segmentation to enforce dynamic, data-aware microsegmentation rules.
Top 10 web application incidents in 2026
Explore top 10 web app incidents in 2026: confirmed attacks, data breaches, exploited vulnerabilities, and lessons for web application security teams.
Des sites IPTV pirates toujours accessibles : pourquoi la justice refuse de sanctionner les VPN
Jusqu'à 10 000 euros par jour et par domaine non bloqué, voilà ce que réclamait beIN Sports à plusieurs intermédiaires techniques, dont NordVPN, Surfshark et Cloudflare. Malgré des sites de streaming illégal toujours accessibles, le tribunal judiciaire de Paris a rejeté ses demandes. Une nouvelle décision qui précise les limites des obligations imposées aux fournisseurs de VPN.
How to Build Your Actual Network Map with Custom Agents in Orca
Ask most teams for a map of their network and you’ll get one of two things: a diagram someone drew for an audit two years ago, or an export from the firewall and cloud consoles showing what each rule allows. Both describe intent. Neither describes what an attacker on the internet can actually reach today. […] The post How to Build Your Actual Network Map with Custom Agents in Orca appeared first on Orca Security.
Arnaque au faux support Microsoft, des chercheurs lèvent le voile sur un réseau criminel actif depuis près de dix ans
En six mois, plus de 20 000 sous-domaines Cloudflare ont été associés à un réseau d’escroqueries au faux support Microsoft. Derrière ces adresses renouvelées en permanence, une organisation cybercriminelle active depuis 2017.
Windows Shell Zero-Day and 1,413 Fixes: Microsoft October 2026 Security Update
Microsoft’s October 2026 Patch Tuesday fixes 1,413 vulnerabilities, including exploited Windows Shell zero-day CVE-2026-96951. See AppTrana coverage. The post Windows Shell Zero-Day and 1,413 Fixes: Microsoft October 2026 Security Update appeared first on Indusface.
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More
Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an actual feature. And somehow, it fits right in with this week's security stories. The rest gets interesting in different ways. A small permission can lead to a big theft. A trusted login can hide the wrong person. Old bugs are finding new victims, familiar tools are being put to strange uses, and
Compliance penetration testing requirements, by framework
Your penetration testing requirements depend on who each framework lets run the test. Compare PCI DSS, SOC 2, HIPAA, NYDFS, CMMC, and DORA.
Your AI agent is sandboxed. Its data still needs guardrails.
Docker Sandboxes contains your agent. Mend AI Guardrails checks what it sends.
Frontier-Level Red-Teaming From a Self-Hostable Open-Weight Model: Testing NVIDIA Nemotron 3.5 Super
Key Findings AI Agents Are the Newest Attack Surface The teams building fastest aren’t just shipping apps anymore. They’re shipping agents: support bots wired into ticketing systems, internal copilots with read access to the data warehouse, coding agents that can open pull requests, and autonomous workflows that call APIs on their own. Each one is […] The post Frontier-Level Red-Teaming From a Self-Hostable Open-Weight Model: Testing NVIDIA Nemotron 3.5 Super appeared first on
What a Sentence Forgets: Preserving Context in Document Ingestion
Weekly Threat Report October 7–13, 2026: French Supermarket Refrigeration Attacks, Ivanti Connect Secure Zero-Day Chain, and AI-Agent Incidents
The Week At A Glance This week’s incidents highlighted the real-world impact of exposed control systems and rapidly exploited enterprise […] The post Weekly Threat Report October 7–13, 2026: French Supermarket Refrigeration Attacks, Ivanti Connect Secure Zero-Day Chain, and AI-Agent Incidents appeared first on .
Beyond Blocking: Creative Ways to Detect and Hamper Video Piracy
Discover smart ways to mitigate live video piracy, slow down restreamers with clever CDN tricks, and protect your streams.
Under CPS 234, Your APIs Are Information Assets. Can You Prove You're Protecting Them?
APRA's information security standard already covers the APIs your agents run on. Most institutions cannot yet evidence it.
9 API Security Features SaaS Applications Need in 2026
Key Takeaways API incidents are now the norm. In Akamai’s 2026 survey, 87% of organizations reported at least one in […] The post 9 API Security Features SaaS Applications Need in 2026 appeared first on .
Fastly Named a Leader in the 2026 IDC MarketScape for WAAP
Fastly named a Leader in the 2026 IDC MarketScape for WAAP. Learn how Fastly protects web apps and APIs with automated defense and low false positives.
How to Apply Your Own Vulnerability Scoring in Orca with Custom Agents
Every mature vulnerability management program has a scoring model that isn’t CVSS. It might say that anything on the CISA Known Exploited Vulnerabilities (KEV) catalog jumps the queue, that an internet-facing asset outranks an internal one, or that a finding behind a compensating control can wait. These rules reflect years of experience with what gets […] The post How to Apply Your Own Vulnerability Scoring in Orca with Custom Agents appeared first on Orca Security.
Top 6 AI Security Providers in India to Evaluate in 2026
Key Takeaways In this article, we cover products that protect live AI applications at runtime, not consulting, testing-only, or employee-access […] The post Top 6 AI Security Providers in India to Evaluate in 2026 appeared first on .
Vibe Coding VS Code Extension Monitors All Developer Activity
Agents Are Acting. Most Organizations Cannot Stop Them.
The State of Agentic AI and API Security 2H 2026 Report is available now
AI Bot Cosplay
In a single day over 6M requests posed as AI bots to probe for .env files, Git metadata, credentials and other private files. Unpack the threat of AI bot cosplay and learn how Fastly's WAF rules can block impostors.
Agentic AI Governance Solution Checklist: 10 Questions to Ask
What continuous offensive security testing is and how to implement it
Continuous offensive security testing is not faster pentesting. See the standard of proof it runs on, and how to build your program around it.
Mend.io upgrades 184 open source organizations to the Renovate Community (OSS) plan
184 open source organizations now have the Renovate Community (OSS) plan
You Can’t Secure the AWS Accounts You Don’t Know About.
Wallarm Infrastructure Discovery Named Enterprise Cloud Security Solution of the Year. Ask an AWS security team how many accounts they run, and the honest answer is usually a range. Enterprises on AWS operate anywhere from 100 to 5,000 accounts. Most security teams can see only a fraction of them. That gap is why we built [...] The post You Can’t Secure the AWS Accounts You Don’t Know About. appeared first on Wallarm.
Your AI Transformation Needs Runtime Protection for the Whole Agentic Estate
Learn why Salt treats AI-DR as one essential layer of AG-DR (Agentic Detection and Response)
Cequence Agent Trust: Meta’s Muse Is a Bot and a Customer. Now what?
NIST SSDF: 4 core practices for secure software development
What the NIST SSDF requires and how to implement its four practice groups.
Agentic Zero Trust Scorecard: Score Your Agent Governance
Earlier this year, Dr. Chase Cunningham “DrZeroTrust” published Agentic Zero Trust: Extending the Zero Trust Security Paradigm to Autonomous AI Systems. The paper argues that Zero Trust in its original form is necessary but incomplete for the agentic AI world and lays out what is required. […]
AI Governance on AWS: The Runtime Control Loop: AI Governance on AWS: Four Functions, One Loop, and a Deadline That Already Passed
Answer this without checking: how many AI agents are running in your environment right now? Most security leaders give an estimate and a shrug. That is a fair response, because agents get spun up by an engineer solving a problem on a Tuesday afternoon, through a path that puts them on nobody's radar. In August [...] The post AI Governance on AWS: The Runtime Control Loop: AI Governance on AWS: Four Functions, One Loop, and a Deadline That Already Passed appeared first on Wallarm.
From fuzzers to AI hackers: What seven years of application security research solved, and what remains unsolved
From REST API fuzzers to agentic AI: explore seven years of application security research and the gaps in verified exploits, continuous testing, and retesting.
New Remote DoS Attacks Against GraphQL Java
Executive Summary Imperva Threat Research identified a series of remote denial‑of‑service vulnerabilities in GraphQL Java, one of the most widely used libraries for GraphQL in the Java ecosystem. In this blog, we’ll deep dive into these vulnerabilities, analyze their impact, and provide recommendations to protect your environment. If your endpoints are protected by Imperva Web Application Firewall, your systems are already protected against these threats. Introduction GraphQL Java is the engine
Corsha named as a Cool Vendor™ in the Gartner® Coolest Vendor Innovations in Cyber-Physical Systems Security, 2026 report.
Data Sovereignty Isn’t Optional Anymore. Here’s How eXate Makes It Achievable.
Every regulated institution is living under the same converging pressure, whichever jurisdiction it calls home. Data sovereignty legislation is tightening everywhere: Canada’s Bill C-27, the UAE’s PDPL, Qatar’s PDPPL, India’s DPDP Act and Malaysia’s PDPA all impose residency, access control and audit requirements standard cloud tooling was never built to satisfy.
Knowledge documents: When your application rejects everything an agent tries
Discover how knowledge documents improve autonomous API security testing by resolving hidden values, custom dependencies, and undocumented execution order.
The Smartest People in AI Are Telling Us to Fix Everything. Now There Is a Way to Do It.
Seven months of warnings from Anthropic, OpenAI, and Microsoft say the same thing: the bugs you deprioritized are exploitable, and the window is short. Wingman is broadly available today. Here is why we built it. The post The Smartest People in AI Are Telling Us to Fix Everything. Now There Is a Way to Do It. appeared first on StackHawk, Inc..
AI Agent Security Readiness: The Federal Standard You Should Get Ahead Of
Here's the uncomfortable part first: in August 2026, researchers found AI agents connected to Hugging Face running loose inside enterprise networks. No owner, no audit trail, nobody who could tell you they existed until something broke. If that sentence made your stomach drop a little, good, because it should. It's the same blind spot most [...] The post AI Agent Security Readiness: The Federal Standard You Should Get Ahead Of appeared first on Wallarm.
AppTrana Adds Post-Quantum Cryptography Support with X25519MLKEM768
Quantum computers could very soon undermine the public-key cryptography that secures financial transactions, health records, and other sensitive data moving over TLS today. When that happens, encrypted information protected by. The post AppTrana Adds Post-Quantum Cryptography Support with X25519MLKEM768 appeared first on Indusface.
What are agentic pentesting tools?
Traditional security testing tools excel at applying proven security checks quickly and consistently. Agentic pentesting tools add another dimension: they use AI agents to explore applications, adapt their testing based on runtime behavior, and investigate attack paths that may require multiple steps or changing strategies.... Read more The post What are agentic pentesting tools? appeared first on Invicti.