Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
375 matching stories — announcement, in API Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Use Orca’s pre-built Threat Investigator agent, or build your own with Orca’s MCP Server feeding the context? It’s a choice every security team running Orca eventually has to make, and framing it as either/or isn’t the right approach. Orca’s Threat Investigator and custom agents are built for different problems. Most mature teams will end up […] The post When to Use Orca’s Threat Investigator Agent vs. Build Your Own on the Orca MCP Server appeared first on Or
Key Takeaways The Cost of Switching Tabs Cloud engineers and developers live in the AWS console, not in a security platform. So when a question comes up about a resource’s risk, the only path has been to stop, open a new tab, and go looking for that asset inside their security tooling.  That detour costs […] The post Bring Orca Security Context Into the AWS Console with the Orca Browser Extension appeared first on Orca Security.
Discover why unmanaged DNS over HTTPS (DoH) creates security visibility gaps and how a controlled DoH strategy restores visibility without compromising privacy.
Learn how to preserve Google Analytics attribution during bot challenges. Discover how to use Fastly's NGWAF and VCL to maintain data accuracy while securing your site.
Enterprises have spent decades building security around a familiar question: Who are you? Identity and access management (IAM), authentication, service accounts, OAuth tokens, and role-based access controls all start there. Establish identity, assign permissions, and control access. Agentic AI changes the equation. AI agents do not simply access systems. They reason, select tools, call APIs, retrieve […]
Enterprises have spent decades building security around a familiar question: Who are you? Identity and access management (IAM), authentication, service accounts, OAuth tokens, and role-based access controls all start there. Establish identity, assign permissions, and control access. Agentic AI changes the equation. AI agents do not simply access systems. They reason, select tools, call APIs, retrieve […] The post Agents Without Guardrails: Why Agentic AI Governance Must Focus on Behavior,
Quick commerce, the 10-to-30-minute delivery model that’s reshaped how people buy groceries, food, and everyday essentials runs on a business […] The post Why Quick Commerce Platforms Are Becoming Prime Targets for Automated Bot Attacks appeared first on .
Every AI-powered application, a support chatbot, an internal copilot, a fully autonomous agent ultimately runs on API calls to an […] The post LLM API Security: Protecting the APIs Behind Your AI Models appeared first on .
Most security programs still measure success by counting blocked attacks. At Cloud Security LIVE 2026, Ariel Parnes, Co-Founder at Mitiga, and Roee, field CTO at Orca, made the case for a different metric entirely. Prevention will never reach zero probability, and both of them were comfortable saying so out loud. What decides the outcome, once […] The post Zero Breach vs. Zero Impact: Key Takeaways From Cloud Security LIVE 2026 appeared first on Orca Security.
Some attacks announce themselves with malformed requests and datacenter IP ranges. The most dangerous ones look exactly like your best customers. Cequence recently encountered an incident of the latter kind alongside a major consumer brand — a large, patient, and genuinely sophisticated automated abuse campaign against a high-value prize sweepstakes — and the telemetry is […]
Credential stuffing isn’t a sophisticated attack technique. It doesn’t exploit a zero-day or require deep technical skill; it simply takes […] The post Stopping Account Takeover in Banking Applications: Why Credential Stuffing Still Works in 2026 appeared first on .
AI coding assistants write functional code but miss security flaws. Salt Code fixes that by embedding security policies directly into your coding agent.
LLM security testing for pentesters: map attacks to the OWASP LLM Top 10, break a vulnerable MCP server locally, and turn what you find into regression tests. Including solutions for enterprise scale.
Compare eight of the best API security testing tools in 2026, including StackHawk, ZAP, Burp Suite, and more. See how they compare on API coverage, authentication, CI/CD integration, pricing, and authorization testing. The post 8 Best API Security Testing Tools in 2026 appeared first on StackHawk, Inc..
Learn how broken access control vulnerabilities like IDOR and privilege escalation happen, how code review can detect them, and how runtime testing verifies authorization across users, roles, and resources. The post Broken Access Control: Examples, Detection, and Prevention appeared first on StackHawk, Inc..
Learn how API penetration testing uncovers BOLA, BFLA, authentication, injection, and business logic vulnerabilities—and why continuous runtime testing helps secure APIs between pentests. The post API Penetration Testing: Methodology, Checklist & Tools appeared first on StackHawk, Inc..
Weeks apart, at two unrelated companies, Escape's AI pentesting agent found the same stored XSS. Both had shipped a customer-facing chat where the model emits Markdown and the frontend renders it with raw HTML enabled and no sanitizer, so anything the model can be made to say executes
How Figma scales their detection and response, 1Password and Cloudflare on least privilege and identity for Agents, Uber's paper and OSS repo on monitoring and securing enterprise AI agents
Escape is the best Horizon3.ai alternative for continuous AI pentesting across APIs, web apps, and complex authentication, including regression testing, developer-ready remediation, and platform pricing suited for rapidly scaling orgs.
Security posture management is the continuous process of measuring and improving your cybersecurity readiness. Learn what it is, why it matters, and how to build a program that works.
How does the Equixly–Qualys integration work? Exploit-validated API and application findings land in Qualys VMDR automatically, scoped by your asset inventory.
Every year, the security industry publishes benchmark reports built more or less the same way: pick a handful of common vulnerabilities, measure how often they show up, publish the percentages, and move on. We just finished our second year running one of those reports — and the most important thing we found wasn’t a percentage. […] The post Imperva API Security Token & Authentication Risk Report: Nearly 40% of APIs Face Multiple Authentication Risks appeared first on Blog.
SwyftComply AI closes the vulnerability discovery-to-protection gap before attackers exploit it. Autonomous protection, expert-verified, audit-ready. The post SwyftComply AI: How We Turn Vulnerability Flood Into Audit-Ready Protection appeared first on Indusface.
Imperva Red Team uncovered CVE-2026-17106, a container-to-host arbitrary file-write vulnerability in Docker’s docker cp command. Docker later confirmed that the same CVE also affected sbx cp when copying files out of Docker Sandboxes. A malicious container or sandbox could exploit the copy process to create or overwrite files outside the destination selected by the user, […] The post CopyEscape: Taking Over Docker Hosts with docker cp appeared first on Blog.
TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently. Imperva Cloud WAF and On-Prem WAF customers are protected against practical attack patterns described in the research. Imperva’s existing security engine already blocked malicious […] The post Imp
Oracle's largest-ever CPU patches critical unauthenticated flaws in PeopleSoft, WebLogic, and E-Business Suite. See AppTrana's coverage for each. The post Oracle’s July 2026 CPU: Critical Unauth Vulnerabilities in PeopleSoft, WebLogic, and E-Business Suite appeared first on Indusface.
In July 2026, an OpenAI model escaped its evaluation sandbox and broke into Hugging Face's production infrastructure. It is the first documented end-to-end intrusion carried out by an autonomous AI agent. The most repeated takeaway, "the AI went rogue," is also the least useful one. The real lessons are about containment engineering, about who is [...] The post Lessons from the OpenAI and Hugging Face Incident: When Safety Filters Disarm the Defender appeared first on Wallarm.
An actively exploited SharePoint zero-day, Copilot command injection, and Entra SSRF top Microsoft's July 2026 advisory. Get the full breakdown The post Copilot RCE, Entra SSRF, and SharePoint Zero-Day: Critical Vulnerabilities in Microsoft’s July 2026 Advisory appeared first on Indusface.
