Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,427 matching stories — in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher reported the
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was
The September Microsoft Patch Tuesday release included 975 vulnerability advisories. This month, 1,415 vulnerabilities were just dropped. Compared to a pre-June average of 100 a month, that increase is staggering. Where did they come from? And what does the future look like?
Android users report that Google automatically added their phone number to accounts they wanted to keep separate. Here’s how to check yours.
Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update. [...]
Microsoft says companies should treat AI agents as insiders, and is adding controls that grant access per task and tighten it as an agent’s risk rises. The post Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring appeared first on SecurityWeek.
Most MSPs already sell security awareness training. Keeping it relevant for every user takes ongoing work: building campaigns, tracking failed simulations, and...
Drupal has patched two critical remote code execution (RCE) vulnerabilities affecting Drupal core and the contributed Entity List module. The first flaw, tracked CVE-2026-108097, affects the core Field UI module, while CVE-2026-108099 affects Entity List. Neither is directly exploitable through the affected component alone, but Drupal warns that multiple serious exploit paths exist through contributed […]
Copyright takedown requests tied to OnlyFans and other adult content creators are revealing how attackers exploit vulnerable university and government websites to manipulate search results. UpGuard's Greg Pollock explains what universities, government websites, and security teams need to think about next.
Target selection has guided traditional pentesting for years, and it now has a second job: directing compute and token budgets to the attack surface assets that actually matter.
ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick, after researchers detected the applications authenticating into customer Microsoft 365 environments. A vendor-controlled Microsoft 365 application credential was compromised and used to obtain Microsoft Graph access tokens in customer tenants. ConnectWise subsequently disabled seven application identities and suspended Cloud Backup, SaaS […]
Protect sensitive data by pairing Cyera's data discovery with Akamai Guardicore Segmentation to enforce dynamic, data-aware microsegmentation rules.
Palo Alto Networks’ Unit 42 threat intelligence team uncovered a multistage cyber intrusion against a telecommunications managed service... The post Unit 42 traces Peerstitch malware deployment to FortiOS vulnerability exploited after FortiManager compromise appeared first on Industrial Cyber.
SOCRadar Dark Web Team identified several underground posts, including an alleged ZoomInfo database sale involving 185 million records, an alleged TryCircle customer data leak, and an alleged Vicente López municipal database exposure. Other posts advertised a previously compromised HDB Financial Services dataset and an unverified X (Twitter) user database leak claim. Alleged ZoomInfo Database Sale […]
This guide is published by Guardz and includes our own platform: we fit MSPs seeking consolidated security with per-action approval control, while...
PRESS RELEASE DOVER, DE, UNITED STATES, October 19, 2026 — Attaxion has announced a partnership with Idextrus, a provider helping organizations understand and address security, performance, and accessibility risks in their public facing assets. Idextrus offers security services with real-intelligence, human review to deliver plain-language, scored reports that help clients understand what is exposed and […]
Learn about the key differences between cybersecurity and information security in this in-depth post.
Learn how ethics plays a part in the cybersecurity industry and other social responsibility considerations.
Now in beta: the Sn1per MCP Server is a free, open source (Apache-2.0) MCP server that lets the AI assistant you already use drive your self-hosted Sn1per, with scoped, audited scans and structured results, for authorized security testing only. The post Introducing the Sn1per MCP Server (Beta): Drive Sn1per From Your AI Assistant first appeared on Sn1perSecurity.
Modern cloud intrusions rely on structural blind spots: headless OAuth token issuance, pre-consented multi-tenant trust, and resilient operational relay infrastructure. A central...
Mosad is an underground actor primarily involved in the trade and disclosure of sensitive information linked to military, intelligence, government and defense environments. The post Mosad Threat Actor Report appeared first on ThreatMon.
Security researchers have found a new malware that hides inside Fortinet firewalls. The malware is called PEERSTITCH. It is an ARM64 implant that runs in the memory of the device. Palo Alto Networks’ Unit 42 shared the findings on October 14, 2026. Its team studied an attack on a telecommunications managed service provider. Hackers steal […] The post New PEERSTITCH Malware Bypasses Security Checks on Fortinet VPNs appeared first on PrivacySavvy.
When you open your company’s website in a browser, you see the finished product: the navigation, the login form, the interactive widgets. It looks complete because your browser did the heavy lifting to build it. But much of what you see, and a lot of what an attacker can reach, isn’t actually in the raw […] The post Web Scanning in Censys ASM Just Got Deeper appeared first on Censys.
The Arbitrary File Upload in BeyondTrust Remote Support let an attacker upload files to the appliance before BeyondTrust's October 15, 2026 fix. This FAQ is updated as new details emerge.
CVE-2026-102764 is an Arbitrary File Upload vulnerability in BeyondTrust Remote Support that allows an external, unauthenticated attacker to perform arbitrary file operations by issuing specially crafted requests. Apply BeyondTrust's security patches, and check appliances for signs of compromise.
CVE-2026-103768 betrifft das ELEX WordPress HelpDesk & Customer Ticketing System bis Version 3.3.7. Version 3.3.8 behebt die Schwachstelle. The post CVE-2026-103768: Upload-Schwachstelle im ELEX-HelpDesk-Plugin appeared first on LocateRisk.
Blog Open Ports Aren’t the Problem. Unknown Exposure Is. An organization’s external attack surface is not static. New servers are deployed, cloud resources appear, applications move between environments, firewall rules change, and temporary services can remain exposed long after they are needed. One of the clearest signals of this shifting exposure is an open network […] The post Open Ports Aren’t the Problem. Unknown Exposure Is. appeared first on ThreatMon.
AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing. [...]
Tim Nordvedt shares the top takeaways from his Dark Reading webinar with KeyCaliber’s Roselle Safran: AI has made finding vulnerabilities cheap, but fixing them still takes limited people, so the real advantage is knowing which exposures matter and showing leadership you’re reducing them. The post Discovery Has Scaled. Remediation Hasn’t: Top Takeaways on Threat Exposure Analytics appeared first on Synack.
Testing AI security without clear scoping produces superficial coverage and unaddressed risk. This post breaks down how to define boundaries, select the right assessment type, and align AI penetration testing, red teaming, and architecture reviews to the decisions that actually matter.
Blog Wallstreet Ransomware: A Closer Look at Sweden’s Unusual Victim Cluster Executive Summary During routine dark web monitoring activities, ThreatMon analysts identified a notable concentration of Swedish organizations among the victims recently listed by the Wallstreet ransomware group. On October 13, 2026, the group published 10 Swedish organizations on its dark web leak site, accounting […] The post Wallstreet Ransomware: A Closer Look at Sweden’s Unusual Victim Cluster ap
CVE-2026-104935, a high-severity authentication bypass + RCE vulnerability, was only partially discovered and patched in July, leaving an opening for threat actors to capitalize on.
Ivanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks. The flaw carries a CVSS score of 8.6 and enables unauthenticated attackers to bypass authentication and execute arbitrary commands on vulnerable VPN appliances. The vulnerability came to light after Volexity investigated a compromised Ivanti Connect […] The post CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited for Unauthenticate
Do you want ants? Because this is how you get ants. Executive Summary On the night of 11 October, attackers switched hundreds of French supermarket fridges into defrost mode. If that sounds familiar: in August, the Department of Defense confirmed refrigeration disruptions at US military commissaries, where at least one base reported that all its […] The post Frostbitten in France: A Danfoss StoreView Internet Exposure Report appeared first on Censys.
Vendor promises fix for separate privilege-escalation flaw in the coming weeks
Closing the door doesn’t make a room secure. Alethe Denis breaks down how physical penetration testing evaluates whether unauthorized people can reach sensitive spaces, interact with equipment, or leave something behind without anyone noticing or reporting it.
New research from Censys’ 2026 State of the Internet Report challenges familiar assumptions about where Internet infrastructure lives, how it changes, and what’s exposed.  The report examines the Internet from five angles: AI exposures, ICS exposures, vulnerability response, threat infrastructure, and the Internet at large. Across these perspectives, one thing remains clear: the Internet is […] The post 5 Key Takeaways From Censys’ State of the Internet Report appeared first on Censys