Vendor news

Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.

169 matching stories — incident, in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.

Incident

A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318

A single unauthenticated request can kill SolarWinds Serv-U, and the heap corruption underneath it looked like it could be more. Bishop Fox chased three separate roads to remote code execution and hit a wall on every one. Here is what we found, why it matters, and how to detect exposure safely.

Incident

Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557

A CVSS 10.0 path traversal in UniFi Network Application lets unauthenticated attackers read controller backups, extract credentials, and take over every managed device on the network. Bishop Fox breaks down the attack paths, the preconditions, and a safe detection tool to check your exposure.

Incident

Detecting CVE-2026-0265 at Scale: PAN-OS CAS Authentication Bypass

CVE-2026-0265 lets unauthenticated attackers forge a JWT and log in as any trusted user on CAS-enabled PAN-OS deployments. Bishop Fox built a detection tool that returns a definitive verdict from a single anonymous request, and breaks down exactly how the bug works and what to do about it.

Incident

Rapid Reaction: Palo Alto PAN-OS Buffer Overflow Vulnerability (CVE-2026-0300)

A Palo Alto PAN-OS buffer overflow vulnerability (CVE-2026-0300) has been disclosed, affecting the User-ID Authentication Portal (also known as the Captive Portal) on PA-Series and VM-Series firewalls. The flaw allows an unauthenticated remote attacker to execute arbitrary code with root privileges via specially crafted packets sent to the User-ID Authentication Portal service. No patches are currently available, and…

Incident

Rapid Reaction: Palo Alto PAN-OS Buffer Overflow Vulnerability (CVE-2026-0300)

A Palo Alto PAN-OS buffer overflow vulnerability (CVE-2026-0300) has been disclosed, affecting the User-ID Authentication Portal (also known as the Captive Portal) on PA-Series and VM-Series firewalls. The flaw allows an unauthenticated remote attacker to execute arbitrary code with root privileges via specially crafted packets sent to the User-ID Authentication Portal service. No patches are currently available, and […]

Incident

Rapid Reaction – cPanel Authentication Bypass Vulnerability (CVE-2026-41940)

A cPanel authentication bypass vulnerability (CVE-2026-41940) has been disclosed, affecting cPanel & WHM installations across multiple versions. The flaw allows attackers to bypass authentication mechanisms and gain unauthorized access to control panel interfaces — putting hosted websites, databases, and server configurations at risk. watchTowr Labs, our dedicated vulnerability research and exploit development team, has assessed […]