0-Doubt

Vendor news

Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.

1,230 matching stories — announcement, in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.

Announcement

Google’s Fingerprinting Policy Shift Raises Online Privacy Concerns

Online privacy is changing as a result of browser fingerprinting. The way it works is worrisome to regulators & technology companies, making them pay more attention to it. Unlike what happens with conventional tracking cookies, which store identifiers in a browser, fingerprinting makes use of characteristics of a device to know how it is different […] The post Google’s Fingerprinting Policy Shift Raises Online Privacy Concerns appeared first on PrivacySavvy.

GoogleIndustry coverage
Announcement

11 Popular Vulnerability Scanning Tools in 2026

Exploitation of vulnerabilities is now the most common initial access vector in breaches, accounting for 31% of all initial access, according to Verizon’s 2026 Data Breach Investigations Report. Vulnerability scanning tools catch these potential attack entry points by checking your environment against known security issues.  Below, we cover what these tools are, the different types […]

AttaxionVendor blog
Announcement

ASTRO C2 Technical Analysis

ASTRO was assessed as a Rust-based command and control framework intended for Windows, Linux, and macOS. A seven-crate workspace, 102 agent source files, and more than 200 command variants were described in the supplied analysis. The post ASTRO C2 Technical Analysis appeared first on ThreatMon.

ThreatMonVendor blog
Announcement

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,

IvantiIndustry coverage
Announcement

Continuous Penetration Testing vs. Annual Pentests: What Enterprises Need to Know

Continuous penetration testing runs against your live attack surface on an ongoing basis. Annual penetration testing gives you a deep, point-in-time snapshot once a year. Neither model is universally correct. The right choice depends on release velocity, attack surface volatility, and which compliance framework is driving the requirement. Enterprises shipping code weekly typically outgrow annual testing alone. The post Continuous Penetration Testing vs. Annual Pentests: What Enterprises Need to

SynackVendor blog
Announcement

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary

MicrosoftIndustry coverage
Announcement

Xandr Fined a Record €8.6 Million for Relaying Grindr Data Revealing Sexual Orientation

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements

MicrosoftIndustry coverage
Announcement

NHS England evolves its cybersecurity strategy with Palo Alto Networks and IBM

The NHS has set an ambitious goal of achieving cyber resilience across healthcare organisations by 2030. Delivering on that vision requires technology, expertise and close collaboration across the public and private sectors. … The post NHS England evolves its cybersecurity strategy with Palo Alto Networks and IBM appeared first on Palo Alto Networks Blog.

Palo Alto NetworksVendor blog
Announcement

Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt

Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the researchers call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft Agent Framework, Microsoft’s AutoGen, Google’s Agent Development Kit 2.0, AWS’ Strands Agents and CrewAI, according to researchers from Pennsylvania State University, Université Montpellier and Dartmouth College. “A seemingl

GoogleMicrosoftIndustry coverage
Announcement

The 2026 Midterm Domain Threat Surface, Four Weeks Out

ZeroFox Signals Research began scoping the 2026 federal election domain threat surface in June and has observed it continuously since early July. For three months we have been observing it, enriching it, and following how election-adjacent domain infrastructure is being registered, held, and in a few cases reconfigured in ways that warrant watching ahead of […]

ZeroFoxVendor blog
Announcement

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed

CobaltIndustry coverage
Announcement

The Ultimate Guide to Brand Protection with Censys

On August 23, 2026, a PowerShell dropper reached out to hxxp://binance-idexchange[.]com/333.mp4 for its next stage. Binance, the world’s largest cryptocurrency exchange with hundreds of millions of users, had nothing to do with it — duh! This mp4 “video” file contained an encrypted, compressed 16.8 MB PowerShell script. Censys ARC published the full chain five days […] The post The Ultimate Guide to Brand Protection with Censys appeared first on Censys.

CensysVendor blog
Announcement

EASM vs Penetration Testing: Why Continuous Asset Visibility Matters

Blog EASM vs Penetration Testing: Why Continuous Asset Visibility Matters An organisation can only assess the security of the systems it knows about. Internet-facing assets change as new applications go live and cloud services are reconfigured, and older systems often keep running after the project that needed them has ended. When those changes go unnoticed, […] The post EASM vs Penetration Testing: Why Continuous Asset Visibility Matters appeared first on ThreatMon.

ThreatMonVendor blog
Announcement

GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys

A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's .onion address using only public information, and then take that address over. Searchlight Cyber, which disclosed the flaw on October 8, says an attacker who recovers the key can redirect the site's visitors to a copy of the site they control.

Searchlight CyberIndustry coverage
Announcement

Agentic AI In Cybersecurity: What Changes When The System Chooses The Next Step

Agentic AI is the breakthrough of the moment, in security as everywhere else: agents that are threat-aware, active, and proactive in investigation. But it is also the technology behind a recent documented autonomous AI intrusion. Both facts are true, and the distance between them is what this article is about.

Group IBVendor blog
Announcement

Web Application Penetration Testing Companies: What Enterprise Buyers Should Compare

The meaningful differences between web application penetration testing companies rarely show up on the homepage. They show up in who performs the testing, how the methodology is documented, what the retest policy covers, and how scope changes get priced once a contract is signed. Use the eight-criteria scorecard below to evaluate providers on substance rather than marketing language. The post Web Application Penetration Testing Companies: What Enterprise Buyers Should Compare appeared first on S

SynackVendor blog
Announcement

New on the Map — September 2026: 22 Protocol and Endpoint Scanners

Most organizations do not have a complete picture of what is reachable from the Internet. A router, a camera system, a data warehouse, a building access controller — any one of these could be answering requests from anywhere in the world right now, and your security team might not know. Attackers scan for these services […] The post New on the Map — September 2026: 22 Protocol and Endpoint Scanners appeared first on Censys.

CensysVendor blog
Announcement

You Can’t Secure the AWS Accounts You Don’t Know About.

Wallarm Infrastructure Discovery Named Enterprise Cloud Security Solution of the Year. Ask an AWS security team how many accounts they run, and the honest answer is usually a range. Enterprises on AWS operate anywhere from 100 to 5,000 accounts. Most security teams can see only a fraction of them. That gap is why we built [...] The post You Can’t Secure the AWS Accounts You Don’t Know About. appeared first on Wallarm.

WallarmIndustry coverage
Announcement

Ransomware 2026 Report September

The September 2026 ransomware attack report reveals a persistent and evolving threat landscape, analyzing 8 significant victim companies across various industries. The post Ransomware 2026 Report September appeared first on ThreatMon.

ThreatMonVendor blog