Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,230 matching stories — announcement, in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
A year since launching Synack’s integration with Qualys, the partnership now includes broader platform support, more AI-led testing, and a shared presence at Qualys ROCon Americas 2026. The post Turn Scanner Findings into Validated Risk with Synack and Qualys appeared first on Synack.
Submergé par les rapports IA, Google n’a pas eu le choix : le géant de la Tech met en pause son programme de chasse aux bugs dans ses logiciels open source.
Google has now suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) after being flooded by AI-generated reports. [...]
IQUALIF France Leak, IUT Paris Seine Breach, US IAB Auction, SMTP Credential Dump, and Apache Struts Exploit Sale SOCRadar Dark Web Team identified several new underground posts, including an alleged IQUALIF-based French
A Mir0Auth attack completely bypasses standard detection signals. The victim signs in through legitimate workflows, leaving no proxy landing pages, harvested credentials,...
Four of September 2026’s top five CVEs were exploited before a patch existed. Fix order, fixed builds, and the compromise check each one needs.
A Russian-speaking Gentlemen ransomware affiliate called Azazel robbed two dozen victims across six countries, then double-crossed his own gang by publishing the loot on a private leak site and pocketing every dollar. CloudSEK traced 50TB of exposed infrastructure and a live AI-driven attack chain. Read how "Caught in 4K" cracked the operation. Authors : CloudSEK TRIAD
An honest comparison of AI pentesting and human pentesting by a seasoned pentester, including methodology, coverage, findings, and reports.
A new China-nexus cyber espionage group known as TA419 has been attributed to multiple credential phishing campaigns targeting artificial intelligence (AI) experts working for U.S. think tanks, universities, and legal sector organizations. The campaigns have impersonated prominent economists and AI policymakers, as well as a prominent Anthropic employee, to single out an AI policy expert at a
Google's Gemini could soon access any file on your macOS device, open apps, browse the web, and perform actions without asking for permission every time. [...]
The suspected China-linked threat actor known as Warlock is still continuing to weaponize Microsoft SharePoint vulnerabilities, likely both old and new, in attacks targeting organizations in Portuguese- and Spanish-speaking countries. The activity, observed by the Symantec and Carbon Black Threat Hunter Team, has hit critical infrastructure, government, and education organizations. "In the
The Dutch Institute for Vulnerability Disclosure (DIVD) identified (DIVD-2026-00015) two vulnerabilities in Zammad. Here's how to find impacted assets.
Blog The NetScaler Zero-Day Siege and Pre-Auth RCE Chains: Technical Analysis and Exposure Assessment On September 27, 2026, Citrix published bulletin CTX697096 with eight NetScaler ADC and Gateway vulnerabilities. Two of them, CVE-2026-88771 and CVE-2026-88772, were already being exploited before fixed builds existed. Both give remote code execution to an unauthenticated attacker. CISA added both […] The post The NetScaler Zero-Day Siege and Pre-Auth RCE Chains : Technical Analysis and Ex
FortiMail Zero-Day Under Active Exploitation Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live. Fixed builds are not yet available for most affected branches, so the primary […]
Data leaks are an increasingly critical cybersecurity problem. Learn how to detect and prevent data leakage and compare vendor solutions.
Vendor risk assessment in 2026: a 3-step process for teams comparing UpGuard, BitSight, and SecurityScorecard. Scope, evidence, and continuous monitoring.
A standard employee offboarding checklist can cover HR tasks while still missing identity and access paths that affect MSP security efforts. Payroll...
Synack was named a Leader in G2's Fall 2026 Grid® and Enterprise Grid® Reports for Penetration Testing. The reviews show what customers value in a pentesting partner: visibility into testing, access to experts, findings they can fix and verify, and a partner that acts on feedback. The post What Customers Value in a Penetration Testing Partner: Insights from G2 Reviews appeared first on Synack.
Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace clandestino único, mejorado con IA, para comercializar objetivos comprometidos en Iberoamérica y Latinoamérica.
Before you build an AI pentesting agent, run it through 5 tests for production readiness. Mark Kuhr breaks down what separates a prototype from a system. The post Build or Buy AI Pentesting? 5 Tests to Judge Production Readiness appeared first on Synack.
Introducing Cortex XCOR: AI-Driven Observability that Delivers Autonomous Response with AI SRE I’ve been tackling the observability problem for more than a decade, since before it was coined observability. From building internal … The post Observability’s AI Moment appeared first on Palo Alto Networks Blog.
Preparing a client update. Reviewing open incidents. Figuring out which account needs attention first. For MSPs, each task often starts with gathering...
TeamViewer Fixes Five Remote Access Flaws TeamViewer has patched five high-severity vulnerabilities in its Full Client and Host applications for Windows, Linux, and macOS. The flaws include local privilege escalation, po
Milk Dragon, also known as NaiLong is an Adversary-in-the-Middle (AiTM) phishing kit active since October 2025. Unlike conventional phishing tactics that rely on fear and urgency, Milk Dragon lures victims with big discounts on consumer goods distributed via Facebook and TikTok marketplace advertisements.
A trusted organization recently watched its own name become the bait for a sophisticated fraud campaign. Scammers cloned its brand, created fake profiles of its executives, and launched counterfeit donation pages, all designed to target the people who trust the organization most. This is what fundraising scams look like today: coordinated impersonation campaigns that exploit […]
Blog An Open Server, an Exposed Toolkit Inside a Viva Aerobus-Linked Intrusion On September 25, 2026, an attacker-controlled staging server used to host tools and stolen material was left exposed to the public internet with no authentication. At 16:20, a victim-side Microsoft SQL Server retrieved a payload from the infrastructure. Within minutes, an unrelated external […] The post An Open Server, an Exposed Toolkit Inside a Viva Aerobus-Linked Intrusion appeared first on ThreatMon.
Compare UpGuard, BitSight, SecurityScorecard, Panorays, Vanta, and five more for continuous vendor and TPRM monitoring.
Reports Reports This report is about ‘Blackhatsect0r & DXQRTXX’. Download Report During threat-hunting activities conducted by the ThreatMon Threat Intelligence Team, an exposed attacker-controlled staging/loot server was identified. The server contained tooling prepared to access Microsoft SQL Server environments, execute Windows commands and encoded PowerShell through xp_cmdshell, upload and retrieve files, perform credential harvesting, collect […] The post Viva Aerobus-
Answer this without checking: how many AI agents are running in your environment right now? Most security leaders give an estimate and a shrug. That is a fair response, because agents get spun up by an engineer solving a problem on a Tuesday afternoon, through a path that puts them on nobody's radar. In August [...] The post AI Governance on AWS: The Runtime Control Loop: AI Governance on AWS: Four Functions, One Loop, and a Deadline That Already Passed appeared first on Wallarm.
Our research uncovered a campaign of 32 malicious browser extensions that uses remote configs to spy on 9,800+ users and hijack browsing activity.
AI-assisted research is flooding the CVE pipeline with bugs that score critical but depend on configurations almost nobody runs. Bishop Fox tested four high-profile Nginx CVEs in the lab, measured real-world prevalence, and explains how to separate actual risk from well-marketed noise.
Learn how runZero’s AI-assisted reporting turns plain-language queries into actionable, real-time security insights and executive-ready reports in minutes.
Compare SIG, CAIQ, VSA, NIST, and HIPAA vendor security questionnaires: when to use each, and a side-by-side table.
We are thrilled to announce that KDDI Corporation, a long-standing NextWave partner of Palo Alto Networks and a Managed Security Service Provider (MSSP) with whom we have built a strong partnership, has … The post “SASE Gateway” provided by KDDI : How SP Interconnect Simplifies Closed Network Zero Trust appeared first on Palo Alto Networks Blog.
CloudSEK uncovered MALFEX, a long-running npm supply-chain campaign linked to a single operator, using malicious packages to deploy RATs and credential stealers. Two packages remain installable, including one malicious postinstall that evaded advisories for 14 months. Authors : Vikas Kundu
Two vulnerabilities in Zilliz Attu 2.6.5 chain into something serious. Missing authentication lets anyone proxy requests unauthenticated, and a regex bypass defeats the private IP block. Bishop Fox turned both into full Kubernetes namespace takeover in a cloud deployment. Update to 3.0.0 now.