Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,230 matching stories — announcement, in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
You know what you spent on penetration testing last year. But can you explain what that investment covered between engagements? For many organizations the honest answer is that it covered the weeks the testers were working against a scope agreed before they started. That was a reasonable arrangement when systems changed a few times a year. It is worth revisiting, now that many of them change weekly. The post Offensive Security Is Becoming a Program, Not a Purchase appeared first on Synack.
Today, NetSPI and Synack announced a definitive agreement to merge, backed by KKR, forming the industry’s leading offensive cybersecurity platform. The post A New Era for Offensive Security appeared first on NetSPI.
This blog provides a deep-dive into the phishing kit created by Chenlun known as the Outsider Phishing Kit. It is a well established kit in the Chinese community with over 267 ready-made phishing templates targeting over 54 countries worldwide.
284 million records claimed at McKesson, 12.9 million verified at Carhartt. The eight biggest data breaches of August 2026, with every number checked against a company statement, filing, or named outlet.
August's CVSS 7.0 was a Lazarus zero-day exploited for five weeks. Its CVSS 10.0 needed no patch at all. The top CVEs of August 2026, ranked by exploitation evidence rather than severity, with remediation steps for all five.
Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. Learn how attackers move from social engineering to lateral movement using legitimate tools, and how Microsoft Defender helps detect and disrupt the activity. The post Impersonating IT support: how threat actors turn a remote session into enterprise-wide access appeared first on Microsoft S
Expert judgment is the scarcest resource in offensive security. Making it accessible to more of the world, continuously, is an engineering problem. The post Putting Experts on the Problems Only Experts Can Solve appeared first on Synack.
Today, SpecterOps released a new open-source skills marketplace for offensive security research and red team operations. We are proud to have collaborated on this project over the last few weeks and hope more teams will join now that it’s public. The initial release includes plugins for Fortra’s Cobalt Strike and Outflank C2. Get started here: https://github.com/SpecterOps/skills Background I recently reached out to a few red teams we’ve worked with before to discuss developing a public AI
The "Spring Ring" operation aims to compromise users of the collaboration suite to remotely access their sessions, spread malware, and even take over infrastructure.
Blog Berlin Government Allegedly Hit by Rhysida Ransomware: 5.79 TB of Data Claimed Stolen TL;DR / Key Findings Threat Actor: Rhysida ransomware group Target Platform/Sector: Public sector and administrative infrastructure of the Berlin State Government Activity Window: August 28, 2026 Alleged Victims & Records: Berlin State Administration (~1.44 million files scanned and classified) Total Disclosed […] The post Berlin Government Allegedly Hit by Rhysida Ransomware appeared first on Th
A secure workspace for your team - so you can focus on building, not on what could go wrong. Every customer support agent starts their day the same way: opening a browser, … The post Building Securely From Day One: Palo Alto Networks Partners with the Zendesk Startup Program appeared first on Palo Alto Networks Blog.
Discover why unmanaged DNS over HTTPS (DoH) creates security visibility gaps and how a controlled DoH strategy restores visibility without compromising privacy.
Executive travel security is the practice of protecting a named leader in transit across both digital and physical risk, from device and credential compromise to surveillance, theft, and physical harm, before, during, and after each trip. It is one part of a broader corporate travel security program. Here, we’ll focus on the executive layer. An […]
An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat. The post Counterfeit installers to system compromise: Tracking a deceptive software download campaign appeared first on Microsoft Security Bl
How Partners Can Turn Marketplace Momentum into Customer Value. Cloud marketplaces have become an increasingly important way for customers to buy technology. They can offer a familiar route to procurement, help organizations … The post Making the Most of the Cloud Marketplace Opportunity appeared first on Palo Alto Networks Blog.
Critical infrastructure cyber attacks are rising. Learn why OT systems are so vulnerable and how runZero helps identify hidden PLC and edge device risks.
The best executive protection companies do more than place guards at the door. They fuse digital threat intelligence, impersonation and PII monitoring, physical security alerting, and rapid takedowns into one program that protects a named leader across both worlds. And the stakes keep rising. Executive security budgets grew 118.9% from 2021 to 2024, and 72% […]
Report quality is decided before the reporting layer runs. Here's the pipeline, the gates that stop bad output shipping, and what a real automated report contains.
Your CFO’s phone has malware on it. Okay. Cool. Cool, cool, cool. Of all the phones in the company, you got the one attached to banking apps, executive email, Slack, expense accounts, password resets, MFA prompts, travel plans, investor conversations, and a metric ton of other things nobody remembered to put in the incident response […] The post So Your CFO's Phone Has Been Pwned: A DFIR Journey appeared first on Censys.
Pakistan’s cyber threat landscape throughout 2026 was characterized by a convergence of nation-state cyber espionage, financially motivated cybercrime, hacktivist activity, and large-scale credential exposure. The post Pakistan Cyber Threat Landscape Report 2026 appeared first on ThreatMon.
ServiceNow Patches Multiple CVSS 10.0 Flaws ServiceNow disclosed four vulnerabilities affecting its AI Platform and related Now Platform components on August 27, 2026 . Three received vendor-assigned CVSS v4.0 scores of
Traefik's request read timeout is enabled by default and documented without exception, but it has never applied to HTTP/3. Bishop Fox confirmed the gap across four years of releases, measured it against the backend, and reported it to the vendor, who shipped a fix within twelve days.
Finnish Kennel Club, Shell Access, UK Iframe, Salt Mobile, and Brazil SERPRO Claims SOCRadar Dark Web Team identified several new underground posts, including an alleged Finnish Kennel Club and Showlink dog-show database
Anthropic Links Claude Session Theft to Infostealer Malware An affected Claude user has shared a warning from Anthropic stating that infostealer malware can steal active Claude login sessions from infected computers. Att
Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets.
Attack surface management has served the vulnerability management program for years, and it now has a second job, governing the asset sprawl that AI makes sprawlier by the day.
Executive Summary Introduction On 22 August 2026, Censys ARC observed a Cloudflare-fronted host serving raw PowerShell as text/html over port 80. The script checks the computer name against two hard-coded values (variations on the word ‘clean’ that, if present, cause the script to exit), hides its console, decodes a second PowerShell stage from a base64 […] The post The Video That Plays You: Fake MP4 File Carries Malicious Payload appeared first on Censys.
Follow the investigation from an unusual concentration of traffic on port 4307 to a broader network of infrastructure, source IPs, and connected activity.
Executive Summary Introduction An open web directory (86.53.111[.]212), exposed on 30 July 2026, held the source code for Moobot, a variant of the Mirai DDoS malware, alongside additional DDoS tools and a suspected fraudulent Chinese ID verification service. Based on recovered attack logs and ongoing monitoring, multiple recovered DoS toolkits were active in July 2026. […] The post Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption appeared
Between CVEs, CPEs, and CISA's Vulnrichment, vulnerability management is an alphabet soup. NIST wants your expert input on using AI to fix NVD before October 13, 2026.
One malware campaign, 11,000 compromised devices, two banks with very different outcomes. At the bank with fused defence, fraud succeeded on just 0.027% of compromised devices; nine times less than the market average. Regulators are taking notice too.
