0-Doubt

Vendor news

Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.

1,428 matching stories — in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.

Announcement

Microsoft Patches More Than 1,400 Security Flaws

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond.

MicrosoftIndustry coverage
Incident

Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)

69Critical1337Important0Moderate1LowMicrosoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild.Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low.This month’s update includes patches for 301 products and comp

MicrosoftIndustry coverage
Announcement

Administrating the Administrator, An OCI Identity Domains Permission Bypass

Discover how a permission bypass in Oracle Cloud Infrastructure (OCI) identity domains allowed lower-level administrator roles to create API keys for Identity Domain Administrators, leading to an unauthenticated privilege escalation path. The post Administrating the Administrator, An OCI Identity Domains Permission Bypass appeared first on NetSPI.

NetSPIVendor blog
Announcement

The October 2026 Security Update Review

Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for October 2026For the first part of the Octob

MicrosoftIndustry coverage
Announcement

Google’s Fingerprinting Policy Shift Raises Online Privacy Concerns

Online privacy is changing as a result of browser fingerprinting. The way it works is worrisome to regulators & technology companies, making them pay more attention to it. Unlike what happens with conventional tracking cookies, which store identifiers in a browser, fingerprinting makes use of characteristics of a device to know how it is different […] The post Google’s Fingerprinting Policy Shift Raises Online Privacy Concerns appeared first on PrivacySavvy.

GoogleIndustry coverage
Announcement

11 Popular Vulnerability Scanning Tools in 2026

Exploitation of vulnerabilities is now the most common initial access vector in breaches, accounting for 31% of all initial access, according to Verizon’s 2026 Data Breach Investigations Report. Vulnerability scanning tools catch these potential attack entry points by checking your environment against known security issues.  Below, we cover what these tools are, the different types […]

AttaxionVendor blog
Announcement

ASTRO C2 Technical Analysis

ASTRO was assessed as a Rust-based command and control framework intended for Windows, Linux, and macOS. A seven-crate workspace, 102 agent source files, and more than 200 command variants were described in the supplied analysis. The post ASTRO C2 Technical Analysis appeared first on ThreatMon.

ThreatMonVendor blog
Announcement

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on October 13. Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." A fix for the third is still pending, according to Volexity. Volexity, which reported the flaws to Ivanti,

IvantiIndustry coverage
Incident

Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)

OverviewOn October 13, 2026, Ivanti published a security advisory for CVE-2026-104935, a high-severity authentication bypass by spoofing (CWE-290) affecting Ivanti Connect Secure (ICS). The vulnerability has a CVSSv3.0 score of 8.6 and allows a remote, unauthenticated attacker to execute arbitrary commands.Ivanti reports that exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers. This indicates that exploitation has been occurring as a zero-da

IvantiIndustry coverage
Announcement

Continuous Penetration Testing vs. Annual Pentests: What Enterprises Need to Know

Continuous penetration testing runs against your live attack surface on an ongoing basis. Annual penetration testing gives you a deep, point-in-time snapshot once a year. Neither model is universally correct. The right choice depends on release velocity, attack surface volatility, and which compliance framework is driving the requirement. Enterprises shipping code weekly typically outgrow annual testing alone. The post Continuous Penetration Testing vs. Annual Pentests: What Enterprises Need to

SynackVendor blog
Announcement

NHS England evolves its cybersecurity strategy with Palo Alto Networks and IBM

The NHS has set an ambitious goal of achieving cyber resilience across healthcare organisations by 2030. Delivering on that vision requires technology, expertise and close collaboration across the public and private sectors. … The post NHS England evolves its cybersecurity strategy with Palo Alto Networks and IBM appeared first on Palo Alto Networks Blog.

Palo Alto NetworksVendor blog
Announcement

Researchers bypass 6 AI agent frameworks with a simple ‘Repeat-After-Me’ prompt

Researchers have tricked six widely used AI agent frameworks into running tool calls written by an attacker, simply by asking the underlying model to repeat the call back. The technique, which the researchers call “Repeat-After-Me,” worked on LangChain’s LangGraph, Microsoft Agent Framework, Microsoft’s AutoGen, Google’s Agent Development Kit 2.0, AWS’ Strands Agents and CrewAI, according to researchers from Pennsylvania State University, Université Montpellier and Dartmouth College. “A seemingl

GoogleMicrosoftIndustry coverage
Announcement

The 2026 Midterm Domain Threat Surface, Four Weeks Out

ZeroFox Signals Research began scoping the 2026 federal election domain threat surface in June and has observed it continuously since early July. For three months we have been observing it, enriching it, and following how election-adjacent domain infrastructure is being registered, held, and in a few cases reconfigured in ways that warrant watching ahead of […]

ZeroFoxVendor blog
Announcement

CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed

CobaltIndustry coverage
Announcement

The Ultimate Guide to Brand Protection with Censys

On August 23, 2026, a PowerShell dropper reached out to hxxp://binance-idexchange[.]com/333.mp4 for its next stage. Binance, the world’s largest cryptocurrency exchange with hundreds of millions of users, had nothing to do with it — duh! This mp4 “video” file contained an encrypted, compressed 16.8 MB PowerShell script. Censys ARC published the full chain five days […] The post The Ultimate Guide to Brand Protection with Censys appeared first on Censys.

CensysVendor blog