Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,428 matching stories — in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
TOPHIT Part 1: A one-operator npm typosquat flood, co-hosted with a GPU-cryptojacking C2
CloudSEK found 85 malicious npm packages, published in three minutes, likely named to surface in search when developers mistype popular libraries. They give attackers remote command access. The same server hosts a GPU-hijacking panel. No victims confirmed. Authors : Vikas Kundu
TOPHIT Part 2: Renting the Attack Surface
CloudSEK found an attacker's control panel targeting vast.ai, a GPU rental marketplace. It rents containers beside victims to scan their networks. It reached one unprotected notebook and planted no miners. The panel exposed its own source code. Authors : Vikas Kundu
CVE-2026-102334: Brute-Force-Risiko in Nginx Proxy Manager
CVE-2026-102334 betrifft Nginx Proxy Manager bis 2.16.0. Fehlende Rate-Limits ermöglichen unbegrenzte Login- und TOTP-Versuche. The post CVE-2026-102334: Brute-Force-Risiko in Nginx Proxy Manager appeared first on LocateRisk.
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Hackers have used a malware family called NeedyMantis to maintain long-term access to networks they had already breached, Microsoft said in a technical analysis. The malware has been seen in a small number of targeted intrusions at telecommunications organizations, universities, medical nonprofits, intergovernmental organizations, and government contractors. Its use goes back to at least
Attack Surface Management Vendors Compared | UpGuard
We compared ASM vendors and helped you rate them before agreeing to a POC!
Chrome Store Hosts 'Poper Blocker' Spyware Downloaded by Millions
A purported ad-blocker exfiltrates reams of sensitive information and benefits from having Google's stamp of approval despite researcher warnings.
Before PEEP: A Historical Hosting Cluster
Follow the investigation from a single IP later tied to the PEEP toolkit back to a historical cluster of domains, hosting environments, and coordinated provisioning.
Find Out if You're Exposed on the Dark Web | UpGuard
Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure.
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat Intelligence identified NeedyMantis, a modular post-compromise malware framework used in targeted intrusions that combines custom loaders, encrypted archives, and extensible components to maintain long-term access and support follow-on operations. The post NeedyMantis: Unpacking a post-compromise malware family used in targeted operations appeared first on Microsoft Security Blog.
Strobes joins OpenAI's Daybreak program
OpenAI gates its cyber models behind an application, identity checks, and workspace scoping. Strobes is now verified for Daybreak.
Autonomous agents attack Azure using compromised identities, destroying resources
Jadepuffer, an autonomous AI attacker first identified in July, has expanded into Azure environments, using compromised digital identities to enumerate resources, delete cloud assets and collect other credentials, according to Microsoft. The activity includes “extensive Azure-focused resource destruction activity using compromised service principals and cloud credential collection that could be used to facilitate future exfiltration,” Microsoft said in a blog post about Storm-3168, also known as
Compounding Intelligence: The Grid Behind the UpGuard Risk Operations Center | UpGuard
Compounding Intelligence connects vendor, attack surface, and workforce risk in the UpGuard Risk Operations Center, so each signal sharpens the others.
Akamai Joins Athena Coalition to Shield Users from New Vulnerabilities
Akamai joins Chainguard’s Athena Coalition, verifying that Akamai App & API Protector customers are automatically shielded from newly disclosed vulnerabilities.
Stolen AI credentials feed growing LLM proxy economy
Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign
The extortion group has modified its exploit in new attacks targeting the PeopleSoft vulnerability CVE-2026-35273. The post Google Warns of ShinyHunters’ Fresh Oracle PeopleSoft Campaign appeared first on SecurityWeek.
NetScaler admins told to patch critical zero-days in ADC and Gateway now
Citrix NetScaler ADC and NetScaler Gateway users should take their systems offline and patch them immediately, they were told over the weekend, as news emerged of two critical unauthenticated remote code execution zero-day vulnerabilities in the products under active attack. “Monday will be too late,” watchTowr CEO Benjamin Harris wrote in a LinkedIn post on Sunday. Citrix subsequently confirmed the two remotely exploitable vulnerabilities were under attack, and released fixes for both. Affected
Securing AI Agents at Scale with NVIDIA
AI agents are crossing an important threshold. They are moving from assistants that respond to us to autonomous systems that reason, plan, and act on our behalf. They can write and execute … The post Securing AI Agents at Scale with NVIDIA appeared first on Palo Alto Networks Blog.
Metree and WuBook Leaks, SonicWall Access, Campus.gov.il Data, and Kenya Vehicle Database
Metree and WuBook Leaks, SonicWall Access, Campus.gov.il Data, and Kenya Vehicle Database SOCRadar Dark Web Team identified several new underground posts, including an alleged Metree e-commerce database leak , an alleged
Stolen AI credentials feed growing LLM proxy economy
Cyber threat groups have increasingly targeted enterprise AI assets, such as credentials, cloud environments, and research, as a means for operationalizing their own use of AI. Now, another sophisticated means for obfuscating illegitimate use of AI resources is coming more clearly to light. According to a report last week from security firm Team Cymru, malicious actors are employing proxy servers, known as transfer stations, to hide the origin of traffic to frontier AI models, providing cover fo
16,415 Stolen Passwords, One Open Door: How Blackhatsect0r & DXQRTXX Exposed Themselves
Blog 16,415 Stolen Passwords, One Open Door: How Blackhatsect0r & DXQRTXX Exposed Themselves On July 28, 2026, someone posting as DXQRTXX told their own Telegram channel to tighten up their operational security. Weeks earlier, on the other side of that same channel, the crew had shared a report about a phishing operation that got caught […] The post 16,415 Stolen Passwords, One Open Door: How Blackhatsect0r & DXQRTXX Exposed Themselves appeared first on ThreatMon.
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772
Citrix NetScaler Zero-Days FAQ: CVE-2026-88771 & 88772 Citrix has released emergency security updates for eight vulnerabilities affecting customer-managed NetScaler ADC and NetScaler Gateway appliances, including two cri
Citrix NetScaler Zero-Day RCE FAQ: CVE-2026-88771 and CVE-2026-88772
CVE-2026-88771 and CVE-2026-88772 are Citrix NetScaler remote code execution zero-days, exploited in the wild and fixed in CTX697096. What is affected, how to fix it, how to check for compromise, and how watchTowr Rapid Reaction flagged exposure before the CVEs existed.
Citrix NetScaler ADC & Citrix NetScaler Gateway Remote Code Execution Zero-Day Vulnerabilities (CVE-2026-88771, CVE-2026-88772)
CVE-2026-88771 and CVE-2026-88772 are remote code execution zero-days in Citrix NetScaler ADC and Citrix NetScaler Gateway, exploited in the wild and now fixed. Preserve evidence, check for compromise, then update to the fixed builds.
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry
Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine's Defense Industry TL;DR: OPERATION TALKED is an ongoing Russia-linked espionage campaign, exposed after the actor left their own C2 as an open
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 (CVSS score: 9.8), a critical security flaw that could result in unauthenticated remote code execution. The vulnerability was first exploited as a zero-day
Critical Arista VeloCloud Orchestrator vulnerability: CVE-2026-93952
Here's how to find impacted appliances on your network to mitigate CVE-2026-93952, an actively exploited improper input validation flaw in Arista VeloCloud.
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
A hardcoded authentication secret ships with every SolarWinds Access Rights Manager install, and reaching TCP 55555 is enough to hit a .NET deserialization sink. Bishop Fox confirmed SYSTEM-level code execution, breaks down the root cause, and shares a safe detection tool for defenders.
AI agents have routed around access blocks. Only 9% of companies in VentureBeat's August survey isolate high-risk agents
Port Scanning vs Service Detection: What an Open Port Really Means
Blog Port Scanning vs Service Detection: What an Open Port Really Means A port scan is often the first step in understanding what a host exposes to the network. You find an open port, identify the service behind it, and continue from there. The problem is that these two steps are not always as closely […] The post Port Scanning vs Service Detection: What an Open Port Really Means appeared first on ThreatMon.
Introducing Censys CLI Skills: AI-Assisted Investigations at Scale
At 2 a.m., a workstation makes an outbound TLS connection to a VPS on port 7443. The EDR flags it. A Tier 1 analyst on her third night shift (and her third cup of coffee) pulls up the IP: DigitalOcean, Linux, a self-signed certificate, nothing in the usual reputation feeds. She writes “no further action” […] The post Introducing Censys CLI Skills: AI-Assisted Investigations at Scale appeared first on Censys.
Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications
.NET MAUI lets developers write once and ship to both platforms. From an attacker's perspective, that means reverse-engineer once and break everywhere. This post walks through extracting readable assemblies from MAUI apps and the high-impact vulnerability patterns that consistently appear.
Semtech and Palo Alto Networks integrate 5G/LTE routers with Zero Trust security for industrial IoT
Semtech Corporation, provider of high-performance semiconductors powering AI data center networking and intelligent, connected Internet of Things (IoT)... The post Semtech and Palo Alto Networks integrate 5G/LTE routers with Zero Trust security for industrial IoT appeared first on Industrial Cyber.
Tracking Nightmare Eclipse: Exploits, PoCs, and Endpoint Security Risks
Blog Tracking Nightmare Eclipse: Exploits, PoCs, and Endpoint Security Risks TL;DR / Key Findings Identity: Abdelhamid Naceri’s vulnerability research predates the Nightmare Eclipse releases. Earlier disclosures identify him as halov and halove23; his 2026 proof-of-concept projects are published through MSNightmare. Employment dispute: Naceri links his public disclosures to his dispute with Microsoft. His account distinguishes […] The post Tracking Nightmare Eclipse: Exploits, PoCs, and En
No One Gets Phished: The New Group-IB Browser Agent Applies Predictive Intelligence At The Click
One employee reaches a phishing page. The tab closes, the domain is blocked for every browser in the company, and the targeted password is already being reset. The new Group-IB Browser Agent brings the corporate browser under XDR coverage, checking every page against predictive Threat Intelligence in real time.
What Would RAG Look Like If Miranda Priestly Were the User?
Where your data goes during an AI pentest
Session tokens, customer records, error traces. Here's exactly where that data goes during an agentic pentest, and what to ask any vendor.
Emerging Threat: (CVE-2026-94545) Next.js Remote Code Execution via ImageResponse SVG Injection
An escaping flaw in the Next.js ImageResponse API lets attacker-supplied values break out into SVG markup and execute code on the server generating the image.
Unifying Security Testing and Exposure Management: Introducing the Synack and Wiz Integration
Security testing and exposure management have run on separate tracks for years, leaving a blind spot between what a scanner flags and what an attacker can exploit. Synack's new integration with Wiz closes that disconnect, feeding continuously validated pentest findings directly into Wiz's exposure management view. The post Unifying Security Testing and Exposure Management: Introducing the Synack and Wiz Integration appeared first on Synack.
Penetration Testing RFP: What to Include and How to Evaluate Responses
Most penetration testing RFPs ask vendors to price "one web application" or "an annual pentest" and leave the rest open to interpretation. This guide gives you a complete penetration testing scope-of-work template, a standard vendor response format, a weighted scorecard, and a pass/fail checklist, so every proposal answers the same questions and gets measured against the same bar. The post Penetration Testing RFP: What to Include and How to Evaluate Responses appeared first on Synack.