Build vs Buy Agentic Pentesting and What the DIY Path Costs
Everyone can build a working pentest agent in a weekend. Owning it for two years is the hard part: the four costs nobody adds up, and the seven requirements a demo never has to meet.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,428 matching stories — in Attack Surface Management (ASM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Introducing SILENTCHAIN Professional: Verified AI Findings for Burp Suite
SILENTCHAIN Professional is now available at $199/seat/year. The advanced AI Burp Suite extension adds Phase 2 active verification, WAF detection, out-of-band testing, 200+ curated payloads, HTML advisory reports, and 10 AI providers. The post Introducing SILENTCHAIN Professional: Verified AI Findings for Burp Suite first appeared on Sn1perSecurity.
ASM Has a Silent C, and It Stands for Change Management
Attack surface management has served the vulnerability management program for years, and it now has a second job, governing the asset sprawl that AI makes sprawlier by the day.
Iran-Linked Hackers Reportedly Knock UK Power Plant Offline for Four Days
The post Iran-Linked Hackers Reportedly Knock UK Power Plant Offline for Four Days appeared first on ThreatMon.
CVE-2026-59313: Drei Spring-Framework-Schwachstellen im August-Batch
Der Spring-Batch vom 20. August 2026 enthält drei Schwachstellen im Spring Framework. Betroffene Anwendungen sollten Versionen. The post CVE-2026-59313: Drei Spring-Framework-Schwachstellen im August-Batch appeared first on LocateRisk.
CVE-2026-55634 und CVE-2026-55220: Kritische Pimcore-Schwachstellen
CVE-2026-55634 und CVE-2026-55220 betreffen Pimcore. Fehlerbereinigungen sind für drei Versionsreihen verfügbar. The post CVE-2026-55634 und CVE-2026-55220: Kritische Pimcore-Schwachstellen appeared first on LocateRisk.
The Video That Plays You: Fake MP4 File Carries Malicious Payload
Executive Summary Introduction On 22 August 2026, Censys ARC observed a Cloudflare-fronted host serving raw PowerShell as text/html over port 80. The script checks the computer name against two hard-coded values (variations on the word ‘clean’ that, if present, cause the script to exit), hides its console, decodes a second PowerShell stage from a base64 […] The post The Video That Plays You: Fake MP4 File Carries Malicious Payload appeared first on Censys.
The 4307 Mirage
Follow the investigation from an unusual concentration of traffic on port 4307 to a broader network of infrastructure, source IPs, and connected activity.
Cyberattack Disrupts 15 MW UK Power Plant for Four Days as OT Attack Vector Remains Unknown
The post Cyberattack Disrupts 15 MW UK Power Plant for Four Days as OT Attack Vector Remains Unknown appeared first on ThreatMon.
OpenAI Urges Cyber Defense Against AI Threats
OpenAI Urges Cyber Defense Against AI Threats OpenAI is calling for a global surge in cyber defense as AI-enabled attacks become more widespread and sophisticated. The call to action raises a practical question for defen
What Is Digital Supply Chain Mapping?
Digital supply chain mapping shows the suppliers, infrastructure and dependencies connected to your services, revealing blast radius and shared risk.
CVE-2026-81934: Redis-Schwachstelle in der TLS-Datenverarbeitung
CVE-2026-81934 betrifft Redis-Instanzen mit TLS-Konfiguration. Bereinigte Releases stehen für mehrere Redis-Branches bereit. The post CVE-2026-81934: Redis-Schwachstelle in der TLS-Datenverarbeitung appeared first on LocateRisk.
PaperCut Software vulns: CVE-2026-81578, CVE-2026-82078
Certain versions of PaperCut NG and PaperCut MF are affected by two vulnerabilities. Here's how to find impacted assets with runZero.
Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption
Executive Summary Introduction An open web directory (86.53.111[.]212), exposed on 30 July 2026, held the source code for Moobot, a variant of the Mirai DDoS malware, alongside additional DDoS tools and a suspected fraudulent Chinese ID verification service. Based on recovered attack logs and ongoing monitoring, multiple recovered DoS toolkits were active in July 2026. […] The post Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized Disruption appeared
TeamPCP Arrests: Two Charged in Australia Over the Supply Chain Campaign That Hit 1,000+ Organizations
TeamPCP Arrests: Two Charged in Australia Over the Supply Chain Campaign That Hit 1,000+ Organizations On 26 August 2026, the Australian Federal Police charged two West Australian men over their alleged roles in a cyberc
Iran-Linked Cyberattack Disrupts UK Power Generation Facility
Blog Iran-Linked Cyberattack Disrupts UK Power Generation Facility TL;DR / Key Findings Incident: A cyber incident affected a small power generation facility in the United Kingdom in July 2026, with the facility reportedly remaining unavailable for approximately four days. Impact: No consumer outages were reported and the wider UK electricity system was not affected. Attribution: […] The post Iran-Linked Cyberattack Disrupts UK Power Generation Facility appeared first on ThreatMon.
Simmering in the hot alphabet soup of vuln management
Between CVEs, CPEs, and CISA's Vulnrichment, vulnerability management is an alphabet soup. NIST wants your expert input on using AI to fix NVD before October 13, 2026.
Qilin Claims ATF Breach as Agency Confirms “Major Incident”
Qilin Claims ATF Breach as Agency Confirms "Major Incident" The Qilin Ransomware group listed the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) on its Dark Web leak site on August 26, 2026, the same day the a
One Adversary, Two Outcomes: The 0.027% Proof
One malware campaign, 11,000 compromised devices, two banks with very different outcomes. At the bank with fused defence, fraud succeeded on just 0.027% of compromised devices; nine times less than the market average. Regulators are taking notice too.
PCI DSS Penetration Testing Requirements: What Enterprises Actually Need for Compliance
Getting PCI DSS Requirement 11.4 Right From the Start Enterprises often know they need PCI compliance penetration testing but remain uncertain about what makes a test compliant. PCI DSS v4.0.1 Requirement 11.4 involves considerably more than scheduling an annual external assessment. Scope, internal and external testing, methodology, tester qualifications, segmentation validation, remediation, retesting, and evidence all influence whether the work will satisfy assessor scrutiny. This guide explai
Are Vendor Questionnaires Enough for Regulatory Compliance?
Vendor questionnaires support due diligence, but NIS2 and DORA require ongoing supplier oversight and evidence.
Caught in 4K: The Aurora Files
The first in CloudSEK's "Caught in 4K" series, where we pull ransomware operations out of the shadows and show exactly how they work. A misconfigured server opened a window straight into an Aurora ransomware operator's playbook: attacker tools, AI-assisted planning, and a look inside the actual negotiation panel where a victims and the operator settled on payment. In partnership with TRM Labs, we traced that payment on-chain, into a wider laundering network moving money across multiple victims.
How to Evaluate a Penetration Testing Vendor: An Enterprise Buyer’s Checklist
Penetration testing proposals are rarely easy to compare. One vendor prices by application, another by testing days, another by credits, and another by AI test runs. Choosing the right penetration testing vendor therefore requires more than comparing report length, brand recognition, or the initial quote. This guide provides an enterprise checklist and weighted scorecard for evaluating scope, methodology, tester quality, finding validation, reporting, remediation, governance, and total program c
Celebrating excellence: Palo Alto Networks announces the 2026 North America Partner of the Year Awards
At the 2026 Executive Partner Summit, Palo Alto Networks President BJ Jenkins made one thing clear: the AI era is the platform era — and above all, the AI era is the … The post Celebrating excellence: Palo Alto Networks announces the 2026 North America Partner of the Year Awards appeared first on Palo Alto Networks Blog.
A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console
Two critical vulnerabilities in Veeam Service Provider Console chain into unauthenticated remote code execution on the management server sitting above every tenant's backups. Bishop Fox confirmed the full chain end to end, breaks down both root causes, and shares a safe detection tool and IOCs.
Tortoiseshell: New Toolset and Operational Infrastructure Exposed
Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data about the Tortoiseshell APT group, leading to the discovery of new samples sharing similarities with known Tortoiseshell malware and additional operational infrastructure.
How Continuous Pentesting Became Standard Practice at Dow
A few years ago, Dow's cyber engineering team made the switch from point-in-time pentesting to continuous coverage for their high-value assets. How'd they do it? By partnering with Synack. And keep in mind this was before the recent wave of AI-powered pentesting solutions. Dow was ahead of the curve. The post How Continuous Pentesting Became Standard Practice at Dow appeared first on Synack.
Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana
Group-IB expone una operación mexicana de PhaaS dirigida a más de 20 instituciones financieras, con capacidades de phishing en tiempo real, vishing con IA y RAT para dispositivos móviles.
What the ERMAC Source Leak Says About HookBot
Executive Summary ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows. […] The post What the ERMAC Source Leak Says About HookBot appeared first on Censys.
Your Innovators Hub, Built Around You
Earlier this year, we introduced Ivanti Innovators Hub to bring together support, knowledge and community into a more unified experience. That launch established a strong foundation for a more effortless and predictable experience. Now, we're building on it with new enhancements designed to make the Hub more personalized, connected and relevant, with integrated learning opportunities, stronger community engagement and more tailored experiences. A more personalized experience Th
Zimbra vulnerability CVE-2026-73570: find impacted assets
Zimbra discloses critical unauthenticated RCE flaw CVE-2026-73570 (CVSS 8.9). Learn how SMTP snmp_notify exploits occur and upgrade to 10.1.20 immediately.
Continuous Compliance Monitoring: What It Is and the Best Tools to Use
Continuous compliance monitoring means using automated tools to assess your organization’s systems, policies, and security controls to ensure adherence to regulatory requirements. The continuous part means that you do this continuously, instead of scrambling once a year to prove you’re compliant (or failing to do so).  Done well, it makes audit prep far less of […]
Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
What is AI Data Poisoning? Risks, Examples and Prevention
Understand AI data poisoning with real-world examples, key risks and practical best practices for securing AI and machine learning models. The post What is AI Data Poisoning? Risks, Examples and Prevention appeared first on Outpost24.
SentinelOne Multi-Tenant Deployment for MSPs: The Intune Guide
Deploying an EDR agent to one machine is straightforward. For SentinelOne specifically, the install command is short, and the packaging process is...
Emerging Threat: (CVE-2026-21580) Confluence Privilege Escalation via Unauthenticated Stored XSS
A stored cross-site scripting flaw in Atlassian Confluence Data Center and Server lets an unauthenticated attacker run script in a privileged user's browser and act on their behalf.
Introducing EchoBench: A Human Calibrated Benchmark for Autonomous Pentesting
NetSPI introduces EchoBench, a human-calibrated benchmark for autonomous AI web app pentesting. EchoBench measures finding fidelity, difficulty-reach, OWASP breadth, and repeatability to accurately gauge AI security capabilities against real human outcomes. The post Introducing EchoBench: A Human Calibrated Benchmark for Autonomous Pentesting appeared first on NetSPI.
Verifying the Verifier – Assessing Identity Verification Services
As AI-driven identity verification becomes the front line of defense against fraud, this piece breaks down how to stress-test these systems, from building synthetic IDs and deepfake voices to uncovering the gaps attackers are most likely to exploit. The post Verifying the Verifier – Assessing Identity Verification Services appeared first on NetSPI.
Unit 42 Defends Organizations Against Next-Gen Frontier AI Risks with Anthropic’s Mythos 5
Frontier AI has compressed attack timelines from weeks to minutes. For defenders to gain the upper hand, they need to fight back at machine speed. That’s why Palo Alto Networks Unit 42 … The post Unit 42 Defends Organizations Against Next-Gen Frontier AI Risks with Anthropic’s Mythos 5 appeared first on Palo Alto Networks Blog.
No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452
CVE-2026-8452 lets an unauthenticated attacker corrupt memory in Citrix NetScaler's SAML parser with a single request, potentially leading to remote code execution. Bishop Fox breaks down the patch, how to safely verify it across a fleet, and what exploitation actually looks like in the logs.