AI in AppSec: What to Build vs. Buy | Endor Labs
Building AI security agents in-house? Learn what to build, what to buy, and what it costs at scale, with a four-level model for the agentic SDLC.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,924 matching stories — in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Once Upon a Codebase: An AppSec Bedtime Story | Endor Labs
A read-aloud story about AT, a forest of code that keeps growing, and his security mechs, plus a guide to the four levels of AI maturity for AppSec.
How to Evaluate Software Composition Analysis Tools for Your AppSec Team
To evaluate software composition analysis tools, start with dependency coverage, vulnerability intelligence, SBOM and license support, CI/CD integration, and remediation workflows. Shortlist products based on your application stack, then run the same controlled tests across each platform. The right tool should identify relevant dependency risks, provide actionable evidence, and fit the way your developers resolve security findings.
Google Gemini 4 Argon: An evaluation
See how Gemini 4 Argon scores on a Java LLM coding benchmark, with an 85.66% pass rate and 193 vulnerabilities. Explore the full results on Sonar.
How to keep your architecture intact when agents write the code
Agents write the code, you own the architecture. Hear Matt Erman on enforcing architecture rules with fitness functions and independent verification.
Tenable Expands Open Security Ecosystem to Extend Exposure Intelligence and Accelerate AI Security Outcomes
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced the expansion of its open technology and partner ecosystem to accelerate integrated security workflows across the entire tech stack. Tenable OPEN for AI delivers validated, ready-to-use AI workflows, enabling organizations to use Tenable’s deep exposure intelligence with their preferred AI models, agents and tools. Tenable OPEN for AI launch partners include BeyondTrust, Cohesity, Command Zero, Corelight, In
H₂O Retailing deploys Tenable One to unify cyber exposure management across multi-cloud infrastructure
Exposure management company Tenable Holdings announced that H₂O Retailing has deployed the Tenable One Exposure Management Platform across... The post H₂O Retailing deploys Tenable One to unify cyber exposure management across multi-cloud infrastructure appeared first on Industrial Cyber.
Aikido launches Noon: workforce security for every employee
Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes. Category: Company Updates
Can a Robot Do Everything Right and Still Be Unsafe?
What a conversation between Boston Dynamics and VicOne reveals about how manipulated information can turn expected robot operation into an unsafe outcome
Inside the HulkApps Shopify Checkout Hijack
Shopify phishing has evolved from the laughable “Dear Shopify Merchant” email into one of the most reliable account-takeover vectors in ecommerce. On the same pattern, Shopify shops have recently been hit with a checkout hijack campaign running through HulkApps, Swym, and Selleasy extensions, where shoppers on legitimate stores were redirected to a fake payment page ... Read more
Build better SLOs with RUM and synthetic SLIs
Learn when to use RUM and synthetic monitoring for SLIs, what each source misses, and how to interpret their results together.
Beyond container image signing: How we enforce software supply chain policies at Datadog
Datadog built Turnstile to evaluate signed attestations and enforce software supply chain policies before container images are deployed.
Security patches need patches now that attackers have AI
Terra finds sharp rise in GitHub security fixes reported broken within 90 days
Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779
OverviewIn early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Direc
How to prioritize technical debt
19.10.2026 Reading time: 5 minutes How to Prioritize Technical Debt Werner Heijstek In this article Technical debt is not always a bad thing According to our State of Software 2026 report, improving a system’s maintainability can frees up between €120,000 – €870,000 of development capacity per system per year. Technical debt is the extra effort […]
Unmasking the robots: Why it’s critical to discover AI agent identities and how Tenable helps you secure them
Discover how to secure AI agents in your cloud environment with Tenable One Cloud Exposure. We explore Microsoft Entra Agent ID and provide essential best practices for robust agentic AI identity security.Key takeawaysUnderstand your current maturity level and then build an appropriate action plan to secure your agent identities.Use your cloud providers’ native tools or Tenable One Cloud Exposure to locate and catalog every AI agent operating in your environment.Do not assign human identities or
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
Drata and Aikido: audit-ready pentesting, built into your compliance workflow
Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits. Category: Compliance
Meet the new Cycode: built to protect where AI risk is born
Today we’re introducing the new Cycode brand. Here is why we did it, what the new logo and colors mean, and what it means for you. The post Meet the new Cycode: built to protect where AI risk is born appeared first on Cycode.
CVE-2026-102764: BeyondTrust RS wird aktiv ausgenutzt
CVE-2026-102764 (CVSS 9,3, EPSS ≥ 67. Perzentil) ist eine kritische Schwachstelle zur Umgehung der Authentifizierung in BeyondTrust Remote Support (RS). Die Schwachstelle beruht auf einer unzureichenden Origin Validation in einer internen Messaging-Komponente, und ihre Ausnutzung ermöglicht es nicht authentifizierten Angreifenden, aus der Ferne Dateioperationen auf einer betroffenen Appliance auszuführen. Die CVE wurde am 15. Oktober […]
More pentesting, same budget, no surprises
AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable. Category: News
Latest updates to Qodo: October 2026
The latest release of Qodo’s Code Quality and Governance platform brings a few practical improvements to everyday workflows. Here’s what’s new in v3.1: Automated rule deactivation: Qodo’s rule lifecycle system now automatically turns off rules teams are consistently ignoring Qodo’s new analytics dashboard moves to GA: see what Qodo caught, what your team acted on, […] The post Latest updates to Qodo: October 2026 appeared first on Qodo.
The Missing Layer in AI Security: Execution | Nullify Blog
We are asked all the time about new model releases and security code review features from the big AI labs. This blog explains how Nullify is better together with these advancements to maximize the value they create for our customers.
Why Developers Ignore Security Alerts (And How to Fix It) | Nullify Blog
Why do developers ignore security alerts? Because they are pricing them. Six ways security teams can cut alert fatigue and get fixes merged, not muted.
Wildfire Technology Is Advancing. Can Organizations Act on the Information Fast Enough?
Wildfire detection technology is advancing fast. Learn why rapid, coordinated communication is what turns early warning into resilience.
Building quality into the agentic workflow
AI coding agents changed how fast teams ship. They didn’t change who has to verify the output. Last week, Qodo field CTO Shlomo Dalezman and solutions engineer Jonathan Klick ran a live session on what happens when code review stops waiting for the pull request. They walked through the Agentic Toolbox, demoed an install-to-review on […] The post Building quality into the agentic workflow appeared first on Qodo.
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Mythos 5: The Determinism Problem
In May we published what AI security scanning actually costs. Three scanners on one codebase agreed on 5% of findings. One scanner run three times reproduced 17% of its own results. A $315 scan generated $128,000 in triage labor. The most common response we got was patience. The models were early. The next generation would fix it. To see those early results, here’spart one of the series.
Anthropic’s Free OSS Scanner: What It Means For Your Team
On October 8, 2026, Anthropic announced OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects. The OSS Scanner is powered by their most capable models, including Claude Mythos. It scans codebases, identifies vulnerabilities, proposes patches, and sends reports directly to maintainers. As you read this, it has already identified real, high-severity issues …
Hallucinated domain in official OpenAI skill underscores AI supply chain risks
Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository. OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these components are often given an implicit level of trust because they are contributed or vetted by verified vendors. Snags arose because one OpenAI skill — designed to teach agents the best way to deploy applications on Render — inst
Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown
At JFrog’s swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development. In this exclusive sit-down interview from the event, former SolarWinds CISO TIM (now CISO in Residence at Team8) sits with JFrog CISO Paul Davis and reflects on the historic 2020 …
By Default, Insecure: Apache Airflow Disables SSH Host Key Verification
Vulnerability Details CVE-2026-94134 – SSH hook default, both providers CVE-2026-94135 – Async SFTP path Severity: High – CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CWE: CWE-322 (Key Exchange without Entity Authentication) Affected packages: apache-airflow-providers-ssh and apache-airflow-providers-sftp – both through version 6.0.1 Fixed in: apache-airflow-providers-ssh 7.0.0 (CVE-2026-94134), apache-airflow-providers-sftp 7.0.0 (CVE-2026-94135) Overview OX S
Rapid7 Analysis: GitLab CI/CD Regex Integer Overflow (CVE-2026-97229)
OverviewOn October 12, 2026, GitLab released 19.4.2, 19.3.5, and 19.2.8 to fix CVE-2026-97229, an integer overflow in its CI/CD regular-expression handling. The issue was reported through HackerOne by joaxcar. GitLab assigned it a CVSS score of 10.0 and described possible code execution by an unauthenticated user.The advisory states that CVE-2026-97229 affects GitLab CE and EE from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. GitLab says all deployment types are affected unles
CVE-2026-99999: Critical PwnEscape Linux Kernel Flaw Enables Guest-to-Host Escape
A critical Linux kernel vulnerability tracked as CVE-2026-99999, dubbed PwnEscape, can break the isolation boundary between virtual machines and their underlying hosts. The flaw resides in the Linux networking stack and can allow attacker-controlled code running inside a guest VM to disclose host memory, crash the host, and, under demonstrated lab conditions, achieve guest-to-host code […] The post CVE-2026-99999: Critical PwnEscape Linux Kernel Flaw Enables Guest-to-Host Escape appeared f
17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them
Key Questions for Your SBOM Program | Endor Labs
All the questions (and some of the answers) you need before kicking off your SBOM program.
Cyber Resilience Act for Mobile Apps: What Changes Now
Since 11 September 2026, an actively exploited flaw in your app starts a 24-hour reporting clock under the EU's Cyber Resilience Act. That's expensive if you don't know what's running, and an edge if you do.
Krybit ransomware: what you need to know
Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.