AI in AppSec: What to Build vs. Buy | Endor Labs
Building AI security agents in-house? Learn what to build, what to buy, and what it costs at scale, with a four-level model for the agentic SDLC.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,719 matching stories — announcement, in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Once Upon a Codebase: An AppSec Bedtime Story | Endor Labs
A read-aloud story about AT, a forest of code that keeps growing, and his security mechs, plus a guide to the four levels of AI maturity for AppSec.
Foreign Risk for Air-Gapped Environments | Manifest
Manifest Foreign Risk brings air-gapped software supply chain security to defense and government teams with contributor-level FOCI visibility.
How to Evaluate Software Composition Analysis Tools for Your AppSec Team
To evaluate software composition analysis tools, start with dependency coverage, vulnerability intelligence, SBOM and license support, CI/CD integration, and remediation workflows. Shortlist products based on your application stack, then run the same controlled tests across each platform. The right tool should identify relevant dependency risks, provide actionable evidence, and fit the way your developers resolve security findings.
Google Gemini 4 Argon: An evaluation
See how Gemini 4 Argon scores on a Java LLM coding benchmark, with an 85.66% pass rate and 193 vulnerabilities. Explore the full results on Sonar.
How to keep your architecture intact when agents write the code
Agents write the code, you own the architecture. Hear Matt Erman on enforcing architecture rules with fitness functions and independent verification.
H₂O Retailing deploys Tenable One to unify cyber exposure management across multi-cloud infrastructure
Exposure management company Tenable Holdings announced that H₂O Retailing has deployed the Tenable One Exposure Management Platform across... The post H₂O Retailing deploys Tenable One to unify cyber exposure management across multi-cloud infrastructure appeared first on Industrial Cyber.
How to Codify Nuance in Agentic Engineering
An API change can pass its tests and still break a supported client. Here’s how to capture the context, reasoning, and conditions agents need to decide well. The post How to Codify Nuance in Agentic Engineering appeared first on Qodo.
Can a Robot Do Everything Right and Still Be Unsafe?
What a conversation between Boston Dynamics and VicOne reveals about how manipulated information can turn expected robot operation into an unsafe outcome
Inside the HulkApps Shopify Checkout Hijack
Shopify phishing has evolved from the laughable “Dear Shopify Merchant” email into one of the most reliable account-takeover vectors in ecommerce. On the same pattern, Shopify shops have recently been hit with a checkout hijack campaign running through HulkApps, Swym, and Selleasy extensions, where shoppers on legitimate stores were redirected to a fake payment page ... Read more
The 7 Biggest AI Agent Attacks of 2026
600,000+ credit cards stolen from two online retailers by AI agents running almost unattended. Between September 10 and 15, 2026, the operator behind that theft […] The post The 7 Biggest AI Agent Attacks of 2026 appeared first on Reflectiz.
Labrador Labs Blocks Malicious Open Source Packages Before They Enter the Supply Chain
Build better SLOs with RUM and synthetic SLIs
Learn when to use RUM and synthetic monitoring for SLIs, what each source misses, and how to interpret their results together.
Beyond container image signing: How we enforce software supply chain policies at Datadog
Datadog built Turnstile to evaluate signed attestations and enforce software supply chain policies before container images are deployed.
Security patches need patches now that attackers have AI
Terra finds sharp rise in GitHub security fixes reported broken within 90 days
Your Next Insider Threat Won’t be Human: Securing AI Agents From the Outside in
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
Authentication Bypass, Remote Code Execution, and Database Read in Eptura Archibus (FIXED)
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
How to prioritize technical debt
19.10.2026 Reading time: 5 minutes How to Prioritize Technical Debt Werner Heijstek In this article Technical debt is not always a bad thing According to our State of Software 2026 report, improving a system’s maintainability can frees up between €120,000 – €870,000 of development capacity per system per year. Technical debt is the extra effort […]
Unmasking the robots: Why it’s critical to discover AI agent identities and how Tenable helps you secure them
Discover how to secure AI agents in your cloud environment with Tenable One Cloud Exposure. We explore Microsoft Entra Agent ID and provide essential best practices for robust agentic AI identity security.Key takeawaysUnderstand your current maturity level and then build an appropriate action plan to secure your agent identities.Use your cloud providers’ native tools or Tenable One Cloud Exposure to locate and catalog every AI agent operating in your environment.Do not assign human identities or
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
Drata and Aikido: audit-ready pentesting, built into your compliance workflow
Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits. Category: Compliance
Meet the new Cycode: built to protect where AI risk is born
Today we’re introducing the new Cycode brand. Here is why we did it, what the new logo and colors mean, and what it means for you. The post Meet the new Cycode: built to protect where AI risk is born appeared first on Cycode.
More pentesting, same budget, no surprises
AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable. Category: News
Latest updates to Qodo: October 2026
The latest release of Qodo’s Code Quality and Governance platform brings a few practical improvements to everyday workflows. Here’s what’s new in v3.1: Automated rule deactivation: Qodo’s rule lifecycle system now automatically turns off rules teams are consistently ignoring Qodo’s new analytics dashboard moves to GA: see what Qodo caught, what your team acted on, […] The post Latest updates to Qodo: October 2026 appeared first on Qodo.
The Missing Layer in AI Security: Execution | Nullify Blog
We are asked all the time about new model releases and security code review features from the big AI labs. This blog explains how Nullify is better together with these advancements to maximize the value they create for our customers.
Why Developers Ignore Security Alerts (And How to Fix It) | Nullify Blog
Why do developers ignore security alerts? Because they are pricing them. Six ways security teams can cut alert fatigue and get fixes merged, not muted.
H₂O Retailing Reduces Cybersecurity Risk with the Tenable One Exposure Management Platform
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced that H₂O Retailing Corporation has successfully deployed the Tenable One Exposure Management Platform across its diverse multi-cloud infrastructure. The implementation provides the group with unified visibility, risk-based prioritization, and accelerated response times using AI capabilities to objectively assess which vulnerabilities pose the highest real-world exploitation risk.H₂O Retailing is a leading re
Wildfire Technology Is Advancing. Can Organizations Act on the Information Fast Enough?
Wildfire detection technology is advancing fast. Learn why rapid, coordinated communication is what turns early warning into resilience.
Your CVE is reachable. But is it exploitable?
Reachable CVEs can still be safe in your app. See how reachability vs exploitability analysis helps you decide which dependency vulnerabilities to fix first. Category: News
Building quality into the agentic workflow
AI coding agents changed how fast teams ship. They didn’t change who has to verify the output. Last week, Qodo field CTO Shlomo Dalezman and solutions engineer Jonathan Klick ran a live session on what happens when code review stops waiting for the pull request. They walked through the Agentic Toolbox, demoed an install-to-review on […] The post Building quality into the agentic workflow appeared first on Qodo.
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
Mythos 5: The Determinism Problem
In May we published what AI security scanning actually costs. Three scanners on one codebase agreed on 5% of findings. One scanner run three times reproduced 17% of its own results. A $315 scan generated $128,000 in triage labor. The most common response we got was patience. The models were early. The next generation would fix it. To see those early results, here’spart one of the series.
Anthropic’s Free OSS Scanner: What It Means For Your Team
On October 8, 2026, Anthropic announced OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects. The OSS Scanner is powered by their most capable models, including Claude Mythos. It scans codebases, identifies vulnerabilities, proposes patches, and sends reports directly to maintainers. As you read this, it has already identified real, high-severity issues …
Hallucinated domain in official OpenAI skill underscores AI supply chain risks
Researchers have discovered a first-of-its-kind supply-chain vulnerability in OpenAI’s official skills repository. OpenAI maintains an official GitHub repository of skills that teach AI agents how to work with various platforms and services. As an official skill, these components are often given an implicit level of trust because they are contributed or vetted by verified vendors. Snags arose because one OpenAI skill — designed to teach agents the best way to deploy applications on Render — inst
Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown
At JFrog’s swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development. In this exclusive sit-down interview from the event, former SolarWinds CISO TIM (now CISO in Residence at Team8) sits with JFrog CISO Paul Davis and reflects on the historic 2020 …
By Default, Insecure: Apache Airflow Disables SSH Host Key Verification
Vulnerability Details CVE-2026-94134 – SSH hook default, both providers CVE-2026-94135 – Async SFTP path Severity: High – CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CWE: CWE-322 (Key Exchange without Entity Authentication) Affected packages: apache-airflow-providers-ssh and apache-airflow-providers-sftp – both through version 6.0.1 Fixed in: apache-airflow-providers-ssh 7.0.0 (CVE-2026-94134), apache-airflow-providers-sftp 7.0.0 (CVE-2026-94135) Overview OX S
Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research
Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone, was of the latter kind.Virus Bulletin created the award to honor Péter's life and work, and it recognizes outstanding technical security research: the rigorous, the deep, and the useful – exactly what he was known for himself. And as far as recognitions in our industry
17 of 40 teams that say they enforce AI agent permissions still share the credentials behind them
Key Questions for Your SBOM Program | Endor Labs
All the questions (and some of the answers) you need before kicking off your SBOM program.
Cyber Resilience Act for Mobile Apps: What Changes Now
Since 11 September 2026, an actively exploited flaw in your app starts a 24-hour reporting clock under the EU's Cyber Resilience Act. That's expensive if you don't know what's running, and an edge if you do.