Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,719 matching stories — announcement, in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Clear information security policies help organizations establish responsibilities, manage risks, and support an effective Information Security Management System (ISMS). For businesses pursuing ISO/IEC 27001:2022 certification,... The post The 10 Mandatory ISO 27001 Policies You Cannot Skip (with Policy Templates Strategy) appeared first on Varutra Consulting.
ISO 27001 certification helps organizations demonstrate a structured approach to information security. Audit findings can arise when an Information Security Management System (ISMS) is incomplete,... The post 7 Common Reasons Companies Fail Their ISO 27001 Audit (And How to Avoid Them) appeared first on Varutra Consulting.
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR […] The post Agentic Pentesting for Websites: A CISO’s Guide to Closing the Exploit Gap appeared first on Reflectiz.
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed
The New Era of Cyberattacks: What a “Secure Device” Means Now
Three government agencies warn that state-sponsored attackers are using consumer messaging apps to impersonate trusted contacts, deliver malware, and bypass enterprise security controls.
According to a security leaders, AI is lowering the technical bar for nation-state-level attacks while shrinking the time defenders have to respond.
How the SBOM links threat modeling, risk assessment and testing in FDA premarket submissions. For current rules, see the CyBeats FDA SBOM requirements guide.
What FDA's April 2022 draft guidance said about SBOMs for medical devices. Superseded; see the CyBeats guide to current FDA SBOM requirements.
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity
Learn how vulnerability remediation works for each type of flaw and what to do when upgrading a dependency breaks your build or isn't an option. Category: DevSec Tools & Comparisons
We compare the top developer security tools for enterprise teams on signal quality, governance, and remediation: Aikido Security, Snyk, GitHub Advanced Security, SonarQube, Checkmarx, and Endor Labs Category: DevSec Tools & Comparisons
Continuous offensive security testing is not faster pentesting. See the standard of proof it runs on, and how to build your program around it.
GPT-6.1 Sol writes 39% more code than GPT-6 Sol, with a higher pass rate and lower finding density. See the full code quality and security evaluation.
Sony patched seven XAV-9500ES vulnerabilities affecting Wi-Fi, Bluetooth, and USB. VicOne examines the attack paths, potential impact, and next steps.
Replacing legacy DAST across hundreds of applications creates two immediate risks: losing security coverage during the transition and carrying the same vulnerability backlog into a new platform. A successful migration needs more than new scanning software. You must establish which applications are currently tested, identify gaps in authenticated and API coverage, preserve unresolved findings and […]
Every enterprise DAST vendor promises better vulnerability detection. The harder question is what happens after the scan finishes. Can your team reproduce the findings? Did the scanner reach authenticated workflows and business-critical APIs? How much work will developers need to complete before a vulnerability is resolved? These questions matter as application portfolios grow and release […]
Uncover how indirect prompt injection and tool poisoning allow attackers to exfiltrate private data via AI agents—all without stealing a single credential.
Use cross-cluster queries in Datadog BYOC Logs to investigate incidents across regions and business units without centralizing stored logs.
tldr; As the real-world challenges of running AI agents in production become clear, three themes emerged at We Are Developers World Congress North America: Agent containment, observability and evaluations, and agent experience. The post Contain, observe, adapt: Three trends shaping agentic software development appeared first on Dynatrace news.
TL;DR A malicious release of TensorLake's TypeScript SDK, [email protected], used an install hook to search for developer credentials and accept remote commands. Sonatype's code review found that its GitHub fallback could create a public repository and commit collected data, including a stolen GitHub token in one path, and that the malware could modify accessible repositories by committing .claude and .vscode files. The loader exits under several common CI environment markers, so the payload's
The post 7 ATO Attacks Stopped in Under 30 Minutes: Re-imagining the Digital Banking Journey appeared first on Feedzai.
We compare the top FedRAMP-compliant security tools in 2026: Aikido for Government, Checkmarx One for Government, Qualys, Rapid7 InsightGovCloud, Snyk for Government, Tenable, Wiz for Government Category: DevSec Tools & Comparisons
More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. [...]
Marc Andreessen is famously quoted saying that “being too early is the primary reason why qualified startups fail, not being too late”. This was almost the case for Bright 8 years ago, but we were able to pivot and build a real business providing value for many customers. Now, technology has caught up to our […]
AI is adding new operational demands to already complex technology environments. Technology leaders must improve reliability and developer productivity, control costs, and demonstrate business value while understanding how AI models and agents affect the applications and infrastructure around them. Dynatrace commissioned Forrester Consulting to evaluate the potential business value of unified observability. Its Total Economic […] The post Forrester study models 466% ROI from unified observ
08.10.2026 Reading time: 5 minutes Why AI coding can cost more than it saves Werner Heijstek In this article Summary AI-generated code costs more than it saves when it is hard to maintain, because rework, review, and refactoring burn more tokens. AI token spend behaves like cloud spend: variable, usage-based, and capable of spiking without […]
08.10.2026 Reading time: 5 minutes Why AI-generated code can cost more than it saves Werner Heijstek In this article Summary AI-generated code costs more than it saves when it is hard to maintain, because rework, review, and refactoring burn more tokens. AI token spend behaves like cloud spend: variable, usage-based, and capable of spiking without […]
184 open source organizations now have the Renovate Community (OSS) plan
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced the expansion of the CyberAgents Exchange, powered by Tenable, to further accelerate enterprise security adoption of open source AI agents, skills and MCP servers. Engineered by Tenable using OpenAI GPT cyber models, the CyberAgents Exchange AI Inspector (Exchange Inspector) evaluates selected AI components listed on the Exchange, including an enterprise-grade safety review, which is designed to help organiz
Community-built AI agents, skills, and MCP servers are landing in SOC workflows fast. Here’s what the Exchange Inspector tests before a listing earns its vetted tag on the CyberAgents Exchange. Three tools have already passed.Key takeawaysEvery Inspector-vetted listing clears three gates: an automated check, a frontier model assessment, and human verification. Tenable uses Tenable One AI Exposure to screen for prompt injection and exposed secrets, and OpenAI GPT Cyber models to assess the
TL;DR Milestone: Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale: Sonatype Research Labs logged 149,329 open source malware packages in Q3 2026. npm remained overwhelmingly dominant at 89.5% of the quarter's malicious packages, although its share declined from 96.6% in Q2. Behavior: Among packages containing overt-malware behavior, 74.5% involved droppers, secrets exfiltration, or both, showing how often Q3 malware w
Boards now ask for evidence that cyber risk is within appetite. What board-ready security evidence looks like, how to govern autonomous testing, and how to get it into your 2027 plan.
The popular Tensorlake SDK, a package with more than 12,000 weekly downloads, shipped a poisoned release (version 0.5.144 ) that was infected with the self-propagating Shai-Hulud worm.
Shai-Hulud is back for another round, this time hijacking the Tensorlake package, 12k weekly downloads Breaking News: Shai-Hulud malware affecting “tensorlake” package version 0.5.144,  Overview A malicious version of tensorlake (version 0.5.144) was published to npm with Shai-Hulud malware. The malware also contains an Ethereum contract address, which is tied to a wallet containing 12.44$ […] The post “Shai-Hulud: Here We Go Again” – “tensorlake” npm Package Hit Wit
Emma Jin wanted a big-name company on her resume. She joined Semgrep as its first intern instead, and six years later she’s an engineering manager. Here’s why eight former interns took the startup route, what it was like to ship to production, and where they are now.
Run paging, incident coordination, and response automation for sensitive federal workloads with Datadog Incident Response.