Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,719 matching stories — announcement, in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
An oil trader prices tomorrow's cargoes on a model someone on the desk built last year... The post Application Security for the Energy, Oil & Gas and Utilities Industries: The Complete Guide appeared first on Cycode.
If Dynatrace looks different today, that’s intentional. The design refresh incorporates customer feedback to improve the user experience by reducing visual layering on page surfaces and improving contrast in dark mode. Status and chart colors are more vibrant and easier to tell apart, and charts have new themed palettes alongside the existing options. The refresh […] The post A design refresh for every Dynatrace App, including yours appeared first on Dynatrace news.
Cycode’s Hugging Face integration gives security teams visibility, context, and control over the AI models your teams build, publish, and pull... The post Cycode + Hugging Face: See & Secure Every AI Model appeared first on Cycode.
Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber campaign dubbed PhantomSub. "The malicious packages abuse the 'Baileys' WhatsApp open source project to add the victims to groups without their consent," OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko said in a technical
Cut AI coding costs without sacrificing code quality by choosing the right model tier and verifying security, reliability, and maintainability.
Improve first pass quality with coding agents by combining better context, clear constraints, automated verification, and continuous feedback.
AI agents in production don’t just generate text. They can query customer records, call tools, update systems, trigger financial workflows, and make decisions with direct business impact. The relevant security question is no longer only “Was the prompt safe?” but “What did the agent actually do, under whose authority, and what happened next?” The best ... Read more The post Best Tools for Securing AI Agents in Production in 2026: 5 Options Reviewed appeared first on Rein Security.
See how the Blue Agent investigated a multi-platform attack in minutes, following evidence across AWS and GitHub to uncover compromised credentials, stolen source code, and custom data exfiltration tooling
The post What EU CRA’s 24-hour deadline means for your SBOM appeared first on Anchore.Most compliance frameworks treat a review as a once-a-year event. The EU CRA doesn’t work that way. It requires you to know what’s in every release, prove that no release ships with a known exploitable vulnerability, and since September 11, 2026, report an actively exploited vulnerability within 24 hours of becoming aware of it. That […]
The time required to write code is shrinking. The work required to validate code for production is not.
Greenbone freut sich, CoreWin als neuen Vertriebspartner bekannt zu geben. Als in der Ukraine ansässiger Value-Added-Software-Distributor ist CoreWin hervorragend positioniert, um OPENVAS in der Ukraine, Armenien, Aserbaidschan, Georgien, Kasachstan, Kirgisistan, Moldau und Usbekistan verfügbar zu machen. Warum unsere CoreWin-Partnerschaft wichtig ist Organisationen in diesen Regionen, im öffentlichen wie im privaten Sektor, sind auf eine verlässliche […]
Key Takeaways Buried in OpenAI’s evaluations of its GPT-6 Astra model sits a finding that mobile teams should sit with for a minute. The model reverse-engineered compiled software well enough to escape a browser sandbox and chain privilege-escalation flaws on a hardened operating system, according to the company’s published evaluations. Reading compiled binaries used to ... Read more
On September 1, OpenAI announced that its new model, GPT-6 Astra, had become the first to cross the “Critical” cybersecurity threshold in the company’s Preparedness Framework.  Most coverage focused on the safety implications, and fairly so, but buried in the announcement sits a benchmark result that should change how every security leader reads their next ... Read more
Status of High-Risk Vulnerabilities No. Vulnerability No. (CVE) Content CVSS Risk Level 1 CVE-2026-72898 Metabase Unauthenticated SQL Injection 10 CRITICAL 2 CVE-2026-58231 SAP Commerce Cloud Unauthenticated Code Injection 10 CRITICAL 3 CVE-2026-48362 Adobe ColdFusion OS Command Injection 10 CRITICAL 4 CVE-2026-18051 W3 Total Cache Unauthenticated Arbitrary File Write 10 CRITICAL 5 CVE-2026-74253 Joomla Sourcerer Unauthenticated Read more about [2026.09] Threat Intelligence Report[…] The p
PCI DSS 4.0.1 makes a full software component inventory mandatory. See what controls 6.3.2 and 11.3.1.1 have required since 31 March 2025.
Learn tips for generating and managing SBOMs in the C and C++ ecosystems.
A Pixel modem zero-day shows why device trust must extend below the OS to firmware, chipsets, patch status, and vendor support.
A High severity flaw in brig let a sandboxed AI agent plant a symlink and gain read-write access to host directories. See how 0.3.0 fixes it.
VicOne supports NVIDIA's Open Agent Safety Platform, extending the focus from secure AI agent decisions to the real-world actions of vehicles and robots.
TL;DR: Frontier AI has collapsed the vulnerability exploit window from weeks to mere hours. Attackers now use advanced AI models to reverse-engineer published fixes and generate working exploits faster than human security teams can deploy updates. In the AI era, publishing a patch creates a blueprint for attackers. Surviving this threat requires vendors to tier sensitive …
Manifest has joined Athena, the Chainguard-led coalition defending open-source software. See how we help teams find risk in code they cannot rebuild.
Aikido is an inaugural partner in OpenJS's Security Stewardship Program, funding bug bounties and maintainer support for Node.js. Category: Aikido
OpenAI gates its cyber models behind an application, identity checks, and workspace scoping. Strobes is now verified for Daybreak.
490K downloads, quiet follower inflation, and a mysterious Dan from Indonesia. OX Research is tracking a malicious npm campaign making spam accounts look legitimate. The attackers use Baileys to silently make developers follow spam channels on WhatsApp. Overview The OX Research team identified 101 npm packages as part of a malicious WhatsApp group subscriber campaign. […] The post PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels appeared first on OX Security
The most secure browser in 2026 is Google Chrome, on the criterion that matters most: it ships security patches faster than anything else and installs […] The post The 10 Most Secure Browsers in 2026 appeared first on Reflectiz.
A malicious MCP server tricked the SDK into sending login credentials to the attacker instead of the real login provider... The post Cycode Uncovers Account Takeover in MCP Python SDK appeared first on Cycode.
Talovertaus on aina ollut väärä Digitaalisten järjestelmien rakentamista on vuosikymmeniä verrattu talon rakentamiseen: se on projekti, jolla on valmistumispäivä, käyttöönotto ja ylläpito. Valitettavasti vertaus menee pieleen juuri sen kriittisimmässä kohdassa.
Threat actors are actively exploiting a critical Oracle PeopleSoft vulnerability, CVE-2026-35273 (CVSS 9.8), and they are getting past Web Application Firewalls with one URL-encoded character. PSEMHUB was never meant to be reached from the outside world. It sits behind an IP allow-list, and the original exploit chain reached it indirectly: attackers abused PeopleSoft’s unauthenticated Integration Broker listening connector to make the server issue a loopback request to itself, satisfying t
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. [...]
In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from Google Gemini models breaking containment to ShinyHunters ratting on TeamPCP hackers.
It was meant to make life simpler: a secret email address to which developers can send a message and create an issue in their GitLab project. But poor security defaults and a long-lived token embedded in the address mean that anyone who knows the address can potentially modify protected repositories. If project owners publish or leak these addresses, as some have, then they become vulnerable. The project-scoped email address supplied by GitLab in the form of a button that says “Email work item t
The post RiskOps in Brazil: Unifying Identity, Fraud, and AML in a New Risk Architecture appeared first on Feedzai.
Part 2 of 2: AI-driven binary analysis is forcing a rethink of automotive firmware protection. Part 1 covered how AI shortens PoC-to-exploit timelines.
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper actions-cool/maintain-one-comment Visiting either of the repositories now shows the message: "Access to this
Running a single custom detection agent against one repository is straightforward. Running hundreds of agents, each owned by different teams, targeting different services, with overlapping rule sets, across an enterprise codebase is where things break.
Running a single custom detection agent against one repository is straightforward. Running hundreds of agents, each owned by different teams, targeting different services, with overlapping rule sets, across an enterprise codebase is where things break.
The post Feedzai Fusion 2026: 3 Things That Got the Room Talking appeared first on Feedzai.
SonarQube Remediation Agent with Claude Opus 5.5 delivers better fixes, higher merge readiness, and roughly 58% lower cost per fix.