Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,719 matching stories — announcement, in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
CI/CD credentials are a prime target of malicious open source packages because of the sheer authority those credentials carry. Depending on their privileges, they can provide access to source code, build systems, package registries, cloud infrastructure, and production delivery.
Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with root privileges. The post Check Point, Kaspersky, Tanium Patch Product Vulnerabilities appeared first on SecurityWeek.
Create, test, and publish custom IaC Security rules in Datadog to detect organization-specific policy violations before deployment.
The best on-prem AI pentesting tools of 2026 for regulated teams, compared on air-gap support, whitebox depth, and application coverage Category: DevSec Tools & Comparisons
Most AI code review tools were built to make code better, not safer. They catch style issues, suggest refactors, and flag obvious bugs. Security is usually an afterthought, if it's addressed at all. That leaves a real gap for dev teams who need something more specific: a way to catch vulnerabilities before they ship, without drowning developers in noise.
Most AI code review tools were built to make code better, not safer. They catch style issues, suggest refactors, and flag obvious bugs. Security is usually an afterthought, if it's addressed at all. That leaves a real gap for dev teams who need something more specific: a way to catch vulnerabilities before they ship, without drowning developers in noise.
Where do application security programs lose time and create a backlog? Not in the detection itself, but in the gap between detection and an approved fix. Every finding that reaches your team opens four questions before anyone can act on it: Detection only surfaced the problem. Four questions, four brakes, and every one has to […]
OpenAI published a framework for disclosing model misalignment alongside six reports describing problematic behavior. The post OpenAI Says Its Models Searched GitHub for Leaked API Keys During Training appeared first on SecurityWeek.
TL;DR Factory.ai Alternatives Depend On The Engineering Workflow By 2028, Gartner projects that 75% of enterprise software engineers will use...
Why Autonomous Endpoint Management Depends on Trusted Data Back to Basics: AEM Fundamentals | Part 1 of 5 The market is rushing toward autonomous endpoint management. But most of the conversation skips past the infrastructure and jumps straight to the outcomes. The market is loud, the promises are bold, and the buyers who got burned before are now the ones asking the hardest questions. They don't need another feature list. They need to know what's actually underneath the claims. IT teams have he
This guide compares the best DAST tools on the market and explains what each one actually does well once it runs against your applications... The post 13 Best DAST Tools and Scanners in 2026 appeared first on Cycode.
AWS has recognized Aikido with its Security Competency for Application Security, validating how Aikido secures applications from code to cloud to runtime. Category: Company Updates
The post Redefining the Cost of Fighting Financial Crime appeared first on Feedzai.
Phoenix Contact patched 20 CHARX SEC-3xxx EV charger vulnerabilities in firmware 1.9.1. VicOne examines their wider implications and practical steps for operators.
CloudsineAI's TraceCtrl LLM Guards is approved for the IMDA Spark Programme. It inspects prompts and outputs at runtime to stop injection and data leakage. The post TraceCtrl LLM Guards approved for IMDA Spark appeared first on cloudsineAI.
Large language models are now a core part of the software development lifecycle. The 2025 Stack Overflow Developer Survey found that 82% of developers used OpenAI’s GPT models in their work last year, and Google has reported that AI now writes over 25% of new code committed at the company. All of that rests on ... Read more
Automated Vulnerability Management continuously discovers, validates, and remediates vulnerabilities across applications. Learn how AVM strengthens security. The post What Is Automated Vulnerability Management? first appeared on ArmourZero.
Christine Gadsby spoke with Decipher's Dennis Fischer about cybersecurity’s evolution, mobile communications risks, AI-driven threats, and secure government communications.
The best Qodo alternatives for AI code review in 2026, compared across noise, security, and cost, so you can pick the tool that fits your team. Category: DevSec Tools & Comparisons
A detection agent in application security is an autonomous, configurable unit of analysis that evaluates code against a specific vulnerability pattern or security policy and returns structured findings. To scale custom vulnerability detection across many repositories, you deploy these agents as modular, language-aware components that run in CI/CD pipelines, share a centralized rule configuration, and pair every detection with remediation guidance. AI-powered agents detect specific vulnerability
Threat Center and Package Firewall for VS Code Extensions
It is not always possible to patch vulnerabilities as quickly as hackers exploit them, but recent figures show just how much this gap has widened. FortiGuard Labs estimates that the time between the disclosure of a critical vulnerability and its active exploitation has dropped sharply to between 24 and 48 hours. By contrast, Verizon’s 2026 Data Breach Investigations Report shows that organizations take a median of 43 days to complete vulnerability remediation. As many leaders in the global finan
If your NGINX/OpenResty servers or Kong gateways pull Lua modules straight from public luarocks.org, one upstream outage can stall every build and deploy that depends on a “rock”. With LuaRocks support in JFrog Artifactory, you host and proxy those modules from a private LuaRocks registry you control, using the native experience you expect, not a …
Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week. The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the fix is in Parallels Desktop 27, a version that Intel Macs cannot install. Yuval Moravchick, who leads
AI agents are rapidly evolving toward more autonomy, more context, greater reach and more authority to act. We have to build security now for what’s coming next. We are making enormous bets right now about how to secure software two years from now, at exactly the moment when software is changing too quickly for anyone […] The post How Do You Build Security for AI Agents That Don’t Exist Yet? appeared first on OX Security.
Built for a new class of active, dynamic risk that traditional cloud security wasn’t built to see. TL;DR OX Cloud is the runtime pillar of the OX AINAPP platform, and our answer to a question most cloud security tools still aren’t built to ask: what is actually happening in your cloud right now, and does […] The post OX Cloud: CNAPP Coverage Plus Runtime Security for AI Agents appeared first on OX Security.
Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The group is also exploiting vulnerabilities in Active Directory and RDP.
Dear Tanja, Over the years you've been many things: an external, then a permanent employee, an engineer, a project manager, and, outside of work, a mother. We'd love to hear more about all of it. Let's start with the job: What is your current role at Adnovum, and what percentage do you work? I'm a Project Manager and Team Lead for our software engineers, working 80%. Given my technical background, though, I stay very hands-on and take on considerably more than typical project management tasks.
Runtime application self-protection (RASP) brought security controls closer to the code they protect. Instead of relying only on perimeter inspection, RASP observes application execution and can intervene when inputs reach dangerous functions or when behavior matches an attack pattern. That approach is valuable for conventional web and API workloads, but enterprise AI agents introduce a ... Read more The post Runtime Application Self-Protection: How It Works and Where It Falls Short for AI Appli
Key findings, Oracle CSPU September 2026 Highlights The September 2026 Critical Security Patch Update includes 673 new security patches across 17 product families. As in prior CSPUs, a single vulnerability can appear in more than one risk matrix when it affects several products. Highlights include: 673 new security patches, down from the record 943 in August and well above June’s 245. September is the second largest CSPU Oracle has issued, a decline of close to 29 percent from August, and the fi
Learn how Observability Pipelines Packs map security logs to Microsoft Sentinel schemas and help control downstream ingest volume.
Use Bits Chat in Slack to investigate incidents, collaborate with responders, make code fixes, and capture follow-up work where your team communicates.
Protect your software supply chain from rising malware attacks. Endor Labs blocks malicious open-source dependencies early and reduces incident response.
A security read of Anthropic's AI-native SDLC playbook and where AI SDLC security has to move: design, build-time hooks, and before the push, with Phoenix Purple. The post Securing the AI-Native SDLC: Where Anthropic’s Playbook Stops and Security Has to Start appeared first on Phoenix Security.
OWASP published the 2026 edition of its Top 10 for LLM Applications on August 4, 2026... The post OWASP Top 10 for LLM Applications appeared first on Cycode.
TL;DR: What Is 8090 Software Factory? A code-completion tool finishes the line you’re typing. A software factory decides what should...
Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client. One appliance-install request later, attacker-controlled code runs as root. While testing Desktop 26.4.0 (build 57513) on Apple silicon, we found that an unprivileged local user …