Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,720 matching stories — announcement, in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Continuous agentic pentesting is the practice of using autonomous AI agents to attack, validate, and report on your web applications on an ongoing basis, every […] The post How to Implement Continuous Agentic Pentesting for the Web appeared first on Reflectiz.
Continuous AI pentesting for teams that can't use the cloud. The Aikido Machine keeps models, code, and results entirely inside your network. Category: Product & Company Updates
These days, we see no shortage of headlines: news of a «Q-Day» that keeps inching closer and big breakthroughs in quantum computing. If you follow any of it, you've probably felt a flicker of unease about what it all means for the security we rely on every day: the security behind our messages, our payments, and the digital infrastructure we all depend on.
Get answers to 20 common questions about continuous offensive security, AI penetration testing, DAST, and AI red teaming.
Watch July’s This Month in Datadog for in-depth conversations with Datadog product leaders about Bits Release, Bits Testing, Bits Chat, and more.
Open source malware doesn't wait for a CVE. Neither should your defenses.
Scaled AI-assisted development creates a visibility gap Coding agents have moved from experiment to everyday engineering workflow faster than many organizations expected. Agent adoption has scaled faster than teams’ ability to understand how AI-assisted changes behave once they reach production. As developers shift from writing code themselves to specifying, reviewing, orchestrating, and refining agent-generated output, […] The post Coding agents are scaling fast. How do teams keep up? app
... The post AIS & AFRL Host Test Event for the National Motor Freight Traffic Association® appeared first on Assured Information Security.
AI killed the patch window. Smarter patch management is how teams keep up.
Malicious packages and AI assets have grown 7.4x in the last three years. And yet, four out of five enterprises have no governance framework for coding agents. The software supply chain has become agentic, yet most enterprises are still securing and governing it with the manual systems from the last era. This moment requires a …
We are actively investigating a coordinated malware campaign affecting a broad set of highly downloaded packages by Jared Wray (GitHub) and affecting the cacheable ecosystem.
As organizations rely more on Salesforce Flows, security risks are moving beyond Apex code. Discover the common vulnerabilities hidden in declarative automation and why comprehensive Salesforce security must include Flow scanning. The post What’s Hiding Inside Your Salesforce Flows? first appeared on DigitSec. The post What’s Hiding Inside Your Salesforce Flows? appeared first on DigitSec.
An attacker hijacked the keyv/cacheable npm maintainer account and shipped a self-propagating Mini Shai-Hulud worm across 2 billion+ monthly installs, reaching most teams transitively through ESLint. Valid OIDC provenance masked the compromise. No CVE was assigned. The post Mini Shai-Hulud keyv/cacheable npm Compromise (No CVE Assigned): Self-Propagating Worm Steals CI, Cloud, and Developer Credentials appeared first on Phoenix Security.
Engineering organizations deploy dependency scanners, train developers, secure endpoints, and establish policies for open source components. Yet malicious packages still reach developer workstations, build systems, and CI/CD environments.
Security teams are drowning in technical debt while engineering ships code faster than ever. Traditional scanning tools are great at detecting flaws, but finding a vulnerability is only the first step. The real bottleneck is fixing it.
If you have spent any time working in app security, you already know the routine. You plug a scanner into your pipeline and run a test. Then, you receive a massive report with thousands of critical vulnerabilities. Security throws the report over the fence to the engineering team. Engineering looks at the sheer volume of alerts. They realize half are false positives or lack context, and push back right away.
In the first post of this blog series, I covered a shift we’re seeing across convenience retail: software that goes beyond reporting and analysis into systems that can help operators take action. That shift raises an obvious question: What has to exist underneath a product like PDIQ for it to consistently act in a reliable way? The answer involves much more than a foundation model. When […]
In response to the cyberattack on US Water Systems, Tenable Public Sector CTO joins MSNOW to discuss what we know and practical strategies for modern security teams, demonstrating how proactive exposure management enables organizations to pinpoint high-risk vulnerabilities and block potential attack paths in real time.
What an SAP penetration testing scope actually contains, layer by layer, from the message server and ICF tree to custom ABAP and the BTP side. The post SAP Penetration Testing: What Gets Tested appeared first on RedRays - Your SAP Security Solution.
What moves the cost of an ABAP code security scan: custom object counts, effective lines, systems in scope, transport gating, triage and retest. The post ABAP Code Security Scan Cost Drivers appeared first on RedRays - Your SAP Security Solution.
The SAP security risks that survive a clean audit: unread custom ABAP, RFC destinations, forgotten ICF services and the BTP layer nobody owns. The post SAP Security Risks Enterprises Still Miss appeared first on RedRays - Your SAP Security Solution.
Every organization surveyed for Cycode's State of Product Security in the AI Era 2026 report confirmed it has AI-generated code in its codebase, and 81% said they lack full visibility into how and where AI is used across the SDLC... The post What Is API Security? Risks, Best Practices, and the Code-First Approach appeared first on Cycode.
Enterprise software no longer sits still long enough to audit... The post Top 10 Continuous Security Monitoring Tools in 2026 appeared first on Cycode.
Agentic Remediation: Remediation at Machine Speed, Grounded in Security Context
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced enhanced AI security capabilities within the Tenable One Exposure Management Platform. Tenable One AI Exposure now delivers expanded platform coverage with support for Google Gemini, extending its coverage across major LLMs: Google Gemini, Anthropic Claude, OpenAI ChatGPT Enterprise and Microsoft Copilot. The release also extends discovery to all major Model Context Protocol (MCP) deployments and AI-native I
Good news doesn't arrive alone. This month we joined not one frontier AI program but two! Yesterday we shared that Escape joined OpenAI's Trusted Access for Cyber. Today we're a verified member of Anthropic's Cyber Verification Program.Both programs solve the same
Keyv and Cacheable are affected with +440 Packages Compromised and Over 2B Monthly Downloads Breaking News: A new Shai-Hulud campaign, attributing itself as “Shai-Hulud: Here We Go Again”, spreads in npm under filenames – math_init.js and Math_Symbol.js, using a preinstall script to execute during install time. Overview A massive Shai-Hulud campaign hit npm, affecting over […] The post A Massive Shai-Hulud Campaign Hits npm: +440 Packages Compromised, Over 2B Monthly Down
The post “You Own the Problem”: Red Hat and Bitsea on Getting Ready for the EU CRA appeared first on Anchore.What Happens When Your Open Source Maintainer Disappears (EU CRA Edition) You find a vulnerability in an open source package. You check for a fix. There isn’t one, because the maintainer walked away from the project two years ago. Under the EU Cyber Resilience Act (CRA), what happens next isn’t ambiguous. That was the question […]
Your coding agent knows the language. It doesn’t know your company. It can’t see the service that consumes the API you just changed, the convention your team settled on last quarter, or the three PRs where a reviewer already rejected this exact pattern. That context exists somewhere in your organization. None of it is in […] The post Bringing Code Governance to Kiro appeared first on Qodo.
A top-tier telecom ran a 36 use-case container security POC against six vendors, on-prem and air-gapped. Here is what it tested and why AccuKnox won.
Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account Category: Vulnerabilities & Threats
keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation order.
Explore Snyk’s first Agentic AppSec capabilities: an autonomous Remediation Agent that fixes vulnerabilities and Malicious Code Defense that blocks risky packages before they ship.
CI Fortify directs critical infrastructure operators to prepare for OT isolation. Learn why communications continuity is essential to coordinating response when normal systems are unavailable or no longer trusted.
An attacker hijacked the keyv and cacheable npm packages on August 4, 2026, shipping a credential stealer with valid provenance. Here's how to respond.
What closed and open models actually do when you tell them to hack a website Summary The cybersecurity capability of a model is currently measured by a solve rate, a percentage, and that number tells you almost nothing worth knowing. It doesn't tell you how the model behaved. It doesn't tell you what it is actually capable of, or where it is lacking, or how far it still is from doing the job end to end. And when you put an agent next to a human practitioner, the entire comparison collapses in
Every engineering org using AI coding agents is climbing the same ladder. Most don’t know they’re on it. And at almost every rung, they measure the wrong thing. We know because we watched it happen. Not just on our own teams, but on customer teams running Wingman inside their coding flow. Same ladder, same traps, […] The post The AI Coding Maturity Ladder, and the One Metric That Survives It appeared first on StackHawk, Inc..
AI Agents Now Read Untrusted Content and Act On It An AI agent in your organization will summarize an email thread today that was never meant for it to read. The user asks something harmless: “What’s on my plate this week? The agent will pull in messages, invites, and documents to answer, and it will […]
There’s a reason “Connections” is in the name of our annual user conference. We’ve built a tightknit community of customers and PDI associates over the last 40 years, and the connections are only growing stronger. But there’s another invaluable group that truly makes every Connections Live conference possible: our sponsors. The conference wouldn’t exist without them, so we want to extend a sincere thank you and shout-out to […]