Stop Chasing CVEs: How Red Hat Hardened Images & Anchore Cut Container Noise at the Source
The post Stop Chasing CVEs: How Red Hat Hardened Images & Anchore Cut Container Noise at the Source appeared first on Anchore.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,929 matching stories — in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
New Webinar: Closing the Approval Gap in AI-Era Ad Tech
A single approved marketing tag can quietly load fourth-party code your security team has never seen, granting full access to your forms, customer data, and […] The post New Webinar: Closing the Approval Gap in AI-Era Ad Tech appeared first on Reflectiz.
5 Generative AI Security Risks Compliance Teams Need to Know
Your employees aren't trying to create compliance incidents by using AI tools. They're trying to finish their work faster. According to a 2026 BCG survey, 74% of frontline employees now use generative AI every day or a few times a week. When an employee uses an enterprise AI assistant to summarize a customer contract before a meeting, another pastes application logs into a public generative AI tool to troubleshoot an issue, or a developer relies on an AI coding assistant connected to an internal
Copilot RCE, Entra SSRF, and SharePoint Zero-Day: Critical Vulnerabilities in Microsoft’s July 2026 Advisory
An actively exploited SharePoint zero-day, Copilot command injection, and Entra SSRF top Microsoft's July 2026 advisory. Get the full breakdown The post Copilot RCE, Entra SSRF, and SharePoint Zero-Day: Critical Vulnerabilities in Microsoft’s July 2026 Advisory appeared first on Indusface.
[2026.07 Vulnerability Report] Trends and Mitigation Strategies for High-Risk Joomla Vulnerabilities
Joomla is an open-source content management system (CMS) that helps users efficiently build and manage websites and content. While its adoption rate is relatively low in Korea, it is widely used overseas on a variety of websites, including those of corporations, public institutions, and educational organizations. Joomla allows users to add functionality not only through its core features but also via various extensions such as components, modules, and plugins. While this extension structure offe
[2026.07 Vulnerability Report] Langflow Remote Code Execution Vulnerability (CVE-2026-33017)
CVE-2026-33017 is a critical (CVSS 9.8) unauthenticated remote code execution (RCE) vulnerability in Langflow, an open-source framework for building LLM and RAG pipelines. The flaw exists in the POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which is designed to allow unauthenticated access for public flows but improperly accepts attacker-controlled data from the request body instead of using server-stored flow definitions. This data is used to construct a Custom Component—an extensible
[2026.07 Vulnerability Report] Windows Kernel-Mode Driver UAF (CVE-2026-58602)
CVE-2026-58602 is a Use-After-Free (UAF) vulnerability in the Windows Kernel-Mode Driver that allows a local attacker with low privileges to escalate to SYSTEM-level access on Windows 11 and Windows Server 2025. The flaw stems from improper memory management in kernel-mode driver handling, where a previously freed memory object can be re-referenced via a dangling pointer, enabling arbitrary code execution in the kernel context. Microsoft addressed this vulnerability in the July 2026 Patch Tuesda
Cobalt Launches Autonomous Pentest
Introducing CatastropheBench
CatastropheBench evaluates frontier agents with tasks to find and develop a zero-day RCE exploit against the most important software on the internet. Today's models score zero.
Normalize security logs to Google SecOps UDM with Observability Pipelines
Learn how Observability Pipelines normalizes your telemetry to Google SecOps UDM, enabling both consistent investigations across sources and precise upstream control over your SIEM ingest.
What Is AI Pentesting and How Does It Work?
AI pentesting uses reasoning-capable models to continuously find and validate the flaws scanners miss, especially broken authorization and business-logic abuse.
Zombie CVEs: Put to Rest by Humans, Dug Back Up by AI Agents
New research: 65–75% of frontier AI agents’ working patches resurrect vulnerabilities that were already found, fixed, and buried.  In 2023, a path traversal vulnerability in Starlette, one of Python’s most popular web frameworks  – was found, disclosed as CVE-2023-29159, and fixed. Case closed. The bug was dead and buried, like hundreds of thousands of CVEs before it: discovered by researchers, […]
Checkmarx One for Government Achieves FedRAMP Moderate Certification
A new standard for secure-by-design in the public sector.
EU CRA Compliance Checklist: 5 Steps to Prepare Now
The post EU CRA Compliance Checklist: 5 Steps to Prepare Now appeared first on Anchore.For years, software vendors have been told to build secure products, maintain visibility into their dependencies, patch vulnerabilities, and provide customers with meaningful security information. The European Union Cyber Resilience Act changes the nature of that advice. For many companies, these practices are becoming legal requirements, with reporting obligations beginning this fall and most requirements [&#
Top LLM security tools to protect AI applications
Compare the top LLM security tools for AI applications, including Aikido, Snyk, Semgrep, Endor Labs, and Wiz, across code, supply chain, and runtime. Category: DevSec Tools & Comparisons
Finding Went Exponential. Your Fixing Didn’t.
Defenders and threat actors got handed the same superpower this year. It finds vulnerabilities. The CVE curve is the cleanest public proof we have. 48,185 published in 2025, up 21% over 2024, and 2026 is running far hotter. CVE publication held near 51 a month for nearly four years, then broke. A changepoint analysis lands […] The post Finding Went Exponential. Your Fixing Didn’t. appeared first on StackHawk, Inc..
What Lies Beyond Mythos: What Automakers and Suppliers Need to Prepare for Now
AI-chained attack vectors are changing vulnerability triage. Learn why automakers and suppliers must move from CVSS scores to attack-path prioritization before July 2026.
Top Acunetix alternatives for automated vulnerability scanning
Exploring Acunetix alternatives? Its DAST covers rule-based checks but can't reason about business logic or produce audit-grade pentests. Five options that go further. Category: DevSec Tools & Comparisons
Credentialed Scanning: The Accuracy Upgrade that Comes with a Loaded Gun
Key Takeaways Credentialed scanning (also called authenticated vulnerability scanning) is a vulnerability scan that logs into the target system with valid credentials and inspects it from the inside. Instead of poking at open ports and guessing versions from banners, a credentialed vulnerability scan reads the installed package list, patch level, registry keys, and configuration files ... Read more
Why does the rise of Agentic AI force security teams to become research-aware?
Bruce Schneier : "security is a process, not a product". .toc-smart { position: fixed; top: 120px; left: 20px; width: 200px; font-family: Inter, system-ui, sans-serif; font-size: 10px; line-height: 1.2; z-index: 99; padding-left: 1rem; border-left: 4px solid #d0d0dd; color: #2e2e2e; transition: opacity 0.3s ease; } .toc-smart.hidden { opacity: 0; pointer-events: none;
Best Cloud Penetration Testing Providers in 2026
Key Takeaways: Most cloud breaches begin with a configuration error the customer made. Gartner projected that through 2025, 99% of cloud security failures would be the customer’s responsibility, caused by misconfigured identity and access management, exposed storage, and over-permissioned services.  Cloud penetration testing is the simulation of real-world attacks against cloud infrastructure on AWS, Azure, ... Read more
AI pentesting, Mission log: July
What we shipped in AI pentesting this month.
How Strobes AI identifies and exploits a SQL injection vulnerability
See how Strobes AI runs autonomous SQL injection testing, finding an injectable parameter, proving exploitability, and shipping evidence for remediation.
Human-in-the-loop security: why AI findings need human validation
An AI pentester can hand you a critical finding in minutes. The only question that matters is whether you believe it. Here is why human validation turns a claim into proof.
What to Evaluate Before You Let an AI Agent Exploit Your Systems
An AI agent that can exploit your systems does an attacker's work. Here are the seven governance checks to clear before you authorize agentic pentesting in production.
8 best AI pentesting tools for 2026
AI pentesting means different things from vendor to vendor. Compare the top 2026 tools on autonomy, coverage, strengths, and pricing.
Shift Down, Not Just Left: Why Security Must Adapt to Agentic Era
Security teams have spent the better part of a decade trying to shift left — catching issues earlier in the development lifecycle instead of at the end.  It worked, to a point.  But in a recent OX Security webinar on AI and supply chain risk, Atlassian CISO David B. Cross made the case that the […] The post Shift Down, Not Just Left: Why Security Must Adapt to Agentic Era appeared first on OX Security.
When Anyone Can Build: Gene Kim on What Vibe Coding Breaks First
Gene Kim on vibe coding: he did the math live, 2.8 billion builders. What breaks first isn't the code. It's the line they're all standing in.
Why Model Routing Backfires and How to Build Agents That Don’t Burn Your Budget
Model routing promises to cut your AI agent spend by offloading routine tasks to cheaper models like Claude Haiku while reserving frontier models like Claude Sonnet for complex reasoning. In the right configuration, routing strategies can reduce inference costs by 40–85%. But if you implement routing incorrectly in a multi-turn agent, you can end up …
Better generic secrets detection starts with finding non-secrets
Some API keys are meant to be public. Betterleaks now removes them from generic secret findings, dropping thousands of false positives per scan. Category: News
Top 13 AI security testing solutions for dev pipelines in 2026
Compare the top AI security testing solutions for dev pipelines.
AI Security Remediation Graph: How AI-Powered Vulnerability Fixes Transform Defense
TL;DR An AI security remediation graph combines runtime application intelligence with AI to automatically generate security fixes that work in your production environment. Unlike generic AI tools that provide one-size-fits-all patches, this approach understands your application's specific behavior and creates fixes that reduce remediation time by up to 87%.
Summer Scams: What to Watch For and How to Stay Safe
The post Summer Scams: What to Watch For and How to Stay Safe appeared first on Feedzai.
CVE-2026-53359 (auch bekannt als Januscape): VM-Escape betrifft Linux KVM/x86
Januscape, erfasst unter der Kennung CVE-2026-53359 (CVSS 8.8), ist eine „Use-after-free“-Sicherheitslücke [CWE-825] im Linux-Kernel KVM/x86, durch die ein Gast den Host zum Absturz bringen und möglicherweise die Isolation zwischen Gast und Host durchbrechen kann. Die Ziele mit dem höchsten Risiko sind Intel- und AMD-x86_64-KVM-Hosts, die verschachtelte Virtualisierung zulassen, insbesondere in Umgebungen, die nicht vertrauenswürdige Gäste […]
The StackHawk agent found a vulnerability. Embrace the auto-fix.
Can you trust an AI agent to fix security vulnerabilities? This article explains how StackHawk applies fixes locally, verifies them with a runtime rescan, and relies on your existing code review and CI pipeline to validate every change before it ships. The post The StackHawk agent found a vulnerability. Embrace the auto-fix. appeared first on StackHawk, Inc..
COBOL is back, and AI is writing it. Who's verifying the code?
As AI accelerates COBOL modernization, organizations face a new bottleneck. See why trusted verification is essential for every commit.
Tenable Joins Cisco’s SolutionsPlus Program as an Exposure Management Partner for Vulnerability Management Customers
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced that it has joined Cisco’s SolutionsPlus program to offer its unified exposure management capabilities to Cisco customers. This partnership provides global enterprises with a fast, proven transition to an industry-leading exposure management platform without losing critical visibility into enterprise risk. As a leader in open and connected AI-powered exposure management platforms, the&nb
Coder Signs Strategic Collaboration Agreement with AWS to Scale Secure, AI-Powered Software Development
Coder has signed a strategic collaboration agreement (SCA) with Amazon Web Services (AWS). The agreement will help organizations adopt AI across software development without compromising on security, governance, or cost.
Cobalt Showcases the Future of Offensive Security at Black Hat USA and DEF CON with Product Innovations, Executive Speakers, and New Brand Debut
Codify What Your Best Reviewers Already Know with Rule Miner
Codify What Your Best Reviewers Already Know with Rule Miner Every team has standards nobody wrote down. The reviewer who always catches the same missing null check. The tech lead who rejects PRs that skip error handling in one specific way. The convention nobody documented because everyone on the team already knows it. That knowledge […] The post Codify What Your Best Reviewers Already Know with Rule Miner appeared first on Qodo.