Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,928 matching stories — in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
CVE-2026-89122 lets a crafted link load attacker-controlled content through SAP Enterprise Portal. EP-RUNTIME patch levels and navigation checks. The post SAP Note 3790401: Enterprise Portal Open Redirect (CVE-2026-89122) appeared first on RedRays - Your SAP Security Solution.
SAPUI5 changes URLListValidator defaults in CVE-2026-89106. Fixed runtime versions and practical checks for applications with custom URL allowlists. The post SAP Note 3799054: SAPUI5 URL Validation XSS (CVE-2026-89106) appeared first on RedRays - Your SAP Security Solution.
Security tool consolidation fails because traditional security tools operate outside application runtime where attacks actually execute. While consolidation can reduce complexity and centralize alerts, it cannot fix the fundamental blind spot: WAFs, EDR and SIEM platforms lack visibility into actual code execution, data flows and application logic. The solution isn't more consolidation or new tools, but enriching existing security investments with Application Detection and Response (ADR) to prov
See how secure, interoperable communications help emergency services, and healthcare teams coordinate response, protect data, and maintain operations.
Learn how Datadog classifies internal services by criticality using incident history, APM traces, monitor data, and traffic signals.
We surveyed 500 security and engineering leaders on how often they pentest, how far AI pentesting adoption has come, and what they need to rely on it.
What to look for in an AI pentesting tool: 9 questions covering data handling, safety, auditor-ready reports, false positives, and retests.
What is AI security? Learn the 3 meanings, key risks, and best practices to secure AI systems, AI defenses, and AI-generated code
Learn how application security testing reduces noise, finds exploitable risk, and helps teams prioritize the fixes that matter most
Learn CI/CD supply chain security best practices to harden pipelines, reduce exploitable risk, secure dependencies, and prove integrity
The way software gets built has changed faster than the standards that govern it. AI agents now create pull requests, select dependencies, refactor codebases, interpret test failures, and execute infrastructure changes across the entire Software Development Life Cycle (SDLC). AI agents are autonomous team members, but unlike human engineers, they are ephemeral: their reasoning, decisions, …
Anthropic's models found 29,439 candidate vulnerabilities in open source. Its dashboard shows 516 patched upstream. That 1.75% is the real story. Vulnerability management now depends on prioritisation, ownership and how fast you consume upstream fixes, because exploits arrive in minutes and median KEV remediation sits at 43 days. The post From 29,000 Findings to 516 Fixes: Why Vulnerability Management Must Move to Remediation appeared first on Phoenix Security.
Selling to banks or government? Aikido now offers CREST-accredited penetration testing, plus AI pentesting between audits. Category: Compliance
GitLab warned users today to immediately patch a maximum-severity vulnerability in the CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. [...]
CVE-2026-104286 (CVSS 9,8, EPSS ≥ 82. Perzentil) ist eine kritische Path-Traversal-Schwachstelle [CWE-22] in Verbindung mit einer fehlerhaften Verarbeitung von NULL-Bytes [CWE-158] und betrifft Fortinet FortiMail. Eine Ausnutzung ist über HTTP/HTTPS-Anfragen an die Weboberfläche von FortiMail möglich. Die Schwachstelle wurde am 1. Oktober 2026 sowohl veröffentlicht als auch in die KEV-Liste der CISA aufgenommen. Eine erfolgreiche […]
Fin's AI agents outpaced its review process. See how shared standards and low false positive rates keep AI code review trustworthy. Read the lessons.
Fuzz testing is now a team sport Security teams don’t fuzz test in isolation. QA engineers, security teams, protocol experts, and CI/CD pipelines all contribute to the process. Until now, collaborating through a shared Black Duck Defensics® environment, sharing test configurations, and gaining visibility into results wasn’t easy. With the latest release, that changes. You […] The post Improve collaboration with Defensics multiuser deployment appeared first on Black Duck.
The Marketplace designation gives federal agencies a clearer basis for planning around the latest Dynatrace platform while certification work continues. The post Dynatrace reaches FedRAMP Class D (High) Initial Implementation status appeared first on Dynatrace news.
The post Anchore DoWI 8430.01 SBOM Requirements appeared first on Anchore.
ISO/IEC 27001:2022 helps organizations protect information, manage security risks, and build customer trust through an Information Security Management System (ISMS). For businesses pursuing ISO 27001... The post ISO 27001 Implementation Checklist: Step-by-Step Guide for Small Businesses in 2026 appeared first on Varutra Consulting.
New frontier models ship almost every month. Each release can change the balance of quality, cost, and speed available to teams building with AI. Code review brings those trade-offs into focus: how many bugs can a model catch, how much noise does it create, and what does each review cost? At Qodo, review and governance […] The post Which LLM should review your code? appeared first on Qodo.
Clear information security policies help organizations establish responsibilities, manage risks, and support an effective Information Security Management System (ISMS). For businesses pursuing ISO/IEC 27001:2022 certification,... The post The 10 Mandatory ISO 27001 Policies You Cannot Skip (with Policy Templates Strategy) appeared first on Varutra Consulting.
ISO 27001 certification helps organizations demonstrate a structured approach to information security. Audit findings can arise when an Information Security Management System (ISMS) is incomplete,... The post 7 Common Reasons Companies Fail Their ISO 27001 Audit (And How to Avoid Them) appeared first on Varutra Consulting.
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR […] The post Agentic Pentesting for Websites: A CISO’s Guide to Closing the Exploit Gap appeared first on Reflectiz.
Cybersecurity researchers have disclosed details of a two-pronged artificial intelligence (AI)-augmented initial access campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure entities in Ukraine. The activity, which brings together commodity offensive tools like Cobalt Strike with an AI orchestration layer powered by Anthropic's Claude Code, has been attributed
The New Era of Cyberattacks: What a “Secure Device” Means Now
Three government agencies warn that state-sponsored attackers are using consumer messaging apps to impersonate trusted contacts, deliver malware, and bypass enterprise security controls.
How the SBOM links threat modeling, risk assessment and testing in FDA premarket submissions. For current rules, see the CyBeats FDA SBOM requirements guide.
What FDA's April 2022 draft guidance said about SBOMs for medical devices. Superseded; see the CyBeats guide to current FDA SBOM requirements.
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity
Learn how vulnerability remediation works for each type of flaw and what to do when upgrading a dependency breaks your build or isn't an option. Category: DevSec Tools & Comparisons
We compare the top developer security tools for enterprise teams on signal quality, governance, and remediation: Aikido Security, Snyk, GitHub Advanced Security, SonarQube, Checkmarx, and Endor Labs Category: DevSec Tools & Comparisons
Continuous offensive security testing is not faster pentesting. See the standard of proof it runs on, and how to build your program around it.
GPT-6.1 Sol writes 39% more code than GPT-6 Sol, with a higher pass rate and lower finding density. See the full code quality and security evaluation.
Sony patched seven XAV-9500ES vulnerabilities affecting Wi-Fi, Bluetooth, and USB. VicOne examines the attack paths, potential impact, and next steps.
Replacing legacy DAST across hundreds of applications creates two immediate risks: losing security coverage during the transition and carrying the same vulnerability backlog into a new platform. A successful migration needs more than new scanning software. You must establish which applications are currently tested, identify gaps in authenticated and API coverage, preserve unresolved findings and […]
Every enterprise DAST vendor promises better vulnerability detection. The harder question is what happens after the scan finishes. Can your team reproduce the findings? Did the scanner reach authenticated workflows and business-critical APIs? How much work will developers need to complete before a vulnerability is resolved? These questions matter as application portfolios grow and release […]
Uncover how indirect prompt injection and tool poisoning allow attackers to exfiltrate private data via AI agents—all without stealing a single credential.