Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,928 matching stories — in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Malicious package detection is the practice of identifying open source packages that were published or modified to attack the systems that install them... The post Malicious Package Detection: Why Databases Miss Attacks and Where Detection Has to Fire appeared first on Cycode.
See how SonarQube Cloud builds on Clippy to bring consistent Rust quality, security, compliance, and CI governance across teams.
Explore Claude Opus 5.5 benchmarks covering coding accuracy, complexity, bugs, security vulnerabilities, maintainability and output efficiency.
Bisher hat Cisco in diesem Monat 97 neue CVE-IDs für seine Produkte veröffentlicht. Zwar weisen Sicherheitsforschende darauf hin, dass die reine Anzahl an CVEs kein direktes Maß für das Risiko ist, doch macht die Gesamtzahl den September zum bisher größten Monat für koordinierte CVE-Veröffentlichungen in der Geschichte von Cisco. Zudem handelt es sich bei 32 […]
Aikido found Graphalgo-linked Go malware in Terraform providers and Go Modules, using targeted triggers, Slack, and blockchain C2. Category: Vulnerabilities & Threats
The post FedRAMP & CMMC in 2026: what actually changed for your Authority to Operate (ATO) appeared first on Anchore.If you sell software to the U.S. government, the last few months have been a lot. FedRAMP rev5 still holds until September 2027 but FedRAMP 20x moves to be the new standard. CMMC Phase 2, the requirement for third-party C3PAO certifications, got put on pause. Two of the biggest compliance frameworks a contractor has to […]
TL;DR Why Software Factory Compliance Tools Need More Than Scanners Software factory compliance tools sit between engineering policy and the...
An MCP-enabled assistant is usually given the exact names of the tools available to it. That list is supplied to the model behind the scenes. Sometimes the list does not stay behind the scenes. A user asks the assistant what tools it has, and the model replies with internal names such as search_customers, create_ticket, or […]
TL;DR What The Claude Mythos Vulnerability Query Really Refers To “Claude Mythos vulnerability” turns up in search bars for two...
Software delivery across the Department of War (DoW) depends on speed, but growing use of open source, third-party components, and AI-assisted development makes the software supply chain harder to control. DoW teams need to identify and address risk early without introducing manual gates that slow mission delivery.
A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "
Adobe patched a maximum-severity zero-day. You’ll want to apply it fast, but what if someone already got inside, and what if data is leaving your […] The post StyleSmuggler: The Magento Flaw That Turns a Template Into a Backdoor appeared first on Reflectiz.
Ask your Evo tenant about models, MCP servers, and skills across your AI estate, from the client you already work in.
Learn how we used weak labeling to infer user satisfaction from Datadog telemetry when agent users don’t click thumbs up.
Code Execution in the Datadog MCP Server lets AI agents run investigations as code. In evals, it cut input tokens by 73% and raised accuracy from 74% to 90%.
As organizations race to adopt AI across software development and security, the pressure to move fast is colliding with the mandate to stay economical, repeatable, and defensible. The biggest risk isn’t adopting too slowly. It’s scaling without understanding the true cost of AI. Prefer to listen or watch? Check out our on-demand webinar on this […] The post The real and hidden costs of AI security programs appeared first on Black Duck.
A fake LastPass Authenticator installer offered on GitHub installs a Windows kernel driver that shuts off antivirus and other security software before a password stealer runs if a victim downloads and runs it, researchers at LastPass and Delphos Labs said on September 17. Microsoft's own hardware-compatibility program signs the driver, scored zero detections on VirusTotal when researchers
In short: AI reduces false positives, speeds remediation, and adds semantic, context-aware code review and fix suggestions directly into developer workflows. AI automates detection, triage, and remediation of vulnerabilities in source code. Large language models (LLMs) and purpose-built ML models now analyze code semantically rather than purely syntactically, reducing false-positive rates, generating context-aware fix suggestions, and compressing remediation timelines from days to minutes. For p
In short: AI reduces false positives, speeds remediation, and adds semantic, context-aware code review and fix suggestions directly into developer workflows. AI automates detection, triage, and remediation of vulnerabilities in source code. Large language models (LLMs) and purpose-built ML models now analyze code semantically rather than purely syntactically, reducing false-positive rates, generating context-aware fix suggestions, and compressing remediation timelines from days to minutes. For p
Blocking suspicious install scripts may no longer be enough to mitigate threats from malicious JavaScript dependencies used in software supply-chain attacks. Security researchers at Checkmarx are warning of attackers using a malicious package called “indexed-btree” to impersonate the legitimate sorted-btree library, to spread malware hidden in the package’s normal runtime code. The campaign abandons the preinstall and postinstall scripts common in recent attacks, instead using a core package fun
Aikido Altar is a compressed, open-weight AI model built for sovereign security intelligence, powering Aikido Machine's on-prem, air-gapped pentesting. Category: Company Updates
Discover how Hunter Agent helps regulated software teams find complex vulnerabilities, strengthen assurance, and create traceable compliance evidence.
We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail monitoring strategies. The post From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies appeared first on Unit 42.
Three months ago, we changed our approach to AI pentesting and introduced Cascade, our multi-agent pentesting product that keeps memory of engagements relevant to your business. Since then, we've watched it run hundreds of times with our partners, and worked relentlessly to improve it in the areas that
Learn the top llm development risks, from prompt injection to data leakage, plus practical mitigation strategies for secure AI apps
Learn how to assess vulnerability blast radius, understand BlastRADIUS, and reduce risk with reachability, segmentation, and fixes
TL;DR: what autonomous pentesting is going to absorb I have watched the security industry run a very profitable game with abbreviations for the last decade. The simple way to do it is to invent a category, give it a cool catchy abbreviation, market it as the missing piece of the stack, and repeat. The greatest ... Read more
The security industry killed CVE coverage as a credible metric, and it deserved to die. Vendors inflated the numbers for years in the name of depth, and nobody in the room had an incentive to ask whether they reflected real validated risk or just a longer signature list. So “CVE coverage is a vanity metric” ... Read more
Prompting an agent to fix a vulnerability is a task, running a Product Security or Application Security program across hundreds of repos (or more) is a system, and the gap between them is the entire product.
Attackers have already figured out that capability no longer scales with headcount. The tooling to run the kind of simultaneous, multi-target campaign that used to take a whole crew is now…
Ask a good pentester which class of vulnerability does the most damage, and the answer comes back with unsettling regularity: authorization bugs. Broken object-level authorization (BOLA), broken…
Strobes has run Claude-powered agentic pentests under Anthropic's Cyber Verification Program since June 2026. Here's what the program gates and what changed in three months.
Use Journey Paths in Datadog Product Analytics to quantify how users convert, investigate drop-offs, and find friction between funnel steps.
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from
In March 2026, LangChain took its coding agent from Top 30 to Top 5 on Terminal Bench 2.0 without touching the model or fine-tuning a single weight... The post AI Agent Harness: The Layer That Decides Whether AI Security Works appeared first on Cycode.
Auto remediation in application security (AppSec) is the automated process that detects, triages, and fixes security vulnerabilities in code, dependencies, or infrastructure configurations without requiring manual developer intervention for every finding. It combines vulnerability scanners (SAST, DAST, SCA) with automated fix-generation engines that produce patches, dependency upgrades, or configuration changes, then submit those fixes as pull requests or direct commits into the development work
You’ve run kubectl describe pod. Your dashboard shows 40 millicores requested for the api-server container. You probably assumed your monitoring had the full picture. The Kubernetes scheduler actually reserved 1000 millicores — a full CPU core — for it. How could both values be true? If you’re sizing clusters, building cost models, or tuning HPA […] The post Your pod may be requesting 25× more CPU than you think — and Kubernetes won’t tell you appeared first on Dynatrace news.
Model safety and deployment safety are two different disciplines with two different owners. Here is what enterprises are responsible for, and what it takes to hold it.
... The post AIS Brings Hands-On ICS Cybersecurity Expertise to Colorado State University Workshop appeared first on Assured Information Security.
cPanel disclosed a critical EmailTrack flaw letting standard mail accounts reach root access. Check affected versions, patch links, and remediation steps. The post CVE-2026-67401: SQL Injection in cPanel’s EmailTrack Puts Shared Hosting Environments at Risk appeared first on Indusface.