The context tax: why your coding agent reads the same 600 lines 400 times
Discover how SemSitter powers Sonar Vortex with a codebase graph that gives coding agents precise context across files, documentation, and languages.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,928 matching stories — in Application Security (ASPM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Your Kubernetes cluster is running images your registry scan never checked
The post Your Kubernetes cluster is running images your registry scan never checked appeared first on Anchore.Most container security programs put real effort into scanning images before they reach a registry, then treat the job as done. That’s a reasonable place to focus, but it leaves something out: what’s declared in a manifest and what’s actually running in a live cluster can drift apart fast. An image gets patched in the […]
AI pentesting for APIs: REST, GraphQL, and gRPC at scale
An API scanner that sends more payloads is not automatically conducting a better pentest. It may only be generating more traffic. REST, GraphQL, and gRPC can expose the same customer data and business operations through very different interfaces. REST distributes behavior across resources and HTTP methods. GraphQL concentrates it behind a query language. gRPC combines […]
AI pentesting vs legacy tools: Why runtime proof wins
AI does not beat a legacy scanner because it can write more payloads. An AI model can produce thousands of plausible tests and still leave your AppSec team with a larger, less trustworthy queue. AI pentesting becomes useful when it adapts to application context, builds multi-step attack hypotheses, executes them against the running target, and […]
AI security for enterprise agents: A testing guide
The riskiest part of an AI agent is not the model. It is the authority wrapped around it. An agent that can only draft text creates a content problem when it fails. Give the same agent access to email, source code, customer records, payment systems, or a shell, and a bad decision becomes a business […]
Introducing Agentic Code Scanning: The Holistic Cycode System Around Any Model
TL;DR: Agentic Code Scanning is the fourth dimension of Cycode's code scanning spectrum, not a separate product bolted on... The post Introducing Agentic Code Scanning: The Holistic Cycode System Around Any Model appeared first on Cycode.
Hims & Hers Lawsuit: FTC and Two States Sue Over Website Tracking Pixels
“Private.” “Secure.” “Discreet.” That is how Hims & Hers described its telehealth services to millions of customers. According to the FTC and two states, the […] The post Hims & Hers Lawsuit: FTC and Two States Sue Over Website Tracking Pixels appeared first on Reflectiz.
Hugging Face Security Incident: A New Class of Threat Is Here
What Engineering Teams Can Learn from the Hugging Face Incident, and How Sonatype Can Help Developers Respond at AI-Speed. Hugging Face recently disclosed that part of its production infrastructure has been compromised by an autonomous AI agent system.
China's 'Fire Ant' campaign used compromised Cisco routers as platform for more attacks
How Qodo Builds the Wisdom to Govern, Part 2: The Rules Lifecycle System
Part 1 of this series described the Context Engine, the knowledge layer that gives review agents a verified picture of the system a change lands in: repository structure, pull request history, cross-repository relationships, and the requirements behind the work. Context answers what is there. It does not answer what the organization requires. Those are different […] The post How Qodo Builds the Wisdom to Govern, Part 2: The Rules Lifecycle System appeared first on Qodo.
[2026.08] Threat Intelligence Report
Status of High-Risk Vulnerabilities No. Vulnerability No. (CVE) Content CVSS Risk Level 1CVE-2026-48276Adobe ColdFusion Arbitrary File Upload RCE10CRITICAL 2CVE-2026-48286Adobe Campaign Classic Authorization Bypass RCE10CRITICAL 3CVE-2026-10134IBM Langflow OSS Code Injection10CRITICAL 4CVE-2026-50160Hoppscotch Mass Assignment Authentication Bypass10CRITICAL 5CVE-2026-48316Adobe ColdFusion Improper Input Validation RCE10CRITICAL 6CVE-2026-57572Crawl4AI Docker API Argument Injection RCE10CRITICAL
Visualize how CUPED adjusts experiment results with Datadog
Learn how Datadog visualizes CUPED adjustments so you can trace which covariates change experiment lift estimates and improve precision.
From traces to experiments: A loop for improving AI agents
Learn how to read AI agent traces as a roadmap and how to run production experiments that measure whether improvements hold in production.
Making Rust observability reliable at scale with OpenTelemetry
Learn how Datadog improved Rust tracing by building an opinionated OpenTelemetry-based library to help ensure consistent sampling, propagation, and trace quality at scale.
How to automate pentest reporting without losing report quality
Report quality is decided before the reporting layer runs. Here's the pipeline, the gates that stop bad output shipping, and what a real automated report contains.
We invited a direct competitor into Security Hub Extended. Here’s why.
When customers keep pointing you to a solution that overlaps with parts of your own offering, you have a choice to make. This post is about the choice we made with Upwind, and why we’d make it again. AWS Security Hub Extended exists because customers told us what was working for them in enterprise security […]
Tenable Joins White House-Led Project Watershed to Bolster U.S. Water Systems Cybersecurity
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced that it has joined Project Watershed, a White House-led initiative focused on protecting U.S. water and wastewater systems from cyber threats. Tenable brings expertise in helping organizations unify visibility, including across IT and OT security domains, prioritize risk and automate remediation to keep pace with evolving threats related to cyber exposures in the agentic AI era.Led by the Office of the
Next-Gen Artificial Intelligence and Autonomous Risks: Why AI Supply Chains Need SBOMs | CyBeats
Agentic AI, cognitive AI ecosystems, and AI-powered deepfakes are reshaping the threat landscape. Learn why SBOMs for AI models are essential to securing the AI supply chain.
Scale Synthetic monitoring with granular and team-scoped access control
Scaling up your observability practice often creates access control challenges. Synthetic monitoring is no exception. As more teams rely on synthetic tests to validate releases, automate operational workflows, and monitor the availability of AI or web services, more users and automated systems need the ability to create and execute synthetic monitors. For example, QA teams […] The post Scale Synthetic monitoring with granular and team-scoped access control appeared first on Dynatrace news.
CMMC on Pause: What Companies in the DoD Supply Chain Should Know and Do Next (Part 2 of 4)
Silence Is Now a Statement: Why CISA’s 2026 SBOM Minimum Elements Are a Real Improvement
The post Silence Is Now a Statement: Why CISA’s 2026 SBOM Minimum Elements Are a Real Improvement appeared first on Anchore.For 5 years, the SBOM conversation has been stuck on just generating one, saving it as an artifact, and “it’s done.” That’s what you get from a mandate measuring existence rather than quality: a lot of documents and very little consumption. ENISA’s 2026 adoption survey found more than 60% of respondents naming comprehensive coverage as […]
eBPF Security: What Kernel-Level Visibility Catches, and What It Cannot
eBPF has become an important building block for Linux runtime security because it can observe behavior close to the Linux kernel without changes to every application. Security teams can use it to monitor processes, files, network connections, and system calls across hosts and containers. But kernel-level visibility has a boundary. In an AI agent workflow, ... Read more The post eBPF Security: What Kernel-Level Visibility Catches, and What It Cannot appeared first on Rein Security.
Investigate user sessions end-to-end with the new Session Replay
From failed checkouts to disputed transactions, when something goes wrong in a digital customer journey, you often need more than metrics or events. You need to see what the user saw, what they did, and what exactly happened in the end-user browser or mobile application. The new Session Replay lets you replay the full experience […] The post Investigate user sessions end-to-end with the new Session Replay appeared first on Dynatrace news.
The real test of AI-native code analysis: is your security debt shrinking? | Blog | Endor Labs
The real test of AI-native code analysis: is your security debt shrinking?
CRA-Umsetzung bei Greenbone: So haben wir die Meldepflicht betriebsfähig gemacht
Welche Anforderungen der Cyber Resilience Act zum 11. September 2026 stellt, haben wir bereits in einem eigenen Beitrag zum Umsetzungsstand der CRA-Meldepflicht erläutert. Dieser Beitrag beantwortet die andere Hälfte der Frage: wie die Umsetzung bei Greenbone selbst erfolgt ist. Eine Einordnung vorweg, weil sie für die Übertragbarkeit entscheidend ist: Wir haben nicht alle Maßnahmen neu […]
AI-SDLC Security – From 40 to 800 Commits: What Breaks in Security When Build Stops Being the Bottleneck
Phoenix's engineering output jumped from 40 to 800 commits per developer a month. Code review didn't survive the jump intact — Faros AI's telemetry on 22,000 developers shows 31.3% of PRs now merge unreviewed. Here's what broke, and what we rebuilt around generation instead of inspection. The post AI-SDLC Security – From 40 to 800 Commits: What Breaks in Security When Build Stops Being the Bottleneck appeared first on Phoenix Security.
[2026.08 Vulnerability Report] Claude Code Sandbox Escape (CVE-2026-39861)
Claude Code is an agentic coding tool that reads and modifies files and runs commands in a development environment. CVE-2026-39861 is a sandbox escape vulnerability affecting versions of Claude Code prior to 2.1.64. A process running inside the sandbox could create a symbolic link to a location outside the workspace, allowing a subsequent file write by Claude Code’s unsandboxed process to reach that location without prompting the user for confirmation. Reliable exploitation requires untrusted co
[2026.08 Vulnerability Report] Microsoft SharePoint Server Deserialization Remote Code Execution Vulnerability (CVE-2026-50522)
CVE-2026-50522 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in Microsoft SharePoint Server, caused by insecure deserialization of untrusted data via the legacy BinaryFormatter in the WS-Federation token processing endpoint. An unauthenticated remote attacker can post a specially crafted malicious payload to the /_trust/default.aspx endpoint to execute arbitrary code in the context of the SharePoint service account, requiring no credentials and no user interaction (CVSS
Why Secure Communications Remain a Human Problem
Understand why secure communications depend on human behavior and how agencies can balance security, compliance, and usability.
Build vs Buy Agentic Pentesting and What the DIY Path Costs
Everyone can build a working pentest agent in a weekend. Owning it for two years is the hard part: the four costs nobody adds up, and the seven requirements a demo never has to meet.
4 ASPM Tools to Watch in 2026: Enterprise-Grade Features and Market Insights
Application security in 2026 turns on how well organizations handle the volume of alerts their scanners produce, and on how much of the code producing those alerts a machine wrote. A single feature release still generates findings from SAST, DAST, SCA, IaC scans, and container checks, each landing in a different dashboard and competing for […] The post 4 ASPM Tools to Watch in 2026: Enterprise-Grade Features and Market Insights appeared first on OX Security.
Mini Shai-Hulud hits openapi-react-query-codegen: 10 malicious npm versions
An npm supply chain attack published ten malicious versions
Shai-Hulud – Trinitite: Sponsored by Preview 2 Effects
TeamPCP went to jail, but the spirit of Shai-Hulud lives on: @7nohe/openapi-react-query-codegen was compromised, 128k weekly downloads affected Overview Less than 24h of TeamPCP’s creators arrest in Australia, a new Shai-Hulud malware variant hits npm, specifically compromising @7nohe/openapi-react-query-codegen, a TanStack query generator package. This malware is a variant of the Shai-Hulud malware, now containing the […] The post Shai-Hulud – Trinitite: Sponsored by Preview 2
Mini Shai-Hulud worm hits openapi-react-query-codegen, spreads across npm, RubyGems, and PyPI | Blog | Endor Labs
A compromised release of @7nohe/openapi-react-query-codegen runs a dropper on install through three separate triggers, then harvests cloud credentials and republishes itself across npm, RubyGems, and now PyPI. It shipped with valid npm provenance.
Popular code generator for TanStack Query hit by supply chain worm
A supply chain worm was found hiding in @7nohe/openapi-react-query-codegen, a popular code generator for TanStack Query, stealing credentials and spreading itself to every package the victim maintains. Category: Vulnerabilities & Threats
Securing Docker images
Most of a container's vulnerabilities come from the base image. How to harden Docker images, why hardening is ongoing, and how to patch the base you already run. Category: Guides & Best Practices
OpenTelemetry series: Anatomy of an OTel span
Today, the world is using LLM applications like never before, from the chatbots, assistants, and AI agents you type a question into and get an answer back from. Behind that simple back-and-forth, LLM applications do much of their work out of view, from retrieving context and calling models to generating responses. Spans make those steps […] The post OpenTelemetry series: Anatomy of an OTel span appeared first on Dynatrace news.
Can Agentic AI Security Scale? Inside the Governance Model Behind Amplify's Harness
Security engineering teams have spent the past two years watching AI agents move from novelty to infrastructure. First they wrote code. Then they reviewed code. Now they are being asked to find vulnerabilities, decide which ones matter, and push fixes directly into pull requests. That last step is where most security leaders stop and ask a harder question: who is actually governing the agent?
IBM says a data breach costs $5 million. Verizon says $83,000. Both are right. | AppSecAI
Two of the most-cited breach reports of 2026 appear to disagree by a factor of 60. They don't. The reason they differ is more useful to your board than either number by itself. Bruce Fram, Founder and CEO, AppSecAI — August 2026
From SBOM to Declaration: Closing the CRA 24-Hour Clock Across One Platform
From 11 September 2026, EU Cyber Resilience Act Article 14 gives manufacturers 24 hours to report an actively exploited vulnerability. Most AppSec programmes are built around CVE enrichment, which arrives too late and can't see malicious packages at all. Phoenix's five-stage pipeline turns SBOM, exploitation intelligence, and risk exceptions into one Article 14-ready evidence chain. The post From SBOM to Declaration: Closing the CRA 24-Hour Clock Across One Platform appeared first on Phoenix Sec