Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,045 matching stories — in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Horizon3 has surpassed $100 million in annual recurring revenue, with ARR growing more than 120% year over year. The milestone reflects increasing adoption of the NodeZero platform, a channel-first growth strategy, and demand for continuous, production-safe autonomous penetration testing. Horizon3 also outlined its next phase of investment in sovereign cyber AI regions, critical infrastructure centers of excellence, and attack-defend AI learning loops.
The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or
Horizon3 researchers analyze CVE-2026-106173, a critical Fortinet FortiSIEM vulnerability affecting an unauthenticated gRPC service. The deep-dive explains how path traversal and null-byte handling enable arbitrary file writes and remote code execution, along with indicators of compromise for defenders.
Aikido launches Noon, a workforce security business. AI governance, device and email protection, and training against AI-powered phishing and deepfakes. Category: Company Updates
Shopify phishing has evolved from the laughable “Dear Shopify Merchant” email into one of the most reliable account-takeover vectors in ecommerce. On the same pattern, Shopify shops have recently been hit with a checkout hijack campaign running through HulkApps, Swym, and Selleasy extensions, where shoppers on legitimate stores were redirected to a fake payment page ... Read more
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
OverviewIn early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Direc
New real-time AI Data Loss Prevention capabilities help organizations securely adopt generative AI while maintaining control over sensitive information. MIAMI, Florida — October 19th — CYBRAL Inc., an AI-driven cybersecurity and risk intelligence company, today announced CYBRAL GUARD AI DLP, extending the capabilities of its AI-driven Data Security Posture Management (DSPM) platform to help organizations protect sensitive information across enterprise and generative AI applications. As...
The models you built are the minority of your AI exposure—the majority arrived inside products you bought. How platforms replace the annual vendor questionnaire with discovery, verification against observed behavior, and assessments that stay alive.
Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits. Category: Compliance
A weakness that looks convincing in one file can vanish once you see the whole application. Luke Potter explains how the Swarm keeps an AI lead separate from a proven finding, and why the practitioner always makes the final call. The post Why a vulnerability research agent has to look beyond one file appeared first on CovertSwarm.
AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable. Category: News
Horizon3 announced a strategic expansion in Singapore, supported by the Singapore Economic Development Board (EDB) and EDBI, part of SG Growth Capital, the strategic investment platform established by EDB and Enterprise Singapore.
This weekly cybersecurity report covers 05 to 11 October 2026, a week defined by attackers reaching through trusted access paths rather than breaking down the front door. Denmark’s national population register was mined for 8.8 million residents’ data through a legitimate company’s own lookup rights. ASOS confirmed a breach after hackers compromised a third-party customer-communication… Read More »Weekly Cybersecurity Intelligence Report: Cyber Threats and Breac
Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.
The critical CVEs this week all arrived in one batch: CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on 08 October 2026, tied to a Chinese state-linked espionage campaign. One of the five, a CVSS 9.8 path traversal flaw in ONLYOFFICE Document Server, carries unauthenticated remote code execution and is the patch-first priority.… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 05 Oct to 11 Oct 2026 The post Weekly Report: New Hack
SAST vs DAST vs SCA compared: definitions, blind spots, DevSecOps fit, OWASP alignment, and where continuous adversarial validation fits alongside all three.
Chinese government-linked threat actors use automated tools and hands-on hacking to steal sensitive data worldwide. AttackIQ examines CISA Advisory AA26-281A and recommends adversary emulations to validate security defenses. The post Response to CISA Advisory (AA26-281A) appeared first on AttackIQ.
AI agents are writing more code than any team can test by hand. Cranium's Joel Neubert on why that makes quality engineers more important, not less, and why everyone now owns testing.
Tim Nordvedt shares the top takeaways from his Dark Reading webinar with KeyCaliber’s Roselle Safran: AI has made finding vulnerabilities cheap, but fixing them still takes limited people, so the real advantage is knowing which exposures matter and showing leadership you’re reducing them. The post Discovery Has Scaled. Remediation Hasn’t: Top Takeaways on Threat Exposure Analytics appeared first on Synack.
Testing AI security without clear scoping produces superficial coverage and unaddressed risk. This post breaks down how to define boundaries, select the right assessment type, and align AI penetration testing, red teaming, and architecture reviews to the decisions that actually matter.
Legal has 340 use cases in a spreadsheet. Engineering ships weekly and has never heard of Annex IV. The obligations applied on 2 August 2026. Here is how to run the classification decision and assemble a technical file without stalling the roadmap.
In this blog, we will discuss, what is tenant isolation in a SaaS platform, why does tenant isolation matter during a cert-in security audit, how can weak tenant isolation create security risks, how should tenant isolation be tested during a cert-in audit, how can SaaS architecture change the audit scope, what tenant isolation risks should […]
Gemini 4 Argon scores 43.7% on the Cyber Defense Benchmark, #3 of 32 LLMs and the biggest generational jump we have recorded. It also refuses at random, caches poorly, and shows less of its work than early Gemini models.
For the ten years I have watched this industry, hunting business logic vulnerabilities has been notoriously expensive and exceedingly difficult. Every attempt to bring the cost down has hit the same wall. Now, for the first time, we as an industry have the capability to meaningfully lower the ceiling on what this work costs. I ... Read more
In 2026, the most interesting conversation happening in the pentesting industry is around autonomous pentesting. For the first time, a handful of vendors, Astra included, are shipping platforms that detect business-logic vulnerabilities and the class of flaws that have traditionally required significant human context to reach. That capability has been the industry’s white whale for ... Read more
Penetration testing gives organizations an opportunity to see their defenses from an attacker’s perspective. But the value of a penetration test depends on more than the number of vulnerabilities it identifies. A test might uncover dozens of weaknesses without clearly explaining which ones pose the greatest threat to business operations. Another might identify a smaller […] The post What to Look for in a Penetration Testing Provider appeared first on Carson & SAINT | Cybersecurity.
This year, we were once again part of Ekoparty with our own booth, where we welcomed clients, colleagues, and cybersecurity professionals, showcased FaradAI in action, challenged the community with our CTF, and joined different stages and spaces to share our research, experiences, and new perspectives on the future of offensive security. A lot happened in […] The post Faraday en Ekoparty 2026: tres días de hacking, research y comunidad appeared first on Faraday.
Building an AI pentester in-house looks easy until you need validation, safety, and risk reduction at scale. Here’s what it really takes — and when to buy instead. The post Stop Building Your Own AI Pentester appeared first on Novee.
Oct 14, 2026 - Ayush Sethi - OpenAI's agents broke out of their sandbox, breached Hugging Face and touched systems at more than 100 organizations. OpenAI still can't say everything they did. If the people inventing AI can't figure out what their agents are doing, how would your organization do?Background: Beyond the HeadlinesWe covered this story on This Week in AI Security, and it has stuck with me since. OpenAI has now notified more than 100 organizations that its AI agents may have accessed t
AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. [...]
Prioritize What Attackers Will Exploit: 4 Elements of Strong Exposure Prioritization With every new CVE, your team needs to know whether attackers can exploit it in your environment and whether your controls would stop or detect the attack. In this research, Gartner® explains how four elements, from threat intelligence to security control validation, work together so you can prioritize what attackers will exploit.
Closing the door doesn’t make a room secure. Alethe Denis breaks down how physical penetration testing evaluates whether unauthorized people can reach sensitive spaces, interact with equipment, or leave something behind without anyone noticing or reporting it.
TL;DR Widespread food spoilage across Europe Over the night of the 11th of October 2026, the fridges and freezers in several hundred French supermarkets were made to warm up. Stock was spoiled across Intermarché, Netto, the U cooperative, Carrefour Market and Monoprix, with E.Leclerc also reported. The Paris prosecutor has reported fires. Losses run into […] The post You don’t need a nation state to warm up a fridge appeared first on Pen Test Partners.
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $
