Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
943 matching stories — announcement, in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Oct 20, 2026 - Ayush Sethi - An AI agent with “read-only” access to Shane Mac's bank account posted his balances and spending into his company's executive Slack channel, under his name. Nobody asked it to. If a personal agent can do that to its own owner, what can the ones your employees have connected to your systems do to you?Shane Mac ran into an unexpected problem with his personal AI agents.Background: Beyond the HeadlinesWe covered this story on This Week in AI Security, and it really made
Horizon3 has surpassed $100 million in annual recurring revenue, with ARR growing more than 120% year over year. The milestone reflects increasing adoption of the NodeZero platform, a channel-first growth strategy, and demand for continuous, production-safe autonomous penetration testing. Horizon3 also outlined its next phase of investment in sovereign cyber AI regions, critical infrastructure centers of excellence, and attack-defend AI learning loops.
The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia's October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or
Shopify phishing has evolved from the laughable “Dear Shopify Merchant” email into one of the most reliable account-takeover vectors in ecommerce. On the same pattern, Shopify shops have recently been hit with a checkout hijack campaign running through HulkApps, Swym, and Selleasy extensions, where shoppers on legitimate stores were redirected to a fake payment page ... Read more
WhatsApp argued that NSO Group violated a 2025 injunction against using the messaging app to spread spyware. A federal judge said WhatsApp hurt its case by not revealing enough information.
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
The models you built are the minority of your AI exposure—the majority arrived inside products you bought. How platforms replace the annual vendor questionnaire with discovery, verification against observed behavior, and assessments that stay alive.
Drata and Aikido bring AI pentesting into your compliance workflow. Get verified findings, auditor-ready reports, and up to $4,000 in free pentest credits. Category: Compliance
A weakness that looks convincing in one file can vanish once you see the whole application. Luke Potter explains how the Swarm keeps an AI lead separate from a proven finding, and why the practitioner always makes the final call. The post Why a vulnerability research agent has to look beyond one file appeared first on CovertSwarm.
AI pentesting lets security teams test more often without raising the budget. Learn how upfront pricing and forecasts keep costs predictable. Category: News
Reachable CVEs can still be safe in your app. See how reachability vs exploitability analysis helps you decide which dependency vulnerabilities to fix first. Category: News
Explore how NodeZero autonomous penetration testing connects application, cloud, identity, and infrastructure weaknesses into validated attack paths, helping banks prioritize remediation and build evidence for the ECB’s cybersecurity supervisory recommendations.
Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone, was of the latter kind.Virus Bulletin created the award to honor Péter's life and work, and it recognizes outstanding technical security research: the rigorous, the deep, and the useful – exactly what he was known for himself. And as far as recognitions in our industry
This weekly cybersecurity report covers 05 to 11 October 2026, a week defined by attackers reaching through trusted access paths rather than breaking down the front door. Denmark’s national population register was mined for 8.8 million residents’ data through a legitimate company’s own lookup rights. ASOS confirmed a breach after hackers compromised a third-party customer-communication… Read More »Weekly Cybersecurity Intelligence Report: Cyber Threats and Breac
Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.
The critical CVEs this week all arrived in one batch: CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on 08 October 2026, tied to a Chinese state-linked espionage campaign. One of the five, a CVSS 9.8 path traversal flaw in ONLYOFFICE Document Server, carries unauthenticated remote code execution and is the patch-first priority.… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 05 Oct to 11 Oct 2026 The post Weekly Report: New Hack
SAST vs DAST vs SCA compared: definitions, blind spots, DevSecOps fit, OWASP alignment, and where continuous adversarial validation fits alongside all three.
Horizon3 has promoted Keith Poyser to General Manager, EMEA, following more than 260% regional revenue growth in the last fiscal year. Poyser grew the regional team from eight to more than 110 employees and will lead the company's next phase of expansion across Europe, the Middle East and Africa.
Chinese government-linked threat actors use automated tools and hands-on hacking to steal sensitive data worldwide. AttackIQ examines CISA Advisory AA26-281A and recommends adversary emulations to validate security defenses. The post Response to CISA Advisory (AA26-281A) appeared first on AttackIQ.
AI agents are writing more code than any team can test by hand. Cranium's Joel Neubert on why that makes quality engineers more important, not less, and why everyone now owns testing.
Tim Nordvedt shares the top takeaways from his Dark Reading webinar with KeyCaliber’s Roselle Safran: AI has made finding vulnerabilities cheap, but fixing them still takes limited people, so the real advantage is knowing which exposures matter and showing leadership you’re reducing them. The post Discovery Has Scaled. Remediation Hasn’t: Top Takeaways on Threat Exposure Analytics appeared first on Synack.
Testing AI security without clear scoping produces superficial coverage and unaddressed risk. This post breaks down how to define boundaries, select the right assessment type, and align AI penetration testing, red teaming, and architecture reviews to the decisions that actually matter.
Legal has 340 use cases in a spreadsheet. Engineering ships weekly and has never heard of Annex IV. The obligations applied on 2 August 2026. Here is how to run the classification decision and assemble a technical file without stalling the roadmap.
In this blog, we will discuss, what is tenant isolation in a SaaS platform, why does tenant isolation matter during a cert-in security audit, how can weak tenant isolation create security risks, how should tenant isolation be tested during a cert-in audit, how can SaaS architecture change the audit scope, what tenant isolation risks should […]
Gemini 4 Argon scores 43.7% on the Cyber Defense Benchmark, #3 of 32 LLMs and the biggest generational jump we have recorded. It also refuses at random, caches poorly, and shows less of its work than early Gemini models.
For the ten years I have watched this industry, hunting business logic vulnerabilities has been notoriously expensive and exceedingly difficult. Every attempt to bring the cost down has hit the same wall. Now, for the first time, we as an industry have the capability to meaningfully lower the ceiling on what this work costs. I ... Read more
In 2026, the most interesting conversation happening in the pentesting industry is around autonomous pentesting. For the first time, a handful of vendors, Astra included, are shipping platforms that detect business-logic vulnerabilities and the class of flaws that have traditionally required significant human context to reach. That capability has been the industry’s white whale for ... Read more
Penetration testing gives organizations an opportunity to see their defenses from an attacker’s perspective. But the value of a penetration test depends on more than the number of vulnerabilities it identifies. A test might uncover dozens of weaknesses without clearly explaining which ones pose the greatest threat to business operations. Another might identify a smaller […] The post What to Look for in a Penetration Testing Provider appeared first on Carson & SAINT | Cybersecurity.
This year, we were once again part of Ekoparty with our own booth, where we welcomed clients, colleagues, and cybersecurity professionals, showcased FaradAI in action, challenged the community with our CTF, and joined different stages and spaces to share our research, experiences, and new perspectives on the future of offensive security. A lot happened in […] The post Faraday en Ekoparty 2026: tres días de hacking, research y comunidad appeared first on Faraday.
Building an AI pentester in-house looks easy until you need validation, safety, and risk reduction at scale. Here’s what it really takes — and when to buy instead. The post Stop Building Your Own AI Pentester appeared first on Novee.
Oct 14, 2026 - Ayush Sethi - OpenAI's agents broke out of their sandbox, breached Hugging Face and touched systems at more than 100 organizations. OpenAI still can't say everything they did. If the people inventing AI can't figure out what their agents are doing, how would your organization do?Background: Beyond the HeadlinesWe covered this story on This Week in AI Security, and it has stuck with me since. OpenAI has now notified more than 100 organizations that its AI agents may have accessed t
AI-powered penetration testing can uncover complex attack paths, but safety restrictions and network limitations leave many assets and vulnerabilities untested. Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps. [...]
Prioritize What Attackers Will Exploit: 4 Elements of Strong Exposure Prioritization With every new CVE, your team needs to know whether attackers can exploit it in your environment and whether your controls would stop or detect the attack. In this research, Gartner® explains how four elements, from threat intelligence to security control validation, work together so you can prioritize what attackers will exploit.
Closing the door doesn’t make a room secure. Alethe Denis breaks down how physical penetration testing evaluates whether unauthorized people can reach sensitive spaces, interact with equipment, or leave something behind without anyone noticing or reporting it.
TL;DR Widespread food spoilage across Europe Over the night of the 11th of October 2026, the fridges and freezers in several hundred French supermarkets were made to warm up. Stock was spoiled across Intermarché, Netto, the U cooperative, Carrefour Market and Monoprix, with E.Leclerc also reported. The Paris prosecutor has reported fires. Losses run into […] The post You don’t need a nation state to warm up a fridge appeared first on Pen Test Partners.
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a web page, the company said. Its researchers built the attack in six days by directing AI agents running OpenAI's publicly available GPT-5.6 Sol model. Google has since confirmed all three bugs, fixed them, and paid XBOW its top $
