Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
944 matching stories — announcement, in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Traditional vulnerability management was built for a smaller, slower problem than most teams face today. This post breaks down CTEM, why it exists, how its five stages work, and what it actually takes to move from a reactive pile of findings to a continuous, prioritized risk reduction program.
In this blog, we’ll discuss the common reasons enterprise security audits are delayed, how CERT-In empanelled auditors help complete assessments more efficiently, best practices for preparing your organization, and how proper planning can reduce delays throughout the audit process. Why Audit Delays Are a Challenge for Large Enterprises? Large enterprises often face complex security audits involving multiple applications, business […]
A supply chain attack compromised popular Rust crates, arrayref, append-only-vec, and internment, injecting a dependency on the malicious proc-macro1 package that downloads and executes a remote payload at build time. Category: Vulnerabilities & Threats
Cryptographic Context Injection ships attacker instructions as ciphertext the model decrypts in its own sandbox. It leaked full Grok chat histories, zero-click.
A checklist for scoring AI pentesting vendors on validation, code access, scope control, and reliability, plus the red flags that separate a real platform from a strong demo. Category: Aikido
When HiBob's Global CISO Tamir Ronen needed a solution that could catch complex business logic flaws across their cloud environments, he knew he needed continuous, attacker-grade testing that could extend his internal red team, not another tool generating noise. The post Case Study: How HiBob Scaled Its Internal Red Team and Closed Gaps Across Every Environment appeared first on Novee.
Discover how BOFScale leverages a modified Tailscale daemon compiled as a BOF-PE to seamlessly hide C2 traffic and DERP relays behind CDNs using standard WebSockets. The post BOFScale: A CDN-Fronted Tailnet from a BOF-PE appeared first on NetSPI.
Explore how cyber diplomacy can become an operational capability that helps governments and partners reduce exploitable risk and strengthen resilience across shared ecosystems.
Learn how to operationalize CTEM as a continuous cycle that validates exploitable risk, prioritizes what matters, verifies remediation, and drives measurable risk reduction.
AI pentesting works, but building it in-house is the hard part. Synack VP Chris Brown breaks down the reliability, token economics, model dependency and validation costs that come with building versus buying an AI pentesting capability. The post AI Pentesting Works. Building It Yourself Is the Hard Part. appeared first on Synack.
CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs. We escalated it to full RCE and reported two more bugs, all fixed in 0.14.3. Category: Vulnerabilities & Threats
Cássio De Alcântara is Director, LATAM Sales at Rapid7.Across Latin America, organizations are embracing cloud, AI, and digital transformation to drive innovation and business growth. These technologies create new opportunities, but also introduce greater complexity and expanding attack surfaces.In this environment, security leaders are being asked to understand where risk exists across increasingly distributed environments and quickly eliminate blind spots like Shadow IT and Shadow AI – all wit
What Is the National Credit Union Administration (NCUA)? The National Credit Union Administration (NCUA) is the independent federal agency that regulates and supervises federal credit unions and insures deposits at federally insured credit unions through the National Credit Union Share Insurance Fund.
CISA added 3 vulnerabilities to its Known Exploited Vulnerabilities catalog between 10 and 16 August 2026, all in a single batch on 11 August. Five newly disclosed CVEs reached CVSS 9.0 or above in the window, all of them in SAP’s 11 August Patch Day. Four of the five critical CVEs this week covered in… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 10 Aug to 16 Aug 2026 The post Weekly Report: New Hacking Techniques and Critical CVEs 10 Aug to 16 Aug 20
The week of 10 to 16 August 2026 was defined by third-party access: every major incident reached its victims through a system the victims did not own. A cyberattack on Ceva Logistics exposed customer data across at least six downstream brands including Bol and Valve’s Steam hardware business. Trezor warned nearly 14,000 customers after its… Read More »Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 10 Aug to 16 Aug 2026 The post Weekly Cybersecurity Int
We tested 7 frontier LLMs as Strategizers and Executors inside Hackian's pentesting agent. See how separating planning from execution delivers 95% of top performance at half the cost.
GenAI arrived everywhere at once—and most organizations can't say what AI they run, what it touches, or prove it's under control. An AI risk management platform answers all three with discovery, monitoring, enforced policy, security testing, and auditable evidence.
Fewer than five open-source offensive security agents existed before GPT-4 shipped. By March 2026 Hadrian’s census counted roughly seventy. The good ones are not thin LLM wrappers. They drive nmap, Burp and sqlmap, read the output, reason about what it implies, and choose the next move. That is closer to how a tester works than… Read More »The Top Open-Source AI Pentesting Tools in 2026, and What Each One Leaves You to Build The post The Top Open-Source AI Pentesting Tools
You can’t patch everything. So what do you fix first? Findings in Q2 2026 have changed traditional answers.The latest Quarterly Threat Landscape Report from Rapid7 Labs shows vulnerability disclosures still surging while attackers use automation and AI-assisted tooling to compress the time between disclosure and exploitation. The gap that patch cycles were built to fill is closing. Speed and volume are overwhelming security teams that have relied on traditional patch cycles and reactive programs
Procurement teams play an important role in managing vendor risk. Before approving a security audit provider, they evaluate the auditor’s qualifications, assessment methodology, reporting quality, and ability to support compliance and customer security requirements. Selecting the right security audit partner helps organizations make informed decisions and reduces delays during procurement and vendor onboarding.  In this blog, we’ll explain why procuremen
Ten documented zero-click attacks on AI agents in shipped products: what each one broke, which CVEs followed, and the controls that reduce the risk.
Most engineering teams believe they solved secret scanning the day they flipped on GitHub’s default toggle, but the game doesn’t stop there. In many cases, an overlooked leak can spiral into a severe data breach, especially when an LLM is connected to sensitive data, internal APIs, or production infrastructure. Exposed credentials are hot and always ... Read more
Have you ever tried to answer “Is this container safe to run?” If yes, then you know how tricky that question is. Securing containers is one of the toughest jobs in security, and hunting vulnerabilities across an estate of them gives security folks the same vibe as hunting in the fifth domain. Container vulnerabilities can ... Read more
Somewhere right now, someone is spinning up a fresh Kubernetes cluster, feeling pretty good with a basic firewall, skimmed a hardening guide, and maybe even applied a few CIS benchmarks. What could possibly go wrong? Roughly 18 minutes. That’s the average time before a newly exposed Kubernetes cluster receives its first malicious probe or attack ... Read more
Security teams have no shortage of data. Vulnerability scanners, asset inventories, threat intelligence, ticketing systems, cloud platforms, and compliance tools all contribute information that can help organizations understand and reduce cyber risk. The usefulness of that information depends heavily on how easily it can move between systems. When security data remains fragmented, teams spend more […] The post Your Security Data Is More Valuable When It Works Together appeared first on Car
Aug 17, 2026 - Ayush Sethi - What your workforce's AI prompts reveal in aggregate Most AI security controls judge one prompt at a time. We built Topics to read the layer above them, where a workforce's prompts add up into a pattern that no single message shows.Someone in your legal team pastes a contract that is still under negotiation into an AI tool and asks it to flag any clauses that put you at a disadvantage. To every control watching that message, it is a document question. There is no PII
Operation ASTERIX overviewRapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Among the artifacts was evidence that the operator relied on AI coding assistants throughout the campaign's development; recovered p
OpenAI, Anthropic, Meta and the UK AI Security Institute have each now disclosed agents reaching systems they were never authorised to touch. Luke Potter revisits his original AI agent security analysis with the fuller evidence, and what it demands of containment design. The post The OpenAI agents didn’t go rogue. They went out of scope, together. appeared first on CovertSwarm.
As frontier models add more classifiers to prevent cyber abuse, attackers and defenders are increasingly forced to switch to open-weight models. These models have trailed frontier models by six to nine months, but they have finally reached a point where we believe they can be used for more…
No passwords, no keys in env vars. An agent's identity is minted from what it is verifiably, and proved every time it exercises an authorized capability.
The post reverse engineers how Windows Exploit Guard actually enforces EAF/EAF+, working from payloadrestrictions.dll, the DLL that verifier.dll loads into every protected process. The post Reverse Engineering payloadrestrictions.dll: EAF+ Enforcement in Windows Exploit Guard appeared first on Pikered.
Three essays from November 2024, republished with their original dates — the genome from which Vijil grew.
Discover how NetSPI uncovered and reported vulnerabilities in JFrog Artifactory that allowed unauthenticated attackers to bypass authentication and steal an arbitrary artifact. The post Stealing the Artifact – JFrog Artifactory Vulnerability appeared first on NetSPI.
Hiring a CERT-In empanelled auditor is an important decision for any CISO. The quality of the assessment directly affects your organization’s ability to identify security risks, support compliance requirements, prepare for customer security reviews, and make informed remediation decisions. While multiple organizations may offer similar services, their expertise, testing approach, reporting quality, and post-assessment support can vary significantly. In this blog, we’ll cover the 10 q
Aug 17, 2026 - Ayush Sethi - What your workforce's AI prompts reveal in aggregate Most AI security controls judge one prompt at a time. We built Topics to read the layer above them, where a workforce's prompts add up into a pattern that no single message shows.Someone in your legal team pastes a contract that is still under negotiation into an AI tool and asks it to flag any clauses that put you at a disadvantage. To every control watching that message, it is a document question. There is no PII
Security teams don't need more findings. They need evidence of what matters. Learn how validation turns assumptions into evidence, improves prioritization, and strengthens CTEM programs.
Security Advisory No Exploit Required: Water Utilities Under Active Attack Attackers found programmable logic controllers sitting on the open internet, logged in, and locked operators out. No vulnerability required. Status Active Campaign States Affected 7+ reportedly up to 12 Campaign Start July 27 Exposed PLCs 4,400+ Worldwide The Short Version Since July 27, water and […]