Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,046 matching stories — in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
In this blog, we will explain how a customer account can become a starting point for privilege escalation in a web application. We will cover restricted functions, admin panels, APIs, HTTP methods, role parameters, object authorization, and mass assignment issues that can allow customer-level users to reach higher-privilege functions. We will also explain how Web […]
49 AI agent security resources from September 2026: Gemini breaching three companies, 2,000 malicious RubyGems packages, and a zero-click Agentforce hijack.
The bugs could lead to authentication bypass, shell command execution, and memory corruption. The post Fortra Patches Critical Vulnerabilities in BoKS appeared first on SecurityWeek.
N0n is a newly-emerged cyber extortion gang. The group was first spotted in the middle of September 2026, and within days it had published on its dark web leak site details of what it claimed to be around a dozen victims. Since then, the tally has continued to grow. Read more in my article on the Fortra blog.
In this blog, we will explain what changes when a payment gateway or third-party integration is added to a web application. We will look at payment requests, APIs, redirects, callbacks, sensitive data, security misconfigurations, business logic, and common payment-related risks. We will also discuss how Web Application Penetration Testing can help identify weaknesses in payment […]
See how Horizon3 and CrowdStrike connect NodeZero exploitability intelligence with Falcon Next-Gen SIEM and Fusion SOAR to prove, prioritize, remediate, and verify exploitable risk.
We’re pleased to share that Ridge Security has been accepted into NVIDIA Inception, NVIDIA’s program for startups building breakthrough AI. Ridge Security joined in September 2026, giving the team behind RidgeGen, our […] The post Ridge Security Joins NVIDIA Inception appeared first on Ridge Security.
October 2026's AI coding agent security roundup: git config hijacks in seven agents, swapped plugin pins, sandbox escapes, and 13,000 leaked screenshots.
Oct 02, 2026 - Ayush Sethi - This is a broad release, and most of it is about precision. It sharpens who FireTail can attribute AI usage to, makes governance adaptive so it improves as your workforce uses AI, and adds harder access controls like restricting AI to corporate accounts. The throughline is the one we keep coming back to: see what AI is running across your organization, govern how it gets used, and be ready to show your posture when someone asks.Here is everything that shipped, groupe
OverviewRapid7 tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Rekoobe build seen against South Korean targets, a dropper, and six builds of a Linux implant we track as AVERAT, deployed against Taiwanese appliances. Additionally, we provide source code details of the Rapid7 BPFDoor controller introduced in our April 2026 blog, Stealthy BPFDoor Variants are a Needle Th
We compare the top vulnerability remediation tools in 2026: Aikido Security, Snyk, GitHub Advanced Security, Tenable, Qualys, and Wiz Category: DevSec Tools & Comparisons
Synack was named a Leader in G2's Fall 2026 Grid® and Enterprise Grid® Reports for Penetration Testing. The reviews show what customers value in a pentesting partner: visibility into testing, access to experts, findings they can fix and verify, and a partner that acts on feedback. The post What Customers Value in a Penetration Testing Partner: Insights from G2 Reviews appeared first on Synack.
Frontier AI made finding vulnerabilities fast and abundant. Vulnerability remediation is now the bottleneck, and the step that fails quietly is proving the fix.
Simbian, Intezer, Dropzone AI, Charlotte AI, and Microsoft's triage Agent, compared on what matters once an XDR is in place: acting back through it, seeing past it, and covering more than one.
Five AI SOC Agents compared, from their own documentation, on how they work with a SIEM you already own: where they query, what they write back, and what breaks when the SIEM changes.
Every time a new AI capability lands in security operations, someone asks how many analysts it lets us cut. It’s become almost reflexive. But it might be the wrong question, […] The post The Future Of Human-Machine Teaming: Why AI Won’t Replace Security Operators appeared first on Ridge Security.
We compare the top threat intelligence feeds in 2026: Aikido Intel, Socket Threat Feed, Snyk Security Database, OSV.dev, and Spectra Intelligence (ReversingLabs) Category: DevSec Tools & Comparisons
Security tool sprawl slows teams down. State of Threat Management data shows how connected workflows help them act on known risks faster.
Security leaders at key financial institutions in Singapore now have a new line in their compliance calendars: AI-assisted red teaming, a requirement MAS introduced on 1 July 2026. What appears to be a scoping exercise actually asks a harder question, i. e., how does a bank differentiate between another convincing report and one that secures ... Read more
Before you build an AI pentesting agent, run it through 5 tests for production readiness. Mark Kuhr breaks down what separates a prototype from a system. The post Build or Buy AI Pentesting? 5 Tests to Judge Production Readiness appeared first on Synack.
Security activity doesn’t always equal risk reduction. Learn how attack paths, business impact, verification, remediation speed, and recurrence can show whether CTEM is actually working.
On September 1, 2026, OpenAI announced that its Astra model had reached the Critical tier for cyber capability under the company’s Preparedness Framework, a first for its systems. While working through an internal benchmark of 20 recently disclosed vulnerabilities in Google’s V8 engine, the model found two zero-days that no one had asked it to ... Read more
An unauthenticated attacker who can reach TCP 19009 on a Check Point management server can take it over completely. Bishop Fox reproduced the full root RCE chain on R81.10 and R82.10, breaks down all three vulnerabilities the patch actually closes, and shares a safe detection tool for defenders.
Question 14 on the customer questionnaire asks which models process their data and whether any of it was used for training. You can answer for the two systems your team built, and for none of the eleven you did not. An AI-BOM is what closes that gap.
As AI takes on more of the enrichment, correlation, and initial assessment inside the SOC, roles, skills, and KPIs still require deliberate redesign. Security leaders need to decide where automation is dependable, where human judgment should remain decisive, and how teams should be measured when alert handling is no longer the center of the operating modelThe Gartner® report, The Roles Required for the AI-Enabled Security Operations Center (SOC), examines the roles and capabilities Gartner expec
Comparing the top endpoint security tools for developers in 2026. We look at Aikido Security, GitGuardian Developer Endpoint Protection, Koi Security, Socket, and CrowdStrike Falcon Category: DevSec Tools & Comparisons
CVE-2026-76504 is a critical, actively exploited Cisco Catalyst SD-WAN Manager vulnerability that allows unauthenticated API access as the admin user. Horizon3 reverse engineered the flaw, and NodeZero® Rapid Response safely validates exposure.
Skyhawk Security is named as a Sample Vendor in Gartner’s new research, Agentic Security: Preemptive Exposure Management Demands AI-Driven Validation and Autonomous Interdiction, published September 28, 2026. We’re proud of the recognition. In our opinion, it reflects something we have believed since the start: defenders cannot keep up with AI-powered attackers by counting vulnerabilities. They […] The post Skyhawk Security mentioned in the 2026 Gartner® Agentic Security: Preem
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding (CWE-177). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.According to Ci
AI-assisted research is flooding the CVE pipeline with bugs that score critical but depend on configurations almost nobody runs. Bishop Fox tested four high-profile Nginx CVEs in the lab, measured real-world prevalence, and explains how to separate actual risk from well-marketed noise.
Anyone can find a bug in a deliberately-vulnerable app. The harder question — the one that actually matters in production — is: can you run a real security program end to end and prove a fix held? Find it, prove it’s exploitable, prioritize it, patch it, and re-test to confirm it’s closed. This post runs that whole […] The post Six Damn-Vulnerable Apps, One Autonomous Loop appeared first on Faraday.
Why Pentest Proposals Never Seem to Match A compliance officer receives a request for a penetration test, contacts several providers, and receives proposals that appear to describe completely different services. One covers external IP addresses, another includes applications and APIs, and a third promises audit-ready evidence without explaining what was tested. This guide to penetration […] The post Penetration Testing for Compliance Officers: A Non-Technical Buyer’s Guide appeared f
The question for security leaders is who's in charge of the agents that test their defenses. We think it should be ethical hackers. That's how we're building our agentic capabilities. The post CovertSwarm named a Sample Vendor for Agentic Red Teaming in the Gartner® Emerging Tech Impact Radar: Preemptive Cybersecurity appeared first on CovertSwarm.
Multi-tenant SaaS platforms serve many customers through a shared application, making proper access control and tenant separation important security concerns. A privilege escalation issue can allow a user to access functions, records, or tenant data beyond the permissions assigned to that account. In this blog, we will discuss How Web Application Penetration Testing Finds Privilege […]
Agentic AI Security Model safety is not agent safety. Confusing the two may become one of the more consequential mistakes we make as AI moves from answering questions to taking actions. Agentic AI security is the practice of keeping an autonomous AI agent safe while it acts, not just while it answers. It sits downstream… Read More »Your AI Agent Is Safe. Until It Starts Acting. The post Your AI Agent Is Safe. Until It Starts Acting. appeared first on FireCompass.
The company plans to close the deal around the end of the year at which point Paragon will begin trading on Nasdaq under the REDLattice umbrella.
Skyhawk Security is proud to be named a Sample Vendor for Intelligent Simulation in Gartner Emerging Tech Impact Radar: CSP Infrastructure and Operations, published September 22, 2026. In our opinion it is the only security-focused company on that vendor list, and we believe that says something important about where cloud defense is heading. In the […] The post Skyhawk Security Named in 2026 Gartner® Emerging Tech Impact Radar: CSP Infrastructure and Operations report appeared first on Sky