Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,046 matching stories — in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Horizon3 announced a new integration that brings validated NodeZero® findings into CrowdStrike Falcon® Next-Gen SIEM, helping security teams correlate exploitable exposure with broader security telemetry.
OverviewOn September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected appliance.Cisco Secure Email Gateway, formerly known as IronPort Email Security Appliance, is an enterprise email security product
Your vulnerability report is sorted by severity. The adversary looking at the same environment is sorted by path. That mismatch is the whole problem. Open any scanner output, and you get a tidy hierarchy: criticals at the top, then highs, then a long tail of mediums and lows that most teams will never touch. To ... Read more
GitLab has released security fixes for CVE-2026-85706, a critical path traversal vulnerability affecting both GitLab Community Edition (CE) and Enterprise Edition (EE) with a maximum CVSS score of 10.0. The flaw allows unauthorized access to server-side files, risking exposure of sensitive source code and development infrastructure. Following confirmation of its addition to CISA’s Known Exploited Vulnerabilities (KEV) catalog, organizations managing self-hosted GitLab instances are strongly urge
VAPT testing does not end when the security assessment report is delivered. The findings need to be reviewed, prioritized, fixed, and tested again to confirm that the security issues have been addressed. A clear remediation and retesting process helps organizations move from identifying vulnerabilities to verifying their closure. In this blog, we explain what happens after a […]
Seventeen public incidents of agents hacking real companies, and not one of them was an alignment failure at root. Every single one ran on authority nobody scoped. Here is what to change.
Dependabot vs Renovate compared on setup, monorepos, platforms, and security, plus why auto-updating misses what's actually exploitable Category: DevSec Tools & Comparisons
The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface.For anyone evaluating MDR right now, the Managed Detection and Response Services Landscape, Q3 2026 report by Forrester is a useful map that lays out where the market is heading.
Gartner’s Emerging Tech Impact Radar: Preemptive Cybersecurity opens with this quote: “Advancements in open and frontier AI models reinforce the need to embed preemptive cybersecurity as attackers more effectively chain vulnerabilities, exploit exposures more quickly and evade detection more smartly. Product leaders must incorporate preemptive cybersecurity as they build an autonomous cyber immune system.” Skyhawk’s […] The post Skyhawk Security named a Sample Vendor in Gartner® Emerging T
Your GRC platform assumes the thing it governs holds still. AI doesn't—vendors swap models mid-contract and questionnaires can't see it. What GRC still does well, where it runs out of road, and the pattern that uses both without pretending either is enough.
Updated September 2026 · Source: Picus Blue Report 2026, 338M+ attack simulations, January–June 2026
OverviewOn September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions.On September 1
In this episode of Swarm Spotlight, Jayson E. Street sits down with national security and cybersecurity veteran Thomas Cox for a candid conversation on hacker culture, AI's impact on the industry, and why cyber education needs to start a lot earlier than it does today. The post Swarm spotlight on the community: Thomas Cox on hacking, humanity, and the future of cybersecurity. appeared first on CovertSwarm.
An agent harness turns a language model into an agent: loop, tools, context, approvals, sandbox. Nearly every agent vulnerability we have published lives there.
Cyber insurance providers assess an organization’s security controls before deciding coverage, pricing, limits, and policy conditions. Insurers increasingly review controls such as MFA, patching, backups, access management, and other security practices when evaluating cyber risk. In this blog, we explain how VAPT can help businesses identify exploitable vulnerabilities, address security gaps before an insurance review, maintain evidence of security […]
A heap overflow and SSO misconfiguration to compromise OpenAI internal repositories
In this blog, we explain where VAPT fits into ISO 27001 and SOC 2 preparation, whether VAPT Testing  should happen before or after other security activities, what organizations should test, and how to use VAPT Testing findings to prepare for an audit.  Understand What ISO 27001 and SOC 2 Actually Assess  Before deciding when to conduct a VAPT Testing, it helps to understand what each framework is […]
CVE-2026-85706 is a critical GitLab CE/EE path traversal vulnerability that can allow unauthenticated attackers to read arbitrary server-side files. NodeZero® Rapid Response safely validates exposure.
Synack's reporting experience now scopes to individual assets, generates AI-written executive summaries, and lets teams preview, save and share reports without leaving the platform. The post Executive-Ready Reporting Is Here: What’s New in the Synack Platform appeared first on Synack.
Compare the top 8 mobile app penetration testing tools of 2026 across static analysis, instrumentation, network interception, and the device layer. See the full list. The post Top 8 Mobile App Penetration Testing Tools in 2026 appeared first on Novee.
OpenCTI and Google SecOps SOAR integration syncs threat intelligence and case data in both directions, cutting manual tab-switching for SOC teams.
Sep 11, 2026 - Ayush Sethi - Find, score and scan every AI model across code and cloudEvery model running from your code to your cloud is your risk, whether or not anyone told you it was there. FireTail finds them all, scores each one, scans them on a schedule, and hands you the evidence your board or an auditor will accept.FireTail discovers the models across your cloud accounts and code repositories, scores each one for risk, scans them on a schedule, and maps every finding to the frameworks y
Sep 11, 2026 - Ayush Sethi - AI providers send one number a month. Cost observability is how you turn that into something you can forecast, attribute and defend.Earlier this year Uber went through its entire 2026 AI budget in four months. A single two-hour coding session cost $1,200, and the company now caps each employee at $1,500 per tool per month. If a company that size can lose the thread on its AI spend that quickly, most teams can too. The bill is built to keep you in the dark.AI has beco
A misconfigured cluster join key in JFrog Artifactory's default install lets unauthenticated attackers mint a permanent admin token in one request. Bishop Fox reproduced the full chain, confirmed in-the-wild exploitation, and shares a non-invasive detection check and remediation guidance.
Key Takeaways DarkTortilla is a highly configurable .NET crypter and multi-stage loader active since at least August 2015. Logistics-themed phishing emails deliver the loader inside archive and disk-image attachments such as .iso, .zip, and .img. Encrypted configuration hides inside embedded bitmap images, decrypted with Rijndael in ECB mode using a fixed key. Main payloads including AgentTesla, AsyncRat, RedLine, and Cobalt Strike run injected in memory, never touching disk. The Picus Platform
"Just a container" is a comforting idea, but it’s usually wrong. Once someone gains execution inside a pod, the real question isn’t whether they can escape but whether the cluster has already given the workload. The post The pod was never truly isolated. appeared first on CovertSwarm.
What Claude Mythos means for enterprise security: capability data, Project Glasswing scope, four implications, and what CISOs should do now.
A maximum severity flaw in GitLab's repository commits API allows anonymous attackers to read arbitrary files from self-managed servers. We are already detecting it.
The 10 AI SOC vendors worth evaluating in 2026, ranked, with what each is best at and the one question that separates them.
An agentic SOC is only as good as what surrounds the model. Best of 25 frontier models: a 45.1% MITRE coverage score, zero passes. Five demands to make on a demo.
Your model passed every pre-deployment test. Then a support ticket told your agent to look up another customer's account. Nothing in the build pipeline was wrong—the attack simply arrived after the pipeline ended. That gap is what AI runtime security closes.
A single unauthenticated request bypasses authentication on NetScaler Gateway and AAA virtual servers. Whether that means a dead-end session, a proxy into the internal network, or root on the appliance depends entirely on configuration. Bishop Fox maps every branch and shares a safe detection tool.
CVE volume is climbing across major software companies, and a federal audit shows even NIST couldn't keep up. Here's why remediation speed, not disclosure count, is the number that actually matters. Category: News
CISA added 10 vulnerabilities to its Known Exploited Vulnerabilities catalog between 31 August and 6 September 2026, split across three batches: two on 31 August, seven on 2 September, one on 4 September. Six of the ten carry a CVSS score of 9.0 or higher, all ten have confirmed in-the-wild exploitation behind their KEV listing,… Read More »Weekly Report: New Hacking Techniques and Critical CVEs 31 Aug to 06 Sep 2026 The post Weekly Report: New Hacking Techniques and Critical CVE
The week of 31 August to 6 September 2026 was defined by identity and access failures, not exploited software. McKesson confirmed attackers reached patient data after a voice-phishing call compromised an Okta single sign-on session. Berlin’s state government confirmed data theft from a network segment that had no multi-factor authentication on its VPN. A Thomson… Read More »Weekly Cybersecurity Intelligence Report: Cyber Threats and Breaches 31 Aug to 6 Sep 2026 The post We
Somewhere in your vendor list, right now, there is a door you have never checked. You didn’t build it, you don’t hold the key, and yet if someone walks through it, the breach notification goes out on your letterhead.  The numbers too aren’t subtle. Verizon’s 2026 Data Breach Investigations Report found that 48% of breaches ... Read more
Before you sign with a penetration testing vendor, ask precise questions that turn marketing claims into measurable commitments. Confirm exact scope, learn which work is automated, AI-led, or human-led, and require that findings get reproduced and validated before they reach a report. Ask who can access your environment, how testers are vetted, and what the rules of engagement and stop conditions look like. Review sample reports, confirm remediation and retesting terms, and normalize every cost.
TL;DR Introduction Default printer configurations are common to find in internal infrastructure engagements. These configurations are usually insecure, exposing outdated protocols like SNMPv1 and web interfaces without requiring authentication. For an unauthenticated, internal attacker, this can be a treasure trove of information for later exploitation, sometimes including usernames, email addresses and file names: However, the […] The post Passing the bucks $$$: Passback attacks explained