Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,046 matching stories — in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
These vulnerabilities allow attackers to chain an unauthenticated WordPress REST API flaw with a SQL injection bug to fully take over sites running Core 6.9.0–6.9.4 or 7.0.0–7.0.1. The post CVE-2026-63030 & CVE-2026-60137: WordPress Core Pre-Authentication RCE Overview & Takeaways appeared first on NetSPI.
Traditional DSPM finds where sensitive data lives. Code-based DSPM finds how it gets exposed, and points to the fix in your code. Category: Guides & Best Practices
K-12 and higher education institutions face constant cyberattacks due to limited IT resources. Here are five cybersecurity priorities they should act on now to reduce risk. The post Five cybersecurity priorities every school needs to get right appeared first on Kaseya.
Jul 20, 2026 - Jeremy Snyder - Satya Nadella dropped a blog post last week that TechCrunch framed as a "shocking warning" to enterprises using AI. I want to cool that down for a second, because underneath the headline, there's a genuinely useful idea buried in there, and it has almost nothing to do with the drama around open versus closed models.Nadella's core argument: enterprises are paying for AI twice. Once with money, via token usage. And a second time with something far more valuable, the
AI agent incident response starts with the blast radius: when a compromised coding agent spawns 50 subagents, revoke the entire delegation chain in one atomic step.
We recreated the WordPress pull requests behind CVE-2026-63030 and CVE-2026-60137 to test whether today's code reviewers and SAST tools would catch both vulnerabilities.
Why alert fatigue is worse in the AI era: attackers scale attacks with AI while thin AI SOC tools add faster noise. The fix is reasoning-based investigation, not more suppression.
AI-enhanced SOC workflows rework triage, phishing, endpoint, insider, hunting, and detection. How SOC automation moves analysts from executing to steering.
Agentic AI penetration testing delivers real benefits, but only with the right practices. Six that separate a genuine pentest from a glorified scanner.
Faraday 5.22 is focused on helping security teams make better risk-based decisions, while also improving platform performance and reliability. This release introduces a workspace Risk Score that reflects real urgency instead of a diluted average, a security fix that users should apply now, and a set of workflow fixes that remove friction from daily operations. The post Faraday 5.22: Smarter Risk Scoring, Faster Performance, and a Critical Security Fix appeared first on Faraday.
AI agent harnesses are changing how penetration tests get executed. Bishop Fox used MCP agents across external, application, and cloud testing to surface two information leaks totaling over 12 million records in hours rather than days. Here is how the approach works and where it makes sense to use.
It's Becoming Air Traffic Control. The post Exposure Management Used to Be Baggage Claim. appeared first on Pentera.
OpenCTI helps security teams turn raw data into strategic threat intelligence, powering smarter long-term risk and investment decisions.
Not all threat intelligence is created equal. While operational and tactical intelligence focus on detecting and responding to immediate threats, strategic threat intelligence asks the question: what should we be preparing for? Operating at a higher altitude, strategic intelligence translates the broader threat landscape into forward-looking insights that executive leadership can act on, shaping long-term security investments, resource planning, and risk decisions. But raw data alone doesn't get
How our AI red teaming agent solved all five levels of GitHub's ProdBot challenge, one distinct exploit per level, and what defenders can take from it.
Key Takeaways Picture your last security tool purchase. You compared a few vendors, picked the one with the slickest demo, wired it into your pipeline, and moved on. Six months later, you own four scanners that overlap, flood Slack with alerts nobody triages, and somehow still miss the one flaw that actually matters. If that ... Read more
A practical buyer’s guide for developers, AppSec engineers, and engineering managers choosing where to scan, what to scan, and which tool actually fits. Key Takeaways Code security scan tools exist to catch the risk you wrote in a file yourself…before it’s shipped, and in 2026 they have stopped being optional. A 2025 report by Verizon ... Read more
CVE-2026-45281 reveals a high-severity authorization flaw in Nextcloud Server allowing authenticated attackers to fully access and modify other users' calendars.
A critical zero-day in WordPress Core is putting over 500 million websites at risk of full takeover. We are already detecting it.
AI can breach a bank's defenses in 21 minutes. The ECB just gave financial institutions until October to prove their resilience under DORA. See what's required and how continuous, AI-driven pentesting gets you audit-ready fast.
Chaos is a ransomware family originally introduced in June 2021 by the developer of the Bagli ransomware through the release of the C#-based Chaos ransomware builder. It rapidly gained popularity within the cybercriminal ecosystem, spawning numerous derivative ransomware families. The post Chaos Ransomware: BlackSuit-Linked RaaS Resurgence and Detection Opportunities appeared first on AttackIQ.
This Week in Cybersecurity (TWiC) Three stories dominated the last few weeks, and they share one thread: the human operator is coming out of the loop. Sysdig documented the first ransomware operation run end to end by an LLM. Sygnia investigated a lone attacker who compressed a multi-week cloud intrusion into 72 hours and got […]
AttackIQ recommends CISA AA26-194A emulations to validate defenses against FSB Center 16 targeting exposed devices. The post Response to CISA Advisory (AA26-194A): Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting appeared first on AttackIQ.
A crafted cursor:// link installs an attacker-controlled MCP server that runs unsandboxed commands under your account, and the install dialog hides the payload.
Building agents is the easy part. Even building a cross-functional AI governance committee to define policies for deploying these agents is within reach for most organizations. What many organizations are contending with is dealing with the structural, functional and technical challenges to embedding governance across the full lifecycle of an AI agent.
ADPathFinder unifies SharpHound data with OpenGraph collectors like MSSQLHound and ConfigManBearPig. Discover how this tool maps complex, cross-dataset privilege escalation paths across AD, ADCS, MSSQL, and SCCM, and brings vital graph context to your password audits. The post ADPathFinder: OpenGraph Attack Path Mapping in BloodHound CE appeared first on NetSPI.
EU exposes Russia-linked cyber campaign targeting member states as Australia warns of widespread attacks on content management systems. The post The week in breach news appeared first on Kaseya.
Escalating a Hacktron finding into a PostHog production RCE using Claude, and challenging open-weight models to write the same V8 exploit.
For years, organizations have relied on familiar defenses to separate legitimate users from automated attacks. CAPTCHA challenges, browser fingerprinting, IP reputation, and behavioral analysis have all played an important role in identifying malicious bots before they reach sensitive applications. But the rules are changing. As highlighted in Dark Reading’s article, “AI Bots Are Breaking Traditional […] The post AI Bot Detection Is Changing. Your Security Strategy Should Too.
ServiceNow portals can expose backend records through public widgets and API endpoints even when the visible portal looks locked down. Bishop Fox built snowpick to test both surfaces systematically, and across 166 authorized assessments, nearly a third of instances returned data they shouldn't have.
Jul 14, 2026 - Lina Romero - We're exhibiting, Jeremy is speaking, and with the EU AI Act enforcement deadline now less than ten weeks out, the timing couldn't be better. Here's how to find us, what we're doing, and how to book time with the team.🤝 Meet the TeamThe best part of Infosecurity Europe is the people. Here is who will be holding down the fort at Booth G172. Come say hi!📅 Book a Slot at Our StandInfosecurity Europe gets busy fast. If you want guaranteed 1:1 time with the team, book i
Jul 14, 2026 - Lina Romero - FireTail is coming to Black Hat USA, and we're setting up at Mandalay Bay. Here's how to find us, what we're doing, and how to book time with the team.🤝 Meet the TeamThe best part of Black Hat 2026 is the people. Here is who will be holding down the fort at Booth 5908. Come say hi!📅 Book a Slot at Our StandBlack Hat gets busy fast. If you want guaranteed 1:1 time with the team, book in advance.Reserve your spot here🎙️ Don't Miss Jeremy's TalkEvery employee now has
We benchmarked the latest frontier models, GPT-5.6 Sol Medium, Sol Ultra, and Grok 4.5, on their exploit-development capabilities. After processing 2.096 billion tokens, Sol Ultra was the only model to produce a complete exploit chain.
The mathematics of the missing Dory commitments behind the Jolt exploit.
How our agent found a full proof forgery in Jolt, a16z's zkVM.
How Skyhawk’s Agentic AI Red Team took control of a production AWS organization in seconds, starting with a single low-privilege role, and without a single misconfiguration to exploit. The finding Skyhawk Security set out to test a simple question: what can an autonomous, AI-enabled attacker actually do inside a real cloud environment? So we pointed […] The post Nothing Was Broken. The Org Fell Anyway. appeared first on Skyhawk Security.
Why is the world so alarmed about taking the Flipper on board planes? Is it just poorly educated armchair cyber commentators of the ‘don’t use open Wi-Fi / USB juicejacking’ style of fearmongering, or is there something to it? TL;DR   Why are people worried?   I’m sure you’ve seen the odd post on social media about people having their […] The post Flying with the Flipper Zero appeared first on Pen Test Partners.
AI pentesting agents now match a principal-level human tester on standard benchmarks, in minutes instead of 40 hours. Here is where each approach wins, what the benchmark evidence actually shows, and how to combine them. What is AI penetration testing? AI penetration testing is the use of autonomous AI agents to discover an organisation’s attack… Read More »Agentic AI Pentesting vs Human Pentesting: Comparison in 2026 The post Agentic AI Pentesting vs Human Pentesting: Comp
API Penetration Testing: What It Is, How It Works, and How to Do It Continuously APIs now carry the business logic and the sensitive data, which makes them the attack surface most likely to be under-tested. This guide covers what API penetration testing is, the risks it targets, how an agentic AI approach runs it… Read More »API Penetration Testing: What It Is, How It Works, and How to Do It Continuously The post API Penetration Testing: What It Is, How It Works, and How to Do It
This month exposed a harsh reality: autonomous coding agents are expanding the enterprise attack surface faster than we can patch them.