Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,046 matching stories — in Breach & Attack Simulation / Pen Testing — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Most organizations do not struggle to find vulnerabilities. They struggle to decide what to do about them. Security teams today face a familiar challenge: more assets, more vulnerabilities, more compliance requirements, and more pressure to demonstrate measurable results. New findings arrive every day, yet resources remain limited. Leadership wants clear answers about risk. Auditors want […] The post What Security Leaders Value Most in a Vulnerability Management Platform appeared first on
June 2026 in MCP security: Censys counted 12,520 Internet-accessible MCP services, most of them unauthenticated, and the measurements got a lot more concrete.
A repo's .vscode/settings.json can start VS Code Copilot in Bypass Approvals mode after one Workspace Trust click. Why that is a trust-boundary problem, not a 0-day.
HITRUST penetration testing for healthcare organizations. Learn what CSF assessors expect, how to scope your pentest, and get r2-ready reports in 48 hours.
The 9 artifacts SOC 2 auditors verify in a penetration test, with CC4.1/CC7.1/CC7.2 control mapping, Type 1 vs Type 2 expectations, and a sample-report structure that passes on first review.
MCP servers introduce a new attack surface, but the security fundamentals are familiar. In this final otto-support post, we use nmap, a Nuclei template, and MCP Inspector to discover, enumerate, and exploit an authorization gap without ever touching an LLM.
Three gateways govern AI agents: LLM for content, MCP for tools, agent for authorization. The risk is running them as three vendors, not one decision path.
Explore cloud security research on AWS, Azure, GCP, IAM risk, Kubernetes testing, storage exposure, cloud penetration testing, and attack paths. The post Cloud Security Research & Cloud Penetration Testing Insights | Redbot Security appeared first on Redbot Security.
Explore red team research on adversary simulation, MITRE ATT&CK, offensive security, living off the land, NTLM relay, AS-REP roasting, and attack paths. The post Web, Mobile & API Security Research appeared first on Redbot Security.
Background  Drupal powers millions of websites worldwide, including government portals, financial platforms, media outlets, and enterprise CMS deployments. On May 20, 2026, the Drupal Security Team published SA-CORE-2026-004, disclosing a highly critical SQL […] The post Anonymous PostgreSQL Injection in Drupal Core (CVE-2026-9082) appeared first on Ridge Security.
How PlexTrac’s configurable risk scoring puts business context back in the driver’s seat Security teams have always known that severity and priority aren’t the same thing, but most of the tools they rely on haven’t caught up to that reality. When a scanner hands back a list sorted by CVSS score, it’s ranking how dangerous... The post Your Risk Score Is Only as Good as the Context Behind It appeared first on PlexTrac.
Explore red team research on adversary simulation, MITRE ATT&CK, offensive security, living off the land, NTLM relay, AS-REP roasting, and attack paths. The post Red Team Research & Offensive Security Insights | Redbot Security appeared first on Redbot Security.
Highflame and Tailscale Aperture now enable real-time AI traffic enforcement at the network layer, helping teams detect, govern, and block risky LLM requests before they reach model providers.
Security teams do not buy a reporting and exposure management platform to acquire one more silo. They buy it to consolidate; to bring the findings their other tools generate into one place where work actually gets prioritized and reported. The more of your security stack that connects to that platform, the better it can do... The post Your scanners, your pentests, your exposure data, together in PlexTrac appeared first on PlexTrac.
A CVSS 10.0 path traversal in UniFi Network Application lets unauthenticated attackers read controller backups, extract credentials, and take over every managed device on the network. Bishop Fox breaks down the attack paths, the preconditions, and a safe detection tool to check your exposure.
The Enemy Does Not Sleep: The Birth of the Algorithmic Attacker The cybersecurity industry is sleepwalking. We are still captivated by the romanticized image of the hacker: a human in a hoodie manually typing code to breach a network. Wake up to the reality of 2026. The modern adversary is no longer human. It is algorithmic. We are facing the industrial-scale weaponization of Agentic AI. Recent intelligence reveals a violent 7,851% surge in hostile network traffic driven entirely by...
Faraday participated in Ekoparty Miami 2026, joining the cybersecurity community to share technical research on AI, offensive security, automated reverse engineering and continuous security automation. The event brought together experts, researchers and security teams exploring the next stage of cybersecurity. The post Ekoparty Miami 2026: AI, Offensive Security and the Next Stage of Cybersecurity appeared first on Faraday.
The 2026 Data Breach Investigations Report reflects a threat environment that is not only growing in volume but shifting in character. Here are the findings that matter most for security teams:  1) Vulnerability […] The post Six Highlights from the 2026 Verizon DBIR Every Security Team Should Know appeared first on Ridge Security.
May 26, 2026 - Alan Fagan - Ninety percent of AI usage across the average organization is untracked, ungoverned and unsecured. Ninety-seven percent of organizations using generative AI have already faced a breach or security incident linked to it.If those numbers feel uncomfortable, it is because the tools most security teams reach for first were not built for this problem. Data Loss Prevention is the obvious example. DLP solved a real problem for a different era. It watches files, email and end
May 26, 2026 - Alan Fagan - A clinician dictates a long note into an ambient scribe. A coder pastes a discharge summary into ChatGPT to clean it up. A revenue cycle analyst uses Copilot to draft a denial appeal that contains patient identifiers. An administrator drops a prior authorization request into a free AI summarizer to save twenty minutes.None of it shows up in your security team's logs.This is the AI reality inside every hospital and health system in 2026. Adoption is happening from the
Sparkplug B is the dominant protocol in ICS and SCADA environments, but no public security fuzzer existed for it until now. Bishop Fox used AI-assisted development to build one from scratch, covering all 9 message types, 19 data types, and 87+ field paths from the full specification.
In our last defended-network article, we showed Sable operating against a SIEM-instrumented lab. The takeaway was simple: frontier models can reason about detection, but consistency is still the hard part. Sable evaded Wazuh well on Linux and struggled more as the engagement moved deeper into…
Does the rate of change, the broad penetration, and the complexity of managing and securing AI in general, and AI agents in particular, mean that organizations are stuck on the ground - or flying blind - without a viable strategy for operationalizing governance and dealing with regulatory pressures?
Cranium AI announced a strategic integration with Weights & Biases by CoreWeave, making AI safety and security evaluations a native step in the model lifecycle. The partnership gives enterprises a single source of truth for safety evaluations and regulatory compliance.
Cranium AI announced the acquisition of Aiceberg, an agentic AI security and risk management company, uniting two platforms to secure the entire AI lifecycle. Aiceberg CEO Alex Schlager joins Cranium as Chief Technology Officer.
Cranium AI and ISTARI announced a strategic partnership combining Cranium's AI security and governance platform with ISTARI's global cyber-resilience advisory expertise to provide enterprises with an end-to-end AI risk management and compliance framework.
Educational technology giant Instructure is facing significant scrutiny after threat actor group ShinyHunters claimed responsibility for a large-scale breach involving the company’s widely used Canvas learning management system (LMS). The incident reportedly impacted thousands of schools and universities globally, exposing sensitive student and faculty information and disrupting academic operations during final exam periods. The breach […]
Gli esercizi di Purple Teaming eseguiti con ZAIUX Framework sono un valido strumento per migliorare la sicurezza e garantire la compliance The post Purple Teaming su Larga Scala: come i Framework C2 avanzati abilitano una resilienza Cyber guidata dalla normativa appeared first on Pikered.
Recently, whilst testing in Claude Code, I started to think about the information I was exposing on a daily basis. Where are my chats going? How much is being s
How AI-assisted reverse engineering of stripped PAN-OS binaries led to finding a JWT algorithm confusion vulnerability in GlobalProtect's Cloud Authentication Service, enabling full VPN auth bypass with just a username.
Description: AI agents do not always fail with a crash. They drift. Learn why Step 1 testing and passive observability cannot stop Mission Drift, and how Highflame Compass provides runtime enforcement to keep autonomous agents aligned through Step 100.
Discover how attackers exploit HTTP redirect discrepancies to extract sensitive data embedded in URLs, and what you can do to prevent secret leakage in your web infrastructure.
1. Executive Summary In April 2026, Anthropic previewed Claude Mythos — an advanced AI system capable of discovering complex vulnerabilities in production-grade code, developing working exploits on the first attempt in over […] The post Beyond Mythos: why automated security validation becomes more critical in the AI Era appeared first on Ridge Security.
