Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,464 matching stories — announcement, in Cloud-Native Application Protection (CNAPP) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher reported the
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was
TL;DR: Financial institutions need to demonstrate that security controls are effective in production and that security investments reduce business risk. Across regulatory frameworks including NYDFS, OSFI, DORA, MAS and APRA, verified control evidence helps institutions demonstrate resilience and support accountable risk decisions. Aquasec connects runtime enforcement with FAIR based financial risk modeling, helping security leaders …
Android users report that Google automatically added their phone number to accounts they wanted to keep separate. Here’s how to check yours.
Staffing software giant calls in CrowdStrike as customers face login headaches and questions remain over possible data theft
How criminals turn spend-management onboarding into fraud infrastructure, and why you may be accountable for the fraud you never see.
Learn when to use RUM and synthetic monitoring for SLIs, what each source misses, and how to interpret their results together.
Datadog built Turnstile to evaluate signed attestations and enforce software supply chain policies before container images are deployed.
The China-based threat group uses DLL sideloading in these attacks
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published
Discover how detection teams can split EDR-killer attacks into four distinct behavior hunts to catch BYOVD and driverless threats before ransomware fires.
Palo Alto Networks’ Unit 42 threat intelligence team uncovered a multistage cyber intrusion against a telecommunications managed service... The post Unit 42 traces Peerstitch malware deployment to FortiOS vulnerability exploited after FortiManager compromise appeared first on Industrial Cyber.
Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.
It’s Saturday, 6:04 a.m. First tee time is in 26 minutes.
Learn how ShinyHunters exploits Oracle PeopleSoft to steal sensitive data. Understand the attack risks, potential impact, and security measures to protect enterprise systems. The post ShinyHunters Exploits Oracle PeopleSoft to Steal Sensitive Data appeared first on Fidelis Security.
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device
Peak trading is when your store network is busiest, and most exposed. Twelve practical checks to run before the rush, so every terminal stays online and every card stays protected. Black Friday, the run to Christmas and the Boxing Day sales put more load on your store network than any other time of year. In […] The post The Secure Checkout Checklist appeared first on Orro.
No novelty required to be effective
Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants
AccuKnox Guard 1.1 now ranks #1 of 41 open AI guardrail models on HiveTrace’s independent GuardRate Leaderboard. But the number that matters most isn’t the headline score. It’s the best worst-case category on the board. Here’s why CISOs and CIOs should judge AI guardrails by their weakest day, plus three questions to ask every vendor.
Un chercheur en cybersécurité a présenté une faille vieille de seize ans dans les puces Wi-Fi de Broadcom, exploitable à portée du réseau sans connaître le mot de passe de la box. Il a relevé en France une Livebox 5 d’Orange et des box SFR non corrigées.
AccuKnox Guard 1.1 is now #1 of 41 open guardrail models on HiveTrace’s GuardRate Leaderboard, scoring 0.808 against the runner-up’s 0.764.
Security researchers have found a new malware that hides inside Fortinet firewalls. The malware is called PEERSTITCH. It is an ARM64 implant that runs in the memory of the device. Palo Alto Networks’ Unit 42 shared the findings on October 14, 2026. Its team studied an attack on a telecommunications managed service provider. Hackers steal […] The post New PEERSTITCH Malware Bypasses Security Checks on Fortinet VPNs appeared first on PrivacySavvy.
Let’s address the elephant in the server room: why are you still paying premium cloud-processing rates for data that doesn’t... The post Secure Where Work Happens: Stop Paying Cloud Rates for Local AI appeared first on Skyhigh Security.
Learn how SentinelOne's Static AI blocked APT29's CaptiveCrunch campaign on the endpoint, stopping local DNS poisoning and captive portal network lures.
Use this EDR alert checklist to review critical evidence, validate threats, trace attack activity, and improve incident response. The post EDR Alert Checklist: The Information Security Teams Need for Faster Investigation and Response appeared first on Fidelis Security.
Authorities arrest cyber exec for extortion, cellular implant in Ledger wallets leaks seed phrases, and hackers heat French supermarket fridges to 50°C.
Want to secure cloud computing but not sure where to start? You’re not alone. The cloud makes it easy to launch servers, store data, and scale applications in minutes. That same speed makes it just as easy to leave a storage bucket open or an access key exposed, and attackers look for exactly those mistakes. […]
Every Cybersecurity Awareness Month campaign rests on four habits: Strong passwords, Multifactor authentication, Spotting phishing, and keeping software updated. All four assume a person is the one signing in, reading the message and clicking install. At a growing number of companies that person is now an AI agent, and AI agent security has no equivalent of the annual training. The National Cybersecurity Alliance's theme this year is "Don't Make It Easy for Them," built on the idea that small ha
Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone, was of the latter kind.Virus Bulletin created the award to honor Péter's life and work, and it recognizes outstanding technical security research: the rigorous, the deep, and the useful – exactly what he was known for himself. And as far as recognitions in our industry
Ask most teams for a map of their network and you’ll get one of two things: a diagram someone drew for an audit two years ago, or an export from the firewall and cloud consoles showing what each rule allows. Both describe intent. Neither describes what an attacker on the internet can actually reach today. […] The post How to Build Your Actual Network Map with Custom Agents in Orca appeared first on Orca Security.
Some mid-size organizations evaluate managed IT services the same way they choose office equipment. They check the price, examine the features, and make a decision. That might be fine for buying a device that serves a single function and will last a year or two. But managed IT service providers require a more thorough evaluation.Managed IT services are not limited to single functions, like providing help desk support. Providers today offer a full range of services, from day-to-day IT and cyberse
Both start with retrieval. The difference is who interprets the results. The post RAG Versus Document Search: How to Ground Answers in the Right Evidence first appeared on CTERA.
Every business today runs on digital assets. Customer databases, cloud workloads, payment systems, laptops, mobile devices, websites, and APIs all hold value, and every one of them can contain a weakness an attacker is looking for. New software flaws are disclosed every single day, and attackers often start scanning for them within hours of publication. […]
Quantum readiness starts with knowing where cryptography lives. Singapore’s 2026 milestones make discovery urgent, while SBOMs alone cannot show every algorithm, runtime setting or supplier dependency that may need a migration plan.
Is your business protected against the attack you haven’t seen yet? Most breaches don’t start with a dramatic hack. They start with one phishing email, one unpatched laptop, or one misconfigured cloud setting. The right cybersecurity solutions close those gaps before attackers can use them. This guide explains the main types of cybersecurity solutions, what […]