Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks
keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation order.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,467 matching stories — announcement, in Cloud-Native Application Protection (CNAPP) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense
Explore Snyk’s first Agentic AppSec capabilities: an autonomous Remediation Agent that fixes vulnerabilities and Malicious Code Defense that blocks risky packages before they ship.
AI Model Risk Intelligence Know Which Models You Can Trust Before You Deploy
AI model risk depends on how a model is deployed. Learn how Evo combines adversarial testing, attack impact, and deployment context to help teams compare models and enforce policy.
Agentic vulnerability management, end to end: 2,731 findings, one approved fix
AI agents took a 119,443-finding backlog, traced 2,731 SLA breaches to one base-image fix, and opened a real Jira ticket. A human clicked Approve. That click is the whole autonomy debate, settled in one UI element.
Security briefing: July 2026
N-able N-central exploitation results in RMM tool deployment
After compromising systems via CVE-2026-18577, threat actors use the additional RMM tools and network tunnels to establish persistent remote access
Interlock ransomware gang creates volatile situation
Multiple legitimate DFIR tools abused by GOLD EMBRACE double-extortion specialists
Darktrace Advances Behavioral Security to Protect AI Agents, People and Infrastructure
Voices in Cloud Security #2: Identity Is the Whole Perimeter Now
Voices in Cloud Security is a series of candid conversations with people who work in and around cloud security. This one is with Michael St. Onge. Michael is a self-taught engineer who got his start making computers work for a Marine Corps tank unit in the mid-90s, then built a career through operations, network engineering, […] The post Voices in Cloud Security #2: Identity Is the Whole Perimeter Now appeared first on Tamnoon.
AI Threat Vectors Part 3: When the Attack Arrives by Email – Indirect Prompt Injection in Agentic AI
AI Agents Now Read Untrusted Content and Act On It An AI agent in your organization will summarize an email thread today that was never meant for it to read. The user asks something harmless: “What’s on my plate this week? The agent will pull in messages, invites, and documents to answer, and it will […]
The Assets You Don’t Know You Own: Attack Surface Sprawl Is a Discovery Problem, Not a Tooling Problem
Modern organizations no longer operate within a fixed network perimeter. Cloud services, remote work, third-party integrations, and rapid digital expansion have made the boundary between "inside" and "outside" for the enterprise increasingly difficult to define. Attackers exploit this ambiguity by scanning continuously for weaknesses across an organization's hardware, software, cloud, and internet-facing assets. The uncomfortable truth security leaders must confront is simple: an organization ca
Visit the Top Industry Vendors in the Expo at Connections Live 2026
There’s a reason “Connections” is in the name of our annual user conference. We’ve built a tightknit community of customers and PDI associates over the last 40 years, and the connections are only growing stronger. But there’s another invaluable group that truly makes every Connections Live conference possible: our sponsors. The conference wouldn’t exist without them, so we want to extend a sincere thank you and shout-out to […]
ITSP.10.171 Requirements: What Canadian Defence Suppliers Actually Need to Do
You know ITSP.10.171 applies to your defence work and that it sits behind the Canadian Program for Cyber Security Certification (CPCSC). The open question is what meeting it actually involves: what you need to build or document, where suppliers most often fall short, and whether to handle the work in-house, with software, or with a […] The post ITSP.10.171 Requirements: What Canadian Defence Suppliers Actually Need to Do appeared first on Carbide.
CrowdStrike 2026 Threat Hunting Report: Exploitation Window Closes as AI Use Accelerates
Agentic SOC Autonomy: Earn It One Decision at a Time
Agents that recommend and agents that act carry different blast radii. Tammy Hawkins (ex-Intuit) on earning SOC autonomy one decision class at a time.
What the Agentic SOC Still Gets Wrong: 15 Years In
Five lessons from 15 years of handing security calls to machines — circuit breakers, unified signal, outcome metrics — and what the agentic SOC still misses.
How CASB security helps control cloud file sharing
If you run IT for a growing or mid-market organisation, sharing a file is the easy part. The harder question comes later: who can still open it after a project ends, a role changes or a supplier leaves? CASB security gives you a clearer view of cloud activity and lets you enforce controls over supported actions. Native access reviews and offboarding processes still need to remove permissions that are no longer required. IT needs evidence of who can still open a contract, board pack or customer f
AI Threat Vectors Part 2: Multi-Turn Jailbreak Risk Needs Stateful Prompt Guardrails
Why Reading One Prompt at a Time Misses the Attack Most red-team demos show a single, obviously nasty prompt getting blocked, and everyone in the room feels safe. Real attackers do not send that prompt. They send a sequence of reasonable ones. Each message passes inspection because, on its own, nothing is wrong with it. […]
Managed Observability: Turning Data into Operational Velocity
Key Takeaways “Mean Time to Innocence,” the time it takes a network team to prove a problem isn’t theirs, is a genuine operational cost hiding inside every outage investigation, not just industry slang Full-stack visibility shows where a problem sits, but it doesn’t fix the fragmented, ungoverned data underneath everything else running on the network […] The post Managed Observability: Turning Data into Operational Velocity appeared first on Orro.
AI Threat Vectors Part 1: Voice Is the Next Attack Surface, and It Needs a Firewall
Voice Is the New Keyboard, and No One Is Guarding It For thirty years, “input” meant a keyboard, and security grew up around that idea: sanitise the field, validate the payload, rate-limit the endpoint. The voice broke the assumption. It now sits in call centers, banking apps, cars, wearables, and the AI agents companies ship […]
The Essential Eight Is Being Retired: What Compliance Leaders Need to Know Now
By Manuel Salazar, Director of Cyber Services, Orro Over the past fortnight, I have had close to the same conversation with four different clients, across four different sectors. Someone on the compliance or risk team has seen a headline about the Essential Eight being retired, and the question that follows is always some version of […] The post The Essential Eight Is Being Retired: What Compliance Leaders Need to Know Now appeared first on Orro.
Beyond the Responsible Entity: What SOCI’s ‘Relevant Operator’ Concept Means for You
  By Stu Long, Chief Technology Officer, Orro Over the past few weeks, three separate conversations with clients in mining, water utilities and state government have circled back to the same theme: what the second tranche of SOCI Act reforms actually changes, and for whom. The Department of Home Affairs released its consultation paper on […] The post Beyond the Responsible Entity: What SOCI’s ‘Relevant Operator’ Concept Means for You appeared first on Orro.
Public Water Systems Are Targeted by State Actors: How to Protect PLCs and HMIs in the Operational Technology Network
We hate to say I told you so, but in our recent blog post OT Cyber Resilience and Microsegmentation for AI Attacks, we discussed how hackers are increasingly targeting operational technology networks. And they’re doing so with good reason, tactically speaking; hacking OT doesn’t just compromise customer data or encrypt business systems for a ransom […] The post Public Water Systems Are Targeted by State Actors: How to Protect PLCs and HMIs in the Operational Technology Network appeared fir
AI Hardware Shortages Are Driving Up IT Costs: What Leaders Should Do Now
If your organisation has felt the sting of higher prices or longer lead times on servers, storage, memory or end-user devices over the past year, you are not imagining it.… The post AI Hardware Shortages Are Driving Up IT Costs: What Leaders Should Do Now appeared first on 11:11 Systems.
S3 Clones in the Neoclouds
S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain.
The Good, the Bad and the Ugly in Cybersecurity – Week 31 (2026)
Police flag 4,000 URLs to disrupt The Com, theft victims sue Apple over a $1.8M wallet scam, and OpenAI and Anthropic models reach real systems in cyber tests.
Agent sprawl vs SaaS sprawl: What’s the same, what’s different
Is agent sprawl the same as SaaS sprawl? Learn the key differences, risks, and how IT can stay ahead of AI agent governance.
Sharing My Thoughts on the 2026 Market Trends
Melissa Willis shares takeaways from the 2026 NACS State of the Industry Summit. Here are the big trends and action items fuel and convenience retailers must take.
Rapid7 at Black Hat USA 2026: See preemptive security in action
Black Hat USA returns to Mandalay Bay in Las Vegas this August, bringing together security practitioners, researchers, and leaders from around the world. Rapid7 will be there in the Business Hall, with new capabilities, live demonstrations, expert-led sessions, and two days of activities at the Border Grill.This year, our focus is preemptive security: helping security teams anticipate credible risk, respond at machine speed, and maintain an accurate view of their security and compliance posture
Healthcare Disruption, Critical Software Flaws, and Exposed PLCs Show How Quickly Cyber Risk Becomes Business Risk
AnMed temporarily closed 79 of its 106 facilities after a cyberattack disrupted computer systems, phone lines, and internet connectivity. Appointments were postponed, elective procedures faced uncertainty, and the health system had to coordinate care while teams worked to restore access. For a healthcare provider, that kind of disruption reaches far beyond technology. It affects how […] The post Healthcare Disruption, Critical Software Flaws, and Exposed PLCs Show How Quickly Cyber Risk Be
Prioritize security findings with the Datadog Runtime Prioritization Engine
Learn how the Datadog Runtime Prioritization Engine infers ownership and identifies business-critical resources to help you prioritize security findings.
When AI doesn’t know the target is real
The follow-up to the Hugging Face breach is a disclosure from Anthropic
Attackers Now Exploit the Cloud in Days. Can You Spot Misconfigurations Before They Do?
Executive Summary: Cloud attacks are accelerating at a pace that leaves little room for reactive security. As Google’s latest threat research shows, attackers are exploiting vulnerabilities within days, but successful breaches still depend on the misconfigurations, excessive permissions, and identity exposures that organizations can control. The key takeaway: continuous visibility into cloud posture is no […] The post Attackers Now Exploit the Cloud in Days. Can You Spot Misconfigura
Security in the Age of Machine Speed
As the ability to identify and exploit vulnerabilities reaches “machine speed,” system defenses must keep pace. This paradigm shift requires... The post Security in the Age of Machine Speed appeared first on Skyhigh Security.
Rethinking Scanning for the AI Era: Wiz’s Agentic Code Security System
Enterprise AI AppSec requires more than powerful models. It requires a system that balances speed, depth, and cost across the software lifecycle.
Rapid7 named a Leader in the IDC MarketScape: Worldwide MDR Service for Midmarket 2026 Vendor Assessment
IDC has named Rapid7 a Leader in the 2026 Worldwide Managed Detection and Response Service for Midmarket 2026 Vendor Assessment (Doc #US52992326, July 2026). We believe this recognition and research highlights where MDR is heading.Many security programs are still built around a reactive sequence of detect, triage, and respond, but the timelines surrounding modern attacks have changed too quickly for that model to hold up on its own. Time-to-exploit has dropped from two years to 22 hours, while e
CosmosEscape: Taking Over Every Database in Azure Cosmos DB
A critical vulnerability chain in Azure Cosmos DB enabled full read and write access to every Cosmos DB database.
3 Security Non-Negotiables for Fuel and Convenience Retailers in the AI Era
Regardless of what industry you’re in, cybersecurity should always be a critical priority. For CISOs and other security leaders, it’s the highest one. But with ransomware running rampant and phishing attacks targeting anyone across your organization, it might feel like you’re constantly fighting an uphill battle. The good news is you don’t have to go […]
MSSPs: Your SOC Already Detects Fraud. Missed Opportunity Is Selling It As a Service.
Managed cyber-fraud protection is the most overlooked growth line in the MSSP playbook, and most of the capability is already sitting in your SOC.
Attackers Don’t Respect Vendor Boundaries
Why should you? The post Attackers Don’t Respect Vendor Boundaries appeared first on Pentera.