Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
357 matching stories — in Container Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
TL;DR: Financial institutions need to demonstrate that security controls are effective in production and that security investments reduce business risk. Across regulatory frameworks including NYDFS, OSFI, DORA, MAS and APRA, verified control evidence helps institutions demonstrate resilience and support accountable risk decisions. Aquasec connects runtime enforcement with FAIR based financial risk modeling, helping security leaders …
Today we’re introducing the new Cycode brand. Here is why we did it, what the new logo and colors mean, and what it means for you. The post Meet the new Cycode: built to protect where AI risk is born appeared first on Cycode.
Want to secure cloud computing but not sure where to start? You’re not alone. The cloud makes it easy to launch servers, store data, and scale applications in minutes. That same speed makes it just as easy to leave a storage bucket open or an access key exposed, and attackers look for exactly those mistakes. […]
Every business today runs on digital assets. Customer databases, cloud workloads, payment systems, laptops, mobile devices, websites, and APIs all hold value, and every one of them can contain a weakness an attacker is looking for. New software flaws are disclosed every single day, and attackers often start scanning for them within hours of publication. […]
Is your business protected against the attack you haven’t seen yet? Most breaches don’t start with a dramatic hack. They start with one phishing email, one unpatched laptop, or one misconfigured cloud setting. The right cybersecurity solutions close those gaps before attackers can use them. This guide explains the main types of cybersecurity solutions, what […]
TL;DR: Japan’s cyber emergency is a warning about what happens when familiar ransomware playbooks become faster, cheaper and easier to scale. AI reduces the time and coordination required to analyze targets, build tooling and chain destructive actions. That shortens the interval between initial access and business impact. Defenders need real time enforcement and containment that …
The post DoW Instruction 8430.01 makes software evidence a condition to operate appeared first on Anchore.If you build or deliver software for the Department of War (DoW), your next authorization conversation just changed. As of September 8, 2026, all software operated on DoW networks and systems must be supported by machine-readable evidence of its component composition, build integrity, and application security (§3.5.a(1)). That’s no longer a best practice. It is […]
A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data
What OpenShell is AI agents do more than call APIs. They run shells, install packages, read files, and open network connections. Often they act on text they pulled from the internet a minute earlier. So every agent is untrusted code that holds real credentials. OpenShell,... The post OpenShell on Kubernetes: A Guide for Platform Engineers first appeared on Nirmata.
Hackers got into Google’s newest flagship phone three times on Thursday. The break-ins happened at Pwn2Own Ireland, a contest in Cork run by Trend Micro’s Zero Day Initiative, or ZDI. The contest pays researchers to show real attacks on up-to-date devices. The flaws are then passed to the makers so they can fix them. Pwn2Own […] The post Google Pixel 10 Hacked Three Times at Pwn2Own, Researchers Win $562,500 appeared first on PrivacySavvy.
Three research teams broke into Google's Pixel 10 on October 8 at Pwn2Own Ireland, a hacking contest in Cork whose rules require every target to be fully patched. The contest pays researchers to show working exploits and passes the flaws to the vendors. One of the three Pixel exploits earned Ikotas Labs $300,000, the contest's top prize, and made the team the overall winner. Trend Micro's Zero
TL;DR A malicious release of TensorLake's TypeScript SDK, [email protected], used an install hook to search for developer credentials and accept remote commands. Sonatype's code review found that its GitHub fallback could create a public repository and commit collected data, including a stolen GitHub token in one path, and that the malware could modify accessible repositories by committing .claude and .vscode files. The loader exits under several common CI environment markers, so the payload's
Kubernetes workloads face security risks at every stage, from vulnerable dependencies and container images to misconfigurations and unexpected runtime behavior. See how to build a layered security workflow with Devtron, policy engines, and runtime security tools.
TL;DR Milestone: Since Sonatype began tracking malicious open source packages in 2017, we have logged nearly 2 million malicious packages. Scale: Sonatype Research Labs logged 149,329 open source malware packages in Q3 2026. npm remained overwhelmingly dominant at 89.5% of the quarter's malicious packages, although its share declined from 96.6% in Q2. Behavior: Among packages containing overt-malware behavior, 74.5% involved droppers, secrets exfiltration, or both, showing how often Q3 malware w
An AI agent once deleted someone's entire inbox despite being told to confirm first. Not because it was malicious, but because the instruction didn't survive context compaction. Shantanu Gattani, Sysdig's SVP of Product, on why that gap is the real risk in agentic AI, and who should be responsible for closing it.
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have
A single missing backslash turns a routine “copy a file from a pod” into remote code execution on Windows admin machines — here’s how it works, and how to shut it down... The post When Copy Means Compromise: How kubectl cp Enables RCE on Windows appeared first on Cycode.
TL;DR: Scan results show what is exposed right now only if you can rescan the moment risk changes, and most tools still wait for the next scheduled cycle. Aqua real time scanning lets teams start an on demand scan from the Aqua Hub or API, rescan only what changed in an image and use one …
Sysdig's CEO on the three questions every executive must answer about AI governance. And why runtime security is the only way to answer them with evidence.
CI/CD should make releases predictable not turn every deployment into a major incident. Discover the practices that keep Kubernetes delivery secure, controlled, and reliable.
Bitdefender, a European-based company, announced a partnership with Aruba S.p.A., one of Italy’s IT, cloud and data center... The post Bitdefender, Aruba bring sovereign cybersecurity to critical infrastructure, energy and other regulated sectors appeared first on Industrial Cyber.
Explore how the Shai-Hulud super-worm exploits developer trust in the npm ecosystem and why traditional scanners fail. Learn RapidFort’s proactive defense strategy—Curated Near-Zero CVE Images, automated 95% CVE remediation, and compliance acceleration—to build a resilient digital immune system against modern supply chain threats.
Bitnami’s move behind a paywall disrupts enterprises—RapidFort offers Bitnami-compatible, curated Near-Zero CVE Images that cut vulnerabilities by up to 95%, ensure seamless Kubernetes migration, and accelerate compliance without added costs.
A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "
Blocking suspicious install scripts may no longer be enough to mitigate threats from malicious JavaScript dependencies used in software supply-chain attacks. Security researchers at Checkmarx are warning of attackers using a malicious package called “indexed-btree” to impersonate the legitimate sorted-btree library, to spread malware hidden in the package’s normal runtime code. The campaign abandons the preinstall and postinstall scripts common in recent attacks, instead using a core package fun
