Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
730 matching stories — in Threat Exposure Management (CTEM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9.4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially
Horizon3 has surpassed $100 million in annual recurring revenue, with ARR growing more than 120% year over year. The milestone reflects increasing adoption of the NodeZero platform, a channel-first growth strategy, and demand for continuous, production-safe autonomous penetration testing. Horizon3 also outlined its next phase of investment in sovereign cyber AI regions, critical infrastructure centers of excellence, and attack-defend AI learning loops.
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced the expansion of its open technology and partner ecosystem to accelerate integrated security workflows across the entire tech stack. Tenable OPEN for AI delivers validated, ready-to-use AI workflows, enabling organizations to use Tenable’s deep exposure intelligence with their preferred AI models, agents and tools. Tenable OPEN for AI launch partners include BeyondTrust, Cohesity, Command Zero, Corelight, In
Exposure management company Tenable Holdings announced that H₂O Retailing has deployed the Tenable One Exposure Management Platform across... The post H₂O Retailing deploys Tenable One to unify cyber exposure management across multi-cloud infrastructure appeared first on Industrial Cyber.
Horizon3 researchers analyze CVE-2026-106173, a critical Fortinet FortiSIEM vulnerability affecting an unauthenticated gRPC service. The deep-dive explains how path traversal and null-byte handling enable arbitrary file writes and remote code execution, along with indicators of compromise for defenders.
Staffing software giant calls in CrowdStrike as customers face login headaches and questions remain over possible data theft
Quantum-resistant cryptography presents security leaders with various challenges, but CISOs in industries dependent on IoT and operational technology (OT) devices may face a particularly difficult journey to quantum readiness, especially if sensitive information that must remain confidential for years passes through those devices. A recent report from cybersecurity firm Forescout highlights these challenges in the healthcare industry, where medical histories, diagnostic images, and laboratory re
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere Labs, ROMULUS is akin to a malware delivery service that employs ClickFix-style lures on bogus landing pages to trick unsuspecting users into running malicious commands and infecting their own
Averlon tested Mistral Large 4 on 16 security benchmarks: upper half wherever the evidence is supplied or searchable, weaker where it must recall specifics.
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
OverviewIn early October 2026, Rapid7 analysts investigated a compromise of a Citrix NetScaler ADC appliance. The appliance was running an affected 14.1 build and was exposed to active exploitation targeting NetScaler authentication and SAML deployments.The intrusion achieved root code execution, deployed multiple persistence mechanisms, installed PHP web shells, created outbound command-and-control and internal tunnelling capabilities, performed targeted reconnaissance of DNS, LDAP/Active Direc
Target selection has guided traditional pentesting for years, and it now has a second job: directing compute and token budgets to the attack surface assets that actually matter.
New real-time AI Data Loss Prevention capabilities help organizations securely adopt generative AI while maintaining control over sensitive information. MIAMI, Florida — October 19th — CYBRAL Inc., an AI-driven cybersecurity and risk intelligence company, today announced CYBRAL GUARD AI DLP, extending the capabilities of its AI-driven Data Security Posture Management (DSPM) platform to help organizations protect sensitive information across enterprise and generative AI applications. As...
FERC recently pulled data centers closer to the reliability world. Unfortunately, secure remote access is the risky part that is missing. The post Secure Remote Access: The Data Center Risk Not on the Uptime Slide appeared first on Forescout.
Discover how to secure AI agents in your cloud environment with Tenable One Cloud Exposure. We explore Microsoft Entra Agent ID and provide essential best practices for robust agentic AI identity security.Key takeawaysUnderstand your current maturity level and then build an appropriate action plan to secure your agent identities.Use your cloud providers’ native tools or Tenable One Cloud Exposure to locate and catalog every AI agent operating in your environment.Do not assign human identities or
The persistent, stealthy FortiGate implant was deployed against a telecommunications organization. The post Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack appeared first on SecurityWeek.
Horizon3 announced a strategic expansion in Singapore, supported by the Singapore Economic Development Board (EDB) and EDBI, part of SG Growth Capital, the strategic investment platform established by EDB and Enterprise Singapore.
Averlon tested Gemini 4 Argon on CTI-REALM, RealVuln and VulnGym: it finds nearly as much as the best models we tested, but it is noisy and expensive.
Security researchers have found a new malware that hides inside Fortinet firewalls. The malware is called PEERSTITCH. It is an ARM64 implant that runs in the memory of the device. Palo Alto Networks’ Unit 42 shared the findings on October 14, 2026. Its team studied an attack on a telecommunications managed service provider. Hackers steal […] The post New PEERSTITCH Malware Bypasses Security Checks on Fortinet VPNs appeared first on PrivacySavvy.
The Arbitrary File Upload in BeyondTrust Remote Support let an attacker upload files to the appliance before BeyondTrust's October 15, 2026 fix. This FAQ is updated as new details emerge.
CVE-2026-102764 is an Arbitrary File Upload vulnerability in BeyondTrust Remote Support that allows an external, unauthenticated attacker to perform arbitrary file operations by issuing specially crafted requests. Apply BeyondTrust's security patches, and check appliances for signs of compromise.
Averlon evaluated Meta's Muse Wonder on vulnerability localization, vulnerability discovery and threat intelligence. Strong detection queries and fast scans, weaker threat-report interpretation.
Best Managed EDR Services for Mid-Sized Businesses Mid-sized businesses face a cybersecurity challenge that is often underestimated. They may operate hundreds or thousands of endpoints, support remote and hybrid employees, use cloud applications, and manage sensitive customer or financial information. Yet their security teams are frequently much smaller than those of large enterprises. This imbalance The post Best Managed EDR Services for Mid-Sized Businesses appeared first on Seceon Inc.
Kenna Is Sunsetting. Your Next Move Just Got Easier. There's a smarter way forward than another traditional RBVM tool. And we know a thing or two about Kenna.
Best Autonomous SOC Software for Enterprises Enterprise security operations are becoming increasingly difficult to manage. Organizations operate across on-premises data centers, public and private clouds, remote endpoints, SaaS applications, identity platforms, and distributed networks. Each environment generates security telemetry, alerts, and potential indicators of compromise that security teams must analyze continuously. For enterprise Chief Information The post Best Autonomous SOC Software
October 2026 Patch Tuesday arrived on October 13 with 1,411 CVEs, the first four-digit release in Microsoft's history and the fourth record in five months. One flaw is under active exploitation, a Windows Shell bypass of Mark of the Web protections that Microsoft rates Important
Over the past two years, the frontier AI industry made a deliberate choice. Users complained that assistants refused too often, so labs tuned models to refuse less, reason longer, and take more actions on their own. The goal was capability and helpfulness. The side effect is a class of AI systems that can plan an The post Frontier Models Are Outrunning Their Guardrails: What Security Teams Need to Know appeared first on Seceon Inc.
Overview Recently, NSFOCUS CERT monitored that GitLab released a security update to fix the GitLab Remote Code Execution Vulnerability (CVE-2026-97229). Due to insufficient validation of regular expressions in GitLab’s CI/CD configuration, unauthenticated attackers can construct special regular expressions within the CI/CD configuration to trigger an integer overflow during compilation, thereby executing arbitrary code with the […] The post GitLab Remote Code Execution Vulnerability
Learn how you should respond to the CrowdStrike incident and the likely long-term impact it will have on third-party risk management.
How to build a CTEM program your team actually runs. A stage-by-stage implementation guide with owners, cadence, tooling, and a free checklist. The post How to Build a CTEM Program: A Practical Guide to Implementing the CTEM Framework first appeared on SafeHill.
Onyxia Cyber is proud to join other industry leaders as a partner in the Open Secure AI Alliance, a new industry coalition organized by the Linux Foundation and originally established by NVIDIA. The Alliance is focused on ensuring defenders everywhere have open, frontier tools they can trust and control.
New research shows auto-approve raises attack success on coding agents from 29.2% to 95.6%. What enterprises should require before granting agents autonomy.
A template injection flaw in Adobe Commerce scores a maximum 10.0, letting an unauthenticated attacker execute arbitrary code on a public storefront with no user interaction required.
Overview SecLLM-3.6-27B is a specialized cybersecurity model developed by NSFOCUS for complex security tasks. In the CyberGym Level 1 evaluation, SecLLM-3.6-27B achieved a 91.37% task success rate under a fixed task-interaction and tool-execution framework, representing an absolute improvement of 36.86 percentage points over the 54.51% base model. Model Success Rate Absolute Improvement Qwen3.8-27B base model […] The post NSFOCUS SecLLM Model on CyberGym Technical Report appeared first on
Microsoft Just Published More CVEs Today Than All of Last Year 1,408 Microsoft CVEs in one Patch Tuesday, against 1,244 in all of 2025, in a year when the whole CVE count has doubled: what that does to a patch queue, and how Empirical helps you work it.
Ivanti patched the Authentication Bypass by Spoofing vulnerability in Ivanti Connect Secure across several version branches, with fixed releases now available. This FAQ is updated as new details emerge.
Picture a global telecom company. Three years ago, a marketing team launched a campaign microsite on a cloud platform and pointed a company hostname at it. The campaign ended and the team deleted the app. Nobody deleted the DNS record. A few years ago, that mistake could sit there for a decade. No one was... The post The Quiet Takeover: How Your Forgotten Cloud Resources End Up Selling Slot Machines appeared first on IONIX.
SAP NetWeaver Visual Composer skips authorization checks in portal functionality, letting a low-privileged user invoke internal operations on a connected back-end system and potentially compromise it fully.