Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
734 matching stories — in Threat Exposure Management (CTEM) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
OverviewWhile conducting research into a recent N-able N-central authentication bypass vulnerability (CVE-2026-18577), Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker to bypass authentication and create a new attacker-controlled System administrator account on an affected server.CVE IDDescriptionCWECVSSv4CVE-2026-86206Semicolon/Forwarded access-control bypassCWE-7916
Team PCP calls its own operation ramshackle. It still walked away with live credentials from 2,500 companies, because almost nothing in a standard identity program is built to check whether a credential is still good. The 40 minutes that mattered more than the terabytes In Marc
An unauthenticated file read flaw in MikroTik RouterOS WebFig lets a remote attacker traverse out of the web namespace and read root-owned configuration files, including stored credentials.
AI is accelerating vulnerability discovery, but security teams still need to know which exposures actually matter. Here’s what Fal.Con 2026 reinforced about offensive security, validation, and proving risk.
Tenable's Liat Hayun, SVP of Product Management, tells FedTech Magazine that vulnerability risk is "not one-size-fits-all." Hayun notes, "There can be the same vulnerability in the same type of environment, but agencies must treat them differently based on the context of the environment."
Is Your Security Program Ready for Autonomous Interdiction? Security teams have never had more data. More vulnerability findings. More asset inventories. More threat intelligence. More dashboards. Yet AI-enabled attackers can identify and exploit weaknesses faster than traditional, human-led remediation processes can respond. The challenge is no longer limited to finding and prioritizing exposures. Organizations need [...] The post The Future of Exposure Management is Preemptive appeared first o
OverviewA new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This previously undocumented framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting, and engage
NIST's draft SP 1353 provides AI prompts for three CSF 2.0 tasks and says weeks of drafting compresses into hours. Here is what the prompts can draft, what only humans can validate, and the four things to settle before anyone opens a model.
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced that it is collaborating with OpenAI to create the CyberAgents Exchange AI Inspector (Exchange Inspector), a new security review process for AI agents, skills, MCP servers and multi-agent playbooks available through the CyberAgents Exchange, powered by Tenable.Unveiled today at OpenAI’s Intelligence at Work: Cyber Summit, Exchange Inspector combines frontier assessment using OpenAI GPT cyber models, skills i
See how Virginia Tech used the NodeZero GraphQL API, GitLab, and ServiceNow to automate external pentesting and create a repeatable workflow from attack validation to remediation.
284 million records claimed at McKesson, 12.9 million verified at Carhartt. The eight biggest data breaches of August 2026, with every number checked against a company statement, filing, or named outlet.
August's CVSS 7.0 was a Lazarus zero-day exploited for five weeks. Its CVSS 10.0 needed no patch at all. The top CVEs of August 2026, ranked by exploitation evidence rather than severity, with remediation steps for all five.
An unrestricted file upload flaw in elFinder lets an attacker slip PHP files past MIME filtering during ZIP extraction, achieving remote code execution on the underlying web server.
OverviewOn September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution (RCE) on affected appliances.CVE-2026-83548 is a critical pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. The flaw has a CVSS v3.1 base score
Liat Hayun, SVP of Product Management at Tenable, explains in HealthTech how exposure management transforms cybersecurity into a "live, defensible metric" under the FAIR framework, enabling hospital CISOs to prioritize budgets around financial and operational impact rather than raw vulnerability counts.
CTEM is not about filling five technology boxes. It is about continuously reducing exploitable exposure, proving remediation worked, and measuring whether the environment is becoming harder to attack.
In June, a startup called depthfirst pointed an autonomous agent at FFmpeg’s roughly 1.5 million lines of C and came back with 21 previously unknown vulnerabilities, each with a reproducible proof of concept. Nine now carry CVE identifiers, CVE-2026-39210 through CVE-2026-39218. These were mostly heap and stack overflows in demuxers and decoders, spanning the [...]
CYBRAL has secured three additional U.S. patents covering autonomous security validation and AI-driven visualization of attack paths and sensitive data at risk.
Overview In August 2026, Oasis Security disclosed a high-severity vulnerability in NVIDIA’s NemoClaw framework (CVE-2026-65105, CVSS 3.1 score 8.1). The vulnerability allows an attacker to fully take over a locally running Ollama model service and implant persistent hidden instructions into the AI model via a single malicious webpage and without any user awareness. As of […] The post AI Security Incident Case: NVIDIA’s NemoClaw Chat Template Poisoning Vulnerability appeared fir
Frontier AI models, such as Mythos and GPT-5.5-Cyber, are now finding vulnerabilities at scale and changing the threat landscape. We’ve already shown that generally available, non-frontier models can find and exploit new vulnerabilities in open-source software. In May, Google published what they believe was the first time a threat actor used an AI-generated exploit for […] The post Can AI Create PLC Attacks? Yes, But It’s Not That Easy Yet appeared first on Forescout.
“Private.” “Secure.” “Discreet.” That is how Hims & Hers described its telehealth services to millions of customers. According to the FTC and two states, the […] The post Hims & Hers Lawsuit: FTC and Two States Sue Over Website Tracking Pixels appeared first on Reflectiz.
Regional APT Threat Situation In June 2026, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These activities were primarily concentrated in regions including East Asia, South Asia, Eastern Europe, South America, and Central Asia as shown in the figure below. Regarding the activity levels of different groups, […] The post NSFOCUS Monthly APT Insights – June 2026 appeared first on NSFOCUS.
What's Validation Worth, Does AI Replace the Work, and What Should It Cost? In the last piece I wrote about validation, I laid out the two moments: pre-remediation and post-remediation, and the methods you'd use for each. There we covered the work itself. This one covers everyth
Starting today, industry benchmarks in Onyxia’s Operational Resilience Platform cover five sectors: IT & Tech, Financial Services, Healthcare, Critical Infrastructure, and Retail & eCommerce – expanded from IT and Finance.
Autonomous AI in cybersecurity isn’t all or nothing. Learn why security leaders are adopting a crawl–walk–run maturity model to safely scale AI autonomy with guardrails, reversibility, and continuous validation.
If autonomous AI takes action, the business owns the outcome. Learn why auditability, risk acceptance, tiered approvals, and change control are critical to governing AI in cybersecurity.
Most AI autonomy failures happen because actions can’t be undone fast enough. Learn why reversibility and human-in-the-loop controls are critical guardrails for autonomous AI in cybersecurity.
AI agents have now proven, in the real world, that autonomy without a security model is a liability. At Arctic Wolf, we’ve spent years watching that same lesson play out with cloud migrations, remote work, and every other rush of new technology, and this is that pattern showing up again, just faster. OpenAI recently published ... The Trillion-Dollar AI Bet Needs a Security Strategy
Can a point-in-time network admission model keep up with how access works today? Forescout explores the evolution of network access control. The post UZTNA: the Evolution of Network Access Control appeared first on Forescout.
A path traversal flaw in Next.js lets an unauthenticated attacker redirect a cache write outside its directory on Windows-hosted servers, reaching remote code execution on the host.
In the CyberGym Level 1 global leaderboard, an authoritative benchmark for cybersecurity large models, NSFOCUS AI, NSFOCUS’s self-developed intelligent security agent captured the top global ranking in this round with a 95.02% vulnerability-reproduction success rate. Built on Zhipu’s GLM-5.3 large language model, NSFOCUS AI distills NSFOCUS’s accumulated offensive-and-defensive expertise into computable workflows, systematically unlocking GLM-5.3’s […] The post 95.02% Success Rate! NSFOCUS
The 2026 Gartner Emerging Tech Impact Radar: Generative AI opens with a sentence that in our view should stop every technology buyer mid-scroll: “Generative AI is facing a validation hurdle as, despite surging investment in associated technologies, returns frequently lag behind expectations, highlighting an urgent need for proven value.” But the same report projects a […] The post Skyhawk Security named a Sample Vendor for intelligent simulation category in 2026 Gartner® Emergi
The debate over AI SOC vs traditional SOC has moved from theoretical to urgent. Security teams face record alert volumes, a persistent analyst shortage, and adversaries who now automate their attacks – while the traditional Security Operations Center, built on manual triage and rule-based tooling, struggles to keep pace. The AI-powered SOC is the response: The post AI SOC vs Traditional SOC: What’s the Difference? appeared first on Seceon Inc.
Security operations are complex. Teams are constantly balancing investigations, risk, operational health, and day-to-day priorities. Knowing what requires attention and deciding what to do next isn’t always easy. That’s why Arctic Wolf® is introducing new experiences designed to make security operations more accessible and easier to manage. We’re taking the next step forward with two ... See More, Act Faster: Arctic Wolf’s Next Step in Accessible Security Operations
Last week in Singapore during the Cyber Executive Circle, I posed standing next to a banner with Manuj, pointing at a single line that I The post CTEM Is a Program. Not a Tool. appeared first on Gambit Cyber.
