Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,734 matching stories — in Identity & Access Management — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
One of eMudhra's certificate authority private keys is the number 4.Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from
The Identity Explosion More Systems and Hybrid Deployment Agents As a New Identity Type We have more identities, more identity types, and more systems integrated into the identity and access management (IAM) feature set than ever before. From workforce (B2E) to external (B2C and B2B) and non-human identity (NHI) covering workloads and machines. The rapid rise in AI adoption has also created new requirements for agentic identity and access management.
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys could issue a certificate for any website that a browser would accept. A researcher reported the
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to CVE-2026-0257 (CVSS score: 7.8), an authentication bypass flaw that could be exploited by bad actors to set up unauthorized VPN connections. It was patched by Palo Alto Networks in May 2026 and was
Protect, govern, and understand AI agents and non-human identities operating inside your business-critical applications.
This Cybersecurity Awareness Month, make security the easy choice.
As major banks move to restrict AI assistants from accessing customer accounts, they face a difficult question: How do you protect customers from untrusted agents without preventing them from using the next generation of digital banking? For decades, banks have invested billions of dollars making it easier for customers to manage their money digitally. They […]
Detection after the fact works for many threat categories. For AI agents with tool access, it often works too late. By the time a detection fires, the... The post Why AI Agents Need Enforcement Before Execution, Not Detection After the Fact appeared first on Data443.
Sensitive data that nobody has catalogued cannot be governed. That is not a philosophy, it is an operational fact. Organizations routinely find, during a... The post From Discovery to Enforcement: Building a Data Security Program That Covers the Full Data Lifecycle appeared first on Data443.
Most email security failures happen not because a filter was absent, but because it inspected the wrong thing at the wrong stage. Cyren works differently:... The post How Cyren Filters Email Before a Message Reaches the Inbox: Layers, Scoring, and What Happens to Detections appeared first on Data443.
On June 17, about 30 senior identity practitioners joined us to record a live episode of the Identity at the Center podcast. Jim McDonald and Jeff Steadman hosted. No slides, no pitch, no script.
TL;DR
“The Real Cost of Manually Governing Applications” SailPoint + Cerby webinar recap
OverviewOn October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS), its platform for remotely troubleshooting and administering endpoints. Tracked as CVE-2026-102764 and assigned a CVSSv4 score of 9.3, the vulnerability allows unauthenticated remote attackers to perform file operations on an affected appliance without user interaction. Versions 26.2.3 and earlier are affected unless the BT26-05-RS patch has been applied.BeyondTrust has confirmed that explo
Learn about ISO 42001 certification costs, key cost drivers, and practical ways to reduce expenses without compromising audit readiness. The post How Much Does ISO 42001 Certification Cost? appeared first on Scytale.
Palo Alto Networks’ Unit 42 threat intelligence team uncovered a multistage cyber intrusion against a telecommunications managed service... The post Unit 42 traces Peerstitch malware deployment to FortiOS vulnerability exploited after FortiManager compromise appeared first on Industrial Cyber.
The post Phishing-Resistant MFA: What It Is, and Why It’s the Next Step Beyond Traditional MFA appeared first on WALLIX.
Microsoft has confirmed that the October 2026 Windows Server security updates can cause on-premises Exchange servers to become unstable. Since Patch Tuesday on October 13, admins have reported users unable to sign in to Outlook on the web (OWA), messages stuck in Outlook Outboxes, and mail queues grinding to a halt. The problem affects Exchange [...] The post October Windows Updates Leave Exchange Servers Unstable appeared first on Messageware.
Learn how ShinyHunters exploits Oracle PeopleSoft to steal sensitive data. Understand the attack risks, potential impact, and security measures to protect enterprise systems. The post ShinyHunters Exploits Oracle PeopleSoft to Steal Sensitive Data appeared first on Fidelis Security.
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the Wi-Fi password off the device
A standing privileged account holds elevated access around the clock, whether or not anyone uses it. That is the risk. Standing privilege means a standing target, and often a target no one is watching. Most organizations run more of these accounts than they realize, and many sit rarely used or never used. Attackers reach for them first, because one live key can bypass other controls. The fix is not more monitoring layered on top. It is to remove the standing right, so there is nothing to steal b
Credentials carry different levels of risk. You need your email throughout the day. You rarely need standing administrative control, yet many teams leave it switched on around the clock. That standing access is what attackers look for. A just-in-time approach changes the model. It makes privileged access available for the task that needs it, then takes the access back. Less standing privilege means less to steal, misuse, or forget. This post shows how just-in-time privileged access works, how we
Wildfire detection technology is advancing fast. Learn why rapid, coordinated communication is what turns early warning into resilience.
📣 It’s time to share what you’ve built, learned and fought with! The Call for Papers for Keycloak DevDay 2027 is open until October 24, 2026. As announced in our Save the Date post back in June, the world’s largest Keycloak community conference returns to Darmstadt, Germany, on April 8–9, 2027. And once again, we want the conference day to be shaped by the people who know Keycloak best: you, the community. What we’re looking for 📝 Anything Keycloak-related is welcome! T
At 1Password, we believe strong security should feel like part of the workflow, not an interruption. That is the goal behind our work on user verification (UV) for passkeys.UV is a local identity check a website can require as part of a passkey action, to confirm the person approving the action is the person authorized to do so. This decision belongs to the website, not 1Password, as the site will validate UV occurred before accepting the operation. A useful analogy is paying with a bank card. F
In most organizations, standing privileges don’t show up all at once. They accumulate quietly. A role is added “temporarily.” A contractor needs broad access to finish a project. A service account gets oversized permissions because no one has time to fine-tune them. None of these choices seem harmful in the moment, but over time they build into a privilege surface that’s far too large to monitor and far too easy to misuse.The challenge is that standing privileges often look harmless until someth
Summary AI security discussions often focus on prompt injection, model vulnerabilities, and patching. But one of the most immediate risks is much more familiar: compromised credentials. AI agents require credentials to access enterprise systems and can also discover credentials exposed elsewhere. Because agents operate at machine speed and scale, even short-lived credentials can provide enough […] The post The Myth of the Solved Secret: Why Credentials Are AI’s Most Dangerous Vulnerability
Un chercheur en cybersécurité a présenté une faille vieille de seize ans dans les puces Wi-Fi de Broadcom, exploitable à portée du réseau sans connaître le mot de passe de la box. Il a relevé en France une Livebox 5 d’Orange et des box SFR non corrigées.
Security researchers have found a new malware that hides inside Fortinet firewalls. The malware is called PEERSTITCH. It is an ARM64 implant that runs in the memory of the device. Palo Alto Networks’ Unit 42 shared the findings on October 14, 2026. Its team studied an attack on a telecommunications managed service provider. Hackers steal […] The post New PEERSTITCH Malware Bypasses Security Checks on Fortinet VPNs appeared first on PrivacySavvy.
An employee leaves your company on a Friday; by Monday, their AWS Identity and Access Management (IAM) role is still active, assigned to three production accounts – yet no one flagged it. This isn't a hypothetical; it's the reality of most enterprise AWS environments today. And it's exactly the kind of access that may not surface in an audit, or leaves your environment with a compliance gap.
Here is a number worth sitting with: The average cybercrime breakout time in 2025 was 29 minutes. That is the window between an attacker gaining initial access and beginning lateral movement to other systems, according to the CrowdStrike 2026 Global Threat Report. The fastest observed case in the dataset was 27 seconds. In one documented intrusion,... The post The patch gap: When attackers move in hours and you patch monthly appeared first on ManageEngine Blog.
AI agents and machine identities now authenticate, hold access, and act on their own. Each one is an identity you own, and one most security tools weren’t built to watch. So they run with standing permissions to sensitive resources, and no one reviews what they do with them. Simeio runs the identity work ITDR depends […] The post ITDR in the Age of AI and Agentic AI appeared first on Simeio.
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and July 2026, so that any copy of the Windows backup program that checked for an update during one of those windows would download and run a backdoor. Google Threat Intelligence Group, Mandiant, and ManageEngine's Threat Analysis
Key takeaways The Precisely Platform brings data management capabilities together on one shared metadata and semantic foundation, with general availability planned for early 2027. Precisely AI Studio equips builders with agents, apps, and skills that show what’s possible with the data management capabilities of the Precisely Platform. New MCP servers for Precisely products enable AI […] The post Unified data management for AI readiness: what’s new, what’s next appeared first on Precisely.
Learn how to build a risk heat map from your risk register and prioritize effective risk treatment decisions. The post Risk Heat Map: How to Build One and Use It to Prioritize Cyber Risk appeared first on Scytale.
The post Supply Chain Visibility From Purchase Order to Delivery appeared first on Exostar.
Ask most teams for a map of their network and you’ll get one of two things: a diagram someone drew for an audit two years ago, or an export from the firewall and cloud consoles showing what each rule allows. Both describe intent. Neither describes what an attacker on the internet can actually reach today. […] The post How to Build Your Actual Network Map with Custom Agents in Orca appeared first on Orca Security.