Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,538 matching stories — in Managed Detection & Response (MDR) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Von einem kompromittierten Server gesicherte Dateien zeichnen einen Qilin-Angriff nach — von der Sammlung aus Exchange-Postfächern über die Zerstörung der Backups und das Ausrollen eines Wipers bis zu den ersten gemeldeten Ausführungen der Ransomware.
For years, ransomware in healthcare was seen as a big-system problem. For an IT administrator for 200-person medical group, thinking they were too small to be worth the trouble was a comforting thought. But those days are over. Even though community hospitals and physician groups still have the same kinds of protected health information as large national health systems, what’s changing is how profitable they can be to attack when they have fewer security resources standing in the way.
Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protection is enabled. With malicious Android applications abusing the API serving as the main conduit for malware and financial fraud, the tech giant said the move would block a major attack pathway. Advanced Protection is a
A standard employee offboarding checklist can cover HR tasks while still missing identity and access paths that affect MSP security efforts. Payroll...
Group-IB descubre BraZetsu, un nuevo malware para Windows basado en Python que funciona como un toolkit maestro para Initial Access Brokers y potencia un marketplace clandestino único, mejorado con IA, para comercializar objetivos comprometidos en Iberoamérica y Latinoamérica.
Sophos has been named a Leader in the IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises 2026, recognizing the strength of our prevention-first approach and stopping AI-era threats as early as possible.
At a glance: CVE-2026-65660 is an actively exploited SharePoint flaw allowing an authenticated low-privileged user to execute code on an on-premises SharePoint server. POC was released September 22, and exploitation attempts were observed within days. The authentication requirement may provide limited protection in environments where threat actors can obtain valid credentials through phishing, password spraying, credential theft, or a previous compromise. Researchers also demonstrated a separate
AI now finds critical vulnerabilities faster than anyone can patch them. Why Agentic Runtime Security—not posture—closes the gap.
Agentic Runtime Security is runtime detection and response across cloud, SaaS, identity, AI, and third-party services — the infrastructure endpoint tools can't see. What it is, how it differs from EDR, and how it stops attacks before they reach the business.
Legacy SIEM puts ingestion cost, tuning, and staffing on you, and all three grow with every client. Here is how MSPs close the gap with next-gen SIEM.
Google's AI-powered web app scanner with deterministic validation, OSS tool to detect, prevent, and investigate risky AI agent behavior, NCSC: "One does not simply defend agentically"
Medical practices are attractive ransomware targets because they handle sensitive patient data, depend on connected clinical systems, and face significant operational disruption when technology goes offline, making proactive cybersecurity and recovery planning essential. The post Why Are Medical Practices Such Attractive Targets for Ransomware? appeared first on Omega Systems.
CVE-2026-76504 lets attackers bypass authentication on Cisco Catalyst SD-WAN Manager with no workaround available, and exploitation reportedly started before disclosure. Patching closes the door, it doesn't tell you who already walked through it.
Introducing Cortex XCOR: AI-Driven Observability that Delivers Autonomous Response with AI SRE I’ve been tackling the observability problem for more than a decade, since before it was coined observability. From building internal … The post Observability’s AI Moment appeared first on Palo Alto Networks Blog.
Over the past year the way we build software internally has changed shape. Code is […] L’article Industrialising AI-Assisted Development: What We Changed and Why est apparu en premier sur INTRINSEC.
Preparing a client update. Reviewing open incidents. Figuring out which account needs attention first. For MSPs, each task often starts with gathering...
New training on using AI safely and spotting AI-powered threats arrives this Cybersecurity Awareness Month Attackers are moving faster than ever, weaponizing newly discovered vulnerabilities before defenders can patch them and building new types of malware that signature-based defenses can’t catch. Thousands of organizations around the world rely on our Aurora® Superintelligence Platform, a best-in-class ... AI Threats Are Evolving Fast. Your Employees Are Still the Last Line of Defense.
The Huntress Tragic Quadrant ranks the cyber threats hitting businesses most, from RMM abuse to AiTM, ClickFix, using real SOC data.
A technical walkthrough from runtime preparation and network-share discovery to concurrent file encryption DragonForce is a Ransomware-as-a-Service (RaaS) operation that first surfaced in mid-to-late 2023. It initially presented itself as a hacktivist collective before shifting to a profit-driven model. Early payloads were built on leaked LockBit 3.0 source code and later supplemented with code derived […] The post Inside DragonForce: How a Ransomware Cartel’s Payload Actually Runs a
Benedict Jones spent years working for McAfee and Sophos. While doing threat research at Sophos, he spotted a problem in mobile threat defence that nobody had actually fixed. He’s now CEO and founder of Trustd Mobile, and the story of how he got there says more about MSP buying decisions than most vendor pitches ever […] The post Innovation wins. Why smaller beats bigger appeared first on Heimdal Security Blog.
Milk Dragon, also known as NaiLong is an Adversary-in-the-Middle (AiTM) phishing kit active since October 2025. Unlike conventional phishing tactics that rely on fear and urgency, Milk Dragon lures victims with big discounts on consumer goods distributed via Facebook and TikTok marketplace advertisements.
GreyMatter Attack brings agentic attack-path mapping and validation into GreyMatter, so defenders can find and close security gaps before adversaries do.
Bitdefender, a European-based company, announced a partnership with Aruba S.p.A., one of Italy’s IT, cloud and data center... The post Bitdefender, Aruba bring sovereign cybersecurity to critical infrastructure, energy and other regulated sectors appeared first on Industrial Cyber.
Taking the order is easy. Keeping the promise is what breaks—and when it does, B2B buyers don't complain, they just pick up the phone and stop trusting your site. Keith Gorney, who ran the OMS behind $10B a year at Best Buy, makes the case for why order management, not ERP, is the missing piece: one real-time picture of inventory, reps who can edit a single line instead of scrapping the whole order, and a rollout you can start small and build from. The post Hitting the PIM Ceiling: What Distribu
Minimize human risk and strengthen cyber resilience within your organization.
Minimize human risk and strengthen cyber resilience within your organization.
Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler
Why do businesses need encryption? Protect customer data, reduce breach damage, meet compliance needs, and keep work moving with confidence at every turn. The post Why Do Businesses Need Encryption to Stay Safe? appeared first on mPoweredIT.
Most security metrics report activity, not protection. Measuring Zero Trust takes two dimensions, readiness and fitness. How they work and why you need both.
Cisco disclosed two critical authentication bypass vulnerabilities in September 2026: CVE-2026-76460, affecting Identity Services Engine (ISE), and CVE-2026-76504, affecting Catalyst SD-WAN Manager. Cisco has confirmed active exploitation of both and released patches. MSPs and security teams should identify affected deployments, urgently apply the appropriate updates, and investigate whether attackers already gained access. CVE-2026-76460: Authentication Bypass […]
Doommageddon is a financially motivated ransomware operation built around the now-familiar double-extortion model: steal data first, encrypt systems second, then threaten publication if the victim doesn’t pay. What makes the group interesting is how long it was able to operate in the shadows. Cynet’s analysis traced the group’s earliest known intrusion to March 8, 2026. […]
At a glance: Cisco disclosed CVE-2026-76504 on September 30, 2026, and confirmed the vulnerability has been exploited in the wild. A remote threat actor can bypass authentication and gain administrator-level access to a vulnerable API endpoint without valid credentials or user interaction. Organizations exposing Cisco Catalyst SD-WAN Manager to the internet are the most exposed because the platform serves as the central management plane for SD-WAN environments.
See how attackers like GootKit and WhisperGate abuse Windows Defender exclusions to hide malware from AV scans — and how Huntress detects it.
Security Orchestration, Automation and Response was built around a sound premise: security workflows involve too many manual steps, too many context switches, and too much repetitive work for the alert volumes that modern environments generate.
Cybersecurity skills are among the most in-demand today. University students can explore them for free with Kaspersky Academy’s “Cybersecurity. Entry Level” course
Threat actors are abusing ChatGPT Custom GPTs to disguise them as legitimate product offerings and direct unsuspecting victims to malicious sites that employ ClickFix lures to deliver malware. Huntress, which observed the activity in late September 2026, said it marks the abuse of yet another feature in trusted artificial intelligence (AI) platforms. Prior campaigns have weaponized shared
Used the least. Installed on the most. The post Copilot has the largest AI attack surface of any tool we tracked appeared first on ThreatDown.
Extortion crews are converging on the same playbook: social engineering in, SMB and RMM out. Get the Q3 2026 breakdown of top attacker techniques.