Vendor news

Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.

260 matching stories — in Secrets Detection — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.

Announcement

Weekly Briefing - 18-08-2026

Corgea's weekly briefing for 12-18 August 2026 covers the StubMaker RubyGems typosquat wave, LiteLLM's August blast-radius disclosure, and the JupyterLab PyPI extension-manager bypasses.

Announcement

StubMaker: RubyGems `extconf.rb` typosquats delivered a Windows infostealer

Fresh 15-18 August reporting on the StubMaker campaign shows how RubyGems typosquats such as `brumdler` and `brundlef` abused `extconf.rb` to fake a successful native-extension build, beacon over plain HTTP, fetch a Rust loader from GitHub Releases, and unpack an in-memory Go stealer that targeted Chromium secrets, wallet material, and Telegram data.

Announcement

The Next Model Won’t Fix This: Three AppSec Imperatives From Black Hat USA 2026

Black Hat USA 2026 didn’t introduce the AI security problem, but made it clear how fast that problem is becoming operational. An independent study initiated and funded by Checkmarx helps explain why. On real-world repository tasks, frontier models produced working code 83% to 95% of the time, but only 24% to 36% of their solutions […]

Incident

CVE-2026-73416 and CVE-2026-73627: JupyterLab extension-manager bypasses

Three August 2026 JupyterLab disclosures show the PyPI extension-management path could misapply administrator policy: blocklists compared non-canonical package names, `/lab/api/plugins` trusted incomplete lock enforcement, and a related `PyPIExtensionManager.install()` path skipped its own allowlist check because of a missing `await`.

Announcement

Agentic Development Lifecycle (ADLC): What You Need to Know

AI agents now write code, pull dependencies, run tests, and open pull requests inside enterprise pipelines, sometimes without a developer ever opening an IDE... The post Agentic Development Lifecycle (ADLC): What You Need to Know appeared first on Cycode.

Announcement

Beyond CVSS: Contextual Vulnerability Intelligence for CVEs

CVSS rates worst-case severity, not real risk. ZeroPath layers four signals on every dependency CVE: the real advisory CVSS, CISA KEV, FIRST EPSS, and an AI-derived contextual severity for your repo, refreshed daily and kept honest.

Announcement

What Is Checkmarx Fusion?

Now available in Early Access for SAST within Checkmarx One, Checkmarx Fusion adds a new detection layer that advances vulnerability-finding accuracy beyond what rules-based scanning or an AI model can achieve alone.