Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
129 matching stories — announcement, in Secure Code Training — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Match the DevSecOps certification to what HR and hiring managers ask for. The post Which DevSecOps Certification Matches What HR Is Actually Asking For? appeared first on Practical DevSecOps.
A four-stage roadmap to become an AI security engineer in about 9 months. The post How to Become an AI Security Engineer: The 2027 Roadmap appeared first on Practical DevSecOps.
EU Cyber Resilience Act deadlines, fines, and a DevSecOps checklist. The post EU Cyber Resilience Act 2027 Deadlines: A DevSecOps Compliance Checklist appeared first on Practical DevSecOps.
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since August 2023, eight of which have
A few years ago, a friend stayed at my place during Ruxcon and gave me a bottle of rum called Inner Circle as a thank-you. I liked the name. To be fair, at 75.9%, I am surprised I still remember it. But over the years, security has started to feel a bit like that. At Unprompted Australia two weeks ago, I ran into at least two people I had originally met in Prague. Different conference, different country, almost the other side of the world, and somehow the same people. The year before, at an OWAS
A malicious npm package named "indexed-btree" has been observed hiding its malicious behavior within application code rather than using lifecycle scripts, indicating that threat actors are likely shifting tactics in response to recent security controls. "Indexed-btree is a malicious npm package mimicking the legit sorted-btree package, an ordinary B-tree/indexing utility," Checkmarx said. "
Blocking suspicious install scripts may no longer be enough to mitigate threats from malicious JavaScript dependencies used in software supply-chain attacks. Security researchers at Checkmarx are warning of attackers using a malicious package called “indexed-btree” to impersonate the legitimate sorted-btree library, to spread malware hidden in the package’s normal runtime code. The campaign abandons the preinstall and postinstall scripts common in recent attacks, instead using a core package fun
Attackers taking notes, garbage hidden in JSON, sandbox escapes and Ruby back in the news for the wrong reasons. 🏭 Countering misuse of AI: September 2026 / Anthropic 👍 0 This is a big report, and I think it's worth taking the time to read it. We spend a lot of time discussing whether AI can find vulnerabilities. Meanwhile, the attackers described here are using it to do much more: understand applications, use stolen credentials, write tools, and steal data.One detail I found particular
My family wanted an application to help us coordinate work around the house. We wanted a reward system, family goals, calendar information and some meal-planning capability. Maybe my daughter earns enough points to choose the movie. Maybe we all hit a goal and go to the lake. There were products that solved pieces of the problem. I could not find one that fit the way we wanted everything to work. To be honest, I also did not want to pay for several tools and still end up with a pa
JSON Web Tokens (JWTs) are everywhere in modern authentication, and for good reason: they are compact, self-contained and easy to pass around between services. The catch is that a lot of their security depends on how you use them. If you rely on a well-maintained JWT library, the hardest cryptographic parts are handled for you, but a handful of practical decisions are still yours to get right. This post is aimed at developers who use a JWT library rather than write one. We will walk through the
When people hear “AI leadership team,” they may picture a group of technical AI experts who enter the organization and make AI happen. I do not think that is the right model. You need technical expertise involved. Someone should understand the capabilities, limitations and technical realities. But the most important knowledge may come from the people who understand how the business actually operates. That is why I prefer the idea of an AI committee. “Committee” sounds co
Imagine a marketing team adopting an AI-enabled video platform. The team can now produce more videos in less time. It launches additional campaigns and creates more content than it could before. The productivity improvement is real. The people doing the work probably feel the difference. Then the team presents the result to the business: We produced twice as many videos. That is useful information. It is not yet proof of value. Did the company close more busine
Reflecting on the recent progress AI labs have announced in cybersecurity, one thing is becoming clear: the labs are successfully shaping the narrative, but the reality is more prosaic. They have built LLMs that can sometimes find and exploit vulnerabilities. That is real progress. It matters. But it is not yet autonomous cybersecurity in any meaningful operational sense.
Blog> EU CRA and PLD: Two Deadlines, One Evidence Set> Security Compass Perspective Two regimes, overlapping evidence The EU Cyber Resilience Act requires manufacturers to […] The post EU CRA and PLD: Two Deadlines, One Evidence Set appeared first on Security Compass.
Blog> A clean scan doesn’t prove CRA conformity> Security Compass Perspective A clean scan doesn’t prove CRA conformity Scanning evaluates implemented code and components against […] The post A Clean Scan Doesn’t Prove CRA Conformity appeared first on Security Compass.
That’s a fair question, and it deserves a straight answer rather than a pitch. Snyk, Checkmarx, and Semgrep are good tools. They find real vulnerabilities before code ships. They’ve saved dev teams from real incidents, and if you have one running in CI, you’re ahead of most.  Nothing below is an argument against that. There’s... The post Do We Still Need Secure Coding Training If We Use Snyk? appeared first on NINJIO.
:AI: !ai! A hidden .mcp.json file lets attackers achieve remote code execution in Claude Code via a malicious pull request — no user action required. See the PoC.
Phish & Ships Security Topic: Reporting Suspicious Emails NINJIO Season 11: Episode 08 Data Dave’s (Jon Lovitz) vacation unravels when a phishing-driven breach drains his long-saved loyalty points, all because a cruise line employee deleted a suspicious email instead of reporting it. With the help of intern, Lorna, he traces the attack to the SparkleChasers... The post How It Really Happened: “Phish & Ships” appeared first on NINJIO.
:AI: !ai! Validate autonomous agent resilience, compliance, and human-in-the-loop decision-making before production deployment.
:AI: !ai! Was the OpenAI-Hugging Face breach driven by autonomous AI? We break down what telemetry actually shows and why fundamental security controls still matter most.
ON THIS PAGE | Overview Who It’s For Learning Path How to Learn Coverage For Teams FAQ Blog> DevSecOps Training> DevSecOps Training Embed security into […] The post DevSecOps Training appeared first on Security Compass.
Key Takeaways AI has become one of the fastest-adopted workplace technologies in history. Employees use it to write emails, summarize meetings, analyze documents, create presentations, and automate everyday work. Organizations are racing to deploy AI to increase productivity and remain competitive.  All while cybercriminals are doing the same thing.  During NINJIO’s recent webinar, Human Cybersecurity in the AI Era, Chief... The post Human Cybersecurity i
If your mental model of Enterprise ATT&CK is a fourteen-tactic grid, it is already out of date. MITRE ATT&CK v19, released on 28 April 2026, split the long-standing Defense Evasion tactic into two — Stealth (TA0005) and Defense Impairment (TA0112) — taking Enterprise ATT&CK to 15 tactics, 222 techniques, and 475 sub-techniques.
The patch wave is here. Not coming — here. The Verizon 2026 DBIR reports that vulnerability exploitation now accounts for 31% of initial access vectors, overtaking credential abuse and phishing for the first time. Mandiant’s M-Trends 2026 puts the number at 32% — the sixth consecutive year exploitation has led. Meanwhile, patching is getting worse: only 26% of CISA KEV catalog vulnerabilities were fully remediated last year, down from 38% the year before. Median time to patch climbed to 43