Vendor news

Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.

605 matching stories — announcement, in Software Supply Chain Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.

Announcement

How Do Financial Institutions Measure and Control Cyber Risk?

TL;DR: Financial institutions need to demonstrate that security controls are effective in production and that security investments reduce business risk. Across regulatory frameworks including NYDFS, OSFI, DORA, MAS and APRA, verified control evidence helps institutions demonstrate resilience and support accountable risk decisions. Aquasec connects runtime enforcement with FAIR based financial risk modeling, helping security leaders …

Announcement

AI Workflow Automation in 2026: Give Each System a Job

A lead arriving in a CRM, a customer email that needs an answer, and a Linux server that has stopped serving traffic can all start an AI workflow. Each demands a different kind of ownership. The lead needs a reliable handoff. The email may need context and a draft. The server needs a named target, controlled access, an investigation, a decision about changes, and proof that the service recovered. The useful question for 2026 is what continuing work a system can take on. This guide follows six pl

Announcement

Supply Chain Zero Days: Closing the Gap Between Publication and Detection

When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published

Announcement

Agentic AI risk and blast radius: limit the agent, or recover faster?

Constrain the agent, recover faster, or contain it from below? Three practitioners, three answers, and one minimum they all agreed on. The post Agentic AI risk and blast radius: limit the agent, or recover faster? appeared first on Xygeni AI-Powered AppSec Platform.

Announcement

Meet the new Cycode: built to protect where AI risk is born

Today we’re introducing the new Cycode brand. Here is why we did it, what the new logo and colors mean, and what it means for you. The post Meet the new Cycode: built to protect where AI risk is born appeared first on Cycode.

Announcement

Xygeni Malicious Code Digest 92

81 malicious package versions confirmed this week: one npm package published 39 times in 20 minutes, plus an active Strapi plugin campaign. The post Xygeni Malicious Code Digest 92 appeared first on Xygeni AI-Powered AppSec Platform.

Announcement

AI Agents Are Accessing Production Systems Without Permission. Who Is Watching Them?

A troubling pattern is emerging in autonomous AI development. Increasingly capable coding agents are reportedly discovering credentials, connecting to remote servers, and modifying production systems without developers explicitly authorizing those actions. Models such as Anthropic's Claude Opus 5.5 are now powerful enough to navigate complex software environments, execute commands, investigate infrastructure, and independently determine how to accomplish objectives. Unfortunately, that independe

Announcement

Anthropic’s Free OSS Scanner: What It Means For Your Team

On October 8, 2026, Anthropic announced OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects. The OSS Scanner is powered by their most capable models, including Claude Mythos. It scans codebases, identifies vulnerabilities, proposes patches, and sends reports directly to maintainers. As you read this, it has already identified real, high-severity issues …

Announcement

Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown

At JFrog’s swampUP 2026 conference in New York, security leaders gathered to tackle the rapidly evolving landscape of software supply chain security and AI-driven development. In this exclusive sit-down interview from the event, former SolarWinds CISO TIM (now CISO in Residence at Team8) sits with JFrog CISO Paul Davis and reflects on the historic 2020 …

Announcement

By Default, Insecure: Apache Airflow Disables SSH Host Key Verification

Vulnerability Details CVE-2026-94134 – SSH hook default, both providers CVE-2026-94135 – Async SFTP path Severity: High – CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) CWE: CWE-322 (Key Exchange without Entity Authentication) Affected packages: apache-airflow-providers-ssh and apache-airflow-providers-sftp – both through version 6.0.1 Fixed in: apache-airflow-providers-ssh 7.0.0 (CVE-2026-94134), apache-airflow-providers-sftp 7.0.0 (CVE-2026-94135) Overview OX S

Announcement

Japan’s Cyber Emergency Is a Warning for the World

TL;DR: Japan’s cyber emergency is a warning about what happens when familiar ransomware playbooks become faster, cheaper and easier to scale. AI reduces the time and coordination required to analyze targets, build tooling and chain destructive actions. That shortens the interval between initial access and business impact. Defenders need real time enforcement and containment that …

Announcement

JFrog Business Value Center: Celebrate the ROI of Your Software Supply Chain

You already know the effectiveness of the JFrog Platform – blocking risky packages, speeding up builds, securing the supply chain, providing end-to-end governance and so much more. But when it comes time to renew the license, a new VP may ask: “What are we actually getting in return?” or finance wants to understand the ROI: …

Announcement

AI-Powered eSkimming Is Changing the Economics of Retail Attacks

Cybercriminals have found a way to make eSkimming attacks faster, cheaper, and easier to scale. Autonomous artificial intelligence (AI) agents can now... Read More... The post AI-Powered eSkimming Is Changing the Economics of Retail Attacks appeared first on Source Defense.

Announcement

AgentMon Start 1.3.0 See what happened then see why

AgentMon Start 1.3.0 makes it easier to spot what needs attention and follow the evidence behind it. Pages now lead with a plain-language summary, sessions open in a side panel, and new views reveal prompt cache losses, background spend, and MCP server problems.

Announcement

Website Tracking and GDPR: Why Browser Behavior Matters

Website tracking can collect and share personal data during a live browser session. Privacy teams need to understand that behavior alongside their... Read More... The post Website Tracking and GDPR: Why Browser Behavior Matters appeared first on Source Defense.

Announcement

Improve collaboration with Defensics multiuser deployment

Fuzz testing is now a team sport Security teams don’t fuzz test in isolation. QA engineers, security teams, protocol experts, and CI/CD pipelines all contribute to the process. Until now, collaborating through a shared Black Duck Defensics® environment, sharing test configurations, and gaining visibility into results wasn’t easy. With the latest release, that changes. You […] The post Improve collaboration with Defensics multiuser deployment appeared first on Black Duck.

Announcement

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity

Announcement

“Shai-Hulud: Here We Go Again” – “tensorlake” npm Package Hit With Malware

Shai-Hulud is back for another round, this time hijacking the Tensorlake package, 12k weekly downloads Breaking News: Shai-Hulud malware affecting “tensorlake” package version 0.5.144,  Overview A malicious version of tensorlake (version 0.5.144) was published to npm with Shai-Hulud malware. The malware also contains an Ethereum contract address, which is tied to a wallet containing 12.44$ […] The post “Shai-Hulud: Here We Go Again” – “tensorlake” npm Package Hit Wit

Announcement

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code," Socket said

Announcement

When Copy Means Compromise: How kubectl cp Enables RCE on Windows

A single missing backslash turns a routine “copy a file from a pod” into remote code execution on Windows admin machines — here’s how it works, and how to shut it down... The post When Copy Means Compromise: How kubectl cp Enables RCE on Windows appeared first on Cycode.

Announcement

SSRF in Harbor Webhooks: Any User Can Reach the Server’s Cloud Credentials

OX Research disclosed an SSRF vulnerability in Harbor, the CNCF open-source container registry. Any registered user who can create a project can point a webhook at the cloud metadata endpoint and walk away with the server’s IAM credentials. No admin role, no user interaction, and no need to stay online. Set the webhook, wait for […] The post SSRF in Harbor Webhooks: Any User Can Reach the Server’s Cloud Credentials appeared first on OX Security.

Announcement

Can Vulnerability Scanning Tell You What You’re Exposed to Right Now?

TL;DR: Scan results show what is exposed right now only if you can rescan the moment risk changes, and most tools still wait for the next scheduled cycle. Aqua real time scanning lets teams start an on demand scan from the Aqua Hub or API, rescan only what changed in an image and use one …