Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
608 matching stories — announcement, in Software Supply Chain Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
ws, Open Source Meta Description: We discovered a critical vulnerability in isolated-vm (1M+ weekly downloads), a sandbox that is widely used in popular AI-related projects like n8n, Activepieces, or Mastra AI. We demonstrated how attackers can weaponize this vulnerability to achieve control-flow hijacking and sandbox escape.
How V8 Isolates improve JavaScript sandboxing—and where the real risks remain
TL;DR AI is compressing the time between vulnerability discovery and exploitation, while security teams still depend on workflows that require people to review alerts and piece together context. A vulnerable or unauthorized image, a runtime policy violation or a change in workload protection can become relevant to application availability before teams understand what happened. Aqua …
A supply chain attack compromised popular Rust crates, arrayref, append-only-vec, and internment, injecting a dependency on the malicious proc-macro1 package that downloads and executes a remote payload at build time. Category: Vulnerabilities & Threats
Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident. The post Developer Security Adoption: Why Tools Sit Unused appeared first on Xygeni AI-Powered AppSec Platform.
Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident. The post Vulnerability Prioritization Is Broken: Why Severity Score Alone Gets You Fixing the Wrong Thing First appeared first on Xygeni AI-Powered AppSec Platform.
A checklist for scoring AI pentesting vendors on validation, code access, scope control, and reliability, plus the red flags that separate a real platform from a strong demo. Category: Aikido
C is the language SAST serves worst: the preprocessor, pointers, pattern rules, and no frameworks. Now AI agents are writing C faster than review can keep up.
Attackers turned the trusted AsyncAPI CI/CD publishing pipeline against its users, and the provenance checks all came back clean.
Organizations don’t realize how pervasive shadow AI has become. And as AI's capability grows, shadow use is harder to manage.
Automatically apply security and integrity guardrails to ensure that all code in production is secure and originates from secure builds. Automatically apply security and integrity guardrails to ensure that all code in production is secure and originates from secure builds. The post PBOM vs SBOM: What’s the Difference, and Why Does It Matter in 2026? appeared first on OX Security.
CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs. We escalated it to full RCE and reported two more bugs, all fixed in 0.14.3. Category: Vulnerabilities & Threats
Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident. The post The npm Worm Playbook: Same Attack, Three Times in Eight Months appeared first on Xygeni AI-Powered AppSec Platform.
See how Snyk’s Remediation Agent uses security intelligence, breakability analysis, and validation to turn vulnerabilities into mergeable pull requests.
When Polestar announced that it would stop selling new vehicles in the United States starting with model year 2027, it wasn’t a business strategy pivot driven by demand. It was a direct consequence of a regulatory decision that every automaker importing connected vehicles into the U.S. needs to understand. The Swedish EV maker was denied […] The post Polestar’s U.S. market exit is a warning for automakers appeared first on Black Duck.
Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.
A web GUI used to drive spacecraft and instrument commanding shipped a server that listens on every network interface, asks nobody for a password, and can be steered by any web page an operator happens to open. Here is how a stack of small, ordinary web mistakes adds up to unauthenticated command execution against hardware ... Read more The post When the NASA Ground Station Has No Lock on the Door: Unauthenticated Command Execution in AIT-GUI (GHSA-p9r8-2q67-fp86) appeared first on Cycode.
Two flaws in GitLab’s GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user’s own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now. Overview On August 17, 2026, GitLab published 19.2.4, 19.1.6, 19.0.8, and 18.11.11, fixing two critical GraphQL […] The post Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive appeared first on OX Secur
The annual cybersecurity conference focused on frontier AI agents — and what they mean for cyber. Here are three key takeaways.
Breaking vm2’s sandbox denylist forgot two modules: “os” and “dns.” Under the wildcard config vm2’s own docs recommend, that gap lets sandboxed code read the host process owner’s identity and hijack the host’s DNS with a single call — a change that outlives the sandbox run and never notifies the embedder. Patched in 3.11.6. Overview […] The post Critical vm2 Vulnerability Allows Host DNS Hijacking and Information Disclosure appeared fir
Somewhere in the last few months, the math of application security quietly broke. Anthropic’s Claude Mythos Preview didn’t just analyze code, it found a 27-year-old vulnerability in OpenBSD, a 16-year-old bug in FFmpeg, and a 17-year-old remote code execution flaw in FreeBSD, entirely on its own. Then it went further: it built working exploits for …
One High-Profile European Culinary Brand, Two Different PayPlug Skimming Incidents A prominent European pastry chef and e-commerce merchant surfaced in two separate payment-skimming incidents, creating an unusual overlap between a broad Magecart campaign and a direct compromise of the merchant’s own site. In the first incident, attackers repeatedly used the identity of the same well-known The post ONE HIGH-PROFILE EUROPEAN CULINARY BRAND, TWO DIFFERENT PAYPLUG SKIMMING INCIDENTS appeared f
In all these cases, the credentials may be legitimate and the API calls authorized. The problem is the behavior. Agentic AI is delivering exactly what enterprises were promised: software that does not simply answer questions, but actually performs work. AI agents can update websites, modify records, send documents, interact with customers, prepare contracts, access internal applications and coordinate with other agents. The productivity advantage is enormous. Unfortunately, the potential damage
A benchmark of secure, functional vulnerability fixes across JavaScript, Java, and Python shows Snyk Intelligence helps frontier models break past a 72–75% performance plateau.
Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s Advanced Security, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.
Start your path to a self-healing cloud today, with Wiz Workflows now GA and Remediation and Response in public preview.
Team PCP exfiltrated 78,330 secrets from 2,186 organizations via CI/CD pipelines. Analysis of the CloudSEK disclosure, why attackers target CI/CD, and how to defend.
AI can dramatically accelerate software delivery, but speed without security creates new forms of risk Anyone who’s watched an AI coding assistant generate a working API endpoint, scaffold a microservice, produce a comprehensive test suite, or create a user interface understands deep in their core that software engineering has fundamentally changed. The velocity of AI […] The post The AI coding security gap: Why faster development demands stronger guardrails appeared first on Black Duck.
Growing engineering organizations all hit the same wall. More teams shipping software means more repositories, more permission requests, more onboarding cycles, and eventually one platform admin fielding every change. The platform that was supposed to accelerate delivery has now become the bottleneck. JFrog Projects is built to break that pattern. It’s the organizational structure that …
Frontier models can detect real vulnerabilities at scale. They reason across application logic, analyze authorization flows, identify multistep vulnerabilities, and propose context-aware remediation. That capability is real. But it can lead to a risky conclusion: that frontier model scanning alone can carry the weight a layered defense was built to distribute. Detection and assurance are […] The post AI application security needs both reasoning and assurance appeared first on Black Duck.
The 2026 OWASP LLM Top 10 shifts the job from prevention to containment.
A bank isn’t just a vault holding money. It is an engine powered by implicit public trust, sustained by the continuous confidence that funds remain secure and accessible on demand. When operational risks fail, whether through cyber breaches, system outages, or third-party vulnerabilities, that trust shatters, threatening not just an individual institution, but the stability …
Software companies used to worry about someone walking out the door with a hard drive... The post Intellectual Property Leakage: Risks, Detection, and Prevention appeared first on Cycode.
AI agents now write code, pull dependencies, run tests, and open pull requests inside enterprise pipelines, sometimes without a developer ever opening an IDE... The post Agentic Development Lifecycle (ADLC): What You Need to Know appeared first on Cycode.
Two StepSecurity controls show every CI job and developer machine that still installs from public registries. Once you can see them, you can block public registries in CI and centrally set the registry configuration on every developer machine.
The Agent Baseline defines 35 controls across six security outcomes—but the right starting point depends on how your organization uses agents. Learn how to sequence controls for coding, internal, and production agents.
Risk tiers, deadlines, and compliance steps under the EU AI Act.
Blockchain C2 and Fileless Execution Make Magecart Harder to Disrupt A compromised checkout page can now take instructions from the blockchain, allowing Magecart operators to change malicious infrastructure without touching the infected website again. In this campaign, attackers used a Polygon smart contract to dynamically resolve the domain hosting the next-stage skimmer, making the operation The post BLOCKCHAIN C2 AND FILELESS EXECUTION MAKE MAGECART HARDER TO DISRUPT appeared first on Source
Mend.io at Black Hat USA 2026: keynote, podcasts, awards, and a hit booth game.
Download the case study to see how Nextiva achieved full PCI DSS 4.0.1 compliance in 1 week and eliminated eSkimming risks with Source Defense. The post Nextiva Case Study appeared first on Source Defense.