AI coding agents: A call to action on dependency cooldowns
Delaying software upgrades creates a buffer against poisoned packages, but transitive dependencies continue to be a problem.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
608 matching stories — announcement, in Software Supply Chain Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Move faster than AI-driven risk: Inside Mend.io’s latest AI application security update
AI agent discovery, runtime guardrails, agentic triage, and zero-day speed.
Accelerating CISA BOD 26-04 Vulnerability and Triage Activities through Wiz
Wiz enables organizations to continuously assess environments against the CISA KEV catalog, automating risk prioritization, rapid remediation, and forensic triage workflows.
OX Security Becomes First Prompt-to-Runtime Security Platform, Leading the Evolving AINAPP Category
OX Security’s platform is the first to govern the full agentic development lifecycle — from prompt to runtime — spanning AI governance, code security, cloud enforcement, and agentic pentesting in a single platform. NEW YORK, July 28, 2026 — OX Security today announced that it has become the first security platform to govern the full […] The post OX Security Becomes First Prompt-to-Runtime Security Platform, Leading the Evolving AINAPP Category appeared first on OX S
In the Mythos Age, 90% of Your Security Budget Protects the Wrong Layer
Ninety percent of your security budget protects commoditized controls. One hundred percent of your new risk comes from a layer that budget doesn’t touch. First, let’s start with an indisputable fact: Every employee at your company is now an AI user. Your DevOps engineer provisions infrastructure with an agent. Your analyst automates a workflow with […] The post In the Mythos Age, 90% of Your Security Budget Protects the Wrong Layer appeared first on OX Security.
OX Security Named a Sample Vendor Across Three Categories in the Gartner® Hype Cycle™ for Application Security, 2026
OX Security has been recognized as a Sample Vendor in the Agentic Coding Security, Application Security Posture Management (ASPM), and Software Supply Chain Security (SSCS) categories of the report. The Gartner® Hype Cycle™ for Application Security, 2026 names OX Security as a Sample Vendor across three categories: We are proud to see our vision for […] The post OX Security Named a Sample Vendor Across Three Categories in the Gartner® Hype Cycle™ for Application Security, 2026 a
About Us
About Us
The Generator Can't Be the Validator: What OpenAI's Hugging Face Incident Proves About AI Security
OpenAI’s Hugging Face incident is a wake-up call: AI systems can escape their own test harnesses, and vendors can’t be the only ones validating safety.
Fast Remediation Is the New Trust Model: JFrog and OpenAI Collaboration on Zero-Day Security Findings
UPDATE August 5, 2026: This week at Black Hat USA, the OpenAI team presented a detailed reconstruction of the chain of events behind the Hugging Face incident. I was glad to watch OpenAI speaking openly about it. This kind of transparency reflects the same spirit of collaboration we experienced working with their team behind the …
Atlas: Wiz's autonomous AI Agent for vulnerability research, ranked #1 on CyberGym
See how Wiz built Atlas, an autonomous AI system for vulnerability research that validates every finding with a real, working exploit.
THE PAYMENT SKIMMER THAT WENT SILENT AROUND STORE INSIDERS
The Payment Skimmer That Went Silent Around Store Insiders A highly targeted payment skimmer deliberately shut itself down for the people most likely to uncover it. Before displaying its counterfeit card form, the malware compared the shopper’s billing email against 32 addresses associated with the store owner, internal departments, a related business, and an external The post THE PAYMENT SKIMMER THAT WENT SILENT AROUND STORE INSIDERS appeared first on Source Defense.
What Is AI Pentesting and How Does It Work?
AI pentesting uses reasoning-capable models to continuously find and validate the flaws scanners miss, especially broken authorization and business-logic abuse.
Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
mrmustard 0.7.4 on PyPI was a credential stealer that ran on import, exfiltrating SSH keys, AWS, and Kubernetes credentials. Here is the analysis, IOCs, and how to respond.
Top LLM security tools to protect AI applications
Compare the top LLM security tools for AI applications, including Aikido, Snyk, Semgrep, Endor Labs, and Wiz, across code, supply chain, and runtime. Category: DevSec Tools & Comparisons
Top Acunetix alternatives for automated vulnerability scanning
Exploring Acunetix alternatives? Its DAST covers rule-based checks but can't reason about business logic or produce audit-grade pentests. Five options that go further. Category: DevSec Tools & Comparisons
Why Model Routing Backfires and How to Build Agents That Don’t Burn Your Budget
Model routing promises to cut your AI agent spend by offloading routine tasks to cheaper models like Claude Haiku while reserving frontier models like Claude Sonnet for complex reasoning. In the right configuration, routing strategies can reduce inference costs by 40–85%. But if you implement routing incorrectly in a multi-turn agent, you can end up …
Better generic secrets detection starts with finding non-secrets
Some API keys are meant to be public. Betterleaks now removes them from generic secret findings, dropping thousands of false positives per scan. Category: News
Top 13 AI security testing solutions for dev pipelines in 2026
Compare the top AI security testing solutions for dev pipelines.
Security teams ditch AI-only pen testing
A new report finds weakening trust in AI-only testing — and more willingness to keep humans in the loop. Here's why.
Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
StepSecurity now shows which GitHub Actions secrets are actually used, which workflows use them, and which can be replaced with OIDC.
199 RubyGems, two techniques, zero working payloads: Inside a cryptomining campaign that never ran
199 malicious gems, zero working payloads: how Mend.io caught the campaign.
Akrites marshals the open source community to counter AI threats
Industry heavyweights bring new focus to vulnerabilities in the age of AI. Here’s how it might help improve security.
Opening the Black Box: Agentless Threat Detection for Virtual Appliances
Mapping appliances event logs to real-world campaigns: A step-by-step researcher’s guide to continuous agentless monitoring.
Countdown to the next EU CRA milestone
With key EU Cyber Resilience Act (CRA) deadlines approaching fast, the window to prepare is narrowing. In a recent Black Duck webinar, cybersecurity experts Emmanuel Gonzalez of Black Duck and Antti Tolvanen of DNV Cyber broke down exactly what’s at stake and what organizations need to do to prepare. Below is a brief Q&A based on their […] The post Countdown to the next EU CRA milestone appeared first on Black Duck.
Integrate Aqua and ServiceNow to Prioritize Vulnerabilities by Runtime Reality
TL;DR Most of the vulnerabilities in a container environment will never be exploited, the hard part is knowing which ones will. The remediation timeline for production workloads is not shrinking fast enough to keep up with attacks that adapt at machine speed, so teams cannot afford to work the list in severity order and hope. …
The Perfect Heist: NuGet Typosquat Targets Betting Platform to Rig Results
The JFrog Security Research team has discovered and disclosed a typosquatted NuGet package named Newtonsoftt.Json.Net. Note the double t and the .Net suffix. This package has been masquerading as the popular Newtonsoft.Json library while quietly shipping a trojanized fork. The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results …
FROM MAGECART TO CLICKFIX: GOOGLE CALLBACK ABUSE HITS 100+ WEBSITES
From Magecart to ClickFix: Google Callback Abuse Hits 100+ Websites More than 100 websites were turned into potential launch points for attacks against visitors’ Windows devices. Source Defense researchers previously documented attackers abusing Google callback weakness to deliver Magecart payment skimmers. In this latest campaign, the same delivery method has been adapted for ClickFix, a The post FROM MAGECART TO CLICKFIX: GOOGLE CALLBACK ABUSE HITS 100+ WEBSITES appeared first on Source Defens
SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
Malicious git_credential_manager, Dendreo, and fastlane RubyGems fetch a second stage from a Forgejo C2, skip CI to target developer machines, and install a persistent daemon. StepSecurity analysis with Harden-Runner.
Labrador Labs Registers ‘Labrador SCA’ on KONEPS, Targeting Public Sector Market
Polaris achieves TX-RAMP certification: A milestone in our public sector commitment
We are proud to announce that Black Duck Polaris™ Platform has achieved full Texas Risk and Authorization Management Program (TX-RAMP) certification, a meaningful milestone that reflects our ongoing commitment to serving state, local, and federal government organizations with the security tools they need to protect their software supply chains. What TX-RAMP means—and why it matters TX-RAMP is the […] The post Polaris achieves TX-RAMP certification: A milestone in our public
SOURCE DEFENSE RESEARCH FLAGS RISKY LOADER ON 12K+ WORDPRESS SITES
Source Defense Research Flags Risky Loader on 12K+ WordPress Sites A suspicious JavaScript loader found on more than 12,000 WordPress sites shows why client-side security cannot depend only on known bad domains or confirmed final payloads. The impact is broad: thousands of ordinary websites may be unknowingly giving an attacker a browser-side foothold that can The post SOURCE DEFENSE RESEARCH FLAGS RISKY LOADER ON 12K+ WORDPRESS SITES appeared first on Source Defense.
Manifest Insights Agent (MIA): Instant Blast Radius Analysis
Manifest Insights Agent (MIA) analyzes supply chain indicators against your real software inventory, delivering blast radius answers in seconds, not hours.
Symlinks Are Still Scary (And Yes, You Can Commit Them to Git)
A harmless-looking symlink in a Git repo can redirect a tool into reading or writing anywhere on your machine. That old trick is now showing up in AI coding assistants, with nasty results.
What SCA Can't Tell You About Product Risk
Product security leaders need more than a CVE list per repo. Here's what it takes to understand risk across the full product hierarchy before it ships.
The White House Is Right About Quantum. Here Are the Hot Takes. | Manifest Cyber
The White House signed two quantum executive orders yesterday. The direction is right. The CBOM mandate is meaningful. But the 2030 deadline is a bet, the procurement gap is real, and treating CBOMs as separate from SBOMs adds confusion to a field that can't afford it.
Runtime Enforcement Is the Missing Layer in Agentic Security
Most security products stop at detection. They identify prompt injection, unusual API usage, suspicious MCP servers, or sensitive data leaving an organization, generate an alert, and hand the incident to a SIEM. That model works for traditional infrastructure because humans are still in the loop. Agentic systems are different. A single autonomous agent can execute hundreds of tool calls in seconds. It may invoke an MCP server, retrieve confidential documents through RAG, execute shell commands,
When Security Scans Break the Brain: Solving Trivy’s etcd Exhaustion Problem
This post comes from Pushkar Joglekar, Principal Security Engineer at Broadcom, where he focuses on VMware Kubernetes distributions. Pushkar is a Kubernetes security maintainer and co-author of the security chapters in Nigel Poulton’s “The Kubernetes Book.” He writes from experience securing infrastructure at scale. It starts with a failing deployment. You attempt a quick fix—maybe …
How Do You Protect a Workload You Cannot Afford to Patch Right Now?
TL;DR Vulnerability management is collapsing under scale and the remediation timeline for production workloads is not going to shorten fast enough to keep pace with attacks that adapt at machine speed. Aqua vShield is a patented runtime capability that closes the gap between discovery and remediation by enforcing compensating controls directly inside running containers, blocking …
What your scanner can’t see: Deep visibility into hardened container images with Black Duck
If you’ve ever stared down a vulnerability report and thought “there is no way all this is real,” you’re not wrong. Modern containerized environments generate a lot of noise, findings that technically exist somewhere in the file system but have zero chance of being exploited in your running app. That’s part of why security-conscious teams […] The post What your scanner can’t see: Deep visibility into hardened container images with Black Duck appeared fir