Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
638 matching stories — in Software Supply Chain Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Every board now asks the same question: what is our AI risk? Most teams answer with adjectives. Here are the AI risk metrics that produce a number, where each one comes from, and what an agentic AI strategy has to cover before any of them mean anything. The post AI Risk: The Metrics That Tell You Whether Your Agentic AI Strategy Is Working appeared first on Xygeni AI-Powered AppSec Platform.
Two things get filed under the same heading and they are not the same problem. Attacks on AI systems and attacks powered by AI need different controls, different owners and different evidence. Ten threats, split into the two halves, and the one step that precedes all of them. The post Top 10 AI security threats and how to map them appeared first on Xygeni AI-Powered AppSec Platform.
Linux has never been limited to large enterprises. It runs home servers, development machines, web servers, small business infrastructure, laboratories, schools, nonprofits and thousands of organizations where there may be no dedicated security team at all. Yet much of the modern Linux security industry is built as though every Linux system belongs to a Fortune 500 company. That is why Codenotary's new Linux offering at apps.codenotary.com/linux is significant. It gives Linux users access to ser
Explore our top 10 free penetration testing tools. Understand their functionality and how they can enhance your cybersecurity strategy and manual review process. The post Top 10 free penetration testing tools appeared first on Black Duck.
A capable frontier model isn’t a controlled system. Here are seven questions security teams should answer before they trust AI coding agents with consequential work.
The package poses as a security tool targeting developers looking to implement Internet-based apps with telecom networks.
Malicious package detection is the practice of identifying open source packages that were published or modified to attack the systems that install them... The post Malicious Package Detection: Why Databases Miss Attacks and Where Detection Has to Fire appeared first on Cycode.
WINning AI with AI: How the Wiz MCP for WIN partners accelerates a connected ecosystem
Most software development security requirements describe a desired state, which means nobody can pass or fail them. Here are 12 written as checks, each with the artifact that proves it. The post Software Development Security: A Requirements Checklist With 12 Lines You Can Verify appeared first on Xygeni AI-Powered AppSec Platform.
Ask your Evo tenant about models, MCP servers, and skills across your AI estate, from the client you already work in.
As organizations race to adopt AI across software development and security, the pressure to move fast is colliding with the mandate to stay economical, repeatable, and defensible. The biggest risk isn’t adopting too slowly. It’s scaling without understanding the true cost of AI. Prefer to listen or watch? Check out our on-demand webinar on this […] The post The real and hidden costs of AI security programs appeared first on Black Duck.
The transaction is part of the $4.1 billion deal in which Accenture acquired a majority stake in Dragos in an OT cybersecurity push. The post Dragos Completes NetRise and runZero Acquisitions Following Accenture Deal appeared first on SecurityWeek.
Learn the top llm development risks, from prompt injection to data leakage, plus practical mitigation strategies for secure AI apps
Learn how to assess vulnerability blast radius, understand BlastRADIUS, and reduce risk with reachability, segmentation, and fixes
In March 2026, LangChain took its coding agent from Top 30 to Top 5 on Terminal Bench 2.0 without touching the model or fine-tuning a single weight... The post AI Agent Harness: The Layer That Decides Whether AI Security Works appeared first on Cycode.
Controlling coding agent overpermissioning is key to security. But recent frontier AI incidents show that problems don’t stop there.
This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.
Analyzing model input and output logs in an AI-native detection pipeline to understand and uncover malicious AI agent behavior
This guide compares the best DAST tools on the market and explains what each one actually does well once it runs against your applications... The post 13 Best DAST Tools and Scanners in 2026 appeared first on Cycode.
The coding languages shift — fueled by Microsoft, Google, and Amazon and enabled by AI coding — is driven by the quest for secure software.
If your NGINX/OpenResty servers or Kong gateways pull Lua modules straight from public luarocks.org, one upstream outage can stall every build and deploy that depends on a “rock”. With LuaRocks support in JFrog Artifactory, you host and proxy those modules from a private LuaRocks registry you control, using the native experience you expect, not a …
Parallels Desktop for Mac has a flaw that lets an ordinary local account run code as root, the highest level of access on a Mac, software company JFrog said this week. The attack needs code already running on the machine as a normal user, so it does not work over the network. JFrog says the fix is in Parallels Desktop 27, a version that Intel Macs cannot install. Yuval Moravchick, who leads
TLDR: Runtime security built around detecting activity, correlating signals and then responding assumes there is enough time to act after something malicious happens. Machine speed attacks challenge that assumption because attackers can move across multiple MITRE ATT&CK tactics in seconds, with each successful action creating the conditions for the next. The issue is not whether …
OX Cloud introduces a new class of cloud security built for AI agents that access data, call tools and take action – with real-time visibility into what they can reach, what they are doing and when they cross intended boundaries NEW YORK, Sept. 16, 2026 — OX Security today launched OX Cloud, a next-generation cloud […] The post OX Security Launches OX Cloud, Redefining Cloud Security for the Agentic Era appeared first on OX Security.
AI agents are rapidly evolving toward more autonomy, more context, greater reach and more authority to act. We have to build security now for what’s coming next. We are making enormous bets right now about how to secure software two years from now, at exactly the moment when software is changing too quickly for anyone […] The post How Do You Build Security for AI Agents That Don’t Exist Yet? appeared first on OX Security.
Built for a new class of active, dynamic risk that traditional cloud security wasn’t built to see. TL;DR OX Cloud is the runtime pillar of the OX AINAPP platform, and our answer to a question most cloud security tools still aren’t built to ask: what is actually happening in your cloud right now, and does […] The post OX Cloud: CNAPP Coverage Plus Runtime Security for AI Agents appeared first on OX Security.
SPONSORED FEATURE: DigiCert wants to hand every agent a passport, complete with an expiry date and a named human owner
Your Mac runs a vulnerable version of Parallels Desktop. A malicious package, compromised CI job, or other unprivileged process is already running on it. No admin access. No Parallels-signed client. One appliance-install request later, attacker-controlled code runs as root. While testing Desktop 26.4.0 (build 57513) on Apple silicon, we found that an unprivileged local user …
A healthcare marketer adds a “simple” tracking pixel to an appointment page. Nothing exotic. Just a script to measure conversions, tune campaigns,... Read More... The post HIPAA Enforcement Is Increasing: Why Third-Party Scripts Are the Next Big Target appeared first on Source Defense.
AI is accelerating software creation and cyberattacks alike. Leaders must secure agents and code at inception, enforce controls at runtime, and validate defenses independently.
The "major malicious attack" that targeted RubyGems in May 2026 was the work of a swarm of OpenAI agents, according to a new report published by researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx. On May 12, Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, disclosed details of a coordinated cyber attack that targeted the package manager for the
Agentic development has enabled enterprises to accelerate the pace of innovation while freeing developers to focus on more strategic initiatives. But for many regulated organizations, the idea of sending source code and analysis prompts to vendor-managed LLM endpoints is a nonstarter. That’s why Black Duck Signal™ added support for agentic AppSec testing using your own […] The post Agentic AppSec on your infrastructure with Black Duck Signal appeared first on Black Duck.
Payment service providers play a critical role in modern commerce. They help merchants accept payments, reduce infrastructure complexity, and shift sensitive parts... Read More... The post What PSPs Aren’t Telling Merchants About Client-Side Risk appeared first on Source Defense.
Findings got cheap. Verified closure did not. That gap is the AppSec problem.
Prevention in agent-generated code is architecturally solved—but choosing controls that protect security without slowing development remains the challenge.
How modern website attacks evolve inside the browser, and what to do about it It starts like a lot of incident reviews... Read More... The post A Holistic Look at eSkimming: From Formjacking to Full Funnel Manipulation appeared first on Source Defense.
How Mend Renovate Enterprise keeps dependency updates flowing at agentic scale.
Harden-Runner now secures GitHub Actions jobs running on AWS CodeBuild-hosted runners, on EC2 compute, with managed or custom images.
A new denied-endpoints input blocks the destinations you name and leaves everything else reachable. Here is why that matters, and how to use it to stop CI from bypassing your package proxy