Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
638 matching stories — in Software Supply Chain Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
For twenty years, the software security playbook has worked the same way. You find the vulnerability, score it, open a ticket, assign it to a human, wait for the fix, ship the patch, and prove it happened. Every step in that sequence assumes humans can review each fix individually and still keep up. Frontier AI …
Aikido AI Code Audit found 8 more vulnerabilities than Claude Security with Mythos at less than half the cost. How harness design drives coverage per dollar. Category: Research
Somewhere in your estate right now, a certificate is counting down to its expiry date. Today you probably know which one, because renewals still come around annually and someone owns the calendar. The industry is taking that comfort away: the CA/Browser Forum has voted to cut the maximum TLS certificate lifespan to 47 days by […] The post Bring Your Own CA: Introducing the Thales Imperva SSL Integration Center, Featuring DigiCert Trust Lifecycle Manager appeared first on Blog.
npm Trusted Publishing sat near-idle after it was released. Then Shai-Hulud and 14 more supply chain attacks pushed adoption 3.4x. Charlie looks at the data behind it. Category: News
The way software gets built is changing faster than at any point in the last decade, and the software supply chain has to keep up. A year ago at swampUp, we introduced JFrog Fly: the first agentic repository, serving as a fast, AI-native environment to build what a modern, agentic developer workflow could look like, …
StepSecurity threat intelligence tracked 56 open source supply chain attacks from August 2025 to August 2026, roughly one every three days since March. See the data and the defenses.
In this interview with Snyk CTO Manoj Nair, we examine how attackers weaponize recurring LLM package hallucinations before developers even hit "run."
Image hardening tools compared for 2026: Aikido, Chainguard, Docker, RapidFort, Echo, Minimus, and Wiz Category: DevSec Tools & Comparisons
  Join us at swampUP New York, September 1-3, for our joint session Trusted AI Delivery at Scale: Securing Every Artifact from Curation to Cloud, where we walk the full chain of custody from the moment a package enters your organization to the moment your agent runs on Amazon Bedrock AgentCore. Register here. AI agents …
Explore the latest supply chain security threats with Xygeni's Malicious Code Digest. Stay ahead of malicious code attacks. The post Xygeni Malicious Code Digest 84 appeared first on Xygeni AI-Powered AppSec Platform.
Three Rust crates are compromised: arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 each added a typosquatted build-time dependency (proc-macro1, proc-macro-en) whose build script downloads and runs a remote binary during cargo build. Full technical analysis: timeline, dropper dissection, runtime detection, IOCs, and remediation.
Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.
ws, Open Source Meta Description: We discovered a critical vulnerability in isolated-vm (1M+ weekly downloads), a sandbox that is widely used in popular AI-related projects like n8n, Activepieces, or Mastra AI. We demonstrated how attackers can weaponize this vulnerability to achieve control-flow hijacking and sandbox escape.
How V8 Isolates improve JavaScript sandboxing—and where the real risks remain
TL;DR AI is compressing the time between vulnerability discovery and exploitation, while security teams still depend on workflows that require people to review alerts and piece together context. A vulnerable or unauthorized image, a runtime policy violation or a change in workload protection can become relevant to application availability before teams understand what happened. Aqua …
Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident. The post Developer Security Adoption: Why Tools Sit Unused appeared first on Xygeni AI-Powered AppSec Platform.
Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident. The post Vulnerability Prioritization Is Broken: Why Severity Score Alone Gets You Fixing the Wrong Thing First appeared first on Xygeni AI-Powered AppSec Platform.
C is the language SAST serves worst: the preprocessor, pointers, pattern rules, and no frameworks. Now AI agents are writing C faster than review can keep up.
Attackers turned the trusted AsyncAPI CI/CD publishing pipeline against its users, and the provenance checks all came back clean.
Organizations don’t realize how pervasive shadow AI has become. And as AI's capability grows, shadow use is harder to manage.
Automatically apply security and integrity guardrails to ensure that all code in production is secure and originates from secure builds. Automatically apply security and integrity guardrails to ensure that all code in production is secure and originates from secure builds. The post PBOM vs SBOM: What’s the Difference, and Why Does It Matter in 2026? appeared first on OX Security.
See how Snyk’s Remediation Agent uses security intelligence, breakability analysis, and validation to turn vulnerabilities into mergeable pull requests.
When Polestar announced that it would stop selling new vehicles in the United States starting with model year 2027, it wasn’t a business strategy pivot driven by demand. It was a direct consequence of a regulatory decision that every automaker importing connected vehicles into the U.S. needs to understand. The Swedish EV maker was denied […] The post Polestar’s U.S. market exit is a warning for automakers appeared first on Black Duck.
Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.
A web GUI used to drive spacecraft and instrument commanding shipped a server that listens on every network interface, asks nobody for a password, and can be steered by any web page an operator happens to open. Here is how a stack of small, ordinary web mistakes adds up to unauthenticated command execution against hardware ... Read more The post When the NASA Ground Station Has No Lock on the Door: Unauthenticated Command Execution in AIT-GUI (GHSA-p9r8-2q67-fp86) appeared first on Cycode.
Two flaws in GitLab’s GraphQL API: one lets any user wipe or alter public projects and user data, the other quietly runs changes using a logged-in user’s own permissions. Self-managed instances from 18.2 through 19.2 need to upgrade now. Overview On August 17, 2026, GitLab published 19.2.4, 19.1.6, 19.0.8, and 18.11.11, fixing two critical GraphQL […] The post Critical and High-Severity GraphQL CVEs in GitLab: Code Injection and CSRF via One Directive appeared first on OX Secur
The annual cybersecurity conference focused on frontier AI agents — and what they mean for cyber. Here are three key takeaways.
Breaking vm2’s sandbox denylist forgot two modules: “os” and “dns.” Under the wildcard config vm2’s own docs recommend, that gap lets sandboxed code read the host process owner’s identity and hijack the host’s DNS with a single call — a change that outlives the sandbox run and never notifies the embedder. Patched in 3.11.6. Overview […] The post Critical vm2 Vulnerability Allows Host DNS Hijacking and Information Disclosure appeared fir
Recognizing the partners, integrators, and visionaries driving cloud security transformation, AI risk management, and SOC modernization across AMER, EMEA, and ANZ.
One High-Profile European Culinary Brand, Two Different PayPlug Skimming Incidents A prominent European pastry chef and e-commerce merchant surfaced in two separate payment-skimming incidents, creating an unusual overlap between a broad Magecart campaign and a direct compromise of the merchant’s own site. In the first incident, attackers repeatedly used the identity of the same well-known The post ONE HIGH-PROFILE EUROPEAN CULINARY BRAND, TWO DIFFERENT PAYPLUG SKIMMING INCIDENTS appeared f
In all these cases, the credentials may be legitimate and the API calls authorized. The problem is the behavior. Agentic AI is delivering exactly what enterprises were promised: software that does not simply answer questions, but actually performs work. AI agents can update websites, modify records, send documents, interact with customers, prepare contracts, access internal applications and coordinate with other agents. The productivity advantage is enormous. Unfortunately, the potential damage
A benchmark of secure, functional vulnerability fixes across JavaScript, Java, and Python shows Snyk Intelligence helps frontier models break past a 72–75% performance plateau.
Team PCP exfiltrated 78,330 secrets from 2,186 organizations via CI/CD pipelines. Analysis of the CloudSEK disclosure, why attackers target CI/CD, and how to defend.
AI can dramatically accelerate software delivery, but speed without security creates new forms of risk Anyone who’s watched an AI coding assistant generate a working API endpoint, scaffold a microservice, produce a comprehensive test suite, or create a user interface understands deep in their core that software engineering has fundamentally changed. The velocity of AI […] The post The AI coding security gap: Why faster development demands stronger guardrails appeared first on Black Duck.
Frontier models can detect real vulnerabilities at scale. They reason across application logic, analyze authorization flows, identify multistep vulnerabilities, and propose context-aware remediation. That capability is real. But it can lead to a risky conclusion: that frontier model scanning alone can carry the weight a layered defense was built to distribute. Detection and assurance are […] The post AI application security needs both reasoning and assurance appeared first on Black Duck.
The 2026 OWASP LLM Top 10 shifts the job from prevention to containment.
Software companies used to worry about someone walking out the door with a hard drive... The post Intellectual Property Leakage: Risks, Detection, and Prevention appeared first on Cycode.
AI agents now write code, pull dependencies, run tests, and open pull requests inside enterprise pipelines, sometimes without a developer ever opening an IDE... The post Agentic Development Lifecycle (ADLC): What You Need to Know appeared first on Cycode.
Risk tiers, deadlines, and compliance steps under the EU AI Act.