Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
638 matching stories — in Software Supply Chain Security — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
What Is Reachability Analysis? Reachability analysis determines whether a verifiable execution path exists between an untrusted input (the source) and a vulnerable function or dependency (the sink) inside an application. It replaces the question a package scanner asks – is vulnerable code present in this repository? – with the question that governs risk: can this […] The post Reachability Analysis: Eliminating Vulnerability Backlogs appeared first on OX Security.
Anthropic disclosed an agent that pushed real malware to PyPI. We think we found the package, and every mistake in it points back to the AI. Category: Vulnerabilities & Threats
Compare Astra Security alternatives for AI pentesting in 2026 on depth, white-box testing, compliance output, and platform breadth Category: DevSec Tools & Comparisons
S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain.
Dev Machine Guard now inventories AI agent skills across your developer fleet. See every skill installed for Claude Code, Codex, GitHub Copilot, and other agents, flag skills with executable code, hooks, or shell commands, trace provenance, and detect version drift.
AI is accelerating software development and giving attackers machine-speed capabilities. Security teams must continuously test AI-built code, govern agents, and independently validate every finding.
A developer on your team just told Claude Code to connect to a new MCP server, the protocol coding agents use to reach organizational tools and data. Nobody in security reviewed it. Nobody in security even knows it happened. For two-thirds of enterprises, the primary obstacle to scaling agentic development isn’t budget or headcount — …
TL;DR: The OpenAI agent’s attack on Hugging Face showed how quickly AI can chain vulnerabilities, steal credentials, and move through an environment. It also showed why strong runtime defense matters. Like a World Cup goalkeeper, runtime security does not need to know how the attack developed. It needs to stop the final action, contain the …
Snyk’s Fan Zone tour brought AI security workshops, networking, and friendly competition to 8 cities and 3 virtual sessions. Attendees built skills, shared ideas, and leveled up together.
After 5x ARR growth in 2024 and again in 2025, StepSecurity is on pace for its biggest year yet in 2026. What is driving it, and why supply chain security is inflecting.
OX Security’s platform is the first to govern the full agentic development lifecycle — from prompt to runtime — spanning AI governance, code security, cloud enforcement, and agentic pentesting in a single platform. NEW YORK, July 28, 2026 — OX Security today announced that it has become the first security platform to govern the full […] The post OX Security Becomes First Prompt-to-Runtime Security Platform, Leading the Evolving AINAPP Category appeared first on OX S
Ninety percent of your security budget protects commoditized controls. One hundred percent of your new risk comes from a layer that budget doesn’t touch. First, let’s start with an indisputable fact: Every employee at your company is now an AI user. Your DevOps engineer provisions infrastructure with an agent. Your analyst automates a workflow with […] The post In the Mythos Age, 90% of Your Security Budget Protects the Wrong Layer appeared first on OX Security.
AI coding agents are shipping code to your repositories right now... The post Introducing Agentic Workflows: Put Agents to Work for Security appeared first on Cycode.
UPDATE August 5, 2026: This week at Black Hat USA, the OpenAI team presented a detailed reconstruction of the chain of events behind the Hugging Face incident. I was glad to watch OpenAI speaking openly about it. This kind of transparency reflects the same spirit of collaboration we experienced working with their team behind the …
The Payment Skimmer That Went Silent Around Store Insiders A highly targeted payment skimmer deliberately shut itself down for the people most likely to uncover it. Before displaying its counterfeit card form, the malware compared the shopper’s billing email against 32 addresses associated with the store owner, internal departments, a related business, and an external The post THE PAYMENT SKIMMER THAT WENT SILENT AROUND STORE INSIDERS appeared first on Source Defense.
mrmustard 0.7.4 on PyPI was a credential stealer that ran on import, exfiltrating SSH keys, AWS, and Kubernetes credentials. Here is the analysis, IOCs, and how to respond.
Model routing promises to cut your AI agent spend by offloading routine tasks to cheaper models like Claude Haiku while reserving frontier models like Claude Sonnet for complex reasoning. In the right configuration, routing strategies can reduce inference costs by 40–85%. But if you implement routing incorrectly in a multi-turn agent, you can end up …
With key EU Cyber Resilience Act (CRA) deadlines approaching fast, the window to prepare is narrowing. In a recent Black Duck webinar, cybersecurity experts Emmanuel Gonzalez of Black Duck and Antti Tolvanen of DNV Cyber broke down exactly what’s at stake and what organizations need to do to prepare. Below is a brief Q&A based on their […] The post Countdown to the next EU CRA milestone appeared first on Black Duck.
TL;DR Most of the vulnerabilities in a container environment will never be exploited, the hard part is knowing which ones will. The remediation timeline for production workloads is not shrinking fast enough to keep up with attacks that adapt at machine speed, so teams cannot afford to work the list in severity order and hope. …
From Magecart to ClickFix: Google Callback Abuse Hits 100+ Websites More than 100 websites were turned into potential launch points for attacks against visitors’ Windows devices. Source Defense researchers previously documented attackers abusing Google callback weakness to deliver Magecart payment skimmers. In this latest campaign, the same delivery method has been adapted for ClickFix, a The post FROM MAGECART TO CLICKFIX: GOOGLE CALLBACK ABUSE HITS 100+ WEBSITES appeared first on Source Defens
We are proud to announce that Black Duck Polaris™ Platform has achieved full Texas Risk and Authorization Management Program (TX-RAMP) certification, a meaningful milestone that reflects our ongoing commitment to serving state, local, and federal government organizations with the security tools they need to protect their software supply chains. What TX-RAMP means—and why it matters TX-RAMP is the […] The post Polaris achieves TX-RAMP certification: A milestone in our public
Source Defense Research Flags Risky Loader on 12K+ WordPress Sites A suspicious JavaScript loader found on more than 12,000 WordPress sites shows why client-side security cannot depend only on known bad domains or confirmed final payloads. The impact is broad: thousands of ordinary websites may be unknowingly giving an attacker a browser-side foothold that can The post SOURCE DEFENSE RESEARCH FLAGS RISKY LOADER ON 12K+ WORDPRESS SITES appeared first on Source Defense.
Manifest Insights Agent (MIA) analyzes supply chain indicators against your real software inventory, delivering blast radius answers in seconds, not hours.
Product security leaders need more than a CVE list per repo. Here's what it takes to understand risk across the full product hierarchy before it ships.
The White House signed two quantum executive orders yesterday. The direction is right. The CBOM mandate is meaningful. But the 2030 deadline is a bet, the procurement gap is real, and treating CBOMs as separate from SBOMs adds confusion to a field that can't afford it.
Most security products stop at detection. They identify prompt injection, unusual API usage, suspicious MCP servers, or sensitive data leaving an organization, generate an alert, and hand the incident to a SIEM. That model works for traditional infrastructure because humans are still in the loop. Agentic systems are different. A single autonomous agent can execute hundreds of tool calls in seconds. It may invoke an MCP server, retrieve confidential documents through RAG, execute shell commands,
