Cybersecurity for SMBs: how to grow without the added risks
Why almost 90% of small companies have to deal with cyberincidents, and how to build a security setup without straining your budget or IT team.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,701 matching stories — announcement, in Threat Intelligence — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
A Practical Guide to DPDPA Compliance Using Picus
What Is DPDPA Compliance? DPDPA compliance means meeting the requirements of India's Digital Personal Data Protection Act, 2023, also called the DPDP Act, and its applicable Rules. These requirements govern how organizations collect, use, store, and share digital personal data, including lawful processing, consent, individual rights, and data security.
Click2Shell: WordPress Flaw Enables RCE Chain
Click2Shell: WordPress Flaw Enables RCE Chain Click2Shell is a vulnerability in WordPress Core that allows a logged-in administrator's browser to be manipulated into installing and previewing a theme without explicit con
Analyse de l’attaque de la supply chain TanStack
Philippe Humeau, PDG de CrowdSec, revient en détail sur l’attaque de la chaîne d’approvisionnement de 2026, depuis la fuite du code source et l’enquête technique jusqu’aux enseignements tirés.
Dragos Completes NetRise and runZero Acquisitions Following Accenture Deal
The transaction is part of the $4.1 billion deal in which Accenture acquired a majority stake in Dragos in an OT cybersecurity push. The post Dragos Completes NetRise and runZero Acquisitions Following Accenture Deal appeared first on SecurityWeek.
Clop Hack: ShinyHunters Hijacks Data Leak Site
Clop Hack: ShinyHunters Hijacks Data Leak Site ShinyHunters has turned the tables on rival cybercrime operation Clop (a.k.a. Cl0p), hijacking and defacing the ransomware gang’s own Dark Web leak site (DLS). The Clop hack
Got an Android Phone? Google Thinks You’ll Probably Want a Googlebook Laptop
Apple lovers have long enjoyed seamless connectivity between their iPhones and Macs. Now, Google’s bringing that experience to Android.
Why Observability Unification Is Becoming an IT Operations Imperative
New research from EMA showcases why observability unification is a high priority for IT operations teams, leading them to rethink their approach in response to tool sprawl and evolving AI goals.
CrowdSec Confirms Source Code Stolen in Supply Chain Attack
The cybersecurity firm believes the data breach was the result of the May 2026 TanStack supply chain attack. The post CrowdSec Confirms Source Code Stolen in Supply Chain Attack appeared first on SecurityWeek.
Best Malware Analysis Platforms for Security Teams
Malware can hide inside legitimate-looking files, exploit vulnerabilities, execute malicious scripts, or remain dormant until specific conditions are met. For security teams, identifying a suspicious file is only the beginning. They also need to understand what it does, how dangerous it is, which systems it may affect, and what action to take. A malware analysis […] The post Best Malware Analysis Platforms for Security Teams appeared first on Seqrite Labs.
Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access
Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access SOCRadar Dark Web Team identified several new underground posts, including an alleged Dominican Republic citizen data leak ,
Antiy Detected a Stealthy Contamination Attack Targeting Chinese Open-source AI Model Code Repository
The original report is in Chinese, and this version is an AI-translated edition. Download PDF View in Chinese 1.Summary In September 2026, Antiy CERT monitoring revealed that 71 files from the same batch, submitted under the guise of “model updates,” were successively uploaded to the official model repositories of two leading providers on the Hugging […]
How Click2Shell Exploits WordPress Theme Installation for RCE
Key Takeaways Click2Shell lets an attacker trigger WordPress theme installation automatically once an administrator opens one crafted link. A crafted theme preview link exploits a jQuery selector injection to force theme installation. The Customizer request loads the installed theme's functions.php, exposing its insecure AJAX plugin installer for exploitation. The demonstrated chain targets Mobile Repair Zone 2.5.4, where a vulnerable plugin installer runs attacker controlled PHP. The Picus Plat
The 12 Best Third-Party Risk Management Software Solutions (2026) | UpGuard
Compare the 12 best TPRM tools of 2026, including UpGuard, SecurityScorecard, Bitsight, OneTrust and Panorays.
2026 Vendor Risk Management Workflow (6-Stage Guide) | UpGuard
A 6-stage VRM framework you can implement to increase resilience against the third-party risk threat landscape in 2026 and beyond.
4-Stage Vendor Risk Management Framework (2026 Edition) | UpGuard
A framework for implementing an efficient vendor risk management framework for efficiently managing vendor risks in the 2026 threat landscape.
Digital Brand Protection in the Age of Impersonation | UpGuard
Fight brand impersonation and online fraud. Learn key strategies to protect your digital presence & reputation in today's cyber threat landscape.
What Hospitals Should Know About Managed Detection and Response Services
Most guidance on evaluating a managed detection and response provider is written for a generic enterprise buyer, and generic enterprise criteria miss the specific operational realities of a hospital environment.... The post What Hospitals Should Know About Managed Detection and Response Services appeared first on VerSprite.
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We detail a few of the more notable intrusions we observed including the theft of more than 18,000 sensitive records from a western government.
1,067 Victims in 30 Days: Inside August 2026’s Global Ransomware Wave
Blog 1,067 Victims in 30 Days: Inside August 2026’s Global Ransomware Wave A US federal law enforcement agency. A $10 billion wealth management firm. A children’s school system. A Turkish hospital. In August 2026 alone, ThreatMon tracked 1,067 ransomware victims worldwide and dug into 11 of the most damaging cases by hand. The data provides […] The post 1,067 Victims in 30 Days: Inside August 2026’s Global Ransomware Wave appeared first on ThreatMon.
Pour la première fois, Gemini a piraté de vraies entreprises
Gemini a pénétré dans les systèmes de trois entreprises réelles lors d'un test de cybersécurité mené en mai. Il a deviné un mot de passe dans un cas, puis utilisé des identifiants trouvés dans des bases publiques pour les deux autres. Google a confirmé ces intrusions vendredi, après l'appel du Wall Street Journal.
GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign
CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. The report maps the wider infrastructure, links parts of the activity to the PolinRider campaign, and details indicators, attack flow and defensive actions. Authors : Vikas Kundu
[HIGH] GHSA-xwmw-prc4-v3cr (CVSS 8.8)
## Summary In affected versions, an unauthenticated attacker could register an OAuth client with an arbitrary external redirect URI, and the authorization flow would auto-complete without a consent screen. If a logged-in victim visited a crafted authorization URL, an authorization code was delivere
Gemini si aggiunge alla lista: l’AI di Google ha hackerato tre aziende
Si aggiunge anche Gemini alla lista di grandi linguaggi che hanno mostrato comportamenti inattesi. È successo durante un test di cybersicurezza condotto a maggio da Irregular, una società di sicurezza...
Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up
Google's Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a cybersecurity evaluation. The development was first reported by The Wall Street Journal. The incidents occurred in May 2026 as part of a test run conducted by Israeli company Irregular. The evaluation partner was also involved in similar hacks disclosed
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on TanStack, in which malicious versions of TanStack's npm packages stole credentials from
Google says Gemini AI model breached real systems in security test
Google’s consumer AI model Gemini hacked multiple systems through guessing login credentials, the company said, the latest case of rogue AI cybersecurity transgressions, which have generated safety concerns. The hacks, first reported by the Wall Street Journal, took place in May and were discovered by Google in July. “In a standard evaluation, the model found public information online and guessed credentials to access websites it thought were part of the test,” Heather Adkins, Google’s...
Protecting People, Facilities, and Operations in Today’s Threat Landscape
The post Protecting People, Facilities, and Operations in Today’s Threat Landscape appeared first on Ontic.
Protecting People, Facilities, and Operations in Today’s Threat Landscape
The post Protecting People, Facilities, and Operations in Today’s Threat Landscape appeared first on Ontic.
Y chromosome loss creates hidden cancer vulnerability in men
A study initiated by a University of Arizona Cancer Center physician-scientist Dr. Dan Theodorescu revealed that the loss of the Y chromosome in men’s body tissue could pave the way for cancer to develop in that tissue.
77% of Flock Safety’s Public DNS Namespace is Development Infrastructure
By Adrian Cheek, Senior Cybercrime Researcher What Passive DNS Discloses About the Systems Behind the Cameras Automated license plate readers and AI-assisted video surveillance have moved from a handful of pilot deployments to tens of thousands of installations across US towns, business parks and residential streets. Anyone can see the cameras, but the cloud platform […] The post 77% of Flock Safety’s Public DNS Namespace is Development Infrastructure appeared first on Flare | Identi
An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang
TeamPCP pulled off the worst-ever software supply-chain hacking spree and breached thousands of companies. Now Google’s threat intelligence group says it had a mole inside the hackers’ inner circle.
Ontic’s Corporate Security Executive Dinner
The post Ontic’s Corporate Security Executive Dinner appeared first on Ontic.
More Breadth for Cortex with DomainTools IP Risk Feeds
Fork: Advanced Threat Modeling Workflow Automation for Banks
Advanced threat modeling is distinguished from a basic security checklist by two things a checklist doesn’t provide on its own: a consistent method for weighing findings against business impact, and... The post Fork: Advanced Threat Modeling Workflow Automation for Banks appeared first on VerSprite.
Top API Security Vulnerabilities: Risks and Mitigation Strategies
Blog Top API Security Vulnerabilities: Risks and Mitigation Strategies Application Programming Interfaces (APIs) have become a core part of modern digital environments, connecting microservices, mobile applications, cloud infrastructure, and automated workflows. They allow developers to integrate systems more efficiently, reduce development effort, and speed up the delivery of new applications and services. At the same […] The post Top API Security Vulnerabilities: Risks and Mitigation Str
New Check Point flaw lets hackers execute code with root privileges
Check Point Software has released security updates to address a critical vulnerability that can let attackers execute code with root privileges on management systems. [...]
School Network Security: Test Segmentation That Works
Plan school network segmentation around teaching needs, test permitted and blocked paths, protect administration, and manage changes without losing access.
Public Sector Supplier Remote Access: Control Every Session
Control supplier remote access with named identities, agreed work windows, bounded paths and verified revocation, using a practical public sector example.
Protective DNS for the Public Sector: A Deployment Guide
Deploy protective DNS across public-sector sites and remote staff. Test coverage, handle exceptions and keep essential services available during failures.