Getting started with runtime security and Falco
Discover how to get started with Falco to overcome the challenges of implementing runtime security for cloud-native workloads.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,042 matching stories — announcement, in Vulnerability Management — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Remote Desktop
Firewall Configuration
Region: United Kingdom
How to Scope an Enterprise Penetration Test: Free Scope-of-Work Template
A penetration testing scope defines the assurance an enterprise needs, not just the assets a vendor will touch. Start with the business or compliance objective, then map the system boundary before counting assets. List applications, APIs, infrastructure, roles and integrations separately, specify authenticated and unauthenticated testing, and clarify whether production, staging or both will be […] The post How to Scope an Enterprise Penetration Test: Free Scope-of-Work Template appeared fi
It takes a hacker 48 hours to exploit a vulnerability. Why does it take 43 days to patch it?
It is not always possible to patch vulnerabilities as quickly as hackers exploit them, but recent figures show just how much this gap has widened. FortiGuard Labs estimates that the time between the disclosure of a critical vulnerability and its active exploitation has dropped sharply to between 24 and 48 hours. By contrast, Verizon’s 2026 Data Breach Investigations Report shows that organizations take a median of 43 days to complete vulnerability remediation. As many leaders in the global finan
CTEM Technology Evaluation Scorecard
Use the CTEM Technology Evaluation Scorecard to assess technologies across the CTEM operating model, score capabilities based on demonstrated evidence, and identify critical validation and verification gaps.
CISO’s CTEM Evaluation Checklist
Use the CISO’s CTEM Evaluation Checklist to assess whether technologies supporting your CTEM program can prove exploitability, demonstrate attack impact, verify remediation, and show measurable exposure reduction.
Anthropic's fourth breach: Defending against AI threats
After revealing in July that Claude had hacked into three different companies while undertaking cybersecurity testing, Anthropic has now identified a fourth, earlier, incident where Claude breached systems and accessed data. With concerns rising that even ‘friendly’ AI can get in this easily, what steps can organisations take to protect themselves?
There’s a ten-year-old key confusion bug in PyJWT, fixed in 2.14.0
There’s a new key confusion bug in PyJWT that lets an attacker forge login tokens using nothing but your public key. With over 590 million downloads a month, PyJWT is the most downloaded JWT library in Python, and a lot of authentication sits on top of it. This vulnerability has been fixed in 2.14.0 and […] The post There’s a ten-year-old key confusion bug in PyJWT, fixed in 2.14.0 appeared first on Maze.
From Scan to Patch on AWS — Security Agent + FaradAI, End to End
Scanners have never been the bottleneck. Finding vulnerabilities is the easy part now — an agent can surface more exploitable issues in an afternoon than a team can triage in a week. The bottleneck is everything after the finding: validating it’s real, prioritizing it, and actually fixing it fast enough to hold an SLA while the backlog […] The post From Scan to Patch on AWS — Security Agent + FaradAI, End to End appeared first on Faraday.
Why Is Detection and Response Too Slow for Machine Speed Attacks?
TLDR: Runtime security built around detecting activity, correlating signals and then responding assumes there is enough time to act after something malicious happens. Machine speed attacks challenge that assumption because attackers can move across multiple MITRE ATT&CK tactics in seconds, with each successful action creating the conditions for the next. The issue is not whether …
HarfangLab décroche la certification ISO 27001:2022, un nouveau gage de sérieux pour l'EDR made in France
L'éditeur français de cybersécurité HarfangLab a annoncé mercredi avoir obtenu la certification ISO 27001:2022, délivrée par l'organisme Cyberval, qui vient renforcer la crédibilité de l'entreprise, déjà certifiée par l'ANSSI et le BSI allemand.
The growing impact of nation-state cyber-attacks on businesses
Nation-state cyber threats no longer stop at government and defense. Here's what makes these attackers different, and what it actually takes to raise the bar against them. The post The growing impact of nation-state cyber-attacks on businesses appeared first on CovertSwarm.
ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response
Speed and clarity are the ultimate advantages for modern SOC teams. The integration of ANY.RUN into SentinelOne delivers exactly that. Instant threat intelligence and interactive sandbox capabilities embedded right where your analysts already work. Let’s look at how this unified workflow eliminates context switching, accelerates incident response, and drives higher ROI by transforming alerts into […] The post ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response appeared
Why runtime security should be a top priority for CISOs
By reducing actual, material risks with runtime security, CISOs help their organizations become more resilient and secure.
Closing the cloud security gap with runtime security
Security posture management isn't enough in 2026. Implement runtime security to enable deep visibility into zero days and other hidden threats. Learn more.
Before You Patch. Why Patch Reliability Matters for Confident Deployment
Executive Summary Microsoft’s September 2026 security updates, KB5124008 and KB5124012, have been linked to USB audio failures on some Windows systems, highlighting the operational risk that can accompany security patching. Qualys TruRisk Eliminate classified both updates as Low Reliability, signaling the need for additional validation before production deployment. Patch Reliability helps IT and security teams focus on deeper […]
Securing the AI-Native SDLC: Where Anthropic’s Playbook Stops and Security Has to Start
A security read of Anthropic's AI-native SDLC playbook and where AI SDLC security has to move: design, build-time hooks, and before the push, with Phoenix Purple. The post Securing the AI-Native SDLC: Where Anthropic’s Playbook Stops and Security Has to Start appeared first on Phoenix Security.
We Need to Pace AI Development. We Can’t Pace AI Defense
Anthropic CEO Dario Amodei published an essay this month called “We Must Pace the Frontier.” His argument is straightforward, calling out the reality that AI capabilities are advancing faster than the industry’s ability to align and safeguard them, and frontier labs need to slow the rate of capability growth long enough for safety work, alignment, ... We Need to Pace AI Development. We Can’t Pace AI Defense
We Need to Pace AI Development. We Can’t Pace AI Defense
Anthropic CEO Dario Amodei published an essay this month called “We Must Pace the Frontier.” His argument is straightforward, calling out the reality that AI capabilities are advancing faster than the industry’s ability to align and safeguard them, and frontier labs need to slow the rate of capability growth long enough for safety work, alignment, ... We Need to Pace AI Development. We Can’t Pace AI Defense
Third-Party Penetration Testing: What Security and Procurement Teams Need to Know
Third-party penetration testing means two different things: testing your own organization through an independent provider, and testing or reviewing testing on a supplier, partner, or acquisition target. This guide focuses on the second use case. It works best as a governed risk process, not a document request, built on clear authorization, risk-based scope, defensible evidence, and contractual follow-up. The post Third-Party Penetration Testing: What Security and Procurement Teams Need to Know a
Economic Zero: The Vulnerability Nobody Can Afford to Find
AI discovery turns vulnerability hunting into a purchasing decision. The budget runs out at the part that protects you. “Software will always have vulnerabilities you haven’t found” has held as a working truth for as long as anyone in security has had a job. Security programs took the assumption as a foundation: triage, rank, accept […] The post Economic Zero: The Vulnerability Nobody Can Afford to Find appeared first on Backline.
Transitioning from Rev 5 to FedRAMP 20x: What You Need to Know
FedRAMP 20x is transforming both the structure of the FedRAMP program and federal compliance as a whole. Organizations that have Rev 5 Authorization now find themselves asking how the transition process works and the steps they need to take in preparation. Read on to learn the differences between Rev 5 and 20x, a timeline for […] The post Transitioning from Rev 5 to FedRAMP 20x: What You Need to Know appeared first on A-LIGN.
Security Data Isn’t the Problem. Security Context Is.
Security teams don't need more data. They need context. See how Horizon3 and CrowdStrike connect validated exposure evidence with security telemetry to help teams prioritize what matters most.
Drei neue JFrog-Artifactory-CVEs aktiv ausgenutzt
CVE-2026-82329, CVE-2026-42018 und CVE-2026-42016, die alle JFrog Artifactory betreffen, wurden im September 2026 in CISAs Katalog der aktiv ausgenutzten Schwachstellen (Known Exploited Vulnerabilities, KEV) aufgenommen [1][2][3]. Artifactory dient als zentrales Repository für Software-Build-Artefakte, Binärdateien, Pakete, Container, Dateien, Releases und zunehmend auch KI/ML-Artefakte. Eine Kompromittierung von Artifactory könnte einem Angreifer erlauben, sensible Artefakte und Zugangsdaten zu
Advancing Ivanti’s Commitment to Modern, Cloud-Connected Cybersecurity in Europe
Across Europe, organizations are navigating a rapidly changing cybersecurity and regulatory landscape. Customers are seeking solutions that help them strengthen resilience, simplify operations and meet evolving compliance expectations while supporting the flexibility and scale modern enterprises require. At Ivanti, this shift is shaping how we prioritize investment, innovation and certification efforts. As part of that ongoing strategy, Ivanti has made the decision to withdraw Ivanti Endpo
Investing Together: Wiz Defend and Google Security Operations
Continuing to deepen the integration between Wiz Defend and Google Security Operations, helping teams work faster wherever they choose to investigate
Establishing Trust Across EV Charging Infrastructure
The boundaries of the vehicle are expanding as connected services, software-defined architectures, and AI-powered applications become more integrated into vehicles. This growing connectivity extends data exchange beyond the vehicle itself to cloud platforms (V2C), infrastructure (V2I), other vehicles (V2V), and connected devices. Among these connection points, EV charging infrastructure — particularly Electric Vehicle Supply Equipment […]
Why the SOC Can't Run on Vibes
Evaluate the buy, build-with, and DIY spectrum for AI in the SOC to balance operational control with ongoing maintenance needs.
Apple OS 27 is here. Iru is ready.
Apple's OS 27 releases are available now, bringing new management capabilities across iPhone, iPad, Mac, Apple TV, and Vision.
Trailer 19 SECONDI
La scorsa settimana, nella straordinaria cornice dell’Hotel Excelsior di Venezia, in occasione dell’83ª Mostra Internazionale d’Arte Cinematografica, abbiamo vissuto un […]
Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR
The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface.For anyone evaluating MDR right now, the Managed Detection and Response Services Landscape, Q3 2026 report by Forrester is a useful map that lays out where the market is heading.
Breaking: GitLab Critical Path Traversal Flaw Exploited in the Wild — Patch Immediately
Executive Summary A critical vulnerability (CVE-2026-85706, CVSS 10.0) was disclosed affecting GitLab CE and EE self-managed instances, allowing attackers to read arbitrary server files without authentication via a single HTTP request to the commits API. Due to the potential for complete infrastructure compromise through exposed secrets, immediate patching is required. About CVE-2026-85706 The issue originates […] The post Breaking: GitLab Critical Path Traversal Flaw Exploited in the Wild
„MikroTrick“-Exploit-Chain nimmt SSH-exponierte MikroTik-RouterOS-Geräte ins Visier
Laut CERT Polska wird MikroTik RouterOS seit mindestens dem 2. September 2026 aktiv angegriffen. Die Exploit-Chain nutzt CVE-2026-67276 (CVSS 9,2) und CVE-2026-86060 (CVSS 9,2) gegen Geräte, deren SSH-Dienst aus öffentlichen Netzwerken erreichbar ist. Eine erfolgreiche Kompromittierung verschafft die vollständige Kontrolle über das betroffene System. MikroTik hat für die Schwachstellen in den Versionen 7.25 beta 3, […]
Swarm spotlight on the community: Thomas Cox on hacking, humanity, and the future of cybersecurity.
In this episode of Swarm Spotlight, Jayson E. Street sits down with national security and cybersecurity veteran Thomas Cox for a candid conversation on hacker culture, AI's impact on the industry, and why cyber education needs to start a lot earlier than it does today. The post Swarm spotlight on the community: Thomas Cox on hacking, humanity, and the future of cybersecurity. appeared first on CovertSwarm.
Exception Management Process: Steps, Workflow & Best Practices
Introduction Organizations routinely encounter situations where a policy, control, security requirement, compliance obligation, or established standard cannot be met as defined. These deviations may be necessary, but managing them through email approvals, spreadsheets, or informal requests can create governance gaps. An exception management process provides a structured way to identify, request, assess, approve, monitor, review,... The post Exception Management Process: Steps, Workflow & Be
AI-SDLC – The Second Supply-Chain Hit: Agents Are Already Loose, and the Harness Is the Only Control That Held
RubyGems, Hugging Face and PyPI show AI agents escaping sandboxes into real systems. Why containment, not model behaviour, is the control that holds. The post AI-SDLC – The Second Supply-Chain Hit: Agents Are Already Loose, and the Harness Is the Only Control That Held appeared first on Phoenix Security.
Lumexa Imaging Breach: When a Vendor Connection Becomes the Attack Path
A vendor connection scoped years ago, renewed without review, and monitored less closely than the perimeter exists on nearly every network. The Lumexa Imaging breach […] Source
Executive-Ready Reporting Is Here: What’s New in the Synack Platform
Synack's reporting experience now scopes to individual assets, generates AI-written executive summaries, and lets teams preview, save and share reports without leaving the platform. The post Executive-Ready Reporting Is Here: What’s New in the Synack Platform appeared first on Synack.