Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,042 matching stories — announcement, in Vulnerability Management — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
When wp2shell hit WordPress Core, no single check was enough. A look at how a WAF rule can make vulnerable servers appear patched, and why we shipped three checks instead of one.
Sysdig TRT documents four ways agentic AI is reshaping the threat landscape — from autonomous attackers to AI infrastructure as prime target.
Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers. Organizations should prioritize patching or applying WAF mitigations.
K-12 and higher education institutions face constant cyberattacks due to limited IT resources. Here are five cybersecurity priorities they should act on now to reduce risk. The post Five cybersecurity priorities every school needs to get right appeared first on Kaseya.
Transform SOC data chaos into autonomous intelligence with modern AI pipelines and agentic AI to empower human analysts.
If your firm runs Cisco Vulnerability Management, the platform most people still call Kenna, part of the decision has already... The post Cisco Kenna Is Ending. What Regulated Financial Firms Should Look For in a Replacement. appeared first on NopSec.
Gold Eagle solves a coordination gap that was real, but it was never the actual bottleneck. Finding vulnerabilities was never the hard part. The hard part is fixing them everywhere they run, grouped by owner and bundled for remediation velocity. That's the constraint no clearinghouse touches. The post The Clearinghouse Problem: Coordination Was Never the Bottleneck. Remediation Is. appeared first on Phoenix Security.
JADEPUFFER, the agentic threat actor documented by the Sysdig Threat Research Team, is now using ransomware to destroy trained AI models.
wp2shell is a pre-authentication RCE in WordPress Core that an anonymous request can trigger on a default install. Here are the affected versions, the patch steps, and why events like this are really an exposure validation problem.
Update: Patchstack has independently verified that these combined vulnerabilities can lead to full site takeovers, including remote code execution. We advise all users to update immediately and review your WordPress site for any users you don’t recognize. We are seeing this vulnerability be actively exploited. Overview On 17 July 2026, the WordPress core team shipped […]
Security and vulnerability management teams face a daily barrage of vulnerability alerts, and most dashboards rank them with a single number: the Common Vulnerability Scoring […] Source
A security posture assessment is a technical evaluation of an organization’s actual security posture: its controls, configuration, vulnerability exposure, and readiness to respond, measured directly rather than inferred from a questionnaire or a policy binder. (For the fuller definition of security posture itself, including where it connects to compliance, see What Is Security Posture?.) What […] The post What is a Security Posture Assessment? appeared first on Consolidated Cyber Ris
Security posture is the collective state of an organization’s ability to identify, prevent, detect, and respond to cyber risk. At its full scope, that picture includes: Technical controls and configuration: how systems are set up, hardened, and maintained Vulnerability management: finding and addressing exploitable weaknesses before attackers do Threat detection: the ability to spot malicious […] The post What is Security Posture? appeared first on Consolidated Cyber Risk Management
Faraday 5.22 is focused on helping security teams make better risk-based decisions, while also improving platform performance and reliability. This release introduces a workspace Risk Score that reflects real urgency instead of a diluted average, a security fix that users should apply now, and a set of workflow fixes that remove friction from daily operations. The post Faraday 5.22: Smarter Risk Scoring, Faster Performance, and a Critical Security Fix appeared first on Faraday.
For years, the conversation about AI and cybercrime has been about acceleration: AI helping attackers write better phishing emails, find vulnerabilities faster, generate malware variants at scale. It was still a human directing the operation. That changed. Researchers recently documented what they believe is the first ransomware attack run entirely by an AI agent, start […] The post The First Fully Automated AI Ransomware Attack Just Happened appeared first on A-LIGN.
For the past several years, the Defense Industrial Base (DIB) has been focused on a singular objective: achieving CMMC certification. Organizations across the supply chain have invested heavily to prepare for assessments, implement required controls, and demonstrate compliance.  The announced suspension on CMMC Phase II, has cast some doubt on the program’s future. But the pause doesn’t remove the underlying risk CMMC was designed to address. If […
Audit Observation Management: Workflow, Remediation & Closure Guide 2026 Master the complete audit observation lifecycle from raising findings to final closure. Learn best practices, avoid common mistakes, and move beyond spreadsheets to drive real accountability. Guide 18 min read July 17, 2026 ASPIA In the high-stakes world of enterprise governance, the true measure of an... The post Audit Observation Management: Complete Workflow, Tracking, Remediation & Closure Guide (2026) appeared
This week, the UK National Cyber Security Centre (NCSC) – along with similar agencies from 12 other countries – co-released a new advisory urging critical; infrastructure organisations to improve their defences against cyber-attacks by Russian intelligence services.
Threat intelligence is only as valuable as an organization’s ability to act on it. Profiled, up-to-date IoC feeds provide effective protection against internet-borne cyber threats — but only when they are woven into detection logic, risk assessment, and automated response. This is where most organizations struggle: the intelligence exists, yet it sits disconnected from the […] The post How SecureVisio Uses Threat Intelligence Incident and Vulnerabilities Management appeared first on
Attackers went agentic. Your security architecture should too. A CISO's guide to headless, API-first defense.
An attacker turned AsyncAPI's own CI/CD pipeline into a publisher, hiding a PAT theft inside 37 decoy pull requests, then pushing straight to release branches to ship the Miasma RAT to 3M weekly npm downloads under valid SLSA provenance, with zero CVE assigned. The post AsyncAPI Supply Chain Compromise: CI/CD Pwn Request Delivers Miasma RAT Across Four npm Packages appeared first on Phoenix Security.
SecureVisio is a SIEM/SOAR/XDR-class platform designed to receive, parse, store, and analyze data from a large number of sources. Its modular architecture lets you start with a single service stack and then either grow its resources or add further collectors as log volume, the number of sources, and the number of security rules increase. Key […] The post How Scalable Is SecureVisio? SIEM/XDR Performance and Scaling Explained appeared first on Securevisio.
EU exposes Russia-linked cyber campaign targeting member states as Australia warns of widespread attacks on content management systems. The post The week in breach news appeared first on Kaseya.
For years, organizations have relied on familiar defenses to separate legitimate users from automated attacks. CAPTCHA challenges, browser fingerprinting, IP reputation, and behavioral analysis have all played an important role in identifying malicious bots before they reach sensitive applications. But the rules are changing. As highlighted in Dark Reading’s article, “AI Bots Are Breaking Traditional […] The post AI Bot Detection Is Changing. Your Security Strategy Should Too.
Hot news note 3747367 addresses a critical memory corruption vulnerability in SAP NetWeaver Application Server ABAP, tracked as CVE-2026-44747. An authenticated attacker could exploit faulty memory-management logic to perform an out-of-bounds stack write, potentially gaining unauthorized access to data, modifying information, or causing system unavailability. The vulnerability therefore has a high impact on confidentiality, integrity, […] The post SAP Security Notes, July 2026 appeared fir
Before a security team can reduce risk, they have to know what they’re protecting. That sounds obvious, yet it’s where most cybersecurity programs quietly break […] Source
Ivanti releases standard security patches on the second Tuesday of every month. In today’s rapidly evolving technology and threat landscape, we believe responsible transparency should be a cornerstone of any product security program. AI is compressing the time-to-exploit, and Ivanti uses leading technologies to proactively find and fix issues ––including integrating advanced LLMs into our Engineering and product security to enhance the capabilities of our teams. Our philosophy is simple: discove
Last updated: July 31, 2026 / Originally published: July 14, 2026 Key takeaway: CMMC Phase II is suspended, not canceled or rescinded. Phase I self-assessments, DFARS 252.204-7012, and NIST SP 800-171 Revision 2 remain in force. A CMMC Reform Task Force has been created to review the program and will report back in mid-September. On […] The post What the CMMC Phase II Suspension Means for Defense Contractors appeared first on A-LIGN.
Manifest Insights Agent (MIA) analyzes supply chain indicators against your real software inventory, delivering blast radius answers in seconds, not hours.
See how JADEPFUFFER executed the first documented LLM ransomware attack, and how organizations can reduce the risk of machine-speed attacks. The post JADEPUFFER: How an Agentic Ransomware Attack Unfolded appeared first on Outpost24.
“Open source isn’t about perfection; it’s about putting an idea forward and improving it together as a community.” Rishi (@rxerium) If you’ve spent any time in the Nuclei Templates repository, you’ve almost certainly run something Rishi engineered. With over 500 templates merged, picked up by the likes of the UK’s National Cyber Security Center (NCSC), California Cybersecurity Integration Center, CERT Polska, Spain’s national security agency, and many others, he’s one of the most prolific con
Introducing PolicyEval, the open-source library that scores AI agents against their policy, not just their output. The first two posts in the series (#1, #2) landed on something uncomfortable. AI coding assistants ship vulnerability patches that compile, pass tests, and still break production. Roughly one in five. The fix wasn’t a smarter model – it […] The post Your Agent Produced the Right Answer. It Still Did the Wrong Thing. appeared first on Backline.
Eleven validated Critical and High findings from Strobes AI's autonomous pentesting agents, each with the agent's reasoning, the request sent, and the response that proved it.
Security teams responsible for operational technology tend to plan for the sophisticated scenario: custom Industrial Control System (ICS) malware, zero-day exploits, and adversaries with deep […] Source
Roma, 9 luglio 2026 – In uno scenario caratterizzato da minacce informatiche sempre più sofisticate, la capacità di fare rete […]
As of this week, Iru Compliance Automation supports three new frameworks: CMMC, NIST SP 800-171, and ISO 27701. These frameworks join the others within Iru Compliance Automation today (SOC 2, ISO 27001, ISO 42001, GDPR, HIPAA, NIST 800-53, and NIST CSF 2.0), bringing the total to ten.
En matière de cybersécurité, une question revient souvent : que peut réellement voir un attaquant avant même de tenter une intrusion ? La réponse est parfois surprenante. Sans disposer d'aucun accès privilégié, un cybercriminel peut déjà collecter une quantité importante d'informations sur une organisation simplement en observant ce qui est exposé sur Internet. Serveurs [...]
KRITIS: Definition KRITIS (KRITISche Infrastrukturen) is the regulatory framework for the protection of critical infrastructure, managed by the BSI (Bundesamt für Sicherheit in der Informationstechnik) in Germany. KRITIS targets vital sectors such as public administration, energy, water, food, transport, healthcare, finance, media, and information technology. Organizations subject to KRITIS are required to comply with obligations such as regular audits, reporting of security incidents to the BSI