Federal & Mission-Critical Security Validation
How federal security teams perform continuous validation — identity-first testing, exploit-led proof, and FedRAMP-aligned remediation with NodeZero Federal™.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
1,191 matching stories — in Vulnerability Management — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
CARBONATO: a botnet built around an AI agent
ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable hosts, and gives operators a Telegram-controlled tool for post-compromise activity. The post CARBONATO: a botnet built around an AI agent appeared first on ThreatDown.
CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM
OverviewOn September 22, 2026, F5 published a security advisory for CVE-2026-94127, a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated attacker with network access to an affected virtual server may be able to achieve remote code execution (RCE) by sending specifically crafted traffic.BIG-IP APM provides identity-aware access control for applications and other corporate resources a
Top 10 Vulnerabilities Found in Secure Code Review
A Secure Code Review analyzes an application’s source code from an attacker’s perspective. Reviewers look for paths that could lead to unauthorized access, stolen data, greater privileges, and compromised systems. OWASP guidance focuses on things like the bunching of coding issues such as injection flaws, authorization and session problems, and bugs that lead to the […] The post Top 10 Vulnerabilities Found in Secure Code Review appeared first on Kratikal Blogs.
Top 10 Vulnerabilities Found in Secure Code Review
A Secure Code Review analyzes an application’s source code from an attacker’s perspective. Reviewers look for paths that could lead to unauthorized access, stolen data, greater privileges, and compromised systems. OWASP guidance focuses on things like the bunching of coding issues such as injection flaws, authorization and session problems, and bugs that lead to the […] The post Top 10 Vulnerabilities Found in Secure Code Review appeared first on Kratikal Blogs.
macOS 27: Great new privacy capabilities for IT… if you can use them
Apple's newest privacy controls in macOS 27 only work if your users are MDM-enabled, and only once they've actually shipped in your device management platform. A lot of fleets will hit both walls.
CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Yesterday we wrote up CVE-2026-87902, the unauthenticated local file inclusion in WordPress page template resolution fixed in 7.1.2. That post covered the sink, the preconditions and the fix. This is the follow-up on what we are seeing hit our firewall. Update, 23 September 2026: when this post first went up, every request we had seen […]
The Complete Guide to MSP Vulnerability Prioritization | Cavelo
Learn how MSPs prioritize vulnerabilities at scale: layered scanning plus platform capabilities like risk prioritization, automation, multi-tenancy, and reporting.
WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments
Executive Summary A high-severity vulnerability (CVE-2026-93485, CVSS 7.1) was disclosed affecting WordPress Core, allowing attackers to achieve full remote code execution via a stored cross-site scripting flaw in the comment rendering pipeline. Due to the potential for complete server compromise, immediate patching is required. About CVE-2026-93485 The issue originates from the wpautop() function in wp-includes/formatting.php, […] The post WordPress “Comment2Shell” XSS-to-RCE
Building Orca’s Partner Portal: What Happens When a Non-Engineer Builds With AI
Shannon McWilliams, Head of Distribution, had been at Orca Security a few months when he was asked to look at something specific: what it actually feels like to be one of the company’s reseller partners. How do they experience Orca once they sign on? What are they given to work with? A partner portal built […] The post Building Orca’s Partner Portal: What Happens When a Non-Engineer Builds With AI appeared first on Orca Security.
Penetration Testing for Third-Party Risk Management Programs
Penetration testing for third-party risk works best as a deeper assurance layer for suppliers whose compromise would meaningfully affect the enterprise, not as a blanket requirement. Tier vendors by data access, system access, operational weight, and external exposure, then match testing depth and cadence to that tier. Combine vendor-supplied reports, enterprise-commissioned tests, and shared platforms depending on the relationship. Get written authorization first, scope the test to the product
NodeZero Federal
Horizon3's NodeZero Federal provides production-safe, autonomous penetration testing for federal agencies. Achieve continuous readiness with proven, exploitable findings and rapid retest validation.
Action1 Launches UK Data Center to Give Customers Greater Control Over Data Residency
Investment meets growing demand from UK government and critical infrastructure organizations, deepening Action1's commitment to data sovereignty. The post Action1 Launches UK Data Center to Give Customers Greater Control Over Data Residency first appeared on Action1.
Jetzt patchen! Erhöhtes Risiko bei Cisco-Produkten im September 2026
Bisher hat Cisco in diesem Monat 97 neue CVE-IDs für seine Produkte veröffentlicht. Zwar weisen Sicherheitsforschende darauf hin, dass die reine Anzahl an CVEs kein direktes Maß für das Risiko ist, doch macht die Gesamtzahl den September zum bisher größten Monat für koordinierte CVE-Veröffentlichungen in der Geschichte von Cisco. Zudem handelt es sich bei 32 […]
Growing the WIN AI Ecosystem with Agent Integrations
WINning AI with AI: How the Wiz MCP for WIN partners accelerates a connected ecosystem
Risky identities continue to plague cloud infrastructures
Our research finds cloud-native IAM remains one of the most persistently misconfigured and poorly governed areas of security. Here’s what you can do.
Maturity Assessment: Benchmark Organizational Growth
Key Takeaways A maturity assessment scores a defined capability against a documented set of levels or criteria, using evidence rather than opinion. The method belongs to no single field. Procurement teams, data teams, and security teams all run one. This guide covers what a level asserts, what evidence a level claim requires, and how the […] The post Maturity Assessment: Benchmark Organizational Growth appeared first on Orca Security.
How Cross-Service EvidenceIQ Expands Compliance Programs Without Adding Complexity
Compliance teams at enterprise organizations are juggling multiple audits at once, with 74% of enterprise organizations conducting four or more audits per year. As new requirements come online, whether driven by evolving regulations, or customer and market demands, organizations often need to add more audits and assessments to expand into new markets or win new business. Audit […] The post How Cross-Service EvidenceIQ Expands Compliance Programs Without Adding Complexity appeared first on
SecureVisio and Sycope Partnership: NDR Integration Brings Network Context Directly Into the SIEM
Strategic partnership brings network depth for incident handling and better cost management. SecureVisio and Sycope are pleased to announce their technology partnership. Two independent vendors — connected by a documented integration. Sycope brings the network side: analysis of flow-based data and metadata collected from network probes, and the alerts that come out of that visibility. […] The post SecureVisio and Sycope Partnership: NDR Integration Brings Network Context Directly Into the
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India-based "much smaller organization" in the information technology (IT) services industry, once again highlighting how the adversary continues to target developers to breach target networks. Cybersecurity company SentinelOne, which disclosed details of the activity, said it involved the use of Apple
The 12 Best Third-Party Risk Management Software Solutions (2026) | UpGuard
Compare the 12 best TPRM tools of 2026, including UpGuard, SecurityScorecard, Bitsight, OneTrust and Panorays.
Three months inside Anthropic's Cyber Verification Program at Strobes
Strobes has run Claude-powered agentic pentests under Anthropic's Cyber Verification Program since June 2026. Here's what the program gates and what changed in three months.
Exception Reporting: How to Track, Review and Resolve Exceptions
Introduction Exceptions are a normal part of operating complex organizations. A security control may not be immediately implementable, a business process may temporarily deviate from policy, or a regulatory requirement may require remediation before full compliance can be achieved. The challenge is not simply identifying an exception. Organizations also need to know which exceptions are... The post Exception Reporting: How to Track, Review and Resolve Exceptions appeared first on ASPIA Infotech.
Click2Shell: The RCE WordPress 7.1.1 Just Patched
WordPress 7.1.1 patched a vulnerability reported by pwn.ai’s Paulos Yibelo named Click2Shell, a complicated vulnerability chaining Cross-Site Request Forgery (CSRF) into selector injection to turn a single click into a remote shell. It was reported responsibly and was fixed in the 17 September release; it’s also an interesting vulnerability which highlights the power of chaining […]
How Kyocera AVX Built a Global Security Validation Program from Zero
See how Kyocera AVX used NodeZero to build a global security validation program, scale autonomous pentesting across manufacturing sites, and remediate more than 30,000 vulnerabilities and misconfigurations.
ISO 42001 and AIUC-1: How Two AI Assurance Standards Work Together
AI agent vendors are starting to arrive at your procurement review with two certificates instead of one. A growing number hold ISO 42001 certification for their AI management system, and a smaller but visible group has added AIUC-1, a use-case-level standard for AI agent security, safety, and reliability published by the Artificial Intelligence Underwriting Company. If […] The post ISO 42001 and AIUC-1: How Two AI Assurance Standards Work Together appeared first on A-LIGN.
Patchstack Now Protects Your AI-Built Apps
WordPress isn’t the only place people build websites anymore. AI builders and Node.js hosting are now standard offerings from our own hosting partners, and that shift has quietly recreated every security problem we spent five years solving in WordPress, just with a different tech stack. Today we’re opening Early Access to Patchstack for Lovable, Replit, […]
Check Point, Kaspersky, Tanium Patch Product Vulnerabilities
Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with root privileges. The post Check Point, Kaspersky, Tanium Patch Product Vulnerabilities appeared first on SecurityWeek.
The Good, the Bad and the Ugly in Cybersecurity – Week 38 (2026)
U.S. law enforcement extradites Black Axe leaders, emerging AI safety risks concern Frontier AI leaders, and autonomous OpenAI agents deploy proxy relays.
Every regulatory disclosure rule asks the same question. Each calls it something else
EU orgs must juggle reporting obligations and timelines for CRA, GDPR, NIS2, and more. But the most important step is judging what needs reporting.
What the Mackay Sugar Shutdown Reveals About OT Segmentation Readiness
Mackay Sugar, Australia’s second-largest raw sugar producer, disclosed a cybersecurity incident on June 10, 2026 that disrupted operations across its Queensland milling facilities during the […] Source
Tanium security advisory (AV26-935)
Your Security Team Is Stretched Thin. Can AI Return the Hours?
The Arctic Wolf® 2026 AI & Cybersecurity Trends Report asked security leaders how much time their teams spend each week on nine separate security tasks, and the answer came back between 13 and 15 hours for each one. That’s a workload that adds up to roughly three full-time people before anything unplanned arrives. Leaders are ... Your Security Team Is Stretched Thin. Can AI Return the Hours?
700 AI Agents Worked Together to Hack a Network. Are Defenders Ready?
AI is already changing cybersecurity, but a recent incident involving OpenAI agents offers a more concrete look at what defenders may eventually be up against. According to reporting from Dark Reading, approximately 700 AI agents participated in an attack that reached Hugging Face production systems. The agents shared information, discovered vulnerabilities, obtained credentials, escalated privileges, […] The post 700 AI Agents Worked Together to Hack a Network. Are Defenders Ready? appear
Your Security Team Is Stretched Thin. Can AI Return the Hours?
The Arctic Wolf® 2026 AI & Cybersecurity Trends Report asked security leaders how much time their teams spend each week on nine separate security tasks, and the answer came back between 13 and 15 hours for each one. That’s a workload that adds up to roughly three full-time people before anything unplanned arrives. Leaders are ... Your Security Team Is Stretched Thin. Can AI Return the Hours?
The Autonomous Engine Behind Remediation, and What Finally Makes It Safe
Executive Summary Vulnerability exploitation now happens at a speed that manual, ticket-based remediation can’t match. Qualys’s Enterprise TruRisk Management Platform closes that gap with autonomous remediation: exposures are prioritized by threat, business, and environmental context, then validated by TruConfirm and Agent Val before any resource is committed, eliminating over 90% of remediation noise across 1,600+ […]
Introducing macOS LAPS in Iru: Secure, automated local admin passwords
Local administrator accounts are indispensable for troubleshooting and recovery, but the passwords behind them can also become a serious security liability. Shared credentials, long or nonexistent rotation intervals, and inconsistent storage practices give attackers more time and opportunity to move laterally after a compromise.
Engineered for Trust: How We Built the AI Trust Engine™
The rapid advancement of frontier AI models has fundamentally changed how security products are built. Capabilities that once took months to develop can now be delivered at machine speed, and the market is filling up with agentic security operations centers (SOCs). Numerous vendors now promise AI agents that can investigate alerts, correlate evidence, reason over ... Engineered for Trust: How We Built the AI Trust Engine™
The FedRAMP SSP Replacement: Security Decision Record
If you’ve worked in FedRAMP, you know the System Security Plan (SSP). Hundreds of pages, usually updated right before assessment, and potentially out-of-date three weeks  later. Under the 2026 Consolidated Rules, the SSP is gone and replaced by something called the Security Decision Record (SDR).  The SDR isn’t a simple rebrand, and it’s not a document you write once and defend at assessment time. In
Exploring the new AWS Sign Up experience
This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.