Mount Here, Read There: Twin Path Traversal CVEs in Kubernetes Storage
Discover how a filepath.Join misconception caused cross-tenant path traversal vulnerabilities in Kubernetes CSI drivers.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
25,286 matching stories — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
AI Agents Are Digital Insiders. Treat Them Like It.
Picture the quietest hour in your environment — 3 a.m., nobody logged in, dashboards calm. And yet your AI agent is wide awake: reading records, calling APIs, moving data between systems, deciding what to do next and then doing it. Now here’s the part that should give you pause. Every one of those actions is […] The post AI Agents Are Digital Insiders. Treat Them Like It. appeared first on Cequence Security.
Agentic IAM: Secure Every Identity. Human or Not.
Your identity infrastructure wasn’t built for AI agents. It was designed for people: employees who go through onboarding, get assigned […] The post Agentic IAM: Secure Every Identity. Human or Not. appeared first on JumpCloud.
CISA’s New Zero Trust Guidance Makes One Thing Clear: Identity Must Be Certain
CISA’s new report, The Journey to Zero Trust Using Secure Access Service Edge in a Modern TIC 3.0 Solution, is an important signal for every enterprise security leader. The federal government is moving away from the old perimeter security model. The model where you route every user through a VPN, inspect traffic at a central choke point, and assume that once someone successfully logs in, they can be trusted. That model no longer matches reality.
Tenable Joins Cisco’s SolutionsPlus Program as an Exposure Management Partner for Vulnerability Management Customers
Tenable® Holdings, Inc. (NASDAQ: TENB), the exposure management company, today announced that it has joined Cisco’s SolutionsPlus program to offer its unified exposure management capabilities to Cisco customers. This partnership provides global enterprises with a fast, proven transition to an industry-leading exposure management platform without losing critical visibility into enterprise risk. As a leader in open and connected AI-powered exposure management platforms, the&nb
Shakepay joins Interac e-Transfer® as a Participant
Integration expands access and supports the evolution of Canada’s digital payments ecosystem TORONTO, July 16, 2026 — Interac Corp. (Interac) announced today that Shakepay Inc. (Shakepay), a leading Montreal-based fintech, has joined the Interac e-Transfer® service as a Participant. For Shakepay, the move is part of a deliberate evolution from a crypto-focused experience into a regulated Canadian financial… The post Shakepay joins Interac e-Transfer® as a Participant appeare
What OpenAI’s AI agent attack on Hugging Face means for defenders
The post What OpenAI’s AI agent attack on Hugging Face means for defenders appeared first on Resilience.
Why Customer Lifetime Value Begins on the Network
Network telemetry is actually business revenue telemetry. Every packet and digital interaction shapes the customer experience, which directly influences retention and customer lifetime value.
Impact Analysis of Ransomware Attacks on EMEA Healthcare
By Assaf Morag, Cybersecurity Researcher A ransomware attack against a hospital makes headlines. But the attack against other parts of the broader ecosystem including telemedicine providers, diagnostic laboratories, pharmacies, medical software vendors, public health authorities, and medical equipment suppliers rarely make the news, yet they can be just as devastating.  To better understand the scope […] The post Impact Analysis of Ransomware Attacks on EMEA Healthcare appeared first
AI Agent Identity: What Traditional IAM Doesn't Cover
AI agent identity governs autonomous agents as non-human identities with an owner, least-privilege access, and audit. Learn what traditional IAM misses.
COBOL is back, and AI is writing it. Who's verifying the code?
As AI accelerates COBOL modernization, organizations face a new bottleneck. See why trusted verification is essential for every commit.
The Flashpoint Method: Prioritizing Vulnerabilities in an Era of AI-Accelerated Discovery
We outline Flashpoint’s practical, repeatable framework for prioritizing vulnerabilities based on real-world risk, exploitability, and business impact. The post The Flashpoint Method: Prioritizing Vulnerabilities in an Era of AI-Accelerated Discovery appeared first on Flashpoint.
Introducing AI Cowbell Factors™: A New Standard for Measuring Enterprise AI Risk
How continuous telemetry across AI observability, autonomy, and governance can give brokers and underwriters greater clarity Every major technology shift has forced the insurance industry to rethink how risk is measured. The internet created cyber risk. Cloud computing transformed infrastructure. Now artificial intelligence is changing decision-making itself. Organizations of every size are deploying AI across […] The post Introducing AI Cowbell Factors™: A New Standard for Measuring Enter
Modern Google OAuth Phishing: What K–12 Schools Need to Know
OAuth is a very good security standard that has been carefully designed to balance user experience and security and is a solid security protocol that has been used across many apps. OAuth is a standard many SaaS vendors support for REST API access. When something is as popular as OAuth, it quickly becomes an attractive target for hackers and bad guys, like with yesterday's Google Docs attack. The post Modern Google OAuth Phishing: What K–12 Schools Need to Know appeared first on ManagedMethods C
Coder Signs Strategic Collaboration Agreement with AWS to Scale Secure, AI-Powered Software Development
Coder has signed a strategic collaboration agreement (SCA) with Amazon Web Services (AWS). The agreement will help organizations adopt AI across software development without compromising on security, governance, or cost.
Global Teams, Local Languages: Closing the Multilingual Privacy Gap
A privacy policy that only works in English isn't a global one. Protecto Vault now detects sensitive data consistently across 7 languages, including Arabic and Japanese, closing a gap most PII tooling never addressed. The post Global Teams, Local Languages: Closing the Multilingual Privacy Gap appeared first on Protecto.
The two DORA testing programs
Having the right security testing capabilities is not enough. Most firms building a DORA-aligned program are covering the right pillars at the wrong intervals, and that gap does not show up until something tests it for them. The post The two DORA testing programs appeared first on CovertSwarm.
What Operational Resilience Really Is
What Operational Resilience Really Is Guest blog written by Michael Rasmussen, GRC Analyst & Pundit […] The post What Operational Resilience Really Is appeared first on Cura.
Monitoring end-of-life software with Wazuh
Software reaches end-of-life (EOL) when vendors end standard support for a product or version, including regular security updates. Organizations that continue using EOL software face increased security risks because newly discovered vulnerabilities may no longer receive security patches from the vendor, leaving systems exposed to known and potentially exploitable vulnerabilities. Despite the security risks, EOL […] The post Monitoring end-of-life software with Wazuh appeared first on Wazuh
Click. Click. Fake it until they make it… inside
TL;DR The Problem In this online world it’s been easier than ever to order what you need, when you need and to the exact specifications you want… mostly.   The clothing world, alongside many other sectors, is plagued by fakes to the cost of billions, and these figures have increased year upon year for quite a while.   Now what if the clothing you are worried about is not your […] The post Click. Click. Fak
Membership Inference Attacks in AI: How They Expose Training Data?
Learn how membership inference attacks work, explore membership inference attack risks, and understand privacy attacks in machine learning. The post Membership Inference Attacks in AI: How They Expose Training Data? appeared first on Protecto.
Cobalt Showcases the Future of Offensive Security at Black Hat USA and DEF CON with Product Innovations, Executive Speakers, and New Brand Debut
Active exploitation of Windmill vulnerability
At a glance: Active exploitation of CVE-2026-29059 exposes files accessible to vulnerable Windmill deployments, creating a risk of credential, token, and secret disclosure beyond the affected application itself. Depending on the deployment, exposed data may include cloud credentials, database connection strings, API keys, and authentication tokens that provide access to downstream business and infrastructure systems. In higher-risk deployments where SUPERADMIN_SECRET is configured, Windmill stat
Codify What Your Best Reviewers Already Know with Rule Miner
Codify What Your Best Reviewers Already Know with Rule Miner Every team has standards nobody wrote down. The reviewer who always catches the same missing null check. The tech lead who rejects PRs that skip error handling in one specific way. The convention nobody documented because everyone on the team already knows it. That knowledge […] The post Codify What Your Best Reviewers Already Know with Rule Miner appeared first on Qodo.
Model Inversion Attacks in LLMs: What Enterprises Need to Know
Learn about model inversion attacks in LLMs, model inversion attack risks, AI privacy attacks, and ways to protect enterprise AI systems. The post Model Inversion Attacks in LLMs: What Enterprises Need to Know appeared first on Protecto.
The State of the Internet Is Changing: AI Exposures Surge While Global ICS Trends Shift
The Internet is constantly evolving. New technologies emerge, infrastructure shifts, software ages, and global adoption patterns change. Some of these changes introduce new security risks, while others reveal broader shifts in how the Internet itself is built and used. The Censys State of the Internet Report is our annual assessment of how the public Internet […] The post The State of the Internet Is Changing: AI Exposures Surge While Global ICS Trends Shift appeared first on Censys.
Rhadamanthys Stealer Returns After Takedown
Unit 42 reported a fresh Rhadamanthys infostealer campaign that resurfaced days after a global law-enforcement takedown, delivered through a cloned RingCentral download page at rlngcentrel[.]com. The chain runs a 385,126,400-byte inflated dropper to defeat sandboxes, chains multiple layers of DLL side-loading (via Krita and BugSplat masquerades) into shellcode injected in svchost.exe, and communicates over RC4-encrypted C2 hidden behind Azure Front Door CDN redirectors.
Meet CodeIntegrity at Black Hat USA 2026
Meet CodeIntegrity at Mandalay Bay during Black Hat USA 2026 to connect and compare notes on bringing AI agents into production securely.
What the new DMARC np= tag means for email security
Another layer of security: The new DMARC np= tag can prevent spoofers from using nonexistent subdomains. The post What the new DMARC np= tag means for email security first appeared on Valimail.
Grand Egyptian Museum Ticket Scam Network
A traveler searching for Grand Egyptian Museum tickets can land on a near-perfect lookalike, pay, and never receive a ticket. We started from one such fake domain and pulled the thread: it belongs to an industrial fake-ticket network of 188 domains that impersonates roughly 40 real attractions across 10+ countries — the Louvre, the Colosseum, Versailles, the Uffizi, Dubai theme parks, Istanbul palaces, UK stadium tours, and more. The whole thing runs on a handful of origin servers (GoDaddy, IONO
Cobalt Launches Autonomous Pentest to Bolster Continuous Security Testing Across the Full Application Portfolio
Understanding the Importance of MCP Security
Traditional API security focuses on predictable client-to-server interactions. MCP adds an AI decision layer, dynamic tool discovery, delegated authority, and context that can influence agent behavior.
Top 5 Ways to Offboard SaaS Apps (And Fix the “Enterprise Tax” Security Gap)
The post Top 5 Ways to Offboard SaaS Apps (And Fix the “Enterprise Tax” Security Gap) appeared first on Unixi.
Technical Due Diligence: 6 Types & Key Areas to Assess
What Is Technical Due Diligence? Tech due diligence is an independent, expert-led assessment of a company’s software, infrastructure, security, and engineering team. Conducted during M&A or funding rounds, its goal is to validate technology claims, uncover hidden technical debt, mitigate risks, and evaluate whether the technology can support future business growth. Types of technical due […]
Intro to Building a Quality-First AI Coding Workflow
Build a Quality-First AI Coding Workflow I recently gave a one-hour workshop using SignalPay, a small FastAPI payments API, to demonstrate a quality-first workflow for AI-assisted code changes. The task I walked through was a specific code change in the repo: add a refund endpoint. What I wanted to prove was that making this change […] The post Intro to Building a Quality-First AI Coding Workflow appeared first on Qodo.
Real-world attacks on corporate AI agents | Kaspersky official blog
We dissect incidents to examine the risks associated with trusted agents, and outline effective mitigation strategies.
How Domain Spoofing Powers Brand Impersonation
Domain spoofing is the foundation most brand impersonation attacks are built on. Understanding how attackers create, register, and weaponize fake domains is the starting point for any organization trying to protect its name online. Domain spoofing is the practice of creating or manipulating a domain name to impersonate a legitimate organization. The technique takes several […] The post How Domain Spoofing Powers Brand Impersonation appeared first on Allure Security.
How Digital Risk Management Services Strengthen Enterprise Cybersecurity
In today’s hyperconnected world, organizations face cyber threats that extend far beyond their internal networks. Attackers target brands through phishing websites, leaked credentials, exposed assets, social media impersonation, and third-party vulnerabilities. These risks can damage an organization’s reputation, disrupt operations, and lead to financial losses long before traditional security tools detect them. This is where […] The post How Digital Risk Management Services St
Secure SD-WAN and Unified SASE: What AI-Driven Enterprises Need to Know Before Leaving MPLS
Every enterprise network built in the last two decades was designed around the same assumption: traffic is predictable, applications live in a data center, and humans generate the load. AI just broke that assumption. Copilot, ChatGPT Enterprise, agentic workflows, and retrieval-augmented generation don’t behave like the traffic MPLS or first-generation SD-WAN were built for. They’re... The post Secure SD-WAN and Unified SASE: What AI-Driven Enterprises Need to Know Before Leaving MPL
SAP Integration Suite and CAP Security Scan | RedRays
Product update Clean core is doing its job: custom logic keeps moving off the ABAP stack. But it does not disappear, it relocates. It lands in the Groovy inside your SAP Integration Suite iFlows and in the Node.js and Java handlers of your CAP side-by-side extensions. Both run real code, and both usually ship with […] The post SAP Integration Suite and CAP Security Scan | RedRays appeared first on RedRays - Your SAP Security Solution.