Use OpenTelemetry-native observability with Datadog from ingestion to investigation
Learn how you can use vendor-neutral telemetry while preserving Datadog’s infrastructure and APM experiences.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
25,286 matching stories — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island researchers uncover 7,600+ malicious GitHub repos, over 800 posing as AI Skills and MCP servers, that trick AI agents into recommending malware.
JADEPUFFER evolves: The agentic threat actor deploys ransomware built to destroy AI models
JADEPUFFER, the agentic threat actor documented by the Sysdig Threat Research Team, is now using ransomware to destroy trained AI models.
Delivering A Resilient World Cup Final
How do you stream the World Cup to estimated 1.8B fans? Explore Fastly’s traffic insights, extra-time viewer surges, and real-time anti-piracy strategies.
Devicie renews SOC 2 Type II compliance for 2026
Independent examination provides continued assurance that Devicie’s controls supporting security, availability and confidentiality are operating effectively. Trust is not established through a one-time assessment.
SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
Malicious git_credential_manager, Dendreo, and fastlane RubyGems fetch a second stage from a Forgejo C2, skip CI to target developer machines, and install a persistent daemon. StepSecurity analysis with Harden-Runner.
Account Takeover Prevention: How to Prevent ATO & Mitigate Fraud
Looking for account takeover prevention methods? Discover the steps to preventing all levels of ATO fraud, how to detect attacks, & how to mitigate risks.
dPhish and Raqmana: A New Strategic Partnership
dPhish is excited to announce a strategic partnership with Raqmana, one of Libya’s leading technology and information security companies. This collaboration represents… The post dPhish and Raqmana: A New Strategic Partnership first appeared on dPhish.
The Blind Shutdown: What the fairlife Ransomware Attack Reveals About the OT Decision Support Void
When ransomware strikes a global brand, leadership is faced with a binary choice: keep the production lines running and risk the attack spreading or pull the plug and suffer immediate operational losses. The July 16, 2026, ransomware disclosure by The Coca-Cola Company at its dairy subsidiary, fairlife, illustrates this dilemma. According to the 8-K filings, […] The post The Blind Shutdown: What the fairlife Ransomware Attack Reveals About the OT Decision Support Void appeared first on SIG
The new HIPAA security rule doesn’t reward documentation. It rewards proof.
For twenty years, the HIPAA Security Rule has run on an honor system. “Addressable” specifications let organizations document their way around encryption and MFA. “Periodic” risk analysis meant whenever you got around to it. And when OCR came knocking after a breach, the defense was a binder: policies, attestations, and a risk assessment from eighteen […] The post The new HIPAA security rule doesn’t reward documentation. It rewards proof. first appeared on Tru
WordPress wp2shell RCE: CVE-2026-63030 and CVE-2026-60137
On July 17, 2026, WordPress pushed an emergency security update. WordPress 7.0.2, 6.9.5, and 6.8.6 fixed two core vulnerabilities: CVE-2026-63030 and CVE-2026-60137. Our team at Element Security analyzed the patched code to understand the vulnerabilities, protect our customers, and develop an exploit module for our External Security platform. We identified both root causes and investigated […] The post WordPress wp2shell RCE: CVE-2026-63030 and CVE-2026-60137 appeared first on Element Secu
Threat Modeling Tools
ON THIS PAGE | Overview Types Evaluate Devici Fit Compare Expert Overview FAQ Blog> Threat Modeling Tools> Threat Modeling Tools What they do, how the […] The post Threat Modeling Tools appeared first on Security Compass.
NBCC Kuwait: What Security Leaders Need to Know About the New Cybersecurity Baseline
For years, cybersecurity in Kuwait meant different rules for different […] The post NBCC Kuwait: What Security Leaders Need to Know About the New Cybersecurity Baseline appeared first on COMPLYAN.
WP2Shell: WordPress Core SQLi + REST API Chain to Pre-Auth RCE
WP2Shell chains CVE-2026-60137 and CVE-2026-63030 for unauthenticated RCE on WordPress Core. Patch to 6.8.6, 6.9.5, or 7.0.2 now, PoCs are already public. The post WP2Shell: WordPress Core SQLi + REST API Chain to Pre-Auth RCE appeared first on Indusface.
Top National Security Threats in 2026: What to Watch
Part 3 of Cognyte’s National Security Series TL;DR The global security environment is changing rapidly, and 2026 has already delivered unprecedented challenges for national security teams. Longstanding threats, including domestic extremism, terrorism and espionage, will continue to force intelligence analysts to work around the clock. However, technological advancements, in particular artificial intelligence (AI), cut both ways. They... The post Top National Security Threats in 2026: What to Wat
Inside Veza’s AI Agent Security for Microsoft Copilot Studio: A Technical Deep Dive
How Veza Models Every Bot, Topic, Action, Flow, MCP Server, and Dataverse Role in a Single Access Graph When we launched AI Agent Security for Microsoft Copilot Studio in December, we promised customers one thing: that every bot in their environment would show up in the Access Graph as a first-class identity — with every […] The post Inside Veza’s AI Agent Security for Microsoft Copilot Studio: A Technical Deep Dive appeared first on Veza.
Why Cross-Cloud Federation for Workload Access Is So Hard
Most workloads no longer live in one cloud. A service runs in AWS, calls a database in GCP, and pulls a secret from an Azure vault. Each of those hops needs access. And access means identity. For humans, we solved this. Single sign-on, one IdP, federated trust. For workloads and AI agents, the tools now […] The post Why Cross-Cloud Federation for Workload Access Is So Hard appeared first on Hush Security.
DDoS Attack Trends in 2026: Scale, Precision, and the Gaps in Between
Key takeaways Most enterprise DDoS protection was sized for a threat environment that no longer exists. Precision L7 attacks produce no volumetric signal; they’re invisible to detection logic tuned for bandwidth and packet rate. APIs are the most consistently unprotected surface, with misconfigured or absent rate-limit rules, incomplete WAF coverage, and endpoints outside CDN scope. […]
Changes 2026
As you can see, things around here have changed a little. This site will celebrate its 20th anniversary next month. Between site migrations and Rich’s advancing age, we’re not quite sure the date of the first post. It was either August 7th or August 20th, 2006. That was several database migrations ago. Attribution is hard and the timeline doesn’t entirely line up with BourbonKitten.
Could Modern Code Review Have Prevented wp2shell?
We recreated the WordPress pull requests behind CVE-2026-63030 and CVE-2026-60137 to test whether today's code reviewers and SAST tools would catch both vulnerabilities.
WordPress vulnerabilities (wp2shell): Find impacted instances
WordPress disclosed multiple vulnerabilities affecting the core WordPress framework. Here's how to find affected instances with runZero.
wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core – Advisory + Nuclei Detection
wp2shell (CVE-2026-63030) is an unauthenticated pre-auth RCE in WordPress Core 6.9.0-6.9.4 and 7.0.0-7.0.1. A plain-English advisory, a ready-to-run Nuclei detection template, remediation, and how to detect affected WordPress at scale with Sn1per. The post wp2shell (CVE-2026-63030): Unauthenticated Pre-Auth RCE in WordPress Core – Advisory + Nuclei Detection first appeared on Sn1perSecurity.
QuSecure Featured in The Qubit Report: QuProtect R3 Listed in AWS ICMP
The Qubit Report on QuProtect R3 in the AWS marketplace for the Intelligence Community, and the procurement route it opens for agencies.
Post-Merger Integration Checklist: 30 Steps for Day 1 to 100
What Is Post-Merger Integration (PMI)? A successful post-merger integration (PMI) requires a structured playbook that spans from Day 1 readiness to the first 100 days. Critical steps involve establishing an Integration Management Office (IMO), unifying IT and HR systems, aligning financial controls, and executing a clear communication plan to retain top talent and key clients. […]
Zero Trust Solutions: 14 Tools to Secure Access in 2026
TL;DR: Zero Trust solutions verify every user, device, and connection instead of trusting the network. Best for microsegmentation planning: Faddom; breach containment: Illumio; SASE access: Zscaler; identity: Microsoft Entra ID. What Are Zero Trust Solutions? Zero trust is a cybersecurity strategy operating on the principle of “never trust, always verify.” Modern solutions require the integration of […]
Mean Time to Detect: Reduce Threat Dwell Time Fast
A single pricing mistake, like charging per-device in a remote-first environment where every user carries three endpoints, can cut your margin fast. The way a managed service provider (MSP) charges for managed services shapes everything downstream: margins, scalability, how many clients you can take on without burning out your team, and whether monthly revenue holds up when the next vendor price increase lands. Get it wrong and every contract drains resources; get it right and recurring revenue
Every Week Someone Asks Me When AI Will Replace Pentesters
Datadog released a scanner that sends your code to an LLM instead of matching patterns. After 20 years in this field: the engine was never the problem. What they cannot see is. The post Every Week Someone Asks Me When AI Will Replace Pentesters appeared first on AppSec Labs.
From Web Request to Domain Compromise: Understanding the July 2026 SharePoint Attacks
The Modern Mythology of AI
LLMs are incredibly useful, even astonishing. But they aren't thinking about anything. Peter L. Levin reviews Cory Doctorow's The Reverse Centaur's Guide to Life After AI in Quillette.
wp2shell: A Pre-Authentication RCE in WordPress Core, and Why It Is an Exposure Validation Problem
wp2shell is a pre-authentication RCE in WordPress Core that an anonymous request can trigger on a default install. Here are the affected versions, the patch steps, and why events like this are really an exposure validation problem.
How to Set Up Hermes Agent with Secure Remote Access Using NetBird
Learn how to install Hermes Agent on a Linux server, keep its web dashboard and the community WebUI running with systemd user services, and access everything privately over NetBird. We cover access policies, NetBird Reverse Proxy with NetBird-Only Access, and friendly HTTPS hostnames without exposing a single port to the internet.
Alert Fatigue Didn't Go Away. AI Made It Worse.
Why alert fatigue is worse in the AI era: attackers scale attacks with AI while thin AI SOC tools add faster noise. The fix is reasoning-based investigation, not more suppression.
AI-Enhanced SOC Workflows: A SOC Automation Guide
AI-enhanced SOC workflows rework triage, phishing, endpoint, insider, hunting, and detection. How SOC automation moves analysts from executing to steering.
Agentic AI Penetration Testing: 6 Best Practices
Agentic AI penetration testing delivers real benefits, but only with the right practices. Six that separate a genuine pentest from a glorified scanner.
BankInfoSecurity: CISA Adds FortiSandbox Bugs to KEV Catalog
Agencies Have Until Sunday to Patch Two Critical Command Injection Flaws The post BankInfoSecurity: CISA Adds FortiSandbox Bugs to KEV Catalog appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The Future of Personal Data Protection: Privacy Laws and What They Mean for You
Privacy law is the legal framework that defines what personal data companies can collect, retain, and share, and what rights individuals hold to access, correct, or erase it. Most executives assume those rights travel with them automatically. They don’t. The EU alone has issued over €4.5 billion in GDPR fines since 2018, yet the data broker sitting on your home address, spouse’s name, and daily commute pattern has likely never faced a single enforcement action. Regulators pursue syst
Unauthenticated SQL Injection in WordPress Core Fixed in 7.0.2
Update: Patchstack has independently verified that these combined vulnerabilities can lead to full site takeovers, including remote code execution. We advise all users to update immediately and review your WordPress site for any users you don’t recognize. We are seeing this vulnerability be actively exploited. Overview On 17 July 2026, the WordPress core team shipped […]
What Is a Data Center? A Business Guide to Modern Data Center Infrastructure
Every Microsoft 365 login, AI prompt, ERP transaction, backup, and customer record depends on data center infrastructure. Whether your workloads run on-premises, in Azure, or in a colocation facility, your data center strategy directly affects security, performance, resilience, and business continuity. A data center is a secure facility that stores, processes, and delivers the technology […] The post What Is a Data Center? A Business Guide to Modern Data Center Infrastructure appeared firs
WISeKey Files Registration Statement on Form F-4 with the U.S. Securities and Exchange Commission in Connection with Proposed Redomiciliation to the British Virgin Islands
Zug, Switzerland, July 17, 2026 – Ad-Hoc announcement pursuant to Art. 53 of SIX Listing Rules – WISeKey International Holding Ltd (“WISeKey”) (SIX: WIHN; Nasdaq: WKEY) announced that WISeKey International Corp., a British Virgin Islands company and wholly owned subsidiary of WISeKey (“WISeKey BVI”), has publicly filed on July 16, 2026, a registration statement on Form […]
How CISOs Can Build Board Confidence in Cyber Risk
How CISOs Can Build Board Confidence in Cyber Risk July 17, 2026 | By Dale Hoak Cybersecurity doesn’t build board confidence through technical metrics—it builds confidence by helping directors understand business risk. Too often, cybersecurity leaders default to technical jargon, dashboards, and vulnerability counts because that’s the language they’ve spoken throughout their careers. Boards don’t... The post How CISOs Can Build Board Confidence in Cyber Risk appeared first on RegScale.