Authorization phishing: why attackers stopped targeting the login
Why attackers are pivoting to authorization attacks to get around authentication controls, how they work, and what security teams can do about them.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
25,327 matching stories — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
Can Your Agents Commit? How Do You Enforce Conditions on an Accounts Payable Agent?”
Governing Agent Transactions, A series on governing autonomous agents inside the systems that run the business. In the first post in this series, I described several agents being piloted right now — an invoice agent, a claims agent, a credit agent, a sales agent, an expense agent, a vendor payment agent, a contract agent. Different systems of record, different domains. Same underlying shape: an action with a real, binding consequence, and a condition that defines what the agent is allowed to do
NetBird's August Newsletter
The rebuilt desktop app reaches stable in v0.75, v0.76 tightens up the local client daemon, Norsk Helsenett moves off legacy VPNs, and three new guides land for Hermes Agent, Linkwarden, and Minecraft.
The State of Open Source Supply Chain Attacks
StepSecurity threat intelligence tracked 56 open source supply chain attacks from August 2025 to August 2026, roughly one every three days since March. See the data and the defenses.
2026 Full Year Results
2026 Full Year Results [email protected] Mon, 08/24/2026 - 08:32 Year 2026 Report FY26 Annual Financial Report.pdf Webcast/audio https://openbriefing.com/OB/Nuix-Limited/2026/8/24/FY26-Results/6239.aspx Presentation FY26 Investor Presentation.pdf Market release FY26 ASX Announcement.pdf
Internal Audit vs External vs Statutory Audit: Differences & Scope
Key Takeaway: Internal Audit: Are our risks and controls working effectively? External Audit: Can an independent party provide assurance over the defined subject matter? Statutory Audit: Is this audit required by applicable law? Internal Audit vs External vs Statutory Audit: Quick Comparison Basis Internal Audit External Audit Statutory Audit Primary purpose Evaluate and improve risks,... The post Internal Audit vs External vs Statutory Audit: Differences & Scope appeared first on ASPIA Inf
Understanding the Patchwork of U.S. State Consumer Privacy Laws
Originally posted on Substack Starting in 2018, U.S. states began to enact broad consumer privacy laws. California was the first with the California Consumer Privacy Act (CCPA). By 2026, nearly half the states had enacted similar laws. At first, the laws can seem like a daunting patchwork, but below, I’ll provide you with a primer […] The post Understanding the Patchwork of U.S. State Consumer Privacy Laws appeared first on TeachPrivacy.
AI governance in business context: why contextual intelligence matters
Ask your SIEM who used AI at work yesterday, and you’ll get an answer measured in domains and byte counts. Ask what those people were actually doing, and the trail goes cold. That’s the honest state of most enterprise AI programs right now: plenty of traffic, very little context. The problem isn’t that employees are... Read more » The post AI governance in business context: why contextual intelligence matters appeared first on WitnessAI.
Is Microsoft Copilot safe for enterprise use?
In June 2025, researchers disclosed the first zero-click exploit against a production enterprise AI assistant. A single markdown email, never opened by the user, was enough to make Microsoft 365 Copilot hand over data from prior chats and files to an attacker. No malware. No phishing click. Just Copilot doing its job on content it... Read more » The post Is Microsoft Copilot safe for enterprise use? appeared first on WitnessAI.
IGA Is Only as Complete as the Identities It Can See
Orchid and SailPoint are expanding IGA coverage by helping organizations discover hidden identities, understand access, and bring more of the identity estate under governance.
Apollo Data Breach Shows the Risk Behind a Simple Phone Call
Apollo Global Management has disclosed a data breach involving sensitive personal information after attackers gained access to parts of its cloud environment. The breach occurred between July 6 and July 10, 2026. Apollo later determined that the affected information may include names, dates of birth, contact details, home addresses, and Social Security numbers. The company […] The post Apollo Data Breach Shows the Risk Behind a Simple Phone Call appeared first on Centraleyes.
KI-Risikomanagement: der vollständige Leitfaden 2026
KI-Risikomanagement erklärt: was es erkennt, wie Sie mit EPSS und KEV priorisieren, die Einführung in drei Phasen und was ISO 27001 verlangt.
A Social Engineering Attempt Against ReliaQuest: What We Found
On August 22, 2026, ReliaQuest was the target of a social engineering attempt. Here's the full playbook of what happened and how we shut it down.
AI Agent Security: Risks and Best Practices
AI agents hold credentials, act without asking, and read content nobody vetted. Here are the six risks that recur in real agent incidents and the controls that limit them.
RCSA and Operational Risk: From Attestation to Monitoring
An RCSA completed in January tells you almost nothing about the risk environment in November, yet a large share of programs still treat it as a once-a-year exercise. Regulators have started saying so directly, and the shift toward continuous, evidence-based self-assessment is no longer just a best practice recommendation sitting in an advisory document somewhere.
How Fake OAuth Apps & Shadow SaaS Bypass MFA
Attackers use fake OAuth apps that impersonate trusted brands to steal persistent API tokens. Learn how to stop OAuth hijacking before the prompt appears.
Are Refurbished Phones Dangerous? Here’s How to Avoid the Risks
The post Are Refurbished Phones Dangerous? Here’s How to Avoid the Risks appeared first on Blancco.
Cyber Alerts: Iranian Hackers Target UK Power Facility
Reports are emerging that Iranian-affiliated threat actors successfully shut down a small-scale British power generation facility for four days in late July. The disclosure – coming after confirmation of cyber attacks targeting U.S. water infrastructure across 12 states – occurs against the backdrop of the broader military conflict between the US and Iran. The timing […] The post Cyber Alerts: Iranian Hackers Target UK Power Facility appeared first on SIGA.
Software Bill of Materials (SBOM)
CVE-2026-19478: GitLab's One-Day Exploit and Why Patch Cadence Alone Can't Win
GitLab's critical GraphQL flaw, CVE-2026-19478, was under active exploitation almost as fast as it was disclosed. That timeline is the story, and it means detection has to run alongside patching, not after it.
GDPR in 2026: What Has Changed Since Enforcement Began and What Organizations Are Still Getting Wrong
GDPR in 2026 is very different from the last-minute compliance […] The post GDPR in 2026: What Has Changed Since Enforcement Began and What Organizations Are Still Getting Wrong appeared first on COMPLYAN.
Mapping Exploited CVEs to Your OT Asset Inventory
Learn how to map exploited CVEs to OT assets using passive discovery, behavioral baselines, and compliance alignment—without disrupting operations. The post Mapping Exploited CVEs to Your OT Asset Inventory appeared first on Red Trident.
Daily OT Security News: August 23, 2026
The latest IoT, OT, CPS, and ICS cybersecurity news, vulnerabilities, and key takeaways for August 23, 2026. The post Daily OT Security News: August 23, 2026 appeared first on Viakoo, Inc.
Tipping Off in Saudi Arabia: The AML Compliance Risk Financial Institutions Cannot Ignore
Digital KYC in Saudi Arabia: Closing the Identity Fraud Gap in Fintech
Hidden Ownership Risks: Why Saudi Businesses Must Strengthen Beneficial Ownership Controls in 2026
Why ClickFix is so effective against security-aware users
ClickFix attacks are not like normal social engineering attacks. Learn why they can fool the most security-aware users and how you can defend against them.
How to Transfer BigPond Emails to Gmail/Google Workspace?
If you still use a BigPond mailbox and want to move to a Gmail account or Google Workspace, look no further! In this article, … The post How to Transfer BigPond Emails to Gmail/Google Workspace? appeared first on SysTools Tech Blog.
Limit personal information online to reduce scams, identity theft, and oversharing risks
Sharing online feels normal. People post birthdays, vacation photos, job updates, school details, favorite hangouts, pet names, family milestones, and profile information without thinking much about it. But the more personal information you distribute online, the easier it becomes for scammers to build a convincing story about you. A safer rule is simple: share less […] The post Limit personal information online to reduce scams, identity theft, and oversharing risks first appeared on Total
Keeping OT Going When IT Goes Dark
This webinar reviews recent government directives, clears up the controversy, and introduces practical approaches to islanding. We evaluate islanding advice in the context of the emerging era of AI-based zero-day exploits. The post Keeping OT Going When IT Goes Dark appeared first on Waterfall Security Solutions.
Slopsquatting in the Supply Chain: Weaponized AI Hallucinations
In this interview with Snyk CTO Manoj Nair, we examine how attackers weaponize recurring LLM package hallucinations before developers even hit "run."
What Is Noise Reduction in SIEM and Security Monitoring
What noise reduction means in SIEM and security monitoring: why alerts get noisy, deduplication, correlation, suppression, AI support and success metrics.
isMalicious vs OpenCTI: Why This Is the Wrong Comparison (and How They Work Together)
OpenCTI is a threat intelligence platform and knowledge graph. isMalicious is a data provider that feeds it. Teams searching for an OpenCTI alternative usually need a feed, not a replacement TIP.
Delta Incident Puts Aviation Cybersecurity Into Sharp Focus
A recent incident involving Delta has once again put aviation cybersecurity into sharp focus, highlighting a growing reality for the aviation industry: cyber threats can have consequences far beyond traditional IT environments. As aircraft and airline operations become increasingly connected, cybersecurity needs to extend beyond corporate networks and into the aircraft itself.   The aviation […] The post Delta Incident Puts Aviation Cybersecurity Into Sharp Focus appeared first on CYV
Announcing nDPI Dual License Change
A License Change for nDPI: Protecting the Project We Started in 2012 When we began nDPI back in 2012, the idea was simple: build an open source, high-performance Deep Packet Inspection engine that anyone could use as a foundation layer for network applications. No gatekeeping or strings attached, but just a solid piece of infrastructure […]
Digital Risk Benchmark 2026: Online Threats by Industry
The 2026 digital risk benchmark shows that online threats vary sharply by industry. Financial services face heavy phishing and impersonation pressure. Retail and fashion face counterfeits and fake stores. Meanwhile, technology, gaming, healthcare, manufacturing, and travel face different external digital risks. Digital risk benchmark is a data-based way to compare online threats across industries, channels, […] The post Digital Risk Benchmark 2026: Online Threats by Industry appeared first
Emerging Threat: (CVE-2026-21580) Confluence Privilege Escalation via Unauthenticated Stored XSS
A stored cross-site scripting flaw in Atlassian Confluence Data Center and Server lets an unauthenticated attacker run script in a privileged user's browser and act on their behalf.
Ransomware Group incransom Hits: el-group
Summary In the latest cybersecurity news, el-group — an organization based in CH — has fallen victim to a ransomware attack conducted by the… The post Ransomware Group incransom Hits: el-group appeared first on HookPhish.
Research Worth Reading - Week 34, 2026
Another week in AI security news... 🤖 Patterns and problems in multiagent systems \ Anthropic 👍 0 Anthropic gave 45 agents their own machines, a shared forum, and the same goal of finding vulnerabilities across 15 open-source projects, then measured what happened.The coordinating swarm kept finding vulnerabilities at a roughly constant rate and found many issues that independently assigned agents missed. The interesting part is not just that a bigger budget found more bugs. Coordination
KeyConf26 speakers announced - save your spot today!
The KEYCONF26 speaker line-up is taking shape, and this year’s agenda is now live! 📍 KEYCONF26 is taking place in Prague on 8 October 2026. This October, the Keycloak community will come together once again for a full day of technical insights, real-world experiences and conversations around identity and access management. This year’s programme brings together speakers from across the Keycloak ecosystem – from organisations running Keycloak in complex production environments to expe