61 casos · pág. 1/4
Aikido Security published a best-practices guide for defending against software supply chain attacks. It cites Aikido Intel data: about 7.5 million package versions analyzed in Q2 2026, with 19,500 malicious packages confirmed. The guide uses recent incidents to show which controls would have worked: the axios compromise, tj-actions/chang…
Flashpoint published a vendor blog post describing its External Attack Surface Management (EASM) module, which continuously discovers internet-facing assets and maps them to Flashpoint Vulnerability Intelligence. The company says its intelligence covers more than 480,000 vulnerabilities, including over 105,000 not found in NVD or CVE. Fin…
Huntress announced Attack Reduction, a new capability in Huntress Managed ESPM (Early Access) that disables the "Windows key + R" shortcut for users who never use the Run dialog, aiming to break the most common ClickFix attack chain. The post opens with an attempted fake-CAPTCHA lure that targeted a Huntress employee on a spoofed airport …
Cloudflare has made generally available to all customers, including Free plans, two new WAF capabilities: full transaction detections, which correlate each HTTP request with the origin's response to confirm exploitation, and response rules, which block the origin's response before it reaches the requester. The first managed protections ta…
Cloudflare and Commerce.com describe enabling WebMCP, an experimental Google browser standard that exposes structured tools (e.g. searchproducts, addtocart) to AI shopping agents, across almost 100,000 Commerce.com storefronts. Cloudflare injects a script at the edge, so merchants do not have to edit their themes. This is product and part…
A Check Point vendor blog post argues that AI training and inference workloads, private models, GPU infrastructure, containers, APIs and autonomous agents are changing data center security. It cites the 2026 Check Point Cloud Security Report: 29% of organizations are already moving AI workloads to on-premises or private cloud, and another…
Industrial Defender, an OT cybersecurity vendor, released a new platform version adding internal network security monitoring (INSM) and Risk Signal, announced via a CyberNewswire press release on October 20, 2026. The INSM capability targets the FERC-approved NERC CIP-015-1 standard, which requires entities with high and medium impact BES…
Tenable describes how it moved Tenable One AI Exposure detectors (jailbreaks, prompt injection, harmful content, data exposure) from an English-centric "translate-then-detect" design to a single native multilingual model. The article is product and engineering news and reports no incident, vulnerability or threat actor activity. Tenable b…
CrowdStrike published a blog post dated 2026-10-20 announcing that it has achieved the UK National Cyber Security Centre (NCSC) Cyber Incident Response (CIR) Enhanced Level assurance. The captured article text contains only site navigation and a list of other blog titles. It has no body text describing the assurance scope, requirements or…
Palo Alto Networks disclosed CVE-2026-0311, a server-side request forgery (SSRF, CWE-918) vulnerability in Checkov by Prisma Cloud. A local unauthenticated user can make unauthorized network requests from the host to internal services. The vendor rates it LOW severity with MODERATE suggested urgency (CVSS-B 4.8, CVSS-BT 1.1) and says it i…
Infoblox published a vendor blog showing how its Model Context Protocol (MCP) Server lets AI assistants correlate Tenable vulnerability findings with Infoblox DNS, DHCP and IPAM data. In a lab, the author connected Claude Code to both platforms and ran three analyst-style workflows. These were risk-ranked asset triage, identity gap analys…
Aikido published a vendor blog post arguing that SCA reachability analysis is not enough for prioritizing dependency vulnerabilities. Reachability shows whether code can execute a vulnerable function. Exploitability asks whether an attacker can satisfy the conditions the bug needs. The article uses lodash .template command injection (CVE-…
Wiz announced that its Wiz AI Agents are now available in Wiz for U.S. Government (Wiz for Gov), its FedRAMP High authorized environment. Wiz describes this as the first AI-Application Protection Platform (AI-APP) for U.S. public sector organizations that protect highly sensitive, national security and mission-critical data. This is vendo…
Wiz published the first part of a blog series on operationalizing Application Security Posture Management (ASPM) with Wiz Code. It argues that AI models that find vulnerabilities and generate exploits, combined with AI-accelerated development, break manual AppSec triage workflows. The article uses React2Shell (CVE-2025-55182), a critical …
Volexity published Part 3 of its "Mind the (Patch) Gap" series. It shows how Volexity Volcano and Surge Collect Pro were used to analyze a VM compromised with the zero-day exploit chain and payloads used by UTA0560 (Chrome and Windows zero-days, described in Part 1). The post is mainly product and workflow documentation rather than new in…
Huntress explains the compliance obligations of Texas law HB 3834, passed in June 2019. It requires state agency and local government employees, and state contractors, to complete a Department of Information Resources (DIR)-certified cybersecurity awareness training every year. Since September 1, 2025, HB 3512 adds a second annual require…
A Huntress thought-leadership post sets out five priorities for security leaders in 2026: abuse of trusted IT tools, AI-enabled cybercrime, social engineering, multi-extortion ransomware and identity-based attacks including BEC. The article cites internal Huntress telemetry showing RMM abuse rising roughly 277% year over year, with Screen…
A Huntress vendor blog post lists 10 endpoint security trends. It reports no specific incident, vulnerability or campaign. The themes are agentic AI and the hijacking of non-human identities, ransomware shifting to double and triple extortion, incident response (IR) readiness, EDR-to-XDR consolidation, identity-first security and zero tru…
This vendor blog post from Huntress describes a new integration between the Huntress platform and AlgaPSA, the professional services automation (PSA) product from Nine Minds. Nine Minds built it in a few days using only the public Huntress API documentation. When the Huntress SOC publishes an incident report, it is created as a ticket on …
Huntress announced the Identity Posture Assessment, an on-demand report in Huntress Managed ISPM that scores a Microsoft 365 tenant against the Huntress Identity Security Framework. This is a product announcement, not a security incident. Huntress cites its own data: 79% of critical and high-severity SOC incident reports last year were ti…
