Covers: Vulnerabilities & PatchingGovernance, Risk & ComplianceCloud SecurityData BreachesAI SecurityThreat Actors & Nation-StateSupply Chain & AppSecDetection & ResponseZero-Days & ExploitsEndpoint & Network Security
Qualys VMDR won Best Vulnerability Management Solution at the 2025 SC Awards Europe, its third consecutive year taking that category. Qualys cites a 20.6% global market share and more than 10,000 customers across 130+ countries, and states that the number...
Qualys announced enhancements to its Software Composition Analysis tool, including Software Atlas for mapping applications to their underlying components, first-class support for C/C++ binaries, SBOM generation in CycloneDX 1.4 and 1.6 formats, and runtime...
Qualys TRU found two linked local privilege escalation flaws: CVE-2025-6018, a PAM misconfiguration in openSUSE Leap 15 and SUSE Linux Enterprise 15 that lets an unprivileged local user such as an SSH session reach the "allow_active" context, and...
Qilin, a ransomware operation originally authored under the Dark Web moniker BianLian, has been linked to attacks across more than 25 countries and was identified by public sources as the leading ransomware threat overall as of May 2025. It performs double...
Microsoft's July 2025 Patch Tuesday addressed 140 vulnerabilities, including 14 rated critical and 115 rated important, plus one publicly disclosed zero-day and three flaws in Chromium-based Microsoft Edge. Adobe released 13 security advisories covering 60...
A Qualys-commissioned Dark Reading survey of over 100 IT and cybersecurity leaders found that 49% report having a formal cyber risk program, yet most of those programs remain focused on compliance checklists or technical assessments rather than business...
Oracle's July 2025 Critical Patch Update addresses 309 security vulnerabilities across its product families, with Oracle Communications receiving the most patches at 84, followed by Oracle MySQL at 40 and Oracle Fusion Middleware at 36. Of the total, 228...
On July 19, 2025, Microsoft issued an emergency out-of-band update for two SharePoint Server zero-days, CVE-2025-53770 and CVE-2025-53771, both under active exploitation. CVE-2025-53770 is a critical 9.8 deserialization flaw allowing unauthenticated remote...
A Qualys blog post describes the Cross-Service Confused Deputy Attack, in which a trusted AWS service such as ELB or CloudTrail is tricked into writing into a victim's S3 bucket because the bucket policy lacks account-specific condition keys. The post...
Qualys introduced TotalAI, a product that inventories and monitors cloud-hosted AI services and LLMs across AWS Bedrock, Azure AI Foundry, and Google Vertex AI, using AI fingerprinting to discover models, access paths, configuration states, and connections...
Qualys is adding agentic AI capabilities natively into its platform, aimed at automating cyber risk management tasks including risk assessment, remediation planning, compliance enforcement, and resource optimization. The architecture uses modular,...
Qualys Policy Audit provides automated compliance coverage across more than 500 technologies, including operating systems, databases, middleware, cloud infrastructure, containers, and legacy systems such as AIX, Solaris, HP-UX, and RACF z/OS. The product...
Microsoft's August 2025 Patch Tuesday addressed 119 vulnerabilities, including 13 rated critical and 91 important, plus one zero-day that was publicly disclosed. Adobe released 13 advisories covering 68 vulnerabilities across products including Commerce,...
Qualys introduced an Agentic AI capability in its Enterprise TruRisk Management platform, with an agent named Vikram that connects to cloud providers through existing connectors to inventory VM instances and determine which ones are not being scanned....
On June 20, 2025, a recruitment chatbot began responding unexpectedly during a routine screening process, drawing online attention and prompting independent security researchers to examine the platform. Their review found a series of application security...
Qualys reported that a campaign targeting Salesloft Drift, a marketing SaaS tool that integrates with Salesforce, stole OAuth tokens and affected a large number of Salesloft customers, including Qualys. Qualys said the stolen credentials allowed limited...
Qualys introduced Agent Sara, an agentic AI assistant in its Enterprise TruRisk Management platform that turns natural-language questions into prioritized vulnerability insights and remediation actions, executing VMDR and TruRisk Eliminate queries. In a...
Qualys announced a redesigned PCI ASV user interface for its Enterprise TruRisk Platform, aimed at simplifying PCI DSS 4.0 compliance workflows with a focus on speed, clarity, and accessibility. The enhanced UI begins rolling out on September 25, 2025,...
Qualys introduced Manifest Version Control in its TruRisk Platform, a mechanism that turns manifest updates from an all-or-nothing vendor push into a governed, observable, and reversible process with staging, canary groups, and the ability to prevent a...
Qualys announced ETM Identity, a module inside its Enterprise TruRisk Management platform that consolidates human, service, machine, and AI identity posture into a single per-identity score called Identity TruRisk, correlating identities with asset...
In mid-October 2025, F5 disclosed a long-term breach by a nation-state actor that exfiltrated portions of BIG-IP source code and internal details of unpatched vulnerabilities, prompting CISA to label the event an imminent threat and add it to the KEV list....
Oracle's October 2025 Critical Patch Update addressed 374 security vulnerabilities across its product families, with Oracle Communications receiving the most patches at 73, followed by Oracle Communications Applications at 64 and Oracle Financial Services...
Qualys Threat Research Unit telemetry shows a sharp rise in automated attacks on PHP servers, IoT devices, and cloud gateways, driven mainly by the Mirai, Gafgyt, and Mozi botnets exploiting known CVEs and cloud misconfigurations. The blog cites PHP...
Microsoft's November 2025 Patch Tuesday addresses 68 vulnerabilities, including five critical and 59 important-severity flaws, plus five in Microsoft Edge (Chromium-based). The release includes a zero-day vulnerability that was being exploited in the wild,...
A Qualys blog post describes how attackers use reconnaissance against Amazon EventBridge by quietly mapping event flows before an exploit, exploiting unmonitored IAM roles, permissive event rules, and cross-account risks. It cites AWS figures that...
Qualys describes automated patch management as a unified lifecycle that continuously monitors assets, prioritizes patches by risk, tests updates in production, and deploys fixes across hybrid cloud environments without continuous human oversight. The post...
A Qualys blog post cites a Bain & Company assessment finding 95% of US companies now use generative AI, up 12 percentage points in a year, and an EY survey in which 48% of tech executives report adopting or fully deploying agentic AI. The post states that...
Microsoft's December 2025 Patch Tuesday addresses 72 vulnerabilities, including three critical and 55 important-severity flaws, plus three zero-days of which one was exploited and two were publicly disclosed. Adobe released five advisories covering 138...
ShadyPanda has run long-term browser supply chain attacks since 2018, publishing seemingly harmless extensions such as wallpapers, utilities, and new-tab tools to build installation counts and trusted marketplace status, then weaponizing them through...
Qualys reports its Cloud Agent adoption grew 18% year over year in 2025, with customers standardizing on a single lightweight agent for vulnerability management, compliance, application and asset visibility, and software composition analysis. The year's...