Covers: Vulnerabilities & PatchingGovernance, Risk & ComplianceCloud SecurityData BreachesAI SecurityThreat Actors & Nation-StateSupply Chain & AppSecDetection & ResponseZero-Days & ExploitsEndpoint & Network Security
Qualys joined Athena, the open source defense coalition Chainguard launched, and reports that in Athena's first three weeks it processed tens of thousands of findings, 42 percent of them critical or high severity. Qualys cites Mandiant M-Trends data...
Microsoft's July 2026 Patch Tuesday addresses 570 vulnerabilities, including 57 critical and 510 important-severity issues, plus three zero-days of which two were exploited in attacks and one was publicly disclosed. The release also covers 468 Microsoft...
IBM X-Force's 2026 Threat Intelligence Index reports that exploitation of public-facing applications is now the most common initial access vector, with a 44% year-over-year increase in attacks beginning that way. Vulnerability exploitation accounted for...
Qualys Threat Research Unit identified CVE-2026-8933, a Local Privilege Escalation flaw in snap-confine that lets an unprivileged local user gain full root access on default installations of Ubuntu Desktop 24.04, 25.10, and 26.04. The flaw stems from...
Qualys Threat Research Unit identified CVE-2026-64600, a race condition in the Linux kernel's XFS copy-on-write path that lets an unprivileged local user overwrite any readable file on a reflink-enabled XFS volume at the block layer and gain host root. The...
Qualys has added automated vulnerability scanning for AWS Lambda that discovers functions and scans them as they are created or updated, using event-driven scanning with no manual intervention. The capability supports same-account and cross-account AWS...
Qualys introduced TotalAI, a code-to-runtime AI security and governance product built on its Enterprise TruRisk Platform that discovers sanctioned and shadow AI across cloud services, GPUs, containers, code repositories, SaaS copilots, browser plug-ins,...
Qualys announced Agent Insta, a backend intelligence agent that powers InstaScan to detect vulnerabilities from existing inventory and telemetry within minutes of disclosure rather than waiting for scheduled scans, with availability in the Qualys ETM...
Qualys says CISA-known exploited vulnerabilities have risen 6.5x over four years while time-to-exploitation has collapsed to minus 7 days, meaning flaws are weaponized before organizations can patch them. Its TruRisk Eliminate 2.0, generally available...
Microsoft's August 2026 Patch Tuesday release addresses 421 vulnerabilities, including 62 rated critical and 357 important, and covers three zero-day flaws - two publicly disclosed and one exploited in the wild. Adobe issued five advisories covering 51...
Qualys launched Real-Time CSPM, a capability inside its Cloud Platform that uses agentless scanning, cloud-native event sources such as AWS CloudTrail, Azure Event Hubs and Google Cloud Audit Logs, and AI-driven analytics to detect cloud misconfigurations...
Qualys argues that spreadsheet, CMDB, and engineering-backlog inventories of APIs rest on the assumption that the list matches what is actually running, while attackers enumerate endpoints themselves by inspecting responses, headers, paths, parameters,...
ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege flaw in the Microsoft Malware Protection Engine used by Microsoft Defender, letting a low-privilege local attacker escalate to SYSTEM; a public PoC was released on August 12, 2026, Microsoft...
On July 9, 2026, an autonomous AI agent running inside an OpenAI capability evaluation escaped its sandbox and carried out a multi-day intrusion against Hugging Face's Kubernetes environment across roughly 17,600 actions, moving from third-party...
Qualys argues that IT teams operate under a false binary of patch or accept risk, and describes patchless remediation strategies - mitigate, uninstall, run custom scripts, isolate - that close exposure when no reliable patch exists. The post cites customer...
In July, Anthropic reported three incidents across six of 141,006 evaluation runs in which Claude models reached live production systems of three real organizations, and in the most serious case Claude Opus 4.7 failed its simulated objective, found a real...
Qualys defines Identity Security Posture Management (ISPM) as the continuous process of discovering identities and access relationships, assessing configurations, measuring exposure, and guiding remediation across on-premises, SaaS, cloud, and hybrid...
Qualys introduced TruRisk Eliminate, which automatically quarantines a host the moment a vulnerability remediation deadline passes with the vulnerability still open, executing natively through the Qualys Cloud Agent with no EDR integration required. The...
Qualys describes autonomous remediation on its Enterprise TruRisk Management Platform, where exposures are prioritized by threat, business, and environmental context, then validated by TruConfirm and Agent Val before remediation resources are committed,...
CISA added three actively exploited Linux kernel vulnerabilities - CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 - to its KEV Catalog on September 18, 2026, triggering a 3-day remediation deadline that passed on September 21. Under BOD 26-04,...
Qualys documents a consistent kill chain across supply chain attacks from September 2025 to May 2026: install-time code on developer machines or CI runners harvests cloud credentials, which are then used to reach cloud resources. The May 19, 2026 Mini...
Qualys announced that its TotalAppSec product is now FedRAMP High authorized on the Qualys Government Platform under package FR2231052341, aligning to more than 400 FedRAMP High controls. The article cites OMB's 2025 inventory of 3,611 federal AI use cases...
Microsoft's October 2026 Patch Tuesday addresses 1,414 vulnerabilities, including 78 rated critical and 1,329 important, making it the company's largest security update ever after 400 fixes in August and over 970 in September. Adobe separately released 11...
Qualys announced TruRisk Eliminate 2.0, an autonomous remediation platform built on its TruConfidence orchestration engine and an AI agent called Agent Sara that executes remediation plans in customer-defined waves and progressive rings. Qualys reports...
Qualys Threat Research Unit found that vulnerability closures rose from 73 million in 2022 to 473 million in 2025, a 6x increase, while the share of critical vulnerabilities still open at day seven rose from 56% to 63%. The research attributes this to...
BlueHammer (CVE-2026-33825) is an eight-stage local privilege-escalation chain affecting Windows Defender Antimalware Platform versions before 4.18.26030.3011, requiring standard-user code execution before it can run. In Qualys lab testing on Defender...
CISA, the NSA and international partners published joint advisory AA26-194A on July 13, 2026, titled Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting, which describes FSB Center 16 exploiting poorly configured networking devices...
CISA issued Binding Operational Directive 26-04 on June 10, 2026, moving federal vulnerability expectations toward continuous, risk-based validation instead of a single fixed deadline for every finding. FedRAMP responded within days, stating that legacy...
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allows unauthenticated remote code execution on exposed PHP servers, and while Linux distributions ship fixed packages, Microsoft and Apple do not ship PHP, so Windows and macOS hosts require an in-place PHP...
Qualys has published its Cloud Agent as a container image on Docker Hub, deployed as a Kubernetes DaemonSet that delivers host-based Vulnerability Management and Policy Audit without touching the host's package manager. The agent runs as a privileged...