vulnerability management
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
Attackers are increasingly targeting the software development lifecycle (SDLC) supply chain by compromising developer tools, CI/CD pipelines, and open-source packages. Recent attacks like the ChainDrop npm worm demonstrate sophisticated methods to steal credentials, backdoor developer environments, and propagate malware. Securing the SDLC requires a shift from reactive code scanning to strict execution control and continuous visibility across developer endpoints, build pipelines, and cloud runtimes.
July 2026 CVE Landscape
In July 2026, a significant increase in high-impact vulnerabilities was observed, with 85 critical flaws identified, 36 of which had a Very Critical Recorded Future Risk Score. A notable portion of these vulnerabilities were either already listed in CISA's Known Exploited Vulnerabilities catalog or were reported by vendors. The vulnerabilities affected a wide range of products from 61 vendors, with Microsoft products being the most frequently impacted.
Rapid7 at Black Hat USA 2026: See preemptive security in action
Rapid7 will showcase its
When AI-Accelerated Discovery Outruns Patching, Exploitability Proof Decides What Gets Fixed First
The increasing speed at which AI models discover software vulnerabilities, particularly in open-source components, is outpacing the ability of organizations to patch them. This necessitates a shift in risk prioritization, focusing on exploitability rather than just severity scores. An industry coalition called Athena aims to accelerate the defense of open-source software, while tools like those from Qualys help organizations identify which discovered vulnerabilities are actively being exploited and require immediate attention.
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
Microsoft has developed an internal AI system to proactively evaluate and strengthen its cloud infrastructure. This system operates at AI speed to match the scale and complexity of Microsoft's hyper-scale environments, ensuring security controls are robust and effective. While not a customer-facing product, the insights gained will inform future product improvements.
Operationalizing Day Minus Seven: The Cloud-Native ROC
The article introduces the concept of a Risk Operations Center (ROC) as a necessary evolution for cybersecurity teams facing AI-driven threats. It argues that traditional risk management models are insufficient due to the speed at which AI can discover and exploit vulnerabilities, especially in cloud environments. A ROC, powered by platforms like Qualys Enterprise TruRisk Management (ETM), aims to unify disparate security findings, hyper-prioritize risks based on exploitability and business impact, and enable autonomous remediation to keep pace with attackers.
Found fast, fixed slow: The gap the AI clearinghouse must close
A new AI cybersecurity clearinghouse, mandated by a recent executive order, faces the critical challenge of moving beyond rapid vulnerability discovery to effective remediation. While AI can quickly identify software flaws, the process of validating, prioritizing, and patching these issues remains a significant bottleneck, particularly for open-source software. The clearinghouse must focus on building infrastructure for triage, incentivizing maintainer and user collaboration, and leveraging Software Bills of Materials (SBOMs) to ensure vulnerabilities are actually fixed.
CISA Deploys Anthropic’s Mythos AI to Hunt Vulnerabilities in U.S. Government Code
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is reportedly using Anthropic's advanced AI model, Mythos, to proactively scan government code for security vulnerabilities. The goal is to identify and fix flaws before malicious actors, such as foreign intelligence agencies or cybercriminals, can exploit them. Initial audits using the AI have allegedly uncovered a significant number of bugs, though details on the scope and severity remain undisclosed.
Qualys Joins Cisco Cloud Control Studio as a Launch Partner to Bring Risk Intelligence to Agentic Operations
Qualys has partnered with Cisco to integrate its risk intelligence capabilities into Cisco's new Cloud Control Studio platform. This collaboration aims to provide joint customers with unified asset inventory, prioritized vulnerability findings, and automated remediation workflows directly within Cisco's AI-driven operational environment. The integration is designed to help security teams manage expanding attack surfaces and overwhelming alert volumes by providing context and enabling faster, more efficient responses.
Is Your AppSec Program Built to Close the OWASP Top 10 2025 Coverage Gap?
The OWASP Top 10 2025 list introduces new vulnerabilities, particularly in API security and modern authentication flows, which many current application security programs fail to adequately address. Traditional security scanners often miss critical areas like Broken Object Level Authorization (BOLA) and Server-Side Request Forgery (SSRF) due to limitations in handling complex authentication and multi-role testing. Organizations need to adapt their security strategies to cover these evolving threats and close coverage gaps before they lead to significant remediation efforts.
What’s new in Microsoft Security: June 2026
Microsoft is enhancing its security offerings with a focus on AI and agent protection. New features include 'Codename MDASH,' an AI-powered system for discovering and remediating complex software vulnerabilities across environments. Additionally, Microsoft Defender now extends endpoint protection to local AI agents, detecting and blocking threats like prompt injection attempts targeting tools such as GitHub Copilot CLI and Claude Code.
Modernizing Global Vulnerability Standards For The Age Of AI
The rapid advancement of AI in discovering software vulnerabilities is outpacing current cybersecurity standards and processes. Traditional systems, designed for human-speed discovery and manual validation, are struggling to cope with the speed and scale at which AI can identify and chain weaknesses. This necessitates a modernization of global vulnerability standards, disclosure methods, and prioritization frameworks to effectively manage the evolving threat landscape.
CERT-In’s AI Vulnerability Blueprint: Why Indian CISOs Need Machine-Speed Risk Operations in the Post-Mythos Era
India's CERT-In has issued a blueprint for cybersecurity operations, emphasizing machine-speed risk management to address the evolving threat landscape driven by AI. The directive mandates a 12-hour containment for known exploited vulnerabilities, a significant acceleration from the current average breach lifecycle. This necessitates a shift towards continuous, automated risk operations centers that can detect, prioritize, validate, and remediate threats rapidly to meet new compliance and security standards.
From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI
Elastic's InfoSec Product Security Team has developed an AI agent capable of generating comprehensive CVE security advisories. This agent utilizes generative AI and Retrieval-Augmented Generation (RAG) against MITRE's CWE and CAPEC databases, ensuring accurate classification and scoring. The process automates the drafting of advisories from raw vulnerability reports, significantly speeding up the disclosure phase.