vulnerability management news
18 stories
Vulnerability Backlogs Are an Ownership Problem
A recent report highlights that the persistent challenge organizations face with vulnerability backlogs stems primarily from an ownership problem, rather than a deficiency in vulnerability scanning tools. The analysis suggests that while many enterprises have robust mechanisms for identifying security flaws, the subsequent remediation process falters due to an unclear assignment of…
Frontier AI just raised the stakes, and the old playbook won’t hold up
A new era of vulnerability discovery, driven by advanced AI models, is rapidly changing the cybersecurity landscape, making traditional remediation strategies increasingly unsustainable. This shift, highlighted by initiatives like Anthropic's Project Glasswing and internal experiments by major technology companies, reveals a significant increase in the speed and volume of vulnerability…
The patch window is collapsing: Why security needs a new control plane
A recent report highlights a significant shift in the cybersecurity landscape: the traditional patch management window is rapidly collapsing. This shrinking timeframe between the discovery of a vulnerability and its effective remediation is creating an increasingly critical attack surface for organizations. The analysis suggests that current security strategies are struggling to keep pace,…
The Vulnerability Gap: Why Discovery Is Outrunning Repair
A recent report highlights a widening "vulnerability gap," where the rate of new software vulnerability discovery is significantly outpacing the industry's capacity to repair them. This imbalance is attributed, in part, to the accelerating capabilities of artificial intelligence in identifying flaws, creating a pressing need for a more agile and comprehensive response from the cybersecurity…
Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain
A sophisticated new software supply chain attack, dubbed "ChainDrop," has been observed infecting over 400 npm packages, including widely used libraries such as `keyv` and `cacheable-request`. This attack leverages a three-step process to steal credentials and propagate itself, highlighting a growing trend of attackers targeting the tools and environments developers use rather than just…
July 2026 CVE Landscape
Cybersecurity researchers identified 85 high-impact vulnerabilities in July 2026 that require urgent remediation, marking a 44% increase from the previous month. Of these, 36 were assigned a "Very Critical" risk score by Insikt Group. The vulnerabilities affected products from 61 vendors, with Microsoft accounting for approximately 12% of the total.
Rapid7 at Black Hat USA 2026: See preemptive security in action
Rapid7 is set to showcase its "preemptive security" approach at Black Hat USA 2026, which will be held at the Mandalay Bay in Las Vegas this August. The company's presence will include a booth in the Business Hall, dedicated demonstrations, expert-led sessions, and a two-day event at the Border Grill.
When AI-Accelerated Discovery Outruns Patching, Exploitability Proof Decides What Gets Fixed First
The rapid acceleration of vulnerability discovery, particularly through AI-powered tools, is outpacing the ability of organizations to patch them, creating a critical need to prioritize remediation efforts based on actual exploitability rather than theoretical severity. This challenge is being addressed by the Athena coalition, an industry initiative launched by Chainguard to coordinate…
Protecting Microsoft at AI speed: How SFI proactively hardens our cloud
Microsoft has developed an internal artificial intelligence system designed to proactively assess and enhance the security of its cloud infrastructure. This AI-driven approach operates at a speed commensurate with the vast scale and intricate nature of Microsoft's hyper-scale cloud environments.
Operationalizing Day Minus Seven: The Cloud-Native ROC
The cybersecurity landscape is rapidly changing with the advent of advanced AI models, leading to an era dubbed 'Day Minus Seven.' In this new paradigm, AI can discover, chain, and exploit vulnerabilities at speeds that outpace traditional security workflows. The primary challenge for security teams is no longer identifying vulnerabilities but rather discerning which exposures are genuine,…
Found fast, fixed slow: The gap the AI clearinghouse must close
A recently established AI cybersecurity clearinghouse, mandated by an executive order, is tasked with coordinating the discovery and patching of software vulnerabilities within critical infrastructure. The initiative aims to address the growing gap between the rapid pace of AI-driven vulnerability identification and the slower, more complex process of remediation.
CISA Deploys Anthropic’s Mythos AI to Hunt Vulnerabilities in U.S. Government Code
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is utilizing Anthropic's advanced artificial intelligence model, Mythos, to proactively identify vulnerabilities within federal government code. This initiative aims to detect and address security weaknesses before they can be exploited by malicious actors, including foreign intelligence services and cybercriminal organizations.
Qualys Joins Cisco Cloud Control Studio as a Launch Partner to Bring Risk Intelligence to Agentic Operations
Qualys has announced its participation as a launch partner in Cisco Cloud Control Studio, a new platform designed for agentic IT and security operations. This collaboration aims to integrate Qualys' risk intelligence directly into Cisco's operational workflows, allowing joint customers to manage and remediate vulnerabilities more efficiently. The integration was unveiled at Cisco Live Las…
Is Your AppSec Program Built to Close the OWASP Top 10 2025 Coverage Gap?
Many application security (AppSec) programs face significant gaps in their ability to cover the latest OWASP Top 10 categories, particularly those introduced or emphasized in the 2025 update. Traditional security scanners often struggle with modern authentication methods and complex API interactions, leaving critical vulnerabilities unaddressed.
What’s new in Microsoft Security: June 2026
Microsoft is introducing new security measures, with a significant emphasis on artificial intelligence and the protection of AI agents. The company is developing an AI-driven system codenamed 'MDASH' designed to identify and address intricate software vulnerabilities across various computing environments.
Modernizing Global Vulnerability Standards For The Age Of AI
The rapid advancement of AI in discovering software vulnerabilities is straining existing cybersecurity standards and frameworks, which were designed for human-led discovery and a slower pace of threat evolution. This acceleration necessitates a re-evaluation of how vulnerabilities are managed, from discovery and verification to disclosure and prioritization.
CERT-In’s AI Vulnerability Blueprint: Why Indian CISOs Need Machine-Speed Risk Operations in the Post-Mythos Era
India's cybersecurity agency, CERT-In, has issued a new blueprint that significantly raises the bar for vulnerability remediation, demanding a shift from human-speed to machine-speed risk operations. This directive, released on May 25, 2026, mandates the containment of known exploited vulnerabilities on internet-facing and critical systems within 12 hours. This requirement stands in stark…
From vulnerability report to CVE draft in minutes: how Elastic automated security advisories with AI
Elastic's InfoSec Product Security Team has developed a generative AI agent to automate the drafting of security advisories, significantly reducing the time required to process vulnerability reports. This new system leverages Retrieval-Augmented Generation (RAG) against MITRE's Common Weakness Enumeration (CWE) and Common Attack Pattern Enumeration and Classification (CAPEC) catalogs, which…