The Curious Engineer

All blogs / Security

Qualys Security Blog

blog.qualys.com

Cybersecurity blog covering software, services, and risk insights. Stay updated with the latest on threat detection, compliance, and vulnerability management.

Security

’10’15’20’25
Posts
2,157 from 11 Jun 2008 to 4 Nov 2026
Posting
weekly (144 in the last year)
Kind
company blog
Feed
https://blog.qualys.com/feed

Latest

November 2026

  1. Cloud Agent, now in a Container: Host Security for Nodes You Can’t Touch
  2. PHP2Shell on Windows and macOS: Automating the PHP Upgrade, With or Without an Agent
  3. FedRAMP Authorization Is the Easy Part: How to Stay Authorized with Qualys Policy Audit

October 2026

  1. Operationalizing CISA AA26-194A: Automating Cisco Router Security Assessments with Qualys Policy Audit
  2. Can’t Patch Node.js Yet? Build a Stopgap with the Controls You Own
  3. Can’t Patch PHP2Shell Yet? Build a Stopgap with the Controls You Own
  4. How to Identify Compromised eMudhra Certificates With Qualys (CVE-2026-111943 and CVE-2026-111944)
  5. Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do
  6. The Science of Exploitability: Decoding BlueHammer
  7. Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now
  8. The Real Jump Scare Isn’t the Attacker; It’s The Vulnerabilities You’re Focusing On
  9. TruConfidence: Why Your Patch Automation Can Finally Be Autonomous
  10. Microsoft Patch Tuesday, October 2026 Security Update Review
  11. Exploitability Needs Runtime Evidence: Understanding Runtime Vulnerability Reachability for Containers
  12. Secure Your Mission-Critical Application Estate: Qualys TotalAppSec is Now FedRAMP High Authorized (FedRAMP Certified Class D)

September 2026

  1. Autonomous Remediation Is Already Running at Enterprise Scale
  2. Lessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate
  3. The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches
  4. CISA BOD 26-04 Timelines for Three Linux Kernel CVEs
  5. The End of Point-in-Time Compliance: Why Continuous Audit Readiness Matters to You in the AI Era
  6. The Autonomous Engine Behind Remediation, and What Finally Makes It Safe
  7. Oracle Critical Security Patch Update, September 2026 Review
  8. Before You Patch. Why Patch Reliability Matters for Confident Deployment
  9. Automate Asset Isolation: Your Last Resort to Meet Remediation Deadlines
  10. What Is ISPM? How It Differs from IAM, PAM, IGA, and IDaaS
  11. The Models That Found 10,000 Zero-Days Broke Into Three Companies Using Weak Passwords
  12. Microsoft and Adobe Patch Tuesday, September 2026 Security Update Review
  13. 4 Questions to Ask When Evaluating an Exposure Management Platform
  14. Anatomy of a Silent Domain Takeover

August 2026

  1. PCI DSS 4.0.1: Application Requirements You’re Being Assessed On in 2026
  2. When an AI Agent Turned Attacker: What Qualys Sees Across Every Phase of the Hugging Face Kubernetes Intrusion
  3. Beyond Patching: What IT Teams Need to Know About Unpatchable Exposures
  4. CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
  5. Oracle Critical Patch Update, August 2026 Security Update Review
  6. CVE-2026-68820 is in KEV. Here Is What CISA BOD 26-04 Actually Requires Now
  7. Why API Discovery Is Critical for Modern AppSec Programs
  8. Qualys Introduces Real-Time Cloud Security Posture Management (CSPM) for Faster Risk Detection and Remediation
  9. Microsoft and Adobe Patch Tuesday, August 2026 Security Update Review
  10. Audit Fix: Audit Readiness for the Post-Mythos Era
  11. Zero-Day Remediation Meets Operational Resiliency
  12. Agent Val Now Validates the Entire Attack Surface: From Network to Host
  13. Say Hello to Agent Insta: Closing the Detection Gap in Exposure Management at Machine Speed

July 2026

  1. Operationalize AI Governance Across Shadow GenAI, MCP, and Agentic Workloads with Qualys TotalAI
  2. Qualys Expands Serverless Security with Vulnerability Scanning for AWS Lambda
  3. The Sub-10-Minute Cloud Takeover: How Exposed IAM Keys, Misconfiguration and AI Are Rewriting the Rules of Cloud Breaches
  4. RefluXFS: A Linux Kernel Local Privilege Escalation to Root in XFS (CVE-2026-64600)
  5. Oracle Critical Patch Update, July 2026 Security Update Review
  6. Manual Patching Can’t Outrun AI. Automated Remediation Can.
  7. CVE-2026-8933: Local Privilege Escalation in Set-Capabilities snap-confine
  8. Is Your Security Program Ready for AI-Speed Application Exploitation?
  9. Top Five Compliance Audit Software and Tools: Mastering Modern Regulatory Risk
  10. Microsoft and Adobe Patch Tuesday, July 2026 Security Update Review
  11. How Qualys ETM Identity Detects Identity-Based Attacks Faster
  12. How to Meet a 3-Day Remediation SLA & Comply with CISA BOD 26-04
  13. When AI-Accelerated Discovery Outruns Patching, Exploitability Proof Decides What Gets Fixed First
  14. FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices
  15. Operationalizing Day Minus Seven: The Cloud-Native ROC
  16. Qualys Joins Cisco Cloud Control Studio as a Launch Partner to Bring Risk Intelligence to Agentic Operations
  17. Is Your AppSec Program Built to Close the OWASP Top 10 2025 Coverage Gap?

June 2026

  1. CERT-In’s AI Vulnerability Blueprint: Why Indian CISOs Need Machine-Speed Risk Operations in the Post-Mythos Era
  2. 3 Paths to Upgrade Windows 11 before 24H2 End of Servicing (EOL)
  3. CNAPP’s New Normal: Hyper-Prioritization and Autonomous Remediation at Cloud Scale
  4. Oracle Critical Patch Update, June 2026 Security Update Review
  5. What Changed in OWASP Top 10 2025 and Recommendations for Each Category
  6. How Federal Agencies Can Activate a Risk Operations Center (ROC) to Meet CISA BOD 26-04
  7. Turning Millions of Risks Into One Actionable List
  8. Microsoft and Adobe Patch Tuesday, June 2026 Security Update Review
  9. Advancing Cybersecurity in the Age of Frontier AI: Qualys Steps into Project Glasswing
  10. From Operating Model to Product: How We Built the ROC for Detection-Speed Remediation
  11. Stop Patching at Human Speed: Peer-to-Peer (P2P) Distribution Closes the Remediation Gap Before Attackers Strike
  12. The HazyBeacon Protocol – How Malware Weaponizes Amazon Web Services (AWS) Lambda Function URLs

May 2026

  1. Extending EOL/EOS Software Intelligence Across Containers, Kubernetes, and Modern Workloads
  2. CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path
  3. Inside the 2026 Verizon DBIR: What One Billion Records Revealed About Vulnerability Remediation
  4. Achieve FedRAMP High M365 Security: Governing with Qualys SSPM and SCuBA
  5. Stop Chasing Threats: Top 3 Insights from the SANS Attack Surface Management Survey
  6. FedRAMP High Authorized: Qualys TotalCloud CNAPP – From Compliance to Defense
  7. Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review
  8. Bringing AI Code Security into Qualys ETM
  9. Dirty Frag: Using the Page Caches as an Attack Surface
  10. Before the Breach, There Was a Test Environment
  11. Qualys TotalAI Achieves FedRAMP Moderate (FedRAMP Certified Class C) Authorization
  12. Converge Connect: Unlock Lower Premiums with Proven Qualys Security
  13. Handling the Vulnerability Surge in the Post-Mythos Era

April 2026

  1. Don’t Wait for a Patch. Mitigate RedSun Zero-Day Risk in Microsoft Defender Today
  2. Oracle Critical Patch Update, April 2026 Security Update Review
  3. Enterprise Remediation Benchmark: How Does Your Organization Compare?
  4. Qualys VMDR and TotalCloud™ Now Available on Oracle Cloud Marketplace
  5. Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
  6. Anatomy of an Autonomous AI Agent Risk: How Qualys ETM Connects the Dots on OpenClaw
  7. Deep Scan: Expanding Vulnerability Detection Beyond Traditional Boundaries
  8. The Mythos Inflection Point: Dealing With the Upcoming Vulnerability Disclosure Avalanche and Compressed Exploitation Window
  9. Scaling Modern AppSec: Moving from Static Profiles to AI-Powered Scan Optimization
  10. 12 Best Practices for Securing AWS Cloud in 2026
  11. Signals from the Cloud Security Forecast 2026: Cloud Risk Is Scaling through Design, Not Disruption
  12. Why Every Enterprise Needs a Risk Operations Center (ROC)

March 2026

  1. Optimizing Risk Discovery and Remediation with Qualys Gateway Service (QGS)
  2. The Rise of Managed Risk Operations: How the New Qualys mROC Portal Helps Partners Scale the Risk Operations Center
  3. From Vision to Real-time Threat Intelligence: TruLens for ETM
  4. Threat Research Report: The Broken Physics of Remediation
  5. Meet Agent Val: Closing the Validation Gap in Exposure Management at Machine Speed with Agentic AI
  6. Bringing Continuous Assessment to Harbor: Scan on Push, Stay Secure Over Time
  7. MCP Servers Are the New Shadow IT for AI
  8. 5 Steps to Turn Compliance Checks into Audit Outcomes
  9. CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root
  10. Countering Current Geopolitical Cyber Threats With Qualys
  11. The New Era of Application Security: Reasoning-Based Agents, Runtime Reality, and Risk Intelligence
  12. CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root
  13. Microsoft and Adobe Patch Tuesday, March 2026 Security Update Review
  14. From Shadow Models to Audit-Ready AI Security: A Practical Path with Qualys TotalAI
  15. Cyber Essentials Plus in 2026: Strengthened Controls, UK Cyber Reality & How Qualys Supports Compliance

February 2026

  1. How Security Tool Misuse Is Reshaping Cloud Compromise
  2. New: AI-Powered Patch Reliability Scoring—Predict Patch Impact Before You Deploy
  3. Qualys Recognized as a Leader in the 2026 Forrester Wave™ for CNAPP
  4. Active Directory Attacks Demystified: Pass-the-Hash (PtH), Pass-the-Ticket (PtT), and Beyond
  5. Microsoft and Adobe Patch Tuesday, February 2026 Security Update Review
  6. TruConfirm: Autonomous, Agent-Led, Safe Exploit Validation for Real-World Risk Reduction
  7. Mutagen Astronomy: From Discovery to CISA Recognition—A Seven-Year Journey

January 2026

  1. ROC vs. CTEM: How a Risk Operations Center Evolves Beyond Continuous Threat Exposure Management in 2026
  2. Top 10 Cloud Compliance Tools for Enterprise Security and Audit Readiness in 2026
  3. How Public Container Registries Have Become a Silent Risk Multiplier in a Modern Supply Chain
  4. Qualys Named a Leader and Outperformer in the 2025 GigaOm Radar for CNAPP
  5. Cybersecurity Predictions for 2026 Signal the Maturation of Risk-First Security Models
  6. Your VMDR Year in Review: Making Security Progress Visible and Actionable
  7. Why Serverless Risk Demands Identity-Aware Security at Cloud Scale
  8. Microsoft and Adobe Patch Tuesday, January 2026 Security Update Review
  9. Agent Grant: From Identity Signals to Measurable Risk Reduction
  10. Cloud Agent in 2025: A Year of Scale, Security, and Smarter Visibility

December 2025

  1. Your Guide to PCI DSS 4.0.1 Web Application and API Controls with a Simplified Path to Compliance
  2. ShadyPanda: The Silent Browser Takeover Threat and How Qualys TruRisk Eliminate Helps You Stop It
  3. Navigating Change: Evolving Your Exposure Management Strategy in a Post-Kenna World with Qualys
  4. Scale AI Securely with Qualys TotalAI’s Streamlined Onboarding, Deeper Risk Detection, and Compliance-Ready Reporting
  5. React2Shell: Decoding CVE-2025-55182 – The Silent Threat in React Server Components
  6. Microsoft and Adobe Patch Tuesday, December 2025 Security Update Review
  7. Active Exploitation of 7-Zip RCE Vulnerability Shows Why Manual Patching is No Longer an Option

November 2025

  1. The Future of Cloud Security: A New Act for Cyber Risk Operations
  2. From Vision to Value: Gartner® Identifies Qualys as 2025 Magic Quadrant™ Leader in Exposure Assessment Platforms
  3. Zero-Day Zero: The AI Attack That Just Ended the Era of the Forgiving Internet
  4. GenAI: Harness the Power, Eliminate the Risk — A Practical Playbook for Securing AI from Day One
  5. What is Patch Management Automation and Why It Matters
  6. What It Takes to Design Trust into Event-Driven Architectures with Amazon EventBridge
  7. Unauthenticated Authentication Bypass in Fortinet FortiWeb (CVE-2025-64446) Exploited in the Wild
  8. Microsoft Patch Tuesday, November 2025 Security Update Review
  9. Battle Compliance Confusion and Security Fatigue with Qualys and ServiceNow
  10. Inside an Automotive Giant’s Data Leak — A Cloud Misconfiguration Lesson for AWS Users

October 2025

  1. What Security Teams Need to Know as PHP and IoT Exploits Surge
  2. Oracle Critical Patch Update, October 2025 Security Update Review
  3. A Strategic Response to the F5 BIG-IP Nation-State Breach 2025
  4. Bringing the Power of Agentic AI for Identity Risk, Adaptive Threat Prioritization, and Exposure Exploitability Validation
  5. Introducing TruConfirm for Enterprise TruRisk™ Management: Automated Exposure Validation

Every year

2026 1282025 1442024 1342023 1252022 1162021 942020 792019 652018 1062017 1052016 1052015 1022014 1272013 1312012 1572011 1212010 1512009 1122008 55