Qualys WAS: New Detections for XML External Entities (XXE)

In the new 2017 edition of the OWASP Top 10, XML External Entities XXE make their first appearance at A4 on the list. Qualys is pleased to announce that Qualys Web Application Scanning WAS engine 4.4 includes new detection capabilities for XXE vulnerabilities. About XML External Entities XXE If...

Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review

May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy landscape. Here's a quick breakdown of what you need to know. Microsoft Patch Tuesday for May 2026 This...

Microsoft and Adobe Patch Tuesday, October 2025 Security Update Review

As cybersecurity threats evolve, Microsoft's October 2025 Patch Tuesday delivers one of the most comprehensive security updates of the year. Here's a quick breakdown of what you need to know. Microsoft Patch Tuesday for October 2025 This month's release addresses a staggering 193 vulnerabilities,...

Chatbots, APIs, and the Hidden Risks Inside Your Application Stack

What happens when a legacy application quietly slips under the radar and ends up at the center of a security incident involving AI and APIs? For one global organization, this scenario played out in real time when an unusual chatbot behavior sparked a closer look into their recruitment platform,...

Eliminate Risk with Precision: Introducing Vulnerability Detection Sources in VMDR

In the race against cyber threats, finding vulnerabilities is no longer enough. True security comes from understanding them—where they exist, how they were discovered, and what risks they pose. One of the most overlooked aspects in vulnerability management is knowing the source of detection...

Shrinking Lifespans, Growing Risk: The Final Certificate Countdown

Recent Developments Severely Shorten Certificate Lifespans. The SSL/TLS ecosystem is shifting rapidly and not in a way that favors already stretched teams. Historically, certificates could be valid for up to 10 years. Certificates now face drastically shorter lifespans. DigiCert and other major...

Elevate Your Container Security with QScanner in 2025

Securing container images is more important than ever in the dynamic world of cloud-native technologies. Organizations have long utilized reliable solutions from Qualys to scan their images, ensuring applications run smoothly and securely. These tools have played a crucial role in maintaining the...

Subscription Health Dashboard Update: Optimize Deployments and Identify Issues

For VM teams navigating the complex realm of cybersecurity tools, ensuring deployment health is paramount. Swift methods are required to pinpoint issues amidst complexity. Challenges such as duplicate entries, ghost hosts, and decommissioned devices can obstruct these views, hindering data...

Enhance Your Cybersecurity Posture: Qualys Tackles CISA & NSA’s Top 10 Misconfigurations

The National Security Agency NSA alongside the Cybersecurity and Infrastructure Security Agency CISA have pinpointed the most critical misconfigurations that present substantial dangers to organizations. In particular, the advisory calls out the tactics, techniques, and procedures TTPs actors use...

Qualys Blog

On Wednesday, July 3, 2024 at 2:45 AM EDT Qualys identified suspicious spam content posted to the Qualys blog. Qualys conducted an investigation to identify any compromise and/or impact due to this unauthorized spam blog post and found no indication that the incident had any impact on customer...

Qualys Is Proud to Sign CISA’s Secure by Design Pledge

Cybersecurity leaders in the U.S. are very familiar with the Cybersecurity and Infrastructure Security Agency CISA and their important work to keep the internet, our country, and its citizens safe from cyber threats. As part of their efforts, CISA has identified secure by design software as a key...

An Easy and Effective Strategy To Shield Your Business From Ransomware

Ransomware continues to make headlines and remains a top concern 2022 was a breakout year for ransomware as it wreaked havoc on individuals and organizations around the world. The numbers are staggering: Ransomware attacks surged dramatically in 2022 and were involved in 25% of all breaches,...

Part I: Implementing Effective Cyber Security Metrics That Reduce Risk Realistically

As a CISO or business leader, some burning questions that often come to your mind are: How vulnerable is our cybersecurity posture? Are we better protected than we were three months or a year ago? Have our investments improved the cybersecurity posture and yielded any tangible benefits? Are my...

Risk Fact #3: Initial Access Brokers Attack What Organizations Ignore

Qualys Blog Series – Threat Research Unit Report “Divide and Conquer” is an emerging and winning strategy for cyber criminals who split responsibilities to improve execution of the attack process. Some threat actors specialize in the back end, which often is ransomware deployed at scale. The fron...

CISA BOD 23-01: Meeting and Exceeding CISA Requirements with Qualys

The latest Binding Operational Directive from the Cybersecurity and Infrastructure Security Agency CISA BOD 23-01 requires agencies to implement an essential cybersecurity practice within the next 6 months. While this new mandate impacts agencies directly, it also impacts their supply chain...

QSC Day 1 Recap: As Threats Intensify, Qualys Helps Organizations Shore Up Security

Cyberattacks are occurring more frequently. They’re also more damaging. And they’re only likely to get worse. Chris Krebs should know—for the two years he served as director of the Cybersecurity and Infrastructure Security Agency CISA, he was charged with sussing out threats, sounding the alarm t...

Optimize Vulnerability Remediation with Proactive Zero-Touch Patch

Vulnerability remediation is a complex task, and most organizations struggle to identify, prioritize and remediate vulnerabilities efficiently. With the rise in vulnerability discovery, there is a correlating increase in ransomware attacks initiated through unpatched vulnerabilities. This has led...

Securing IT Assets By Prioritizing Protection And Remediation

As hackers get faster at weaponizing exploits for disclosed bugs, InfoSec teams need — more than ever — automated, continuous and precise IT asset inventorying, vulnerability management, threat prioritization and patch deployment. Critical vulnerabilities that linger unpatched for weeks or months...

Countdown to GDPR: For GDPR Compliance, Web App Security Is a Must

With web and mobile apps becoming a preferred vector for data breaches, organizations must include application security in their plans for complying with the EU's General Data Protection Regulation GDPR. First discussed in the 1990s and turned into law in 2016, GDPR goes into effect in May of thi...

Call For Customer Presentations at RSA Conference 2018!

Tell your security story to your peers at RSA Conference 2018 San Francisco! Qualys is looking for customers excited to share their security and DevSecOps successes, best practices and case studies leveraging the use of the Qualys Cloud Platform. Take the stage in the Qualys booth to share your...

Digging Into WannaCry Details: Answers to Your Burning Questions

Jimmy Graham, Director of Product Management, Qualys Threat Protection & AssetView The WannaCry ransomware attack spread so quickly and has been so disruptive that IT departments can’t get enough information about what caused it, how it can be remediated and what can be done to protect their...

Qualys Cloud Platform 2.26 New Features

This release of the Qualys Cloud Platform version 2.26 includes updates and new features for Cloud Agent, AssetView, Security Assessment Questionnaire and Web Application Scanning as follows: Highlights Cloud Agent Platform View Module Activation Job Status – adds a button in Agent Management tab...

MCP Servers Are the New Shadow IT for AI

Key Takeaways MCP servers are becoming the default wiring between AI agents and enterprise applications — but most organizations have zero visibility into where they are, what they expose, or how they can be abused. Qualys TotalAI now provides layered discovery of MCP servers across network, host...

CVE-2026-3888: Important Snap Flaw Enables Local Privilege Escalation to Root

The Qualys Threat Research Unit has identified a Local Privilege Escalation LPE vulnerability affecting default installations of Ubuntu Desktop version 24.04 and later. This flaw CVE-2026-3888 allows an unprivileged local attacker to escalate privileges to full root access through the interaction...

Your Guide to PCI DSS 4.0.1 Web Application and API Controls with a Simplified Path to Compliance

Executive Summary PCI DSS 4.0.1 compliance mandates stricter security controls for web applications and APIs. Key updates include maintaining an inventory of custom software PCI 6.3.2 and managing payment page scripts to prevent skimming attacks PCI 6.4.3. Organizations must also adopt risk-based...

Oracle Critical Patch Update, October 2025 Security Update Review

Oracle released its third quarterly edition of this year’s Critical Patch Update. The update received patches for 374 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families,...

Introducing the Qualys App Picker: Easier, Faster Navigation for All Your Security Applications

Navigating your cybersecurity platform should be easy. That is why we have reimagined the way users access Qualys applications with the brand-new Qualys App Picker , a streamlined, intuitive navigation panel designed to make access faster, easier, and smarter in the Qualys Enterprise TruRisk...

Qualys Recognized as The Leader in Attack Surface Management by KuppingerCole

In today’s ever-evolving security landscape, organizations face an unprecedented expansion of digital assets—and with that expansion comes a growing attack surface. We're proud to announce that Qualys has been named The Leader in the2025 KuppingerCole Leadership Compass for Attack Surface...

Cybersecurity 2025: Qualys’ Predictions for Navigating the Evolving Threat Landscape

Cybersecurity in 2024 was a year of contrasts—marked by rising threats and groundbreaking innovations. The surge in ransomware attacks and exploitation of vulnerabilities exposed weaknesses in core systems and software, while the rapid adoption of AI tools brought both risks and opportunities to...

Secure, Efficient, Cost-Effective: How Qualys Patch Management Delivers ROI

As demonstrated by real user reviews from PeerSpot Organizations face increasing challenges in managing cyber threats and deploying the tools necessary to detect, protect, and mitigate vulnerabilities. Patch management, a critical component of cybersecurity, often falls victim to resource...

Introducing the Enhanced User Interface of the Qualys Enterprise TruRisk™ Platform

Launching the Enhanced User Interface The Qualys Product Team is excited to announce upcoming enhancements to the Qualys User Interface. These User Experience UX enhancements will make your platform experience faster, smoother, and more immersive. We continuously leverage insights from channels...

Enhancing Cloud-Native Security: Qualys Introduces Scanning for Container-Optimized OS in Google Kubernetes Engine

As organizations move from traditional workloads to containerized environments, they encounter new security challenges. Containers bring added complexity that traditional security tools often struggle to manage, largely because of their transient nature and the shared responsibility between the...

PCI DSS 4.0: Get Audit-Ready for the New Requirements

The Payment Card Industry Data Security Standard PCI DSS originated in 2004 and is managed by the PCI Security Standards Council to ensure security for the global payment industry. This mandate applies to all entities worldwide that store, process, or transmit payment cardholder data or sensitive...

Unveiling the Hidden Power of the CMDB in Cybersecurity

In the ever-evolving landscape of cybersecurity, where attacks grow increasingly sophisticated, organizations must leverage every tool at their disposal to stay one step ahead. While CISOs and SecOps teams often focus on disciplines such as vulnerability detection, attack surface management, and...

Qualys Expands Cloud Platform for First-Party Application Risk Detection and Remediation

Have you faced the need to identify & respond to open-source package vulnerabilities like log4shell, openSSL, etc, in production from Day Zero? Are you using first-party, homegrown applications and are worried the risk introduced by those applications is not seen or addressed? Qualys new...

How Qualys Drives PCI DSS 4.0 Compliance for File Integrity Monitoring

The Payment Card Industry Data Security Standard PCI DSS is a well-known rule for compliance by merchants and entities involved in payment card processing. The new PCI DSS 4.0 standard specifies a broad range of technical and process requirements to ensure the safety of payment cardholder data or...

Staying Ahead of Ransomware Threats

Ransomware attacks have become a growing threat to organizations of all sizes and sectors. Many of these attacks exploit known vulnerabilities, making organizations need to quickly identify and fix these weaknesses to prevent a potential ransomware incident. This is where the Ransomware...

QSC 2022 Kickoff: Quantifying and Qualifying Digital Cyber Risks

Qualys’ annual security conference returned to a live-only event this week at the Venetian Hotel in Las Vegas, and the keynote addresses started things off on a very practical note… about selling coconuts, toasters, and carbon monoxide detectors. The first two keynotes featured speeches from both...

Qualys VMDR Recognized as Best VM Solution by SC Awards 2022 & Leader by GigaOm

Qualys VMDR has been recognized for its commanding industry leadership by both the 2022 SC Awards and analyst firm GigaOm. SC Magazine has chosen Qualys VMDR as the winner of the Best Vulnerability Management Solution category in its SC Awards 2022. The SC Awards honors the best solutions in...

EDR Is Dead. Long Live Multi-Vector EDR.

News of EDR’s demise has been greatly exaggerated. Fact is: older approaches to EDR have to move over. There’s a new solution now: Multi-Vector EDR. This blog reviews the highlights of our latest release of this critically important app on the Qualys Cloud Platform. Although it now seems like a...

Vulnerability On-Demand Search Reporting & Easy Download options

Vulnerability reporting is different from any other aspect of a Vulnerability Management Program. The methodologies of Discover, Assess, Report and Remediate are critical components that should be included in the respective sections of a Vulnerability Report. Qualys VMDR Vulnerability Management...

Prioritize Remediation with a Perceived-Risk Approach to Strengthen CyberSecurity Effectiveness

Minimizing Time To Remediate TTR is becoming one of the key metrics of security program effectiveness. This holistic measure represents many capabilities and is a good validation of your risk mitigation capacity because it captures how quickly you can respond to the most critical vulnerabilities...

If You Think File Integrity Monitoring is Boring, Think Again

You’ll be hard pressed to find file integrity monitoring on any list of cool, emerging, cutting-edge cybersecurity technologies. But if you choose to ignore this mature, foundational technology, it’ll be at great risk. File integrity monitoring, or FIM, plays a key role in critical security and...

Implementing the CIS 20 Critical Security Controls: Make Your InfoSec Foundation Rock Solid

For almost 10 years, thousands of organizations eager to solidify their security and compliance foundations have found clarity and direction in the the Center for Internet Security’s Critical Security Controls CSCs. This structured set of 20 foundational InfoSec best practices, first published in...

Qualys Cloud Suite 8.10.2 New Features

This new patch release of the Qualys Cloud Suite, version 8.10.2, includes updates to shared platform features, a new role for user management, and expanded Policy Compliance platform support. Feature Highlights Qualys Cloud Platform Limit number of external scanners – You can now limit the numbe...

Qualys Introduces Real-Time Cloud Security Posture Management (CSPM) for Faster Risk Detection and Remediation

Key Takeaways Cloud environments change continuously, while security still relies on periodic scans, leaving gaps where risks go undetected. That gap becomes exposure. Qualys Real-Time CSPM monitors cloud changes as they happen, while still supporting periodic scans for environments that require...

3 Paths to Upgrade Windows 11 before 24H2 End of Servicing (EOL)

Key Takeaways Windows 11 24H2 reaches the end of servicing on October 13, 2026, making timely enterprise upgrades critical. Enterprises often face version drift, with multiple Windows 11 builds across endpoints requiring different upgrade paths. Upgrade approaches vary based on system state and m...

Microsoft and Adobe Patch Tuesday, June 2026 Security Update Review

Every Patch Tuesday presents a race between defenders applying fixes and attackers seeking opportunities. Microsoft’s June 2026 release is no exception, delivering security updates for vulnerabilities that could significantly impact enterprise environments if left unaddressed. Microsoft Patch...

The New Era of Application Security: Reasoning-Based Agents, Runtime Reality, and Risk Intelligence

Key Takeaways AI reasoning systems improve vulnerability detection in source code, but do not address the full spectrum of application security risk. Modern application security must account for APIs, runtime environments, and externally exposed assets beyond the source repository. Continuous...

New: AI-Powered Patch Reliability Scoring—Predict Patch Impact Before You Deploy

What do advisory USN-7545-1 and Windows updates KB5065426 , KB5063878 , KB5055523 , and KB5066835 have in common? Based on anonymized Qualys telemetry from 2025, they were among the most frequently rolled-back patches , in other words, patches that had to be undone after deployment. Rollbacks...