blog.qualys

The Real Jump Scare Isn’t the Attacker; It’s The Vulnerabilities You’re Focusing On

Teams are remediating more than ever, but exposure from the vulnerabilities that matter is still rising faster than they can keep up with. Mean time to exploitation is about −7 days. Mean time to ...
blog.qualys

Lessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate

How reliability scoring keeps risky patches out of zero-touch jobs, and how one blocking rule stops a paused update across your environment. Microsoft has paused the rollout of KB5002907, an optional ...
blog.qualys

Two Critical PHP Flaws Could Hand Attackers Your Web Servers. Here’s How to Find, Mitigate, and Patch PHP2Shell Now

PHP2Shell is two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) that can allow unauthenticated remote code execution on PHP installations serving web requests.
blog.qualys

Secure Your Mission-Critical Application Estate: Qualys TotalAppSec is Now FedRAMP High Authorized (FedRAMP Certified Class D)

TotalAppSec is FedRAMP High authorized on the Qualys Government Platform. Discover apps and APIs, cover 99.2% of CISA KEV, and produce ATO evidence.
blog.qualys

The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches

A developer updates a dependency. The build passes. Soon after, cloud defenders see unfamiliar API calls made with valid credentials. The breach did not begin in the customer-facing application or ...
blog.qualys

Autonomous Remediation Is Already Running at Enterprise Scale

The following is a guest blog by ITSPmagazine, based on their interview of Qualys President & CEO Sumedh Thakar at Black Hat USA 2026. Sumedh Thakar has watched the same clock compress for 23 years.