Google this week changed how it publicly discloses vulnerabilities in a bid to give defenders early details about new software defects it discovers, shortening the early window of time between a vendor releasing a patch and customers installing the security update.

Project Zero, Google’s squad of security researchers who find and study zero-day vulnerabilities, will now publicly share when it discovers a vulnerability within one week of reporting that defect to the vendor. Google said these reports will include the affected product and name of the vendor or open-source project responsible for the software or hardware, the date the report was filed and when the 90-day disclosure deadline expires. 

Google’s new trial policy addresses a nagging, persistent challenge in vulnerability management, spanning from discovery to disclosure and patch release to adoption. Tim Willis, head of Project Zero, described this delay as the “upstream patch gap,” in a blog post announcing the change.

“This is the period when an upstream vendor has a fix available, but downstream dependents, who are ultimately responsible for shipping fixes to users, haven’t yet integrated it into their end product,” Willis said. “We’ve observed that this upstream gap significantly extends the vulnerability lifecycle.”

Google insists the policy change will not help attackers, yet may put additional public pressure and attention on unfixed defects. Google hopes this will encourage stronger communication between upstream vendors and downstream customers or dependents, resulting in faster patch development and increased patch adoption, Willis said.

“This data will make it easier for researchers and the public to track how long it takes for a fix to travel from the initial report, all the way to a user’s device,” he said in the blog post.

Project Zero will continue to adhere to a 90+30 disclosure deadline policy that gives vendors 90 days to fix a defect before public disclosure, and 30 days for customers to install the patch. When a vendor addresses a vulnerability before 90 days pass, the 30-day deadline for customers to patch kicks in. If a vendor doesn’t release a patch within 90 days, Project Zero makes details about the vulnerability public.

Early reports of discovered vulnerabilities will not include technical details, proof-of-concept code or information Google believes would help attackers discover the defect until the deadline. Willis described the policy as “an alert, not a blueprint for attackers.”

Zero-day defects are an unyielding problem for defenders, posing a steady risk to enterprise systems and critical infrastructure. Google Threat Intelligence Group tracked 75 zero-day vulnerabilities exploited in the wild last year, noting that zero-day exploitation is targeting a greater number and wider variety of technologies. 

Three of the four most-exploited vulnerabilities in 2024, all of which were contained in edge devices, were initially exploited as zero-days, Mandiant said in its annual M-Trends report released in April.

Project Zero researchers will monitor the effects of this change to when it publicly discloses newly discovered vulnerabilities. “We hope it achieves our ultimate goal,” Willis said, engendering “a safer ecosystem where vulnerabilities are remediated not just in an upstream code repository, but on the devices, systems and services that people use every day.”

The post Project Zero disclosure policy change puts vendors on early notice appeared first on CyberScoop.

from CyberScoop https://ift.tt/pIMWfDc
via IFTTT

Palo Alto Networks has agreed to acquire identity security firm CyberArk for approximately $25 billion, marking the cybersecurity giant’s largest acquisition and its formal entry into the identity security market as the industry continues consolidating amid rising cyber threats.

The transaction ranks among the largest technology acquisitions this year and underscores the market’s focus on identity security in an era of increasing artificial intelligence adoption.

CyberArk, founded over two decades ago, specializes in privileged access management technology that helps organizations control and monitor access to critical systems and accounts. The company’s customers include major corporations such as Carnival Corp., Panasonic, and Aflac. Its technology addresses what security experts consider one of the most vulnerable aspects of enterprise security: managing privileged credentials for both human users and machine identities.

The acquisition comes as cybersecurity companies face pressure to offer comprehensive solutions rather than point products, with customers seeking to streamline their vendor relationships following high-profile breaches. Recent cyberattacks, including Microsoft’s SharePoint vulnerabilities that affected over 100 organizations including U.S. government agencies, have heightened focus on identity protection and privileged access management.

For Palo Alto Networks, the acquisition represents a strategic expansion beyond its traditional network security roots. The company has evolved from a next-generation firewall provider into a multi-platform cybersecurity leader, and identity security represents what CEO Nikesh Arora describes as an inflection point in the market.

“The rise of AI and the explosion of machine identities have made it clear that the future of security must be built on the vision that every identity requires the right level of privilege controls,” Arora stated in a release.

The timing reflects broader industry dynamics driven by artificial intelligence adoption. As organizations deploy autonomous AI agents and systems, these technologies require sophisticated privileged access controls similar to human users, but at machine scale. The combined companies position themselves to address what they term “agentic AI” security, applying just-in-time access and least privilege principles to AI systems.

Industry analysts view the acquisition as addressing a gap in Palo Alto Networks’ portfolio while potentially accelerating growth in areas where the company has seen some deceleration. 

“Over the past several years, Palo Alto Networks has been on a mission to become a huge platform player in the security market,” said Allie Mellen, a principal analyst with Forrester. “Given its product portfolio as it stands today, identity security capabilities are a missing piece of that puzzle. This acquisition rounds out its approach, given its existing cloud, network, and endpoint security products.” 

The transaction follows other major cybersecurity consolidations, including Google’s $32 billion acquisition of Israeli startup Wiz earlier this year. This consolidation trend reflects customer preferences for integrated security platforms over managing multiple specialized vendors, particularly as cyber threats have grown more sophisticated and frequent.

Both companies’ boards have unanimously approved the transaction, which remains subject to regulatory clearances and CyberArk shareholder approval. The deal is expected to close during the second half of Palo Alto Networks’ fiscal 2026.

The post Palo Alto Networks to acquire CyberArk for $25 billion appeared first on CyberScoop.

from CyberScoop https://ift.tt/NiALjIb
via IFTTT