Five nightly imports: five Tests, the same 16 Findings in each, and nothing marked Mitigated after the fix.

Reimport feeds one Test and compares each scan to the last. Gone means closed. Back means reopened.

Read the post: bit.ly/4yX77wy

1/ Most open source security tools are islands. DefectDojo Community Edition just got two official bridges, both free. 🧵

2/ The GitHub Action. Add one step after your scanner. It imports the report into DefectDojo and fails the build at the severity you pick.

uses: DefectDojo/defectdojo-action@v1

github.com/marketplace/ac…

3/ The MCP server. Ask Claude, Cursor or any MCP client about your findings. Read-only by default, scanner text marked as untrusted, no telemetry.

docker run -i --rm ghcr.io/defectdojo/def…

github.com/DefectDojo/def…

Awareness doesn't close a finding. A merged pull request does.

Sensei opens the pull request. Your team reviews and merges. 1,000 free fixes for everyone through Nov 30.

Sign up: bit.ly/4rQOqbW

🚀 DefectDojo v3.5.0 is out.

Organizations, Assets, and Findings can be archived instead of deleted. Sign-ins get an optional idle timeout. CrowdStrike Falcon now imports Identity Protection detections.

Full changelog: bit.ly/47VTUJu

Another day, another vulnerability. CVE-2026-111497 (Brotli2Shell) hides inside Node.js, .NET and Bun. Early Light now detects it. Sensei fixes it. 🧵

Early Light checks each binary for evidence of the fix instead of trusting the version it reports. Free and open source:

earlylight scan image --detector brotli your/app:latest

github.com/DefectDojo/ear…

Sensei fixes it in DefectDojo Pro 3.4.303. It moves Node.js, .NET and Bun pins, image tags and OS packages to fixed releases and verifies every change before the pull request.

Fight AI with AI before new vulns drop tomorrow.
defectdojo.com/blog/early-lig…

You don't need a circular saw to hang a shelf. You'll want one to frame a house.

Community Edition: 360+ parsers, free forever. Pro adds Upstream Connectors, risk-based prioritization, and the Triage Engine.

Read the post: bit.ly/47HzTWX

Cybersecurity Awareness Month ends this week. The budget squeeze on security teams doesn't.

1,000 free Sensei fixes for everyone through Nov 30. Connect a repo and review the pull requests Sensei opens.

Sign up: bit.ly/4rQOqbW

🚀 DefectDojo v3.4.300 is out.

Findings can be edited in place, without the Edit form. The notification inbox is generally available. Connectors can list unmanaged devices your EDR sees.

Full changelog: bit.ly/4kdvFOc

In June, FIRST forecast about 66,000 CVEs for all of 2026.

We passed it in September.

This is just the beginning. bit.ly/4BrW1C8

Last week: an eMudhra CA key that was the number 4, two RCEs in the PHP engine, and 600 new CVEs a day.

We're bringing Mythos-powered code analysis to market. Premium x2 and Enterprise customers get one free through Nov 13.

eMudhra and PHP2Shell: two major vulnerabilities in one day. One of them presented exposure for us. Today we're announcing Early Light, free and open source, so you can find them too 🧵

Detectors for eMudhra and PHP2Shell are both live. Scan images, hosts, servers and the images your repo deploys. SARIF goes straight into DefectDojo. BSD 3-Clause.

Our goal: the fastest detection in security every time a new vulnerability drops. For DefectDojo Pro, Sensei finds and fixes both as of 3.4.202. Next goal: a fix within 2 hours of a new vuln dropping. Fight AI with AI.
github.com/DefectDojo/ear…