Qualys

No entries match these filters. Clear filters

1. changelog Oct 21, 2026 · issue 117
   • New vulnerability check PHP2Shell detection via QID 45110 and TruConfirm exploit validation
2. Secure Your Mission-Critical Application Estate: Qualys TotalAppSec is Now FedRAMP High Authorized (FedRAMP Certified Class D) (2026-10-05) Oct 5, 2026 · release notes

   Qualys TotalAppSec gains FedRAMP HighFedRAMP HighA US federal authorization tier for cloud services, managed by GSA, certifying that a provider meets the strictest NIST 800-53 controls required to handle the most sensitive unclassified government data. authorization on Qualys Government Platform Class D for secure federal deployment.

   • TotalAppSec is now authorized to run inside the FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. High boundary on the Qualys Government Platform (FedRAMP Certified Class D, package FR2231052341).

   1 detail in Everything

3. Lessons from Microsoft Patch KB5002907: Two Layers of Patch Control in Qualys TruRisk Eliminate (2026-09-29) Sep 29, 2026 · release notes

   Qualys TruRisk Eliminate adds AI-Powered Patch Reliability Scoring and new Patch Blocking Rules capability.

   └──▷ HOW TO FIND IT
   Verify the reliability scores of recent problematic Microsoft updates before automating their deployment.
   📍To check this year’s updates, go to Patches › Windows and run: patch.kb: [KB5074109, KB5079473, KB5079391, KB5124008, KB5124012, KB5123099, KB5002907]
   Globally block a faulty patch from deploying in zero-touch jobs by defining a single rule.
   📍Go to TE › Configuration › Patch Blocking Rules, select Windows, click Create Rule, enter patch.kb: [KB5002907] under Criteria (QQL), and click Preview.
   • Adds AI-Powered Patch Reliability Score (High, Medium, Low, or Unidentified) to predict deployment outcomes for zero-touch patch jobs
   • Introduces new Patch Blocking Rules in TruRisk Eliminate to stop faulty patches from deploying across all jobs via a single rule

   2 details in Everything

4. changelog Sep 17, 2026 · issue 078

   Qualys adds AI-Powered Policy Creation, Audit Insights continuous monitoring, and Audit Fix automated remediation to Policy Audit⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds AI-Powered Policy Creation for Policy Audit, enabling teams to upload frameworks, benchmarks, vendor guidance, or internal policies and use AI assistance to map controls to policy logic, assessment criteria, and expected values — with human review and approval before publication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Audit Insights to continuously monitor controls, detect compliance drift, and automatically collect evidence throughout the year instead of at point-in-time assessments.
   • Introduces Audit Fix to streamline correction of compliance findings through pre-built remediation content and automated workflows, validating that fixes remain in place over time.
   • Adds risk-based prioritization to Policy Audit findings by incorporating asset criticality, threat exposure, business context, ransomware relevance, and security risk indicators.
   • Adds AI-Powered Policy Creation for Policy Audit, enabling teams to upload frameworks, benchmarks, vendor guidance, or internal policies and use AI assistance to map controls to policy logic, assessment criteria, and expected values — with human review and approval before publication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Audit Insights to continuously monitor controls, detect compliance drift, and automatically collect evidence throughout the year instead of at point-in-time assessments.
   • Introduces Audit Fix to streamline correction of compliance findings through pre-built remediation content and automated workflows, validating that fixes remain in place over time.

   1 more in Everything

5. changelog Sep 17, 2026 · issue 012

   Qualys adds AI-Powered Policy Creation, Audit Insights continuous monitoring, and Audit Fix automated remediation to Policy Audit⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds AI-Powered Policy Creation for Policy Audit, enabling teams to upload frameworks, benchmarks, vendor guidance, or internal policies and use AI assistance to map controls to policy logic, assessment criteria, and expected values — with human review and approval before publication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Audit Insights to continuously monitor controls, detect compliance drift, and automatically collect evidence throughout the year instead of at point-in-time assessments.
   • Introduces Audit Fix to streamline correction of compliance findings through pre-built remediation content and automated workflows, validating that fixes remain in place over time.
   • Adds risk-based prioritization to Policy Audit findings by incorporating asset criticality, threat exposure, business context, ransomware relevance, and security risk indicators.
   • Adds AI-Powered Policy Creation for Policy Audit, enabling teams to upload frameworks, benchmarks, vendor guidance, or internal policies and use AI assistance to map controls to policy logic, assessment criteria, and expected values — with human review and approval before publication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces Audit Insights to continuously monitor controls, detect compliance drift, and automatically collect evidence throughout the year instead of at point-in-time assessments.
   • Introduces Audit Fix to streamline correction of compliance findings through pre-built remediation content and automated workflows, validating that fixes remain in place over time.

   1 more in Everything

6. The End of Point-in-Time Compliance: Why Continuous Audit Readiness Matters to You in the AI Era (2026-09-17) Sep 17, 2026 · release notes

   Qualys introduces AI-Powered Policy Creation for Policy Audit, continuous monitoring via Audit Insights, and automated remediation with Audit Fix.

   └──▷ HOW TO FIND IT
   Use AI to translate internal policies or benchmarks into actionable technical controls within Policy Audit, while keeping human oversight for validation.
   📍In the console, go to Policy Audit › Policy Creation and use the AI-Powered option to upload a framework or internal policy.
   Leverage Audit Insights to continuously monitor controls and collect evidence automatically, avoiding manual pre-audit scrambles.
   📍In the console, navigate to Policy Audit › Audit Insights to enable continuous monitoring and view real-time compliance status.
   Use Audit Fix with pre-built remediation content to automatically correct specific compliance findings and validate the outcome.
   📍In the console, go to Policy Audit › Audit Fix, select a finding, and run the recommended automated remediation workflow.
   • Introduces AI-Powered Policy Creation in Policy Audit to map frameworks to controls using AI assistance
   • Adds Audit Insights to Policy Audit for continuous compliance monitoring and automatic evidence collection
   • Integrates risk context (asset criticality, threat exposure) into Policy Audit for risk-informed prioritization of findings

   3 details in Everything

7. changelog Sep 15, 2026 · issue 076

   Qualys TruRisk Eliminate adds AI-powered Patch Reliability Scoring and automated host isolation via Cloud Agent for overdue CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Check patch reliability before deploying a Patch Tuesday update — filter to specific KBs in the Patch Management app to see whether Qualys rated them Low or High reliability before pushing to production.
   📍In the Patch Management application, go to Patches › Windows and enter the QQL query: patch.kb: [KB5124008 , KB5124012] — then click Patch Reliability: Low on any result to open the AI Assessment window and review known issues and source links via Detailed Report.
   Automatically isolate any host where a CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. remediation deadline has passed and the vulnerability is still open, preventing exploitation while patching continues.
   copy

   $ vulnerabilities.status:[ACTIVE,NEW,REOPENED] AND vulnerabilities.riskFactor.cisaKEVDueDate < "now-1s" AND vulnerabilities.riskFactor.cisaKnownExploits:TRUE

   • Adds patch.kb QQL filter in the Patch Management app (Patches > Windows) to surface Patch Reliability assessments for specific KBs, with Patch Reliability: Low drill-down opening an AI Assessment window showing known issues and source links via Detailed Report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds AI-Powered Patch Reliability Scoring in TruRisk Eliminate that combines LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-analyzed public sentiment with Qualys telemetry on patch rollback and vulnerability reopen rates to produce a pre-deployment reliability score (Low / High) for each patch.
   • Adds automated host isolation in TruRisk Eliminate, triggered natively through the Qualys Cloud Agent when a user-defined QQL policy is met — no EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. integration required — quarantining the host within seconds and writing a timestamped audit record of which rule, host, and deadline triggered the action.
   • Adds a CISA KEV isolation QQL use case using vulnerabilities.status:[ACTIVE,NEW,REOPENED], vulnerabilities.riskFactor.cisaKEVDueDate < 'now-1s', and vulnerabilities.riskFactor.cisaKnownExploits:TRUE to automatically isolate hosts where a KEV deadline has passed and the vulnerability remains open.
   • Supports ring-based phased deployment in TruRisk Eliminate Patch Management, allowing low-reliability patches to be progressively validated through Test → Staging → Production environments before broader rollout.

   5 details in Everything

8. changelog Sep 15, 2026 · issue 012

   Qualys TruRisk Eliminate adds AI-powered Patch Reliability Scoring and automated host isolation via Cloud Agent for overdue CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Check patch reliability before deploying a Patch Tuesday update — filter to specific KBs in the Patch Management app to see whether Qualys rated them Low or High reliability before pushing to production.
   📍In the Patch Management application, go to Patches › Windows and enter the QQL query: patch.kb: [KB5124008 , KB5124012] — then click Patch Reliability: Low on any result to open the AI Assessment window and review known issues and source links via Detailed Report.
   Automatically isolate any host where a CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. remediation deadline has passed and the vulnerability is still open, preventing exploitation while patching continues.
   copy

   $ vulnerabilities.status:[ACTIVE,NEW,REOPENED] AND vulnerabilities.riskFactor.cisaKEVDueDate < "now-1s" AND vulnerabilities.riskFactor.cisaKnownExploits:TRUE

   • Adds patch.kb QQL filter in the Patch Management app (Patches > Windows) to surface Patch Reliability assessments for specific KBs, with Patch Reliability: Low drill-down opening an AI Assessment window showing known issues and source links via Detailed Report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds AI-Powered Patch Reliability Scoring in TruRisk Eliminate that combines LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-analyzed public sentiment with Qualys telemetry on patch rollback and vulnerability reopen rates to produce a pre-deployment reliability score (Low / High) for each patch.
   • Adds automated host isolation in TruRisk Eliminate, triggered natively through the Qualys Cloud Agent when a user-defined QQL policy is met — no EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. integration required — quarantining the host within seconds and writing a timestamped audit record of which rule, host, and deadline triggered the action.
   • Adds a CISA KEV isolation QQL use case using vulnerabilities.status:[ACTIVE,NEW,REOPENED], vulnerabilities.riskFactor.cisaKEVDueDate < 'now-1s', and vulnerabilities.riskFactor.cisaKnownExploits:TRUE to automatically isolate hosts where a KEV deadline has passed and the vulnerability remains open.
   • Supports ring-based phased deployment in TruRisk Eliminate Patch Management, allowing low-reliability patches to be progressively validated through Test → Staging → Production environments before broader rollout.

   5 details in Everything

9. Automate Asset Isolation: Your Last Resort to Meet Remediation Deadlines (2026-09-15) Sep 15, 2026 · release notes

   Qualys Automate Asset Isolation enables automatic host quarantine via TruRisk Eliminate upon remediation deadline breach.

   └──▷ USE IT
   Configure a policy to isolate hosts when CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. vulnerabilities remain unpatched 1 second past the due date.
   text copy

   vulnerabilities.status:[ACTIVE,NEW,REOPENED] AND vulnerabilities.riskFactor.cisaKEVDueDate < "now-1s" AND vulnerabilities.riskFactor.cisaKnownExploits:TRUE

   • Adds automated asset isolation to TruRisk Eliminate, quarantining hosts automatically when defined policies are met
   • Enables QQL query criteria vulnerabilities.status:[ACTIVE,NEW,REOPENED] AND vulnerabilities.riskFactor.cisaKEVDueDate < "now-1s" AND vulnerabilities.riskFactor.cisaKnownExploits:TRUE to trigger isolation for CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. vulnerabilities after the due date passes
   • Executes isolation natively through the Qualys Cloud Agent without requiring an EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. integration

   3 details in Everything

10. changelog Jul 22, 2026 · issue 023

    Qualys releases QID coverage for CVE-2026-64600 (RefluXFS), a critical XFS kernel privilege-escalation vulnerability affecting RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence., Oracle Linux, Amazon Linux, and Fedora.

    └──▷ HOW TO FIND IT
    Identify Linux systems running an unpatched kernel version exposed to RefluXFS (CVE-2026-64600) across your asset inventory.
    📍In the Qualys console, go to Vulnerabilities › Search and query for QID 387841 to surface hosts vulnerable to the RefluXFS XFS reflink race condition, then prioritize patching for internet-facing and multi-tenant systems.
    Determine the active kernel version on scanned Linux hosts to assess whether a patched kernel has been applied and rebooted into.
    📍In the Qualys console, go to Vulnerabilities › Search and query for QID 45097 to view the Linux kernel version active at scan time, confirming whether vendor-fixed kernels (per RHSA-2026:39179, ELSA-2026-39494, FEDORA-2026-085c9e92a4, etc.) have taken effect after reboot.
    • New QID 387841 detects the RefluXFS local privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. (CVE-2026-64600) via XFS reflink direct-I/O race condition.
    • New QID coverage added across VULNSIGS-2.6.651-2 through 2.6.656-2 for vendor kernel advisories on RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora addressing CVE-2026-64600.
    • Existing QID 45097 (Linux Kernel Version Running) can be used to identify the active kernel version and assess exposure to RefluXFS across Linux endpoints.

    3 details in Everything