This Week's Highlights — issue 010, September 4, 2026
THE CYBER TOOLCHAIN
NO. 010
The best tooling updates that shipped this week.
The week in numbers · Aug 28–Sep 3
Changes per week, last 12 weeks · Aug 28–Sep 3
Changes we read in that week's dailies, including docs and API changes. A gap means no daily was published.
Every feature release from the 1309 tools on our watchlist goes into the daily newsletter. Once a week we read the whole field side by side and choose our top picks, judged on two questions: how deep and complete is the single best capability in the release, and how much it changes what you can actually do.
A tool is judged on everything it shipped that week, so a project that releases daily gets credit for the sum — and still only takes one slot. We would rather run a short list than a padded one.
Focus: What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out: Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus: New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out: Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus: Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out: Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus: API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out: Governance, SOC operations, and vendor launches with no developer surface.
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
The picks in full
Cycode’s Agentic Development Security Platform unites security and development teams with actionable, code-to-runtime context to identify, prioritize, and fix the software risk that matters.
Agentic Code Scanning adds an agent layer that plans from a threat model and disproves findings before surfacing them, catching logic-level flaws like broken access control that rule engines structurally cannot express — it flagged real authorization CVEs (gitea CVE-2025-68941, next.js CVE-2025-29927) that Semgrep OSS, CodeQL, and Cycode's own rule engine all missed. Confirmed findings that generalize are auto-promoted into deterministic SAST rules so a class caught once re-runs at near-zero cost.
Cycode introduces Agentic Code Scanning, a fourth scanning dimension that uses agent orchestration to catch authorization and logic-level vulnerabilities rule engines structurally can't express, backed by per-scan tuning, attack-chain synthesis grounded in its Context Intelligence GraphIntelligence GraphA graph database structure linking entities such as hosts, IPs, domains, and threat actors by relationship, letting cyber tools traverse connections to surface context that flat tables cannot express., automated remediation workflows, and a self-improving rule flywheel.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Agentic Workflows consume exploitability-qualified findings and automate remediation: teams define triggering events, agent action sequences, and confidence thresholds once, and the workflow fires automatically — routing findings to the owning engineer and returning fixes as reviewable pull requests with a full audit trail.
An agent-orchestrated layer that plans from a threat model, ranks code by vulnerability class, and disproves every finding before surfacing it, running above the three existing deterministic/AI scanning tiers. This enables detection of logic-level flaws like broken access control that have no matchable pattern for rule engines. Across a ten-repository, six-language benchmark using an affordable open-weights reasoning model, it detected authorization CVEs gitea CVE-2025-68941 and next.js CVE-2025-29927 that Semgrep OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees., CodeQL, and Cycode's own rule engine all missed.
Cycode links related findings across files into a single multi-step exploit path, carrying data flow from untrusted source to dangerous sink and tagging the resulting risk category (e.g. Code Injection — Critical). Attack chains are grounded in Cycode's Context Intelligence Graph, using real call relationships, ownership, and reachability rather than speculative model inference.
Teams can configure three independent dials per scan — mode, model, and scope — to target expensive agentic reasoning only at code classes that rules cannot describe, while keeping deterministic scanning on every commit. Every scan records what ran, when, on which code, and with which model, for auditability.
Agentic Code Scanning findings that generalize are automatically converted into new deterministic SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. rules (Dimension 1/2), so a vulnerability class caught once by the model re-runs at near-zero cost indefinitely, compounding coverage as repository count grows.
Horizon3 NodeZero is an autonomous penetration testing platform that continuously finds and exploits real attack paths in your environment to identify and prioritize critical vulnerabilities.
Adds autonomous WebApp and Azure Cloud pentest op types—crawling and testing authenticated production/staging web apps and assessing Azure control planes plus VM workloads in a single assumed-breach run with proof-based findings, extending autonomous exploitation into two attack surfaces it could not reach before.
NodeZero expanded its assessment surface with new WebApp and Azure Cloud pentest op types, an Azure Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. AD Password Audit, Australian data residency, and enhanced Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments./Identity and op-tracking capabilities.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
New Azure Cloud Pentest op type assesses Azure control planes and VM workloads in a single assumed-breach assessment, combining Azure API enumeration with an Internal pentest. It lets practitioners set up an Azure connection, run cloud pentests, manage connections, and perform manual cleanup, launched via Launch Op > Azure Cloud Pentest with Azure credentials/scope and a combined Azure API + Internal pentest assessment mode.
New WebApp pentest op type crawls, discovers, and tests production, staging, and private web applications with authenticated workflows, automated route discovery, and proof-based findings. It is launched via Launch Op > WebApp Pentest by entering a target URL and configuring authenticated workflow credentials.
New AD Password Audit feature audits Active Directory passwords within Azure Entra ID to identify weak or compromised credentials, accessed via Azure Entra ID > AD Password Audit by connecting an Azure tenant and launching the audit.
The Action Log now extends from Real-Time View into post-op results, and both the Real-Time and post-op views gain a dedicated Artifacts tab to deconflict NodeZero activity from malicious attacks.
AD & Identity assessments gain a new dedicated Identity Details view, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket extraction during credential dumping, and safer authentication workflows.
Platform traffic and pentest data can now be kept within the Australian region for data-sovereignty compliance.
Endor Labs is a software supply chain security platform that detects vulnerabilities and malicious dependencies in open source code.
Package Firewall intercepts every package install request and returns a 403 for malicious, vulnerable, or non-compliant packages before they touch disk, backed by a real-time malware feed scanning new npm, PyPI, and Go uploads within minutes and cooldown enforcement on fresh versions.
Endor Labs launched Package Firewall, a new enforcement layer that blocks malicious, vulnerable, and non-compliant packages before they reach disk, backed by a real-time malware feed, policy engine integration, flexible deployment modes, cooldown enforcement, and full install logging.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Package Firewall integrates with private artifact managers such as JFrog Artifactory by pointing a remote repository at the Package Firewall URL with no developer-machine changes, and supports an Endpoint Mode where configuration is pushed to developer machines via MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. and to CI runners via a config snippet, requiring no manual developer action.
Package Firewall intercepts every package install request and returns a 403 for flagged packages — the package never touches disk — while clean packages are redirected transparently to the upstream registry.
A real-time malware feed continuously scans every newly uploaded package across npm, PyPI, Go, and other ecosystems using multi-pass LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., static, and behavioral analysis, classifying packages within minutes of upload.
Package Firewall enforces cooldown periods, blocking newly published package versions for a configurable window regardless of requester, addressable at scale via policy.
Every install event — package name, version, time, and reason — is logged and visible in the Endor Labs UI and via the API.
Package Firewall enforces the full Endor Labs policy engine at install time, blocking packages with known CVEs or that violate license compliance policies, beyond malware detection alone.
Free Active Directory pentesting tool for Linux. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin.
Attack paths now cross domain and forest boundaries as a unified graph—cross-forest Kerberoasting, AS-REP Roasting, and ADCS ESC8/ESC11 relay routes across trusts—plus automated cross-forest escalation and a minimal-footprint krbtgt-only DCSync mode for proving full domain compromise.
ADscan v11.3.0 adds a built-in didactic/teaching mode for techniques, seasonal password sprayingpassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., a minimal-footprint krbtgt-only DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers. mode, cross-forest attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis with automated escalation routes, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory.-attribute credential harvesting as a validated attack step, and independently-verifiable evidence blocks in reports.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds set explain_level off|basic|deep to control teaching verbosity, and explain <technique> (e.g. explain kerberoasting, explain "ADCS ESC1") to display a teaching card — MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. ID, the equivalent manual command, and detection Event IDs — for any technique without actually executing it.
$ explain kerberoasting
Adds a month_season spray strategy to the scan config for seasonal password spraying (e.g. March2026, Verano2026), with per-domain language inference (English/Spanish) and last-password-change awareness when domain credentials are available; runs automatically in adscan ci.
$ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'
Reports and the web platform now include a Verify this finding independently block per attack step with native Windows/PowerShell (Get-ADUser, Get-Acl, dsacls, certutil) and Linux equivalents pre-filled with the real DC IP and domain name, covering Kerberoasting, AS-REP RoastingAS-REP RoastingAn attack against Kerberos accounts that do not require pre-authentication. An attacker obtains an encrypted authentication response and tries to crack the account's password offline., DCSync, ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC1, and the GenericAll/GenericWrite/WriteDACL/WriteOwner ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. family.
Attack pathsAttack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. now cross domain and forest boundaries in multi-domain workspaces, analysed as a unified graph, including cross-forest Kerberoasting, AS-REP Roasting, and ADCS ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account./ESC11 relay routes across trusts.
Automated cross-forest escalation now ships two routes: from a compromised trusted forest into the trusting forest via cross-organization TGT-delegation trust, and from a compromised child domain up to its forest root (RaiseChild), each triggering post-compromise on the reached domain.
Plaintext credentials in account description or info LDAP attributes are now a validated, end-to-end attack step — ADscan reads the attribute, recovers the credential, verifies login, and traces the route across forest boundaries.
DCSync now supports a krbtgt only replication mode, capturing the golden-ticket key without pulling every account — a minimal-footprint way to prove full domain compromise.
Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.
Binary Ninja 6.0 ships a first-party MCP server and a Binary Similarity diffing platform (Google BinDiff and WARP providers) with automatic annotation transfer between related binaries, plus TMS320C6x DSP support and up to 2.16x faster analysis at 55% less peak memory.
Binary Ninja 6.0 (Krypton) adds a first-party MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. client integration, a new Binary Similarity diffing platform for Ultimate, TMS320C6xTMS320C6xA family of fixed- and floating-point DSPs from Texas Instruments, designed for high-throughput signal processing; cyber tools use it for hardware-accelerated packet inspection or signal analysis at the edge. architecture support, and up to 2.16× faster analysis with lower memory use.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Binary Ninja ships a built-in GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. MCP server, enabled via the ui.mcp.enabled setting (restart required) or Plugins > MCP > Start Server, listening by default at http://127.0.0.1:24642/mcp. Access can be locked down with the ui.mcp.token setting requiring clients to send a matching bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else., and Plugins > MCP > Copy Connection Info copies the exact URL and authorization header for the active session. A standalone binaryninja_mcp headless stdio-based MCP server binary is also shipped for Commercial and Ultimate on macOS and Linux.
ui.mcp.enabled, and set it to true, then restart. Navigate to Plugins › MCP › Copy Connection Info to copy the URL and bearer token for your client config.ui.mcp.token and set it to a strong secret string. Clients must then include a matching Authorization: Bearer <token> header when connecting to http://127.0.0.1:24642/mcp.A new Binary Similarity feature (Ultimate only) compares related binaries using pluggable providers, shipping with Google BinDiff and WARP providers, and automatically transfers annotations between binaries. It is exposed through Python, C++, and Rust APIs, enabling headless similarity sessions and registration of custom providers and resolvers.
The calling convention system was refactored to properly represent structure parameters and return values, with new Go and Pascal calling conventions added.
Introduces a new BASE sampling mode, enabled by default, for faster automated base address detection especially on large files; the previous IL Analysis Mode remains available when higher accuracy is needed.
Analysis runs up to 2.16× faster and uses up to 55% less peak memory versus version 5.3 across representative binaries.
Binary Ninja now supports multiple independent global pointer registers per architecture, such as TriCore's four global data region pointers, improving decompilation accuracy for such targets.
Adds HLIL_STRUCT_INITIALIZE IL operation for representing structure initializers in HLIL.
The free edition adds AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. (ARMv8) architecture support and the MCP server, plus a new Linux ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. package.
Adds TMS320C6x (DSP) architecture support, bringing Binary Ninja Ultimate to 19 first-party architectures.
Replaces the Plugin Manager with a new Extension Manager UI.
Upgrades the bundled Python to 3.13, now also included on Linux.
Adds a new user wizard to ease migration for new and upgrading users.
Where each pick stands · Aug 28–Sep 3
Tools with changes in each pick's category over the last 12 weeks, including the pick itself.
Each pick's release rhythm · Aug 28–Sep 3
Changes per week for the last 12 weeks. The bright bar is this week; a dash marks a week with no daily.
Which categories moved · Aug 28–Sep 3
The thick bar is this week. The thin bar is the average of the four weeks before, counting only weeks with a daily.
Who shipped the most · Aug 28–Sep 3
Changes per tool this week. Volume is not a quality score.