The week in full · Aug 28–Sep 3

Identity & Access Management · 2026-09-03

Auth0 Organizations gain Cross App Access (XAA) resource application settings and third-party client access controls for Organization Admins.

• Adds third_party_client_access object to Organization connection settings, letting tenant admins control whether Organization Admins can enable third-party application access via the My Organization API — defaults to { "default_value": "block", "allowed_values": ["block"] }, meaning third-party access is locked until explicitly opened.
• Adds Cross App Access (XAA) Resource Application settings for connections, allowing Organization Admins to configure a connection as a XAA Resource Application through the My Organization API.
• Organization Admins can now configure User Access Authorization (Unauthorized, Authorized, or All) and Client Credential Access Authorization (Unauthorized, Authorized, or All) on connections.

Identity & Access Management · 2026-09-03

Auth0 Dashboard gets a redesigned sidebar and improved information architecture in Early Access opt-in.

• New Early Access opt-in redesigns the Auth0 Dashboard sidebar with improved information architecture, consistent breadcrumbs, and a modernized visual experience.

Identity & Access Management · 2026-09-03

Auth0 My Organization API and Embeddable UI Components now support self-service XAA and third-party app access configuration in Open Early Access.

• Adds self-service configuration of third-party application access for an Organization via the My Organization API and Embeddable UI Components, so Organization Admins can manage access without routing changes through the Auth0 Dashboard.
• Adds self-service configuration of third-party application access for a specific connection of an Organization through the My Organization API and Embeddable UI Components.
• Adds self-service configuration of the Cross App Access (XAA) Resource Application role for a connection via the My Organization API and Embeddable UI Components.

SAST / SCA / Code Security · 2026-09-03

Codacy adds Oxlint, a Rust-based JS/TS linter, as a fully integrated analysis engine with broad ESLint-compatible rule coverage.

• Adds Oxlint as a supported Codacy engine for JavaScript and TypeScript, covering correctness, style, and best-practice rule categories including ESLint core rules, typescript-eslint, React ecosystem (react, react-hooks, react-refresh, react-perf), @next/eslint-plugin-next, eslint-plugin-unicorn, testing frameworks (jest, vitest), eslint-plugin-vue, import, jsdoc, jsx-a11y, n (Node), and promise.
• Supports repository-level configuration via .oxlintrc.json, .oxlintrc.jsonc, oxlint.config.json, or oxlint.config.jsonc files, which Codacy will detect and apply automatically during analysis.

General Utilities & Libraries · 2026-09-03

VS Code agent skills gain a forked execution context mode, isolating skill instructions from the parent agent.

• Adds experimental forked skill context mode, which runs a skill in its own isolated context instead of inlining its instructions into the parent agent's context (the existing inline default behavior).

General Utilities & Libraries · 2026-09-03

code-oss gains support for nested AGENTS.md files scoped to subfolders within a workspace.

• Supports nested AGENTS.md files stored in subfolders, allowing custom instructions to be scoped to specific parts of a workspace rather than only the workspace root (experimental).

General Utilities & Libraries · 2026-09-03

code-oss adds experimental multi-root workspace support for Copilot and Claude agent sessions

• Adds chat.agentHost.copilotAgent.multiRootEnabled setting to enable experimental multi-root workspace support for Copilot agent sessions in the editor window.
• Adds chat.agentHost.claudeAgent.multiRootEnabled setting to enable experimental multi-root workspace support for Claude agent sessions in the editor window.
• Agent hooks remain scoped to a single workspace folder; when hooks exist in multiple folders, VS Code prompts the user to select the primary folder from which to load them.

General Utilities & Libraries · 2026-09-03

VS Code Agents window adds Agent Merge to autonomously resolve PR blockers and merge pull requests hands-free.

• New Agents window provides a dedicated VS Code interface for running and tracking multiple agent sessions in parallel across workspaces.
• Enables chat.agentMerge.enabled setting to activate Agent Merge, which monitors a PR and autonomously addresses unresolved review threads, failed required CI checks, branch conflicts, and merges or queues the PR when ready.
• Supports attaching folders, repositories, GitHub issues, and pull requests as context before sending the first prompt in an agent session.

IDS / IPS · 2026-09-03

CrowdSec v1.8.1 adds a HasValidChallengeCookie() helper for bot detection logic.

• Adds HasValidChallengeCookie() helper function for use in bot detection scenarios, enabling challenge cookie validation checks.

Endpoint Security (EDR/XDR) · 2026-09-03

CrowdStrike launches coordinated multi-agent SOC investigations, Charlotte AI AgentWorks for Claude, and GPT-5.6 Cyber on Falcon.

• New shared context layer (built on Enterprise Graph) gives all Charlotte AI domain agents a persistent, shared memory across every agent, investigation, and tenant — what one agent learns, all agents know, enabling coordinated parallel investigations.
• New Charlotte Agentic SOAR provides a single-governed automation workspace for multi-agent SOC workflows.
• New Charlotte AI AgentWorks lets security teams describe a desired security outcome in natural language and build, test, and refine custom agents grounded in Falcon telemetry — no coding required — then execute those agents directly from Anthropic Claude.

Security Data Pipeline · 2026-09-03

Falcon Onum gains Certified Data Pipelines that filter and detect threats in-stream before data lands.

• Adds Certified Data Pipelines, built on Falcon Onum streaming pipeline technology, that filter noise at ingestion so only relevant data reaches downstream agents.
• Runs detection inside the pipeline, enabling threats to be caught in-stream before ingested data is stored.

AI/LLM Security · 2026-09-03

CrowdStrike FAIRR Service adds GPT-5.6 Cyber to assess AI risk, analyze attack paths, and inform remediation priorities.

• New FAIRR Service applies GPT-5.6 Cyber within CrowdStrike's cyber harness to assess frontier AI risk, analyze attack paths, and inform remediation priorities — available for approved, authorized defensive use cases with expert oversight.

Web Application Security · 2026-09-03

DataDome CloudFront v3 splits URI exclusions and adds matrix-param and encoding checks by default

• Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable (new in v3) to hold static-asset extension exclusions separately, enabled by default with a standard extension list — previously these lived inside DATADOME_URI_REGEX_EXCLUSION.
• Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so DataDome strips matrix params (;) from URIs before regex evaluation, matching existing query-param (?) handling.
• Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) so DataDome inspects static-looking paths that contain encoded characters %23, %25, %2f, %3b, or %3f.

Digital Forensics & Incident Response · 2026-09-03

Elcomsoft Quick Triage 2.2 adds Timeline view, file system snapshots, a plugin architecture, MSA password attacks, and expanded full-text search.

• New Timeline view merges events from every timestamped artifact into a single chronology.
• New file system snapshot capability copies file system metadata without extracting file contents.
• New plugin architecture enables third-party and custom artifact parsers.

Digital Forensics & Incident Response · 2026-09-03

Elcomsoft Quick Triage 2.2 adds a merged event timeline, plugin architecture, and file system snapshot artifact.

• New timeline view merges events from different artifacts into a single chronology for cross-artifact investigation.
• New plugin architecture rebuilds artifact support, enabling extensible artifact collection.
• New file system snapshot artifact type available for collection and analysis.

Post-Exploitation · 2026-09-03

evil-winrm v4.1 adds a quit command, Ctrl+D exit support, keepalive for idle shells, and Ruby 3.3/4.0 compatibility.

• Adds quit command inside the shell as an explicit exit mechanism.
• Adds Ctrl+D support as an alternative way to exit the shell session.
• Adds keepalive to prevent Windows from disconnecting idle WinRM shells.

Endpoint Security (EDR/XDR) · 2026-09-03

Fleet 4.91.0 adds managed local Windows admin accounts, macOS/iOS/iPadOS latest OS pinning, per-fleet activity webhooks, Adobe plugin inventory, and 29 new iOS vitals.

• Adds s3_software_installers_signed_url configuration option to serve software installers, in-house apps, and bootstrap packages via GCS presigned URLs so clients download directly from object storage instead of routing through the Fleet server.
• Adds --bypass-end-user-auth flag to fleetctl package to generate fleetd installers that skip end-user authentication prompts on Linux and Windows hosts; requires fleetd v1.60.0 or higher.
• Adds per-fleet software inventory toggle via PATCH /api/v1/fleet/fleets/{id} with {"features": {"enable_software_inventory": <bool>}}; omitting the key leaves the stored value unchanged.

SAST / SCA / Code Security · 2026-09-03

GitHub Copilot enterprise-managed settings now support any default model, configurable per team via team-mappings.json

• Adds model key to enterprise-managed settings, configurable in team-mappings.json, to set a default Copilot model per enterprise team — with the key marked overridable to let teams choose their own preferred model.
• Supports a global enterprise default model for all Copilot users, with per-team overrides assignable based on team membership; non-mapped users inherit the enterprise default.
• Model defaults are now generally available across Copilot Business and Copilot Enterprise in the GitHub Copilot app, Copilot CLI, and Visual Studio Code.

SAST / SCA / Code Security · 2026-09-03

GitHub Copilot app and CLI now enforce content exclusion policies, blocking excluded files from agentic workflow context.

• Copilot app and Copilot CLI now respect content exclusion policies set by enterprise, organization, and repository administrators, preventing excluded files from being used as context in agentic workflows.

Reconnaissance & OSINT · 2026-09-03

Hunter now publishes an API — 10 endpoints across 5 areas: Finder, Enrichment, Account, …

• Finder (4 endpoints) — create, read
• Enrichment (3 endpoints) — read
• Account (1 endpoint) — read

Secrets Detection & Management · 2026-09-03

infisical now publishes an API — 2300 endpoints across 67 areas: App Connections, Secret Syncs, Secret Rotations, …

• App Connections (666 endpoints) — create, read, update, delete
• Secret Syncs (434 endpoints) — create, read, update, delete
• Secret Rotations (285 endpoints) — create, read, update, delete

SAST / SCA / Code Security · 2026-09-03

JFrog extends platform governance to agentic supply chains with new APM Registry, Plugins Registry, Skills Scanning, Agent Guard, and Zero-Touch Remediation.

• New APM Repository provides a governed registry for agent package installs, replacing open-internet pulls via apm install.
• New Plugins Registry delivers a scanned, auditable source for first- and third-party coding agent plugins, replacing default public marketplaces.
• New Skills Scanning uses semantic security scanning to detect malicious behavior in skill files and block them before they reach a developer's machine.

SAST / SCA / Code Security · 2026-09-03

JFrog swampUP 2026 unveils Zero-Touch Remediation, AI-powered policy-as-code, prompt-to-release traceability, and post-release governance.

• Introduces Zero-Touch Remediation via Compliant Version Replacement, which automatically swaps a vulnerable package version for a patched one mid-pipeline by evaluating multiple upstream sources (Chainguard, Maven Central, and others) against the customer's own policy, with JFrog Artifactory as the system of record.
• Introduces Agentic Remediation for first-party code, fixing vulnerabilities at the source level with a developer reviewing and approving before merge — distinct from Zero-Touch Remediation's fully automated mid-pipeline swap.
• Adds an AI-Powered Policy as Code Playground that converts plain-language intent into enforceable, versioned, Rego-based policy automatically, requiring no manual policy authoring.

Integrated & IT Risk Management · 2026-09-03

LogicGate Summer 2026 brings GRC Agents to GA, automated control testing, bulk record linking, lifecycle management, and four new integrations.

• GRC Agents are now generally available for four use cases: Third-Party Risk Management (TPRM), Enterprise Risk Management (ERM), AI Governance, and Business Continuity Management (BCM) — handling high-volume, repetitive workflow administration so risk teams can focus on proactive risk management.
• Automated Control Testing now tests linked evidence records automatically as they are submitted, delivering a pass/fail control-level evaluation with detailed rationale and immediate gap flagging instead of waiting for the next manual audit cycle.
• Bulk Record Linking applies the same semantic intelligence behind Record Linking Recommendations at scale, generating recommendations for hundreds of records simultaneously rather than one at a time.

SAST / SCA / Code Security · 2026-09-03

Noir v1.3.1 adds source line numbers for Rails/OpenAPI/Spring routes, cross-file $ref resolution, and protocol badges in plain output.

• The plain text report now shows the protocol (kafka, mqtt, amqp, …) and an [internal] badge, matching what structured formats (-f json, -f yaml, etc.) already displayed.
• Adds source line numbers for route declarations in Rails config/routes.rb, OpenAPI/Swagger operations, Symfony #[Route] attributes and routes.yaml, Vert.x, and Spring reactive RouterFunction routes — so findings point to the exact line.
• OpenAPI documents over 10 MB now get their own 64 MB parsing budget instead of being silently dropped.

General Utilities & Libraries · 2026-09-03

Obsidian 1.14.0 adds color highlights with emoji syntax, a kanban layout in Bases, and collapsible groups.

• Adds color highlights in the editor: prefix a highlight with a color emoji (,,,,) or pick a color from the new formatting submenu to change its color.
• Typing == in the editor now suggests highlight colors inline.
• Live Preview now shows an inline color swatch when the cursor overlaps a highlight; click it to change the highlight color.

General Utilities & Libraries · 2026-09-03

Obsidian Mobile 1.14.0 adds iOS 26 Native Quick Capture from Lock Screen, Control Center, and Shortcuts with Live Activity support

• New iOS 26 Native Quick Capture lets you capture notes from the Lock Screen, Control Center, or Shortcuts without waiting for your vault to load.
• Quick Capture supports configurable Create Locations — capture to a new note, today's daily note, a bookmarked note, or any chosen note.
• An active Quick Capture note surfaces as a Live Activity on the Lock Screen and Dynamic Island while editing.

Threat Intelligence · 2026-09-03

OpenCTI 7.260902.0 adds a merge-users capability with feature flag, API surface, and bypass enforcement.

• Adds merge-users feature with a feature flag, API surface, and bypass enforcement for user account consolidation.

Continuous Control Monitoring (CCM) · 2026-09-03

RegScale CLI 6.44.0 adds JCAM config validation via jcam check_config to catch misconfigured attribute mappings.

• Adds validation to jcam check_config that checks jcamAgencyDefinedDataItems mappings against attributes JCAM actually carries, reporting entries configured for attributes JCAM does not have and attributes JCAM has that are not mapped.

SAST / SCA / Code Security · 2026-09-03

Semgrep adds multi-webhook policy automations, read-only API tokens, is_partial_scan filter, and Agentic Workflows v2 endpoints.

• Adds is_partial_scan field to the public API response and request filter, indicating whether a scan ran only part of the rule set.
• Adds Agentic Workflows endpoints to the public v2 API reference.
• Adds Incident as a scan type option in the Details > Scans page scan type filter, alongside Full and Diff, for incident-scoped rule checks.

AI-Powered Offensive Security · 2026-09-03

Strix v1.6.1 adds GLM-5.3, Fable 5.1, and Gemini 3.7 Flash to the recommended model list, with openrouter/z-ai/glm-5.3 as the new top pick.

• Adds openrouter/z-ai/glm-5.3 as the new top recommended model, with GLM-5.3, Fable 5.1, and Gemini 3.7 Flash added to the recommended model list.
• MCP call errors no longer quarantine the connection, keeping MCP integrations live after transient failures.

AI-Powered Offensive Security · 2026-09-03

T3MP3ST adds social OSINT tools, headless-browser XSS probing, WAF-aware scanning, and Windows parity

• Adds username_search tool to the social_osint family: checks a username's existence across GitHub, GitLab, Reddit, Hacker News, Wikipedia, Steam, Keybase, VK, and Telegram using unauthenticated public surfaces — no API keys required (Sherlock-style).
• Adds telegram_lookup tool: resolves a @username via the Telegram Bot API getChat call, returning public info (name, description, type, member count); reads the TELEGRAM_BOT_TOKEN environment variable when present and degrades gracefully without it.
• Adds email_format tool: generates corporate email address candidates from a person's name and validates the domain's MX records via live DNS probe — no email sending.

Detection Engineering · 2026-09-03

Tenzir v6.15.0 adds HEC acknowledgement support, raw Avro decoding, and expanded parallel operator options

• New ack = true option on the accept_splunk operator enables the HEC acknowledgement protocol: clients receive an ackId per request, queryable via /services/collector/ack, with acknowledgements held for 10 minutes by default and delivery guarantees preserved across node crashes.
• New read_avro operator decodes streams of concatenated raw Apache Avro binary datums (not Avro Object Container Files), requiring the writer schema via the schema argument.
• New parse_avro function decodes a single raw Avro datum from each blob or string value, also requiring the writer schema via the schema argument.

Detection Engineering · 2026-09-03

Tenzir v6.15.0 adds Splunk HEC acknowledgements, read_avro/parse_avro, parallelized to_google_secops, and expanded parallel options.

• Adds to_google_secops parallelization with independent output instances for higher-throughput Google SecOps pipelines.
• parallel operator now accepts all parallelism options.
• Event branching is up to 9x faster.

Detection Engineering · 2026-09-03

Tenzir v6.15.0 adds Splunk HEC Acknowledgement support for reliable event delivery confirmation.

• Supports Splunk HEC Acknowledgements in the Tenzir Node, enabling reliable confirmation that events have been indexed by Splunk.

Detection Engineering · 2026-09-03

Tenzir v6.15.0 adds Splunk HEC acknowledgements, Avro decoding, and full parallelism options for to_google_secops

• Adds read_avro operator and parse_avro function to decode raw Avro data.
• Adds support for the Splunk HEC acknowledgement protocol, preserving delivery guarantees across node restarts.
• Extends parallel to accept all parallelism options, enabling finer-grained control over concurrent execution.

Endpoint Security (EDR/XDR) · 2026-09-03

Trend Vision One adds daily digest emails and admin controls for failed scheduled report notifications.

• Adds administrator controls to enable or disable scheduled report failure notifications via Administration > Notifications.
• Sends a daily failure digest email by default to the master administrator and report schedule creator whenever scheduled reports fail, including report name, report ID, schedule ID, failure time, and failure reason.
• Surfaces clear failure codes and descriptions, widget-level error details for PDF report failures, and configuration-specific guidance (such as reminders to verify required frameworks and asset groups) within failure notifications.

Secrets Detection & Management · 2026-09-03

TruffleHog v3.97.2 adds AWS Secrets Manager source, Weights & Biases V2 detector, GitHub token-type differentiation, and Jenkins enumeration.

• Adds SOURCE_TYPE_AWS_SECRETS_MANAGER source type, enabling TruffleHog to scan AWS Secrets Manager for leaked credentials.
• Adds token_type and remediation fields to ExtraData in the GitHub V2 detector, differentiating between PAT (ghp_, github_pat_), OAuth (gho_), and GitHub App (ghu_, ghs_, ghr_) token types so incident responders are directed to the correct revocation path.
• Adds a V2 detector for Weights & Biases (enabled via WeightsAndBiasesV2DetectorEnabled feature flag), expanding credential coverage for the ML platform.

Identity & Access Management · 2026-09-03

OpenAI's Advanced Account Security program mandates hardware-backed passkeys for Trusted Access for Cyber members; YubiKey bundle expands to 10 new countries.

• OpenAI's Advanced Account Security (AAS) program now requires hardware-backed passkeys for all Trusted Access for Cyber (TAC) members, disabling weaker phishable methods such as SMS OTPs and push notifications upon security key enrollment.
• Enrolling a YubiKey under the AAS program at chatgpt.com/advanced-account-security covers both ChatGPT and Codex accounts with hardware-backed passkey protection.
• The custom 2-pack OpenAI + YubiKey bundle expands to 10 new countries: Australia, Egypt, Japan, Malaysia, Mexico, Saudi Arabia, Singapore, South Korea, Taiwan, and the United Arab Emirates.

SAST / SCA / Code Security · 2026-09-03

ZeroPath launches a hosted remote MCP server at https://zeropath.com/mcp, letting AI tools query security findings via OAuth 2.1 with no install or API keys.

• New hosted MCP server at https://zeropath.com/mcp supports any MCP client using the Streamable HTTP transport (POST /mcp with a bearer token returning application/json); no local install or API key management required.
• Connect Claude Code via claude mcp add --transport http zeropath https://zeropath.com/mcp; a browser window opens for OAuth sign-in and approval on first use.
• Connect Claude desktop/web via Settings → Connectors → Add custom connector using https://zeropath.com/mcp.

SAST / SCA / Code Security · 2026-09-03

ZeroPath MCP now supports a hosted remote endpoint at https://zeropath.com/mcp via OAuth 2.1 alongside the existing local stdio server.

• Adds a hosted remote MCP endpoint at https://zeropath.com/mcp using OAuth 2.1 authentication over the Streamable HTTP transport — no installation required for clients like Claude and Cursor.
• Supports a local stdio transport mode running the open-source Python server with API-token credentials for scripted setups and self-managed credential environments.

SAST / SCA / Code Security · 2026-09-03

ZeroPath adds an AI AppSec Assistant with planning mode, patch submission state tracking, and auto-cancellation of stale PR scans.

• Adds an AI-powered AppSec Assistant (enabled per-repository) with a chat interface for asking security questions and requesting automated actions on findings.
• Adds Planning Mode for the AppSec Assistant: before executing complex or irreversible actions (such as opening pull requests or bulk-updating findings), the assistant proposes a reviewable plan listing Steps, Risks, and scope, and does not proceed until you approve.
• Adds a Plan first toggle on any assistant message to force a plan regardless of task complexity.

SAST / SCA / Code Security · 2026-09-03

ZeroPath adds Bitbucket Access Sync, cross-VCS permission mapping editor, and Jira/Linear ticket creation from findings

• New Bitbucket Access Sync section in team settings lets you import Bitbucket Cloud user groups and Bitbucket Server groups as ZeroPath teams, with optional hourly auto-sync to keep group membership in step automatically.
• Adds Re-sync now / Sync now button to trigger a one-off Bitbucket group import without enabling continuous sync — useful for first-time imports or manual refreshes.
• Warns when a custom permission mapping grants fewer permissions to a higher VCS role than a lower one, surfacing the inconsistency for correction.

SAST / SCA / Code Security · 2026-09-03

ZeroPath adds SOC 2, SLA Compliance, and scoped org-level reports plus new dashboard widgets for PR authors and exposure windows

• Adds four organization-level report cards — Monthly Security Report (DOCX), Organization Summary Report (PDF), SLA Compliance Report (PDF), and SOC 2 (PDF) — visible only to users with organization-level permission.
• New SOC 2 PDF report delivers compliance-focused metrics and repository scan activity structured for SOC 2 audit evidence, with a Scope field on the cover page.
• New SLA Compliance Report PDF tracks policy-based SLA compliance, showing which findings are within or past configured remediation windows, scoped to selected tags or repositories.

SAST / SCA / Code Security · 2026-09-03

ZeroPath PR scanning adds Gerrit support and split scan-result links for code vs. dependency findings

• Adds Gerrit change scanning via poll-based triggering (no webhook required), posting findings as inline review comments on diff lines.
• The check run Details link now points directly to the dependency view when a scan finds only SCA findings, avoiding a dashboard view that appears empty.

SAST / SCA / Code Security · 2026-09-03

ZeroPath adds a Dependencies tab, Jira/Linear export controls, live PR-submission status, and transitive SCA verdicts for Java, Scala, Python, .NET, and Rust.

• Transitive dependency findings that complete investigation can now receive confirmed or disconfirmed verdicts — previously all transitive findings were withheld as Unknown; transitive resolution covers Java (Maven, Gradle), Scala (sbt), Python (pip), .NET, and Rust (Cargo).
• Export to Jira and Export to Linear buttons — available in the issues list, the bulk action toolbar, and individual issue detail views — are now role-gated, visible only to members with permission to create tickets in the respective integration.
• Findings where validation could not run (budget exceeded, recursion limit, or timeout) surface as Needs Review in the default issue queue; findings an agent examined but could not reach a verdict on are categorized separately and withheld from the default queue to reduce low-signal noise.

SAST / SCA / Code Security · 2026-09-03

ZeroPath: New remote MCP server at https://zeropath.com/mcp lets Claude, Cursor, Codex, or any Streamable HTTP client work with findings — no install, no API key; connections are read-only until changes are approved, and administrators can disable all connections organization-wide from a single control.

• Adds Microsoft Teams integration: scan notifications and vulnerability alerts delivered as Adaptive Cards to Teams channels via an incoming webhook pasted into ZeroPath — no Azure AD app registration or tenant administrator required; channels that stop accepting deliveries are paused and reported.
• New Continuous Scanning mode runs a full scan on every meaningful commit to a repository's default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository.
• New Assistant Skills let administrators author reusable methodology — triage rules, patch review checklists, report structures, codebase conventions — from the Skills tab; four built-in skills (triage, dependency reachability, report writing, patch review) ship forkable into editable copies.

SAST / SCA / Code Security · 2026-09-03

ZeroPath adds a Remote MCP Server for browser-based AI tool integration and a new API endpoint for fetching repository branches.

• Adds a Remote MCP Server (https://zeropath.com/docs/mcp/remote.md) that connects AI tools to ZeroPath in one step via browser sign-in — no local install required.
• New Get repository branches API endpoint fetches available branches for a linked repository, supporting GitHub, GitLab, Bitbucket, Azure DevOps, Gerrit, CVS, and Generic Git (CVS exposes its single materialized branch).

SAST / SCA / Code Security · 2026-09-03

ZeroPath adds a remote MCP server, Microsoft Teams alerts, Gerrit/CVS support, continuous scanning, and access sync in this release.

• Adds a hosted remote MCP server at https://zeropath.com/mcp — point Claude, Cursor, Codex, or any Streamable HTTP client at it, authenticate via browser (no install, no API key), and interact with findings; connections are read-only until changes are approved.
• Adds Microsoft Teams integration: paste an incoming webhook URL into ZeroPath to receive scan notifications and vulnerability alerts as Adaptive Cards in Teams channels — no Azure AD app registration or tenant administrator required.
• Adds Gerrit repository support: import projects for full scans and scan each open change as new patch sets arrive, posting findings as a review message on the patch set.

Exploitation & C2 · 2026-09-02

ADscan v11.3.0 adds cross-forest attack paths, didactic mode, seasonal password spraying, and krbtgt-only DCSync

• Adds set explain_level off|basic|deep to control didactic mode verbosity, and explain <technique> (e.g. explain kerberoasting, explain "ADCS ESC1") to show a teaching card — with MITRE ATT&CK ID, equivalent manual command, and detection Event IDs — for any technique without executing it.
• Adds month_season spray strategy to the scan config for seasonal password spraying (e.g. March2026, Verano2026), with per-domain language inference (English/Spanish) and last-password-change awareness when domain credentials are available; runs automatically in adscan ci.
• DCSync now supports a krbtgt only replication mode, capturing the golden-ticket key without pulling every account — the minimal-footprint path to proving full domain compromise.

Identity & Access Management · 2026-09-02

Aembit integrates with CrowdStrike Falcon AIDR to enforce detection and response policies on MCP transactions via the Aembit MCP Identity Gateway.

• New integration with CrowdStrike Falcon AI Detection and Response (AIDR) enables inspection of MCP tool listings, inputs, and outputs for AI agent traffic governed by Aembit.
• Aembit MCP Identity Gateway allows centrally pre-configured CrowdStrike AIDR policies to be applied across all MCP clients without per-client configuration or custom agent-side inspection logic.
• Configurable policies on MCP interactions support allow, report, block, or transform actions based on identity context and risks identified by CrowdStrike AIDR.

SAST / SCA / Code Security · 2026-09-02

AFL++ v5.03c adds Value Profile fuzzing, four new LLVM instrumentation env vars, starved-mode queue minimization, and POSIX shared memory on macOS.

• Adds AFL_LLVM_VALUE_PROFILE=1 env var to enable Value Profile instrumentation in fuzz targets, paired with the new afl-fuzz flag -r <seconds> to activate value-profile-guided mutation after a delay.
• Adds AFL_LLVM_DENSE=1 env var to disable PCGUARD basic block pruning for denser coverage maps.
• Adds AFL_LLVM_MINMAX=1 env var to score min/max/abs intrinsics (branchless clamps); adds ~10% map entries at a ~20% throughput cost, default off.

Identity & Access Management · 2026-09-02

Auth0 Advanced MFA Configurations are now GA, enabling customizable OTP lengths, lifetimes, and device-remember windows.

• Configurable OTP lifetime for SMS MFA (30 seconds to 1 hour) and email MFA (5 minutes to 1 hour).

Endpoint Security (EDR/XDR) · 2026-09-02

Automox Exclusion Windows now support local device time scheduling and per-device conflict warnings to eliminate false positives.

• Adds a toggle in the Exclusion Window builder to switch between Local time of device and UTC scheduling, so a window set for 2:00 AM fires at 2:00 AM in each endpoint's own time zone without manual UTC conversion.
• Adds an interactive time preview in the Exclusion Window builder that shows the equivalent wall-clock time when toggling between Local and UTC, based on the current browser time zone.
• Exclusion window warning modals now show per-device conflict counts (e.g., '3 of 12 selected devices are currently in an exclusion window') instead of group-level alerts, eliminating false-positive warnings.

Digital Forensics & Incident Response · 2026-09-02

Belkasoft X v2.12 adds SQLite database classification, offline translation via BelkaGPT, and refined Android acquisition.

• Adds SQLite database classification to automatically categorize SQLite databases found during examination.
• Adds offline translation capability powered by BelkaGPT, enabling artifact translation without an internet connection.
• Refines Android acquisition for improved device support and reliability.

Digital Forensics & Incident Response · 2026-09-02

BelkaGPT gains auto-detected language translation supporting 200+ languages and dialects

• Adds translation capability to BelkaGPT supporting 200+ auto-detected languages and dialects as source input.

Container & Image Security · 2026-09-02

Chainguard adds custom container pull policies in open beta, plus build pinning for Libraries across JS, Python, and Java.

• Introduces custom container pull policies (open beta): organizations can now write their own Rego-based container pull policies, submitted as YAML manifests and managed with chainctl, supporting parameterized declarations with per-binding values, and an ENFORCE mode that blocks pulls without loosening system policies.
• Enables build pinning for all organizations using Chainguard Libraries with upstream fallback across JavaScript, Python, and Java — recording which copy (upstream mirror or Chainguard rebuild) was first pulled and resolving that version consistently until explicitly changed.
• Adds 21 new container images this week, including dynatrace-operator, netshoot, strimzi-drain-cleaner, nomad, redpanda-console, apache-polaris, kserve-pmmlserver, kserve-xgbserver, victorialogs-vlagent, and FIPS variants mlrun-api-fips and mlrun-fips.

SAST / SCA / Code Security · 2026-09-02

Checkmarx One 3.66 adds native SCA reachability engine, UV package manager support, Git commit ID scan tagging, and DAST AI permissions.

• Adds Dast-to-code-initiator and Dast-AI-attack-initiator permissions to the dast-admin role, enabling granular access control over each DAST AI feature.
• Adds a new Python Package Manager configuration setting (at tenant and project level) that supports UV as a package manager for SCA dependency resolution, in addition to existing pip support; pip remains the default.
• New native reachability analysis engine in SCA runs Package Usage and Exploitable Path analysis as part of the SCA scan itself, replacing the previous separate SAST scan dependency; supports Python, Java, JavaScript, and C# for direct dependencies with no additional configuration required.

Integrated & IT Risk Management · 2026-09-02

CISO Assistant v3.21.4 adds JIT SSO provisioning, expanded workflow enablers, and updated Dutch translations.

• Adds Just-in-Time (JIT) provisioning for SSO: user accounts are automatically created on first SSO login, eliminating manual pre-provisioning.
• Expands workflow capabilities with more enablers and sample workflows.
• Adds updated Dutch (nl) translations for the UI.

Identity & Access Management · 2026-09-02

Clerk adds a 1–10 minute Reverification window in Dashboard Sessions, limiting how long sensitive-action reverification remains valid.

• Adds Admin Logs to the Clerk Dashboard: a reverse-chronological audit trail of configuration changes made via the Dashboard, Backend API, or Platform API, with filters for Event type (supports trailing wildcards, e.g. oauth_application.*), Instance, Application, Actor, IP address, and Time range; available on Business and Enterprise plans.
• Adds biometric credential APIs to Clerk's mobile SDKs — useBiometricCredentials (React Native/Expo), Clerk.shared.biometricCredentials.signInWithBiometrics and Clerk.shared.biometricCredentials.biometricCredentialId (Swift), and Clerk.biometricCredentials.signInWithBiometrics and Clerk.biometricCredentials.biometricCredentialId (Android) — enabling enrollment and sign-in via Face ID, Touch ID, or Android biometrics with a device-bound private key.

Internet Services · 2026-09-02

Cloudflare Workers AI adds three new models: Claude Fable 5.1, GLM-5.3, and GLM-5.3 Flash.

• Adds claude-fable-5.1 (Anthropic) with a 1M-token context window, adaptive thinking, and support for agentic coding, long-running workflows, and finance/analysis tasks.
• Adds glm-5.3 (Z.ai) with a 1M-token context window, reasoning, function calling, and structured outputs for multi-step, tool-driven development workflows.
• Adds glm-5.3-flash (Z.ai), a natively multimodal 320B-parameter model (18B active) offering near-Claude Opus 4.8 coding and agentic benchmark performance at one-tenth the price.

Internet Services · 2026-09-02

Cloudflare adds new Workers AI models, Log Explorer dataset deletion, crawl Content Signals support, and Access token scannable format

• Adds contentUse parameter to the /crawl endpoint (POST https://api.cloudflare.com/client/v4/accounts/{account_id}/browser-rendering/crawl) supporting values reference, full (default); requests are rejected with a 400 error when a target site's robots.txt sets a more restrictive use level.
• Adds deletion_protection field to Log Explorer dataset management — set it to false via the Update an account or zone dataset API method before calling Delete an account or zone dataset to permanently remove account or zone datasets.
• Access service token Client Secrets created on or after August 26, 2026 use the new scannable format cfast_[40 alphanumeric characters][8-character checksum], compatible with existing CF-Access-Client-Id / CF-Access-Client-Secret headers and secret scanning tools.

Internet Services · 2026-09-02

Cloudflare API adds email security batch operations, browser rendering live view, and SSL/TLS recommendation endpoints.

• Adds POST /accounts/{account_id}/email-security/settings/allow_policies/batch for batch allow-policy operations in Email Security.
• Adds POST /accounts/{account_id}/email-security/settings/block_senders/batch for batch blocked-sender operations in Email Security.
• Adds POST /accounts/{account_id}/email-security/settings/domains/batch for batch email domain operations in Email Security.

Internet Services · 2026-09-02

AI Gateway invoice consolidation, D1 free-tier query limits enforced, new /crawl contentUse param, and GLM-5.3 Flash support in AI Search.

• Adds contentUse parameter to the /crawl endpoint so crawl requests enforce the use directive declared in a site's robots.txt Content Signals.
• AI Search now supports the Workers AI GLM-5.3 Flash model for text generation.
• D1 now enforces daily row read and row write limits on Workers Free accounts — queries exceeding the limit fail with an error.

Vulnerability Management · 2026-09-02

Cloudmersive Cloud DLP AI API v2-9-0 adds support for scanning multipart/form-data files over 2 GB.

• Supports multipart/form-data encoded file uploads over 2 GB in size for DLP scanning.

Endpoint Security (EDR/XDR) · 2026-09-02

CrowdStrike launches SafeMind, a paired offensive/defensive agentic AI system built on NVIDIA Nemotron models, native to the Falcon platform.

• Introduces CrowdStrike SafeMind, an agentic system operating natively in the CrowdStrike Falcon platform that pairs an offensive model (Red Tempest) and a defensive model (Blue Solano) in a closed-loop harness that continuously pits them against each other to improve.
• Launches Red Tempest, an offensive red-team model built for advanced attack-scenario emulation against AI adversaries, trained on CrowdStrike sensor telemetry, threat intelligence, Falcon Complete MDR event annotations, and fifteen years of incident response data.
• Launches Blue Solano, a defensive blue-team model built to protect enterprise assets by autonomously deploying battle-tested defensive measures, trained on the same CrowdStrike cyber dataset.

SAST / SCA / Code Security · 2026-09-02

cve-lite-cli adds EPSS-based priority tiers (fix_now/fix_soon/monitor/low_priority) to terminal, JSON, and HTML outputs

• Adds epssScores and prioritySignal fields to machine-readable JSON output when EPSS data is available for a finding.
• Introduces four EPSS Priority Signal tiers — fix_now, fix_soon, monitor, low_priority — combining CVSS severity with FIRST.org EPSS exploitation-likelihood percentile to produce a single actionable priority per finding.
• Adds an EPSS Priority column to HTML reports with an interactive priority legend; the column and ⚡ Fix Now inline flag also appear in terminal verbose and compact modes respectively.

SAST / SCA / Code Security · 2026-09-02

cve-lite-cli adds EPSS-based priority tiers and epssScores/prioritySignal fields to JSON, terminal, and HTML outputs

• Introduces an EPSS Priority Signal tier system — fix_now, fix_soon, monitor, low_priority — combining CVSS severity with EPSS exploitation-likelihood percentile to produce a single actionable priority per finding; returns null in JSON when no CVE alias resolves against the FIRST.org API.
• Extends HTML report output with EPSS and EPSS Priority columns and an interactive priority legend.
• Extends terminal full output with EPSS and EPSS Priority columns in the findings table.

SAST / SCA / Code Security · 2026-09-02

Adds an EPSS Priority Signal combining CVSS severity and EPSS percentile into four actionable tiers across terminal, JSON, and HTML outputs.

• Adds a prioritySignal field to JSON output exposing four actionable tiers — fix_now (high impact + top 10% EPSS), fix_soon (high impact), monitor (lower severity + top 10% EPSS), low_priority (all else) — set to null when no EPSS data is available.
• Surfaces the EPSS Priority Signal as a new column in the verbose terminal table (shown with --verbose) and as a column plus four-tier legend in the HTML report (--report).

Web Application Security · 2026-09-02

DataDome: Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately from custom URL exclusions, enabled by default with a standard list of extensions.

• Narrows DATADOME_URI_REGEX_EXCLUSION to hold only custom URL exclusions (e.g. /health|/heartbeat), no longer bundling static-asset extensions.

Web Application Security · 2026-09-02

DataDome CloudFront module 3.0.0 splits exclusion config and adds encoded-path inspection via three new settings

• Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to force inspection of static-looking paths that carry an encoded delimiter, with a configurable delimiter list (defaults: %23 %25 %2f %3b %3f).

Identity & Access Management · 2026-09-02

Didit adds standalone risk APIs, full transaction-monitoring API, biometric-template retention, new fraud signals, and ISO age-assurance workflows.

• New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules programmatically; matching library and install endpoints manage preset rules.
• Opt-in biometric-template retention after session deletion: enable via face_retention_policy and face_retention_days on PATCH /v3/webhook/, override per call with retain_face_embeddings on DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/; retained templates carry a finite expires_at and never contain images or identity fields.
• Ready-made age-assurance templates available in the workflow builder with returned data already restricted.

Vulnerability Management · 2026-09-02

Edgescan Atomic adds live assessment timelines, path-traversal checks, multi-identity auth groundwork, and expanded injection/IDOR coverage across v0.1–v0.5.

• Adds live assessment activity timeline in the platform: a running assessment now shows a readable, real-time timeline of tester activity while the assessment is in progress (v0.5.0).
• Adds path-traversal detection: requests are manipulated to test whether files outside the intended directory can be read (v0.5.0).
• Adds broader file-disclosure testing support (v0.5.0).

Vulnerability Management · 2026-09-02

Edgescan adds EASM service-discovery filtering, per-location-type default scan profiles, and TOTP support for authenticated DAST scans.

• Adds a new EASM/ASM filter to scope the host and domain list to assets where no services were discovered, enabling investigation without a full CSV export.
• Adds support for two separate organisation-default scan profiles based on asset location type — one for URL-only unauthenticated web app assets and one for URL+Network — so new assets automatically inherit the correct profile.
• Adds TOTP support in authenticated DAST scans, enabling scanning of applications protected by MFA/time-based one-time passwords.

Vulnerability Management · 2026-09-02

Edgescan adds bulk role permissions, POC assignment at asset creation, and new EASM filters for certificates, domains, ports, and APIs.

• New EASM domain page filters let users narrow domains by open port, API presence, and API confidence for precise external attack surface triage.
• New certificate filter in EASM allows filtering certificates by issue type.
• Adds ability to assign asset owner, technical POC, and assessment notifier emails when creating a single asset, eliminating the need to configure them post-creation.

SIEM · 2026-09-02

Elastic Security 9.5 adds automatic Tech Preview migration of Microsoft Sentinel Scheduled and NRT detection rules to Elastic Security via LLM.

• Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules to Elastic Security, available in Tech Preview in 9.5, with LLM-powered translation selected at migration time.
• Supports Watchlists to ES|QL Lookups conversion and severity mapping carry-over during Sentinel rule migration.
• Surfaces translated rule status in the UI as one of five states: Installed, Translated, Partially translated, Not translated, or Failed, with per-rule actions (View, Install, or error details).

SIEM · 2026-09-02

Elastic Security 9.5 adds AI-driven alert triage workflow, upgraded Attack Discovery with investigation pipelines, and detection gap closure via ES|QL.

• New Security alert analysis workflow in Elastic Security 9.5 performs first-pass AI triage on alerts from selected detection rules, classifying each as true positive, false positive, or inconclusive with a confidence score, and optionally auto-closes high-confidence false positives above a configurable threshold.
• Auto-close in the Security alert analysis workflow is disabled by default and only activates for false-positive alerts that exceed the confidence threshold set by the SIEM engineer or SOC manager.
• Attack Discovery now runs a skill-backed investigation pipeline powered by Elastic Agent Builder and Elastic Workflows — hunting for related activity, analyzing entities, and searching raw logs in Elasticsearch before generating an attack narrative, rather than only correlating alerts.

SIEM · 2026-09-02

Elastic Defend adds 800+ auto-generated vulnerable driver YARA rules, ARM endpoint support, and an automated troubleshooting skill in Elastic Agent Builder.

• Elastic Security Labs Threat Command now continuously monitors VirusTotal, the LOLDrivers catalog, and Microsoft's Vulnerable Driver Block List to automatically generate and instantly deploy YARA-based vulnerable driver detection rules, decoupled from any release cycle, with coverage published in the open elastic/protections-artifacts repository.
• Vulnerable driver protection has grown from 65 rules in 2023 to 800+ known vulnerable drivers today, with new drivers added continuously as they are disclosed.
• New automatic troubleshooting skill available in Elastic Agent Builder enables conversational diagnosis and remediation of endpoint issues including third-party antivirus conflicts and policy application failures.

SIEM · 2026-09-02

Elastic Security 9.5 adds GA detection rule change history with one-click rollback and auto-provisioned case analytics across all deployments.

• Adds a History section on the rule details page showing a complete, chronological, immutable, append-only log of every saved detection rule state — including who changed it, when, and the revision number — with support for version comparison and one-click rollback; captures changes made through the UI or the API.
• Detection Rules History Management ships as GA in 9.5, providing timestamped audit trails for ISO 27001, SOC 2, and DORA compliance without manual export or configuration.
• Case analytics (Cases as Data) ships as GA in 9.5, auto-provisioned and on by default across all deployment types including Serverless, reducing the index architecture from 12 indices per space to 3 global indices with a pre-built Case Analytics data view per space.

Firewalls & Network Defense · 2026-09-02

Fastly adds API Enforcement for schema-based request validation and Log Explorer & Insights for on-platform log storage and monitoring.

• New API Enforcement feature validates incoming API requests against user-defined schemas, logging or blocking non-conforming requests.
• New Log Explorer & Insights feature enables proactive storage, inspection, and monitoring of log data directly on the Fastly Platform.

Firewalls & Network Defense · 2026-09-02

Fastly adds status_499 metric to Historical Stats, Real-Time Analytics, and Domain Inspector APIs to track client disconnects.

• Adds status_499 metric to the Historical Stats API, Real-Time Analytics API, Domain Inspector Historical API, and Domain Inspector Real-Time API to surface client disconnects from Varnish services.

Endpoint Security (EDR/XDR) · 2026-09-02

Fleet adds a configurable release budget for Fleet-initiated activities via FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE

• Adds FLEET_ACTIVITY_FLEET_INITIATED_RELEASE_PER_MINUTE environment variable to throttle Fleet-initiated activities (policy-automation software installs, scripts, iOS/iPadOS scheduled app updates) to a configurable rate (default 1000 hosts/minute, 0 = unlimited), spreading install-execution and result-ingestion load when automations fire across many hosts simultaneously.
• User-initiated activities (self-service installs, admin-run scripts, lock/unlock/wipe, setup experience) now take precedence over queued Fleet-initiated activities on the same host.

SAST / SCA / Code Security · 2026-09-02

GitHub CLI gains file attachment support for issues, pull requests, and comments

• Adds the ability to attach local images and videos to issues, pull requests, and comments directly from the command line via GitHub CLI.

SAST / SCA / Code Security · 2026-09-02

GitHub Enterprise Live Migrations now GA, enabling near-zero-downtime repo moves from GHES to GHEC DR via the gh elm CLI extension.

• Adds the gh elm GitHub CLI extension to manage the full Enterprise Live Migration lifecycle — creating migrations, monitoring sync progress (with --json output for scripting), and initiating cutover — against the GHES REST API.
• Introduces Enterprise Live Migrations (ELM) as a generally available service running on GHES appliances for near-zero-downtime repository migrations from GHES to GitHub Enterprise Cloud with Data Residency (GHEC DR).
• Supports migrations from GHES versions 3.17.18+, 3.18.12+, 3.19.9+, 3.20.3+, 3.21.3+, and 3.22.0+.

SAST / SCA / Code Security · 2026-09-02

GitHub Budgets REST API and billing UI now support optional expiration dates on individual user budget overrides.

• Adds expires_at field to the Budgets REST API when creating or updating an individual user budget, supporting no expiration (default), start of next billing cycle, or a specific date — available on Copilot Business and Copilot Enterprise plans.
• Adds expiration date controls in billing settings UI when creating or editing an individual user budget, with options: no expiration (default), start of next billing cycle, or a specific date — changeable or clearable at any time.
• Automatically removes expired individual user budgets on their expiration date, falling the user back to their cost center per-user budget or the universal budget.

SAST / SCA / Code Security · 2026-09-02

GitHub Copilot code review can now emit PR approvals counting toward required-approvals rules, configurable at enterprise, org, and repo level.

• Adds an approval assessment to the overview comment of every Copilot code review, signaling whether Copilot considers the pull request ready to approve (assessment alone does not count toward merge requirements).
• Enables Copilot to submit a formal PR approval that counts toward a repository's required-approvals rule when turned on by an admin — off by default, configurable at enterprise, organization, and repository level, including per-file-path controls at the repository level.
• Copilot's approval is automatically dismissed when new commits are pushed after approval, matching human-reviewer dismissal behavior, and a fresh review can be requested to re-approve.

SAST / SCA / Code Security · 2026-09-02

GitHub lets you block or unblock users directly from discussion comments in personal repositories.

• Adds in-context block/unblock controls to discussion comments in personal repositories, matching controls already available on issue and pull request comments — accessible via the More menu on any comment, with an optional private note.

SAST / SCA / Code Security · 2026-09-02

GitHub CLI v2.99.0 adds --attach flag to upload images and video directly into issues, PRs, and comments from the command line.

• Adds repeatable --attach flag to gh issue create, gh issue edit, gh issue comment, gh pr create, gh pr edit, and gh pr comment, uploading a local file and embedding it inline in the Markdown body.
• Supports PNG, JPEG, GIF, WebP, SVG, MP4, MOV, and WebM formats, with size limits of 10 MB for images/GIFs, 10 MB for video on Free plans, and 100 MB for video on paid plans.
• Allows inline alt text via the # syntax in --attach, e.g. --attach './login.png#The login error state'; omitting # falls back to the filename.

SAST / SCA / Code Security · 2026-09-02

Claude Fable 5.1 is now selectable in GitHub Copilot across all major IDEs and surfaces for long-horizon agentic coding tasks.

• Adds Claude Fable 5.1 to the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse — available to Copilot Pro+, Max, Business, and Enterprise plans.
• Enterprise and Business admins can enable Claude Fable 5.1 via the Claude Fable 5.1 policy in Copilot settings (off by default); enabling the policy constitutes acknowledgment of Anthropic's data retention requirement for Mythos-class models.
• Eligible enterprise customers can access Claude Fable 5.1 and Claude Fable 5 with zero data retention through a time-bound exemption while Anthropic rolls out Enterprise Frontier Safeguards (EFS), with requests routed to zero data retention endpoints when the model is enabled.

General Utilities & Libraries · 2026-09-02

GitHub CLI gains --attach flag to upload local images and videos to issues, PRs, and comments from the command line.

• Adds --attach flag to gh issue create, gh issue edit, gh issue comment, gh pr create, gh pr edit, and gh pr comment to upload a local image or video to GitHub and embed the resulting URL inline in the body.
• Supports repeating --attach multiple times in a single command to attach more than one file (attaching the same file twice is not allowed).
• Supports alt text for images via a # suffix on the file path (e.g. --attach 'PATH/TO/IMAGE#ALT-TEXT'); alt text is not supported on video files.

General Utilities & Libraries · 2026-09-02

GitHub CLI v2.99.0 adds --attach for uploading images/videos to issues, PRs, and comments, plus worktree support in gh issue develop.

• Adds repeatable --attach flag to gh issue create, gh issue edit, gh pr create, gh pr edit, gh issue comment, and gh pr comment to upload local images and videos and embed them in the body; supports optional alt-text via path#Alt text syntax, replaces existing local-path references with uploaded URLs, and appends new ones.
• Extends gh issue develop with a --worktree flag (used alongside --checkout) to create a linked branch and check it out in a new Git worktree without disturbing the current working copy.
• Outputs text-only spinner output when gh is invoked by a coding agent, improving agent-readable output.

Exploitation & C2 · 2026-09-02

NodeZero 2026.08 adds WebApp and Azure Cloud pentests, Australia data residency, and new Activity & Artifacts tabs.

• New Azure Cloud pentest type combines Azure API enumeration with an Internal pentest for assumed-breach assessment of both cloud control planes and workloads running on Azure VMs.
• New Activity & Artifacts tabs added to both Real-Time View and post-op test results, with the Action Log extended across both views to help distinguish NodeZero activity from malicious attacks.
• New targeted Rapid Response tests for critical vulnerabilities in Metabase, GitLab Community and Enterprise Editions, and Ivanti Endpoint Manager, plus expanded certificate and Amazon S3 takeover detection.

Exploitation & C2 · 2026-09-02

NodeZero adds WebApp and Azure pentests, Australian data residency, Activity/Artifacts tabs, and expanded AD/Identity capabilities.

• New WebApp pentest op type: crawl, discover, and test production, staging, and private web applications with authenticated workflows, automated route discovery, and proof-based findings.
• New Azure Cloud pentest op type: assess Azure control planes and VM workloads in a single assumed-breach assessment combining Azure API enumeration with an Internal pentest.
• New Activity & Artifacts tabs: the Action Log now extends from Real-Time View into post-op results, and both views gain a dedicated Artifacts tab to deconflict NodeZero activity from malicious attacks.

Secrets Detection & Management · 2026-09-02

Infisical v0.165.1 adds folder RBAC, GCP Certificate Manager sync, approval webhooks, and Kubernetes MI auth templates.

• Adds GCP Certificate Manager Sync for PKI, enabling certificates managed in Infisical to be synced to Google Cloud Certificate Manager.
• Adds folder RBAC, allowing role-based access control to be scoped at the folder level within projects.
• Adds webhook events for approval and change request workflows, enabling external systems to react to secret approval lifecycle events.

Threat Intelligence · 2026-09-02

IntelOwl v6.8.0 adds a CTIConnector base class, chatbot improvements with OLLAMA_KEEP_ALIVE support, and richer connector health-check UI messages.

• Introduces CTIConnector base class to standardize CTI connectors and support data-model enrichment across connector implementations.
• Chatbot now defaults analyze_observable to a curated playbook and enforces rejection of placeholder names, preventing accidental stub submissions.
• Connector health-check methods now return a (status, message) tuple, and the UI surfaces the full error message when a health check fails.

SAST / SCA / Code Security · 2026-09-02

JFrog AI Coding Agent Plugin now supports Claude Code, Cursor, VS Code, and OpenCode agents.

• Adds AI Coding Agent Plugin support for Claude Code, Cursor, VS Code, and OpenCode as supported agents.

SAST / SCA / Code Security · 2026-09-02

JFrog AppTrust gains Prompt-to-Release Traceability: auto-assembled, signed audit evidence chains for every release.

• Launches Prompt to Release Traceability inside JFrog AppTrust, automatically collecting commits, PRs, Jira ticket transitions, and approver records, signing them, and attaching them to the application version before any promotion gate runs.
• Validates full Jira ticket transition history (creation → in-progress → done, with dates) rather than merely checking ticket existence, producing auditor-ready workflow proof.
• Detects self-approval violations by mapping each PR's merger and approver back to the committer — automatically flagging the pattern most compliance frameworks explicitly prohibit.

SAST / SCA / Code Security · 2026-09-02

JFrog AI Catalog expands into a full AI control plane with MCP, skills, plugins, and runtime enforcement for agentic workflows.

• Adds an MCP Registry to define which MCP servers are allowed per project, restrict specific tool calls, and scan local MCP packages before an agent can use them.
• Adds an Agent Skills Registry to curate, sign, verify, and scan packaged agent behaviors before execution is permitted.
• Adds an Agent Plugins Registry to control, sign, verify, and scan plugin bundles agents install.

SAST / SCA / Code Security · 2026-09-02

JFrog AppTrust ships Out-of-the-Box Compliance Frameworks for NIST SSDF and EU CRA, with pre-mapped Policy-as-Code enforcement at release gates.

• Adds Out-of-the-Box Compliance Frameworks in JFrog AppTrust, launching with NIST SSDF and EU CRA pre-mapped to Policy-as-Code rules — no Rego to write and no manual control mapping required.
• Introduces a compliance catalog inside AppTrust where AppSec teams select a framework and see every control translated into plain requirements, each linked to specific Policy-as-Code rules enforced at release gates.
• Surfaces coverage gaps explicitly: controls not yet covered by AppTrust are flagged, while controls already satisfied by running AppTrust are shown as covered by default.

Secure Access (VPN / SASE / ZTNA) · 2026-09-02

Knocknoc 26.08 adds Fastly ACL integration and native nftables enforcement.

• Adds Fastly ACL integration for network access control enforcement.

Secure Access (VPN / SASE / ZTNA) · 2026-09-02

Knocknoc adds backend integrations for Kemp LoadMaster, nftables, and Fastly for dynamic network access control.

• New Kemp LoadMaster backend integration enables Knocknoc to dynamically control network access via the LoadMaster.
• New Fastly backend integration enables Knocknoc to control which source IPs are permitted through a Fastly edge service.

Secure Access (VPN / SASE / ZTNA) · 2026-09-02

Knocknoc: New Kemp LoadMaster integration dynamically controls network access through the load balancer based on Knocknoc authentication events.

• New nftables integration dynamically controls network access on Linux hosts, adding and removing source IPs via nftables rules when users authenticate.
• New Fastly integration controls which source IPs are permitted through a Fastly edge service, enabling JIT network access at the CDN layer.

Container & Image Security · 2026-09-02

Kubescape v4.0.13 adds custom Rego rules, offline image scanning, VEX surfacing, new RBAC controls, MCP tools, and fix/list/config improvements.

• Adds --custom-rules flag to load user-authored Rego rules from the standard rule directory layout during scans.
• Adds --skip-db-update flag to kubescape scan image for fully offline/air-gapped image vulnerability scanning.
• Adds --include-controls and --skip-controls flags to kubescape fix to select which controls get remediated.

Runtime Security · 2026-09-02

Landlock ABI 11 adds LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag to atomically tie no_new_privs to ruleset enforcement.

• When LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS is combined with thread-group-wide enforcement, no_new_privs is propagated to sibling threads as well.
• Adds Landlock Trace Events as an always-on observability channel for audit and monitoring of sandbox decisions, independent of audit flag settings.

Runtime Security · 2026-09-02

Landlock: Adds LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag to landlock_restrict_self(2) (ABI ≥ 11): sets the no_new_privs attribute on the calling thread only if ruleset enforcement succeeds, eliminating the need for a prior prctl(PR_SET_NO_NEW_PRIVS, ...) call.

• Landlock tracepoints now provide an always-on observability channel independent of audit flag settings, documented under Landlock Trace Events.

Digital Forensics & Incident Response · 2026-09-02

MVT gains a plugin system, a new mvt command, ADB key alerting, WhatsApp contacts module, and richer Android bugreport parsing

• Adds a top-level mvt command (platform-neutral) hosting version, completion, plugins, and download-iocs; running mvt alone shows installed version, update notices, and available commands.
• Adds mvt completion to generate shell completion scripts for Bash, Zsh, and Fish across mvt, mvt-ios, and mvt-android; pass the shell name (e.g. mvt completion bash) to emit the script directly, and --install to write it.
• Adds a plugin system: third-party packages can register forensic modules and top-level CLI commands via Python entry points; mvt plugins lists installed plugins and checks for updates.

Data Security & DLP · 2026-09-02

Netskope R141 adds per-app-instance visibility controls for SSPM findings.

• Adds the ability to control visibility of SSPM findings scoped to individual app instances, enabling teams to restrict or expose findings by specific SaaS app deployments.

Reconnaissance & OSINT · 2026-09-02

Nmap NSE gets a 400 MB memory cap and a 5-second execution watchdog that kills non-yielding threads.

• Enforces a 400 MB memory limit on the Nmap Scripting Engine (NSE) Lua runtime to bound per-scan resource consumption.

SAST / SCA / Code Security · 2026-09-02

Noir passive scan rules auto-update via --passive-scan-auto-update and custom rule sets load via --passive-scan-path

• Adds --passive-scan-auto-update flag to pull the latest community passive scan rules from the noir-passive-rules repository on startup.
• Adds --passive-scan-path flag to point Noir at a private repository, local directory, or individual file as a replacement rule set for a given run; the flag can be repeated to load multiple sources.
• Auto-provisions the community passive scan rule set to ~/.config/noir/passive_rules/ on first run when passive scanning is enabled, with no manual installation required.

SAST / SCA / Code Security · 2026-09-02

Noir adds --passive-scan-path flag to specify custom passive scan rules location, with offline/air-gapped support.

• Adds --passive-scan-path flag to specify a custom directory for passive scan rules, enabling air-gapped environments where automatic rule downloads are unavailable.
• Passive scan rules default location is ~/.config/noir/passive_rules, loading up to 27 valid rules when present.

SAST / SCA / Code Security · 2026-09-02

Noir passive scan now accepts --passive-scan-path for fully offline, custom-rule runs from local directories

• Adds --passive-scan-path <dir> flag to noir scan, which loads every *.yml/*.yaml rule file found recursively under the given directory, skips bundled rules entirely (no git or network access needed), and can be repeated — duplicate rule IDs across directories are deduplicated automatically.

SAST / SCA / Code Security · 2026-09-02

Noir documents OpenAPI output format with OAS 2.0 and 3.x support, including HTTP QUERY route auto-upgrade to 3.2.0

• Supports both OAS 2.0 (Swagger) and OAS 3.x output formats; use -f oas2 to produce Swagger 2.0 shape where body parameters are emitted as in: formData / in: body entries and cookies ride as a Cookie header.
• Emits OpenAPI 3.0.3 documents by default; automatically upgrades to 3.2.0 when a scan discovers an HTTP QUERY route, since OAS 3.0.x has no query operation.
• Maps discovered parameters to OpenAPI semantics: headers, cookies, path, and query parameters are emitted under parameters; form and JSON bodies become a requestBody with the matching media type (application/x-www-form-urlencoded or application/json).

SAST / SCA / Code Security · 2026-09-02

Noir adds CLI framework detection for Go, Python, Rust, JavaScript, Ruby, C#, Java, Kotlin, PHP, C++, Swift, Nim, Haskell, Scala, Zig, Clojure, Lua, Perl, and Groovy.

• Adds endpoint extraction support for Go CLI frameworks: cobra (with viper env), urfave/cli, pflag, go-arg, go-flags, kong, kingpin, mitchellh/cli.
• Adds endpoint extraction support for Python CLI frameworks: click, typer, fire, docopt, Abseil (absl-py), Cleo.
• Adds endpoint extraction support for Rust CLI frameworks: clap (derive), structopt, argh, getopts.

SAST / SCA / Code Security · 2026-09-02

Noir adds -f adb and -f simctl output formats to launch discovered mobile endpoints directly on Android and iOS devices.

• Adds -f adb output format to emit ready-to-run ADB device commands for launching discovered Android app endpoints.
• Adds -f simctl output format to emit ready-to-run simctl device commands for launching discovered iOS app endpoints.
• Mobile endpoints are included in structured inventory outputs (JSON, JSONL, YAML, TOML, SARIF, Markdown, mermaid, HTML) and Elasticsearch/webhook exports, but excluded from HTTP-shaped formats (cURL, HTTPie, PowerShell, OpenAPI 2.0/3.0, Postman, and active probe/proxy delivery).

SAST / SCA / Code Security · 2026-09-02

Noir adds --no-spinner flag and -f json/yaml format option to list techs, plus flexible global flag placement

• Adds -f format flag to noir list techs accepting text (default), json, or yaml for machine-readable output.
• Adds --no-spinner global flag to disable the loading spinner while preserving normal log output.
• Global flags like --no-color can now be placed on either side of the subcommand verb (e.g., noir --no-color list techs or noir list techs --no-color).

Identity & Access Management · 2026-09-02

Okta adds JA4 TLS fingerprinting across all Syslog events, manual MCP server registration, and a new suspicious authenticator enrollment detection.

• Captures JA4 TLS client fingerprints in securityContext.tlsFingerprint.ja4 across all Syslog event types — including telephony (OTP/SMS), sign-in, auth, and token events — enabling bot traffic, toll fraud, and TLS-based attack pattern detection beyond IP/user-agent signals alone. Not yet available for orgs on custom-hosted domains.
• Adds Suspicious authenticator enrollment detection to Okta Identity Threat Protection (ITP), flagging suspicious activity during authenticator enrollment with details recorded in the System Log for investigation.
• Adds manual MCP server registration, allowing admins to configure authorization server details and client credentials directly for internal or legacy MCP servers that don't support automated metadata discovery endpoints.

Threat Intelligence · 2026-09-02

OpenCTI 7.260901.0 adds workflow status sync via streams, built-in Filigran themes, and a new vulnerability module.

• Adds workflow release status synchronization by name through streams, enabling cross-instance status propagation without manual mapping.
• Introduces built-in Filigran themes, giving teams out-of-the-box branded UI options without custom theme configuration.
• Adds a new vulnerability module to the data model, expanding structured tracking of vulnerability entities.

Cloud Security Posture · 2026-09-02

Prowler image provider adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS to safely scan on-premises registries on private networks.

• Adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS environment variable accepting a comma-separated list of IPs and CIDRs (e.g. 192.168.65.254/32,10.20.0.0/16) to allowlist private network ranges for on-premises registry scanning, while keeping link-local, loopback, and unlisted private addresses blocked as SSRF protection.
• Malformed entries in PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS cause a startup failure, and any non-empty allowlist is logged as a relaxed security control so operators have a clear audit trail.

Cloud Security Posture · 2026-09-02

Prowler adds Slack alert destinations, NCSC Cyber Essentials 3.3, 15 new checks across 7 providers, and an AI feedback mechanism.

• Adds Slack as an alert destination: connect a workspace from the Integrations page, authorize destination channels, and select them in the alert modal's Destination channels selector alongside the existing Recipients email selector.
• Adds NCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026) as a universal compliance framework with 28 requirements across five control themes: Firewalls, Secure Configuration, Security Update Management, User Access Control, and Malware Protection — 16 requirements map to Azure checks, 12 reported as Manual.
• New ecr_repository_image_no_secrets check scans the latest image of each ECR repository — both configuration and filesystem layers — for hardcoded secrets.

Cloud Security Posture · 2026-09-02

Prowler adds browser-based findings import, Slack alerts, on-premises registry scanning, 10 new AWS checks, and CIS Google Workspace v1.4.0 compliance

• Adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS environment variable accepting a comma-separated list of IPs and CIDRs to enable scanning of on-premises and private-network container registries, while all other non-public addresses remain blocked by the SSRF guard.
• Adds --registry-insecure flag that now propagates to Trivy via TRIVY_INSECURE, allowing images behind self-signed certificates to be pulled and scanned (not just enumerated) — intended for trusted internal registries only.
• New check bedrock_knowledge_base_encrypted_with_cmk verifies each Bedrock knowledge-base data source uses a customer-managed KMS key for transient storage during chunking and embedding.

Cloud Security Posture · 2026-09-02

Prowler 5.41.0 adds 10 new AWS checks, CIS Google Workspace v1.4.0, private-registry scanning, and browser-based findings import

• Adds PROWLER_IMAGE_PROVIDER_ALLOWED_PRIVATE_NETWORKS environment variable accepting a comma-separated list of IPs and CIDRs to allow the Image provider to reach on-premises registries while keeping all other non-public addresses blocked by the SSRF guard.
• Adds --registry-insecure flag propagation to Trivy via TRIVY_INSECURE, enabling pull and scan of images behind self-signed certificates on trusted internal registries.
• Adds agentcore_log_group_name_prefixes key to config.yaml to configure which CloudWatch log group prefixes the new cloudwatch_log_group_agentcore_data_protection_policy_enabled check evaluates.

Attack Surface & Exposure Management · 2026-09-02

runZero adds MCP OAuth, CBOM Cyclone JSON export, Censys Platform v3, AI labelling, and major Custom Integration script expansion

• The comment: search operator is now supported in the Issues inventory for searching Issue comments.
• The number of personal dashboards a saved query is used on, and whether it appears on other dashboards, is now visible in the Dashboards column of the query library.

Attack Surface & Exposure Management · 2026-09-02

runZero 5.1 adds External Reporting sharing for standard reports, alert rules for Issue lifecycle events, and comment: search in Issues inventory.

• Adds comment: keyword for searching Issue comments in the Issues inventory.
• Alert rules now support conditions based on Issue lifecycle events.
• Standard reports can now be shared via the External Reporting feature.

Attack Surface & Exposure Management · 2026-09-02

runZero adds MCP OAuth, CBOM CycloneDX export, WMI scripting, Mermaid charting, and Issue lifecycle alert conditions

• Alert rules now support conditions for Issue lifecycle events, enabling automated responses to Issue state changes.
• Large scan jobs process faster after optimization for MAC merging.

Secure Access (VPN / SASE / ZTNA) · 2026-09-02

ScoutDNS Windows Client 2.2.6 adds Microsoft Entra Global Secure Access compatibility for split and full tunnel modes.

• Adds compatibility with Microsoft Entra Global Secure Access (GSA) in Windows Client 2.2.6 (driver 1.0.0.22), allowing ScoutDNS and Entra Private Access to coexist without disrupting private DNS or tunnel startup.
• Automatically detects an active GSA Private Access tunnel and permits only required GSA bootstrap and synthetic DNS paths while continuing to enforce ScoutDNS policy for public DNS — no manual domain or IP exclusions required.
• Validated in both split tunnel (GSA Private Access) and full tunnel modes.

SAST / SCA / Code Security · 2026-09-02

Snyk Repo Content Sync (GA) automatically creates and deactivates Projects as manifest, Dockerfile, and IaC files are added, moved, or removed from monitored branches.

• Introduces Repo Content Sync (GA for Enterprise plans): Snyk automatically creates Projects for newly merged manifest, Dockerfile, and IaC configuration files, and deactivates Projects whose files are removed or renamed — no manual re-import required.
• Repo Content Sync is on by default for Enterprise organizations with no configuration required; organizations already opted in through Snyk Preview retain their existing setting.

SAST / SCA / Code Security · 2026-09-02

Snyk repo content sync now covers Code, open source, secrets, IaC, and container Projects on custom and default branches.

• Repo content sync now covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects — not just a subset of project types.
• Repo content sync now works on custom branches in addition to default branches.

Container & Image Security · 2026-09-02

Snyk now automatically syncs Projects when manifest, Dockerfile, and config files are added, moved, renamed, or removed in a repo.

• Automatically creates and begins monitoring new Projects when manifest, Dockerfile, or configuration files are added to a repository.
• Deactivates Projects whose source files have been removed from the repository, keeping the Project inventory clean without manual intervention.
• Tracks moved or renamed files by activating a Project at the new path and deactivating the one at the old path.

SAST / SCA / Code Security · 2026-09-02

Snyk repo content sync now covers Code, open source, secrets, IaC, and container (Dockerfile) projects on custom and default branches.

• Repo content sync now covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) project types — not just a subset.
• Repo content sync now works on custom branches in addition to default branches.

SAST / SCA / Code Security · 2026-09-02

Socket API write endpoints now accept ?dry_run=true to validate policy, rule, and resolution requests without saving anything.

• Adds ?dry_run=true query parameter to policy, rule, and resolution write endpoints — returns the same response body a real write would, including the id/uuid, but creates, updates, or deletes nothing.
• Supports dry_run on POST /orgs/{org_slug}/alert-policies, PUT /orgs/{org_slug}/alert-policies/{policy_id}, DELETE /orgs/{org_slug}/alert-policies/{policy_id}, POST /orgs/{org_slug}/alert-policies/{policy_id}/rules, PUT /orgs/{org_slug}/alert-policies/{policy_id}/rules/{rule_id}, DELETE /orgs/{org_slug}/alert-policies/{policy_id}/rules/{rule_id}, and POST /orgs/{org_slug}/alerts/resolutions.
• Dry-run creates return HTTP 200 with dry_run: true in the body (not 201); dry-run deletes return { "dry_run": true } instead of { "result": "success" }; dry-run updates return 200 with the updated body plus dry_run: true.

SAST / SCA / Code Security · 2026-09-02

Socket adds POST /orgs/{org_slug}/alert-policies/migration/translate to convert legacy alert triage payloads into new resolution or policy-rule requests.

• New POST /orgs/{org_slug}/alert-policies/migration/translate endpoint accepts the same alertTriage array (1–100 entries) used by POST /orgs/{org_slug}/triage/alerts and returns translated alert_resolution or alert_policy_rule request bodies without writing anything.
• Supports ?dry_run=true on rule-body POSTs so practitioners can validate translated policy-rule payloads before confirming migration.
• Response always returns two arrays — translations (with index, target, method, path, and body) and untranslatable (with index, code, and reason) — so partial batches surface per-entry failures without dropping the rest.

SAST / SCA / Code Security · 2026-09-02

Socket adds dry-run support to POST /alerts/resolutions and a triage-payload translation utility.

• Adds ?dry_run=true query parameter to POST /alerts/resolutions to validate a resolution payload without saving it.
• Adds a Translating Alert Triage Payloads utility to convert existing Alert Triage ignore-rule request bodies into the resolutions format.

SAST / SCA / Code Security · 2026-09-02

Socket adds ?dry_run=true to policy/rule write endpoints so you can test API changes before confirming a migration.

• Adds ?dry_run=true query parameter to policy and rule write endpoints: returns 200 and validates the write without saving anything, letting you test API integrations before confirming the Policies migration.
• During the Policies migration preview, real policy and rule writes return 409 until the migration is confirmed — use ?dry_run=true to safely test writes in the interim.

Endpoint Security (EDR/XDR) · 2026-09-02

Sophos Anti-Virus for macOS 2026.2.0 adds macOS 27 Golden Gate support and updates the threat detection engine to v3.99.0.

• Supports macOS 27 Golden Gate.
• Updates the threat detection engine to version 3.99.0.

Firewalls & Network Defense · 2026-09-02

Sophos Email adds Data Control notification recipients and automatic Intelix-based quarantine release.

• Enables configuration of notification recipients for Data Control rule actions, so the right people are alerted when a Data Control policy triggers.
• Automatically releases quarantined emails from quarantine when an Intelix scan determines the email is not malicious or suspicious, reducing manual triage of held mail.

AI-Powered Offensive Security · 2026-09-02

Strix v1.6.0 adds MCP server support, a managed cloud CLI, workspace file injection, OWASP LLM Top 10 2026 skills, and contextual CVSS dependency reports.

• Adds --workspace-file CLI flag and extra_files config key to place caller-provided files into the sandbox workspace before a scan starts.
• Adds strix cloud subcommand for the managed platform CLI, covering login, scans, billing, and the full cloud API.
• Adds update_vulnerability_report agent API so an agent can revise an already-filed finding during a run.

Endpoint Security (EDR/XDR) · 2026-09-02

Container Security Runtime Malware Scanning gains scheduled and real-time scan types with image filter rules and path exclusions

• Adds two scan types to Runtime Malware Scanning in Container Security: scheduled scans for comprehensive coverage against latest malware patterns, and real-time scans for immediate threat detection after deployment.
• Adds image filter rules to the Container Security policy, letting you exclude specific images (e.g. trusted third-party operators) or restrict scanning to only matching images, with per-namespace scoping so the same image can follow different policies in different namespaces.
• Adds configurable filesystem path exclusions to the Container Security policy; /proc, /dev, and /sys are excluded by default, and additional paths can be added to fine-tune which paths within scanned images are examined.

Secrets Detection & Management · 2026-09-02

TruffleHog Enterprise adds Slack scanning, AWS credential analysis, scan activity API, source archiving, and 16 new detectors

• Adds Slack workspace scanning as a listed app in the Slack Marketplace — scans messages, threads, and attached files, with verified findings to confirm live credentials (Enterprise).
• Adds continuous Slack scanning for new messages, thread replies, and edits across public channels, private channels the app is invited to, DMs, and group DMs — edited messages are rescanned and the app joins new public channels automatically (Enterprise).
• Adds historical Slack scanning covering messages, threads, and attached files including archives, base64-encoded data, binaries, and Microsoft Office documents — include/exclude lists scope channel coverage and interrupted scans resume where they left off (Enterprise).

Threat Intelligence · 2026-09-02

Yeti 2.11.0 adds per-message model selection and session deletion to the agent chat interface.

• Adds GEMINI_MODELS to prod/.env.example (yeti-docker) and agents.geminiModels in the Helm chart to configure the list of selectable models for the agent chat.
• Enables per-message model selection in agent chat, with the chosen model remembered per conversation so each session shows which model answered it.
• Enables deletion of agent chat sessions, removing the conversation and its metadata together.

Web Application Security · 2026-09-01

• Adds an opt-in Generate HAR files option for authentication verification, disabled by default to avoid unnecessary HAR file generation.

Identity & Access Management · 2026-09-01

Aembit integrates CrowdStrike AIDR into MCP access policies to inspect tool listings, inputs, and outputs for AI agents.

• Adds a CrowdStrike AIDR content security configuration attachment to Aembit access policies, enabling MCP traffic inspection (tool listings, tool inputs, tool outputs) from the same control plane that handles identity and credential issuance.
• Supports configurable fail-open or fail-closed behavior per access policy when CrowdStrike AIDR is unreachable, with every failure recorded as a workload event.
• Inspection is opt-in per access policy — only the policies you explicitly configure with a CrowdStrike AIDR content security configuration trigger MCP content checks; all others continue to work unchanged.

Identity & Access Management · 2026-09-01

Auth0 adds Cross-App Access Requesting App (Early Access): fetch third-party API tokens via IdP trust, no manual user consent per integration.

• New Dashboard toggle on enterprise connections enables the Cross-App Access Requesting App flow, letting apps silently fetch third-party API tokens for authenticated users without requiring per-integration Connect your account clicks.
• Built on Auth0 Token Vault using the ID-JAG (Identity Assertion Authorization Grant) protocol; currently supported on OIDC and Okta Workforce connections.
• Org-aware token resolution: in multi-org tenants, requests are scoped by org_id and rejected if the enterprise connection or target resource app is not enabled for that organization, or if the org context is ambiguous across multiple identities.

Identity & Access Management · 2026-09-01

Castle adds an SDKs page giving a single view of SDK integration versions and update status.

• New SDKs page provides a centralized view of all SDK integrations, showing which are outdated so teams can quickly identify where to upgrade.

Secure Access (VPN / SASE / ZTNA) · 2026-09-01

Cato launches SMB FlexPool and MSASE Business Center for MSPs to pool licenses and self-provision SMB customers.

• New Cato SMB FlexPool provides MSPs and service providers a partner-level pool of Cato licenses, enabling unlimited portability to allocate and reallocate capacity across eligible SMB customers without per-customer license purchases.
• New Cato MSASE Business Center adds a consolidated Business Overview page showing business accounts, orders, license usage, invoices, and customer lifecycle activity across the partner portfolio.
• Authorized partners can self-provision eligible services and activate new customer accounts directly in Cato MSASE Business Center without waiting for manual approval workflows.

SAST / SCA / Code Security · 2026-09-01

Checkmarx One 3.62 adds Risk Orchestration, AI Triage & Remediation, AI-BOM export, AISC CLI support, and a new SCA package risk intelligence API.

• Adds POST /api/v1/packages/risks REST API to query vulnerability and malware risk data on up to 100 packages per request, accepting packages by PURL or by name/type/version, with optional parameters controlling detail level from basic risk scores to full CVE details and remediation guidance; a dedicated endpoint for Package Upgrade Recommendations is also available.
• Adds AI Supply Chain Security (AISC) as a standalone scanner type in the Checkmarx One CLI, triggerable with the same workflow and commands used for other supported scanners.
• Adds include and exclude scope configuration rules for AI Supply Chain scans at both the global and project level; exclude rules always take precedence and changes apply to subsequent scans only.

SAST / SCA / Code Security · 2026-09-01

Checkmarx One 3.64 adds organization-level scan settings, MCP container scanning, PNPM lockfile resolution, and CycloneDX 1.7 SBOM provenance.

• Adds allowedLevel and unableToBlockOverride attributes to settings metadata, letting platform administrators restrict specific settings to tenant or project scope and enforce override behavior across configuration levels.
• Adds customState field to /api/results endpoint responses for API Security findings, surfacing custom triage states consistently with other scanners.
• Adds AI asset counters to the scan summary API, enabling the CLI to display an assets table alongside scan results for AI Supply Chain scans.

SAST / SCA / Code Security · 2026-09-01

Checkmarx debuts Fusion multi-model SAST, AI Inventory/AI-BOM, Triage Assist, Remediation Assist, and autonomous Developer Assist MCP mode.

• Adds Developer Assist autonomous mode, which uses hooks and MCP to intercept coding-agent actions such as file writes and package installations before they take effect, returning remediation guidance directly to the agent from an independent AppSec layer.
• Launches Checkmarx Fusion (early access), a Multi-Model AI Engine that runs curated frontier models over the hybrid SAST engine's already-validated findings to surface novel and AI-generated-code vulnerabilities with no known rule, CVE, or signature — available as an optional, usage-based layer where teams choose higher- or lower-cost models per project.
• Introduces AI Inventory and AI-BOM using deterministic analysis to identify models, agents, MCP servers, AI libraries, and SDKs across repositories, with findings traceable to specific files and lines of code, and versioned AI-BOM documentation generated per release.

Identity & Access Management · 2026-09-01

Clerk adds Admin Logs audit trail, configurable reverification window, and biometric credential enrollment for mobile SDKs

• New Reverification window setting on the Sessions page in the Clerk Dashboard lets you configure how long a successful reverification remains valid, from 1 to 10 minutes (default: 10 minutes), controlling how frequently users must re-authenticate before sensitive actions such as changing a password, adding/removing an email address, revoking a session, or deleting an account.
• New Admin Logs section in the Clerk Dashboard provides a reverse-chronological audit trail of configuration changes made via the Dashboard, Backend API, or Platform API — tracking events such as creating OAuth applications, updating instance settings, rotating secrets, and managing Roles and Permissions.
• Admin Logs support filtering by Event type (with trailing wildcard support, e.g. oauth_application.*), Instance, Application, Actor, IP address, and Time range; available on Business and Enterprise plans, recording from August 24, 2026 onward.

Container & Image Security · 2026-09-01

crictl gains --max-retries for connection retry with exponential backoff, plus OpenTelemetry root spans and CRICTL_CREDS/CRICTL_AUTH support on create/run.

• Adds --max-retries flag to crictl to control connection retry attempts with exponential backoff (default: 3).
• Adds CRICTL_CREDS and CRICTL_AUTH environment variables and -u alias for --username to the crictl create and crictl run commands, aligning them with crictl pull.
• OpenTelemetry tracing now emits a root span per crictl execution that groups all gRPC calls made to the runtime during that invocation.

SAST / SCA / Code Security · 2026-09-01

cve-lite-cli v1.32.0 adds license detection, EPSS enrichment, npm advisory fallback, and incomplete-data policy control

• Adds --incomplete-policy warn|error flag (default: warn) to control exit behavior when detection data is incomplete; error exits with code 3. GitHub Action gains an incomplete-policy input.
• Enriches findings with FIRST.org EPSS scores after the OSV pass: highest score shown in the terminal top-3 block, verbose table column, and HTML report detail panel; full score array included in JSON output. Skipped in offline mode and for GHSA-only findings.
• Adds the npm registry advisory API as a secondary source for packages with zero OSV matches, closing coverage gaps for CVEs without an npm ecosystem mapping in OSV. Skips in offline mode and is non-fatal on error.

SAST / SCA / Code Security · 2026-09-01

Cycode adds Agentic Code Scanning as a fourth scanning dimension, catching authorization vulnerabilities that rule engines structurally cannot detect.

• Adds Agentic Code Scanning (Dimension 4) — an agent-orchestrated layer that plans from a threat model, ranks code by vulnerability class, and disproves findings before surfacing them, enabling detection of logic-level flaws like broken access control that have no matchable pattern.
• Introduces per-scan configuration of mode, model, and scope as three independent dials, so teams can target expensive reasoning only at code classes that rules cannot describe while keeping deterministic scanning on every commit.
• Adds attack-chain synthesis that links related findings across files into a single multi-step exploit path, carrying data flow from untrusted source to dangerous sink and tagging the resulting risk category (e.g. Code Injection — Critical).

SAST / SCA / Code Security · 2026-09-01

Cycode adds Agentic Code Scanning: a four-dimension system that orchestrates rules, AI triage, and agentic reasoning to catch authorization flaws no rule engine can express.

• Adds Agentic Code Scanning (Dimension 4) — an orchestration layer that plans from a threat model, ranks what the model reads per vulnerability class, and disproves every finding before surfacing it, running above the three deterministic/AI tiers.
• Introduces per-scan control over mode, model, and scope as three independent dials, with every scan recording what ran, when, on which code, and with which model for auditability.
• Agentic reasoning promotes confirmed vulnerability mechanisms into new deterministic SAST rules (Dimension 1/2), so a class found by the expensive layer is caught at near-zero cost on every subsequent run, compounding coverage as repo count grows.

Web Application Security · 2026-09-01

DataDome CloudFront v3 splits exclusion config and adds default URI inspection for matrix params and encoded chars

• Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions (standard list, enabled by default), separating them from custom URL exclusions previously combined in DATADOME_URI_REGEX_EXCLUSION.
• DATADOME_URI_REGEX_EXCLUSION now holds only custom URL exclusions — static-asset extensions must be moved out of this variable when upgrading to v3.

Web Application Security · 2026-09-01

DataDome CloudFront integration 3.0.0 restructures exclusion and URL-evaluation settings with three new dedicated config keys.

• Adds DATADOME_STATIC_ASSET_EXCLUSION setting (enabled by default) to hold static-asset file-extension exclusions in a dedicated list, separating them from custom URL exclusions previously mixed into DATADOME_URI_REGEX_EXCLUSION.
• Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) to strip RFC 3986 matrix parameters from URLs before evaluating exclusion patterns.

Identity & Access Management · 2026-09-01

• Adds face_retention_policy and face_retention_days fields on PATCH /v3/webhook/ to configure opt-in biometric-template retention at the application level, keeping image-free face embeddings anchored to a User after session deletion so duplicate detection, Face Search, and biometric authentication continue working.
• Adds /v3/transactions/rules/ Management API endpoints to create, update, delete, and backtest transaction-monitoring rules programmatically, plus library and install endpoints to browse, install, and remove preset rules from the rule library.
• App Settings → Data now exposes a Retain biometric template toggle with a required finite retention period field for configuring biometric-template retention via the Business Console.

Identity & Access Management · 2026-09-01

Didit adds three new risk-scoring endpoints: POST /v3/email/risk/, /v3/ip/risk/, and /v3/phone/risk/

• New POST /v3/email/risk/ endpoint scores an email address for deliverability, disposable-address detection, breach exposure, cross-session match, and normalized risk signals without sending an OTP; returns Approved, In Review, or Declined in the top-level status field, with intelligence data exposed as both email.email_intelligence and email.enrichment.
• New POST /v3/ip/risk/ endpoint scores an IP address for geolocation, VPN/Tor/data-center flags, threat data, and country_mismatch against a claimed_country; returns In Review when the resolved country conflicts or the address is flagged as VPN, Tor, or data-center infrastructure.
• New POST /v3/phone/risk/ endpoint resolves a phone number and returns carrier, line-type, porting status, disposable-number detection, and cross-session match signals without sending an OTP; intelligence available as both phone.phone_intelligence and phone.enrichment.

Identity & Access Management · 2026-09-01

Didit adds standalone risk APIs, programmable monitoring rules, MCP tools, biometric retention, and ISO age-assurance workflows.

• Transaction monitoring gains programmable Management API and MCP rule workflows: integrations can create, update, delete, backtest, and manage preset rules, while console actions retain the user who made a manual status change.
• Five upload fraud signals now cover recycled document images, liveness-video forensics, covered documents (DOCUMENT_OCCLUSION_DETECTED), live-capture confirmation, and pre-extraction capture quality.
• Age-assurance workflows can declare ISO/IEC 27566-1, return only an age decision, route borderline estimations to document checks, and start from restricted-data templates.

Identity & Access Management · 2026-09-01

Didit transaction monitoring gains event ingestion, event-based rules, and SDK-side device event capture.

• Adds Event Ingestion endpoint supporting non-monetary event types: login, gameplay, bonus, payment, dispute, security, and responsible gambling.
• Adds Rules on Events with velocity, ratio, ordered-sequence, and cross-subject correlation rule types for event-driven monitoring logic.
• Adds SDK Event Submission for device-side event capture using a scoped monitoring credential.

Identity & Access Management · 2026-09-01

Didit adds standalone risk APIs, ISO/IEC 27566-1 age assurance, transaction-monitoring rule management, and biometric-template retention.

• New POST /v3/document-ai/ endpoint extracts structured data from any uploaded document, not just identity documents, and accepts uploads up to 50 MB.
• New POST /v3/email/risk/, POST /v3/phone/risk/, and POST /v3/ip/risk/ endpoints return standalone risk signals for an email address, phone number, or IP address, each priced per call.
• New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules; matching library and install endpoints manage preset rules from the rule library.

Identity & Access Management · 2026-09-01

Didit: New /v3/transactions/rules/ Management API endpoints (create, update, delete, backtest) plus matching library and install endpoints let rules be managed programmatically, in addition to the Business Console.

• New Biometric Templates API — GET /v3/biometric-templates/, GET /v3/biometric-templates/count/, GET /DELETE /v3/biometric-templates/{template_uuid}/, and POST /v3/biometric-templates/delete/ — to list, count, inspect, and purge retained templates.
• Sessions can now be listed ordered by updated_at.
• New DOCUMENT_OCCLUSION_DETECTED result returned when a partially obscured document is detected at pixel level, translated into every supported language.

Secure Access (VPN / SASE / ZTNA) · 2026-09-01

DNSFilter makes Customizable Dashboards the default landing view and adds live status indicators on deployment widgets.

• Customizable Dashboards is now the default landing view for all users; the legacy Overview page is retired and existing bookmarks redirect automatically.
• Dashboard Filters drawer merges Quick Filters and Advanced Filters into a single experience, grouped by Source (Organizations, Sites, Roaming Clients/Relays, Users) and Traffic (Result).
• Deployment widgets — Roaming Clients Protected, Sites Protected, Relays, Users, and Collections — now show a pulsating green dot indicating live data, unaffected by the dashboard time range filter.

SAST / SCA / Code Security · 2026-09-01

Endor Labs now surfaces native package-manager dependency scopes (e.g. Maven provided, npm devDependencies) on findings and metadata.

• Adds the un-normalized, package-manager-native dependency scope (e.g. Maven provided, npm devDependencies) to findings and dependency metadata after a scan, filterable via the API and usable in exception policies.

Post-Exploitation · 2026-09-01

Evil-WinRM AI branch adds integrated LLM support via --llm, --llm-model, --llm-url, and --llm-api-key flags for in-shell PowerShell command generation

• Adds --llm LLM_NAME flag to select an LLM provider (Ollama, OpenAI, Anthropic, Mistral-AI, Gemini, AzureOpenAI) for in-session PowerShell command suggestions.
• Adds --llm-model LLM_MODEL_NAME flag to specify the exact model to use with the chosen LLM provider.
• Adds --llm-url LLM_URL flag to point to a self-hosted LLM service endpoint (used by Ollama and AzureOpenAI).

Data Security & DLP · 2026-09-01

fheVM v0.14.1 adds Polygon mainnet chain support and KMS canonical mirror tasks for host contracts.

• Adds tasks to mirror the canonical KMS context and epoch onto replica chains in host contracts.
• Adds Polygon mainnet chain configuration to the SDK and Solidity library.

Reverse Engineering · 2026-09-01

Finite State Platform lets License Policy flag components with no license, assigning severity and BOM labels.

• Adds a License Policy setting for components with no license, enabling assignment of a severity and label that appears on the Bill of Materials.

Reverse Engineering · 2026-09-01

Finite State now unpacks ESP32 and Airoha Bluetooth-audio firmware and exports CycloneDX 1.6 SBOMs with author metadata.

• Exports binary scan SBOMs as CycloneDX 1.6 with author metadata, producing auditor-ready documents from binary analysis.
• Unpacks Espressif ESP32 firmware images, including full flash dumps, so ESP32 devices are analyzed as firmware rather than unidentified blobs.
• Unpacks Airoha Bluetooth-audio firmware and identifies vendor SDK and DSP components, enabling complete SBOMs from those images.

Secrets Detection & Management · 2026-09-01

GitGuardian adds AI agents for public secret attribution, source health management for GitHub, and automatic monitoring toggles for Jira, Confluence, and Teams.

SIEM · 2026-09-01

Google SecOps adds customizable multi-event rule schedules GA, Mandiant Frontline Threats Linux/macOS/GCP packs, and an Unroll processor for pipelines.

• General availability of customizable schedules for multi-event rules, enabling first-run delay offsets from 1 minute up to 48 hours to account for log ingestion latency and reduce false negatives.
• Automated true-up runs re-evaluate time windows at 4 hours (and optionally 30 hours) to capture late-arriving logs in multi-event rule detections.
• Existing custom multi-event rules can be migrated to customizable schedules directly from the Rules Dashboard.

Identity & Access Management · 2026-09-01

JumpCloud Agent 2.166.2 adds Firefox Developer Edition support for Go native messaging and on-demand required-app updates.

• Adds Firefox Developer Edition support for the JumpCloud Go native messaging host on macOS, extending browser coverage for Device User Trust enrollment.
• Required software applications with immediate delivery can now be updated on demand through local agent triggers on macOS and Windows, improving responsiveness for administrator and self-service update flows.

Secure Access (VPN / SASE / ZTNA) · 2026-09-01

Knocknoc adds nftables and Fastly as supported backends for dynamic network access control.

• Adds nftables integration to dynamically control network access on a Linux host.
• Adds Fastly integration to control which source IPs an edge service allows through.

Secure Access (VPN / SASE / ZTNA) · 2026-09-01

• New integration with nftables to dynamically control network access on a Linux host based on authenticated users.

Secure Access (VPN / SASE / ZTNA) · 2026-09-01

Knocknoc v26.08 adds Fastly ACL and native nftables enforcement, plus improved Palo Alto visibility and admin diagnostics.

• Adds Fastly ACL enforcement as a new supported enforcement target.
• Adds native nftables enforcement support.
• Improves Palo Alto visibility for administrators.

SAST / SCA / Code Security · 2026-09-01

Mend SAST now scans into dedicated per-branch projects on Azure DevOps and Bitbucket Cloud

• Adds support for scanning into dedicated projects in the Developer Platform for Azure DevOps and Bitbucket Cloud, enabling per-branch policy management and monitoring.

SAST / SCA / Code Security · 2026-09-01

Mend API 3.0 brings JWT auth, cursor pagination, and OpenAPI specs in JSON and YAML

• New Mend API 3.0 REST API available, downloadable as 3.0.json or 3.0.yaml OpenAPI descriptions.
• Authenticates via a per-organization JWT token (expires every 10 minutes) obtained using a user key from the Mend Platform profile page.
• Supports cursor pagination and result-size limiting for scalable programmatic access.

AI/LLM Security · 2026-09-01

nono v0.75.0 adds --extends to nono proxy, glob allow/deny patterns, --strict-broker-path, and resolved command_policies in profile show

• Adds --extends <PROFILE> to nono proxy, enabling the same repeatable profile-composition semantics already available on nono run — requires --profile to be set.
• Adds --strict-broker-path flag to sandbox args: refuses to start instead of warning when a filesystem grant overlaps a directory on PATH, blocking planted-binary attacks on host processes outside the sandbox.
• Adds glob pattern support for env var and hostname allow/deny lists in profile and proxy network configuration.

Exploitation & C2 · 2026-09-01

OCInferno 0.7.0 adds RPST extraction modules for OKE Kubernetes clusters and OCI Data Science pipelines.

• New exploit_kubernetes_clusters_rpst module extracts OCI resource principal RPST from OKE node instance principal by spinning up a temporary pod that accesses IMDS at 169.254.169.254; supports both Enhanced and Basic OKE clusters, accepts --cluster-id or --kubeconfig, and generates a Kubernetes Bearer token without requiring the OCI CLI.
• New exploit_datascience_pipelines_rpst module extracts RPST from OCI Data Science Pipeline runs via a CUSTOM_SCRIPT step that reads OCI_RESOURCE_PRINCIPAL_RPST, OCI_RESOURCE_PRINCIPAL_PRIVATE_PEM, OCI_RESOURCE_PRINCIPAL_VERSION, and OCI_RESOURCE_PRINCIPAL_REGION; operates in autonomous mode (--project-id) or targets an existing pipeline (--pipeline-id), with optional exfil to a listener via --output-url or retrieval from OCI Logging via --log-group-id, and optional teardown with --cleanup.
• Adds 6 new or rewritten RPST modules under the DevOps exploit surface, live-validated in PHX.

General Utilities & Libraries · 2026-09-01

OpenSSL 4.1 adds -verify_partial to openssl cms, succeeding when at least one signature in a multi-signature CMS message verifies.

• Adds -verify_partial flag to openssl cms that succeeds if at least one signature can be verified, and prints per-signature pass/fail details for all signatures in the message.

General Utilities & Libraries · 2026-09-01

OpenSSL adds dtls1_3 option to restrict connections to DTLS 1.3 only

• Adds dtls1_3 option (alongside existing dtls1 and dtls1_2) to constrain TLS clients/servers to DTLS 1.3 exclusively.

General Utilities & Libraries · 2026-09-01

OpenSSL adds DTLSv1.3 documentation, signalling new protocol support in the master branch.

• Adds ossl-guide-dtlsv13 guide page, indicating DTLSv1.3 protocol support is now documented in OpenSSL master.

General Utilities & Libraries · 2026-09-01

OpenSSL gains DTLS listener APIs, new CMS signer-info accessors, and a BIO socket-readiness call

• Adds SSL_LISTENER_FLAG_ADDRESS_VALIDATION, SSL_LISTENER_FLAG_NO_VALIDATE, and SSL_LISTENER_FLAG_SINGLE_THREAD flags to control behavior of QUIC or DTLS listener SSL objects.
• Adds SSL_VALUE_DTLS_LISTENER_MAX_DGRAM_SIZE, SSL_VALUE_DTLS_LISTENER_MAX_PENDING_CONNS, and SSL_VALUE_DTLS_LISTENER_PENDING_TIMEOUT configuration values for tuning DTLS listener capacity and timeouts.
• Adds a callback function API to report creation of QUIC or DTLS listener connection SSL objects.

Attack Surface & Exposure Management · 2026-09-01

runZero 5.1.260826.0 adds MCP OAuth, CBOM Cyclone JSON export, Censys v3, and a 100+ script custom integration library

• The MCP service now supports OAuth, including Export Token and Organization Key as OAuth Client Secrets, in addition to API Clients.
• The Cryptographic Bill of Materials (CBOM) is now exportable as a Cyclone JSON format and detailed report.
• The Censys integration now supports the Censys Platform v3 API.

Identity & Access Management · 2026-09-01

SailPoint Workflows now warns on missing trigger filters and applies filters during test runs before you enable a workflow.

• Adds missing-filter warnings in the workflow editor and on the Test Workflow experience when a filterable trigger has no filter configured.
• Applies your trigger filter against the test input during test runs, showing whether the filter matches — previously, testing ignored the trigger filter entirely.

Endpoint Security (EDR/XDR) · 2026-09-01

Sophos adds AI Defense EAP, ITDR Identity Risk Scores, new ITDR regions, and a Generative AI DNS filtering category.

• New Generative AI category in DNS Protection filtering policies gives visibility into and control over AI service usage on your networks.
• Sophos AI Defense (Early Access Program) lets EDR, XDR, and MDR customers on Sophos Fusion monitor, control, and secure AI usage across their environment.
• Sophos ITDR now surfaces a Risk Score per identity, combining breach likelihood with potential impact, powered by a patent-pending ML model that updates as findings and accounts change.

Runtime Security · 2026-09-01

Tetragon adds matchCmdArgs selector to filter on process command-line arguments in tracing policies.

• Adds matchCmdArgs selector to tracing policies, filtering on arguments passed to the current process at execution time (distinct from matchArgs, which filters arguments passed to the hook); indexes are zero-based, exclude argv[0], and support up to five matchCmdArgs filters per selector with argument indexes ranging from 0 to 31.
• Tetragon caches at most the first 256 bytes of command-line arguments (including NUL separators); arguments beyond that limit are truncated and cannot match.
• matchCmdArgs requires large BPF program support, available on Linux kernel 5.3 and later.

SAST / SCA / Code Security · 2026-09-01

Veracode CLI gains toolchain discovery, new packaging flags, SBOM export, OAuth2 login, and expanded scan capabilities across v2.38–v2.52

• Adds --exclude flag to veracode package to prevent specified Java packages or JAR files from being scanned (v2.51.0).
• Adds --skip-packagers flag to veracode package to exclude specific artifacts (e.g. unsupported SQL) from packaging without affecting other languages (v2.48.0).
• Adds --java-source flag and VERACODE_PACKAGE_JAVA_SOURCE=true environment variable to veracode package for Java source code packaging (v2.46.0).

Threat Intelligence · 2026-09-01

Yeti 2.10.0 slims the semantic search response to {score, matched, object_summary}, cutting payload size by ~86%.

• Redesigns the POST /api/v2/search/semantic response shape: each hit is now {score, matched, object_summary} instead of a full object with semantic_score and matched_on merged into it — search metadata is cleanly separated from object data.
• Adds matched field to each hit, returning the specific matching document (e.g. for a DFIQ question matched via an approach, only that approach with its description and steps is returned, not all approaches).
• Adds object_summary field to each hit, containing id, root_type, type, name, description, and tags — use the id to fetch the full object separately; dfiq_yaml is no longer included in responses.

SAST / SCA / Code Security · 2026-09-01

ZeroPath adds GET /api/v1/orgs/list endpoint to enumerate organizations via API.

• Adds POST https://zeropath.com/api/v1/orgs/list endpoint to list organizations, returning each org's id, name, and role; authenticated via X-ZeroPath-API-Token-Id and X-ZeroPath-API-Token-Secret headers.

Web Application Security · 2026-08-31

Acunetix 360 v26.8.1 adds opt-in HAR file generation for authentication verification.

• Adds opt-in HAR file generation for authentication verification, enabling practitioners to capture and inspect the full HTTP request/response exchange during auth checks.

Identity & Access Management · 2026-08-31

Aembit adds Edge SDK (TypeScript & Python), glibc amd64 CLI build, and authorizationChain field in Agent Proxy workload events.

• Adds authorizationChain field to Agent Proxy workload events — an ordered list of context IDs for the authorization events behind a request, enabling full trace-back to the directive and credential retrievals.
• Adds severity, outcome.result, and outcome.reason fields to response events when Aembit answers in place of the Server Workload, so the outcome is no longer cleared between request and response.
• Windows MSI installer now applies AEMBIT_TENANT_GRPC_PING_INTERVAL_SECS and AEMBIT_TENANT_GRPC_PING_TIMEOUT_SECS when passed as install-time properties.

Identity & Access Management · 2026-08-31

Custom Token Exchange hits GA with Dashboard management, shared transaction context, and WebAuthn biometrics as a first factor.

• Custom Token Exchange is now Generally Available for Enterprise, B2B Professional, and B2C Professional customers and during Trial periods — lets applications exchange an existing Auth0 or external-IdP token for Auth0 access, ID, and refresh tokens via custom Action logic.
• Adds shared transaction context between Custom Token Exchange Actions and Post-Login Actions via transaction metadata, enabling token customization based on subject or actor token information.
• Enables Session Delegation through Custom Token Exchange, allowing a service, AI agent, or support agent to establish a web session on behalf of a user.

Detection Engineering · 2026-08-31

Beelzebub v3.9.1 adds method-aware HTTP routing to reduce honeypot fingerprinting.

• Adds method-aware routing to the HTTP honeypot service to reduce fingerprinting by responding differently based on the HTTP method used by scanners.

Web Application Security · 2026-08-31

Bright Security adds active EXIF metadata leakage detection across multipart and JSON image upload flows

• New check actively tests multipart and JSON upload flows using JPEG and PNG canary images embedded with controlled metadata in fields such as UserComment, ImageDescription, Artist, timestamp fields, and GPS coordinates — a finding is created only when a metadata field matches exactly or a GPS coordinate pair is confirmed preserved in the served image.
• Scanner validates the full image processing path — upload endpoint, application response, image discovery via response body, redirect headers, JSON/HTML responses, image links, and rendered DOM — rather than flagging storage configuration alone.
• Detected leakage evidence includes the original upload request, the application response, the specific EXIF fields retained, and the URL where the image was found, giving teams a reproducible proof artifact usable as a testable AppSec control in CI/CD.

Exploitation & C2 · 2026-08-31

Bugcrowd adds Vulnerability Detection Report generation and Request a Response expiration removal controls.

• Adds ability to remove the expiration on a Request a Response, extending researcher response windows beyond the default deadline.
• Adds capability to respond directly to a Request a Response from within the platform.
• Adds Vulnerability Detection Report generation under Vulnerability Scanning, providing exportable scan findings for customer programs.

Attack Surface & Exposure Management · 2026-08-31

Censys upgrades host reputation to ML-based scoring with SHAP explainability and adds new Forgejo/Gitea fingerprints and risks.

• Introduces ML-based host reputation scores and labels — each host now receives a label (Benign, Suspicious, Malicious, Honeypot, or Inactive), a 0–100 score, a confidence level, and evidence for the top five signals that influenced the assessment, generated using a SHAP (SHapley Additive exPlanations) model.
• Adds a new Forgejo software fingerprint to the Platform, enabling detection of self-hosted Forgejo Git forge instances.
• Adds an Exposed Forgejo Application risk fingerprint to ASM, flagging exposed HTTP services running Forgejo due to the sensitive nature of source code, credentials, and CI/CD configurations they may contain.

Attack Surface & Exposure Management · 2026-08-31

Censys ASM gains web screenshots, full redirect paths, JavaScript library fingerprints, and JavaScript risk detection in its 2026 scanning upgrade.

• Adds automatic web screenshot capture for every web entity in ASM inventory, with exact timestamps and a historical view over time to surface exposed login pages, admin panels, and potentially compromised infrastructure.
• Adds full redirect path tracking to detect domain takeovers or incorrect redirect destinations across web entities.
• Adds JavaScript library fingerprinting using a large number of software fingerprints to surface unknown or unauthorized JS dependencies across web assets.

Container & Image Security · 2026-08-31

Chainguard Guardener launches with Hardened Actions, Commit Verification, and AI-driven Dockerfile migration via chainctl agent dockerfile

• New chainctl agent dockerfile commands run AI-driven, iterative migration of Dockerfiles to Chainguard Containers locally.
• New Hardened Actions capability recommends and migrates GitHub Actions to Chainguard's hardened, SHA-pinned equivalents via non-blocking PR review comments or scheduled/on-demand migration pull requests.
• New Commit Verification capability enforces cryptographically signed commits against a per-repository policy, supporting keyless (Sigstore) signatures and static keys such as GPG.

Container & Image Security · 2026-08-31

Chainguard Libraries for Python: source-rebuilt PyPI packages with CVE backports, CUDA wheels, and remediated index endpoints

• Adds https://libraries.cgr.dev/python/ index serving PyPI packages rebuilt from source within the Chainguard Factory, consumable via pip, uv, or poetry.
• Adds https://libraries.cgr.dev/python-remediated/ index providing older package versions with High and Critical CVEs patched, identified by a +cgr.N local version suffix (e.g., 1.1.2+cgr.1).
• Adds CUDA-specific indexes — https://libraries.cgr.dev/cu126/simple/, https://libraries.cgr.dev/cu128/simple/, and https://libraries.cgr.dev/cu129/simple/ — serving GPU-accelerated Python wheels built and tested against specific NVIDIA CUDA versions.

Container & Image Security · 2026-08-31

Chainguard Libraries for JavaScript launches with SLSA provenance, SBOMs, and a secured npm-protocol endpoint at libraries.cgr.dev

• New chainctl libraries verify PACKAGE-VERSION.tgz command verifies a package tarball's SLSA provenance attestation in a single step.
• New chainctl libraries update-hashes command updates lockfile integrity hashes in place after switching from upstream npm to Chainguard-rebuilt packages.
• Adds https://libraries.cgr.dev/javascript/ as the npm-protocol repository endpoint for Chainguard-built JavaScript packages, authenticated with credentials retrieved via chainctl.

Container & Image Security · 2026-08-31

Chainguard Libraries for Java delivers patched Maven artifacts via a drop-in repository at libraries.cgr.dev/java/ with SBOM and SLSA provenance files.

• New Chainguard Libraries for Java service rebuilds Maven Central and other common Java artifacts from source with the latest vulnerability patches and supply-chain protections, accessible at https://libraries.cgr.dev/java/.
• Adds CVE Remediation (beta for Spring Boot): patched artifacts are published with a -0.cgr.N version suffix (e.g. org.apache.commons:commons-lang3:3.18.0-0.cgr.1) so version ranges can automatically resolve to remediated builds.
• Each built artifact includes a .slsa-attestation.json SLSA provenance file and a .spdx.json SBOM file co-located with the .jar and .pom in the repository directory.

Container & Image Security · 2026-08-31

Chainguard adds custom Rego container pull policies, build pinning for Libraries, and new Windows-compatible chainctl workflows.

• Adds chainctl policies custom validate subcommand that reports the exact line and column of a policy error before storing it, enabling CI validation of Rego policy manifests.
• Introduces custom container pull policies (open beta): organizations can now write Rego expressions submitted as YAML manifests, managed via chainctl, supporting parameters with per-binding values and ENFORCE mode that blocks pulls.
• Adds chainctl libraries cache command to review which package-version copies (upstream mirror or Chainguard rebuild) your organization holds, or to opt out of build pinning.

Internet Services · 2026-08-31

Cloudflare adds GLM-5.3 models, Durable Object alarm control, JWT symmetric keys, Access token management, and Log Explorer deletion

• Adds { retryAlarm: false } option to ctx.abort() in Durable Objects, preventing alarm retries after the object resets — useful for one-shot cleanup alarms.
• JWT validation now supports symmetric HMAC keys using HS256, HS384, and HS512 algorithms, configurable via the Cloudflare dashboard or API.
• Adds grace period option when rotating Access service token secrets (1 hour to 30 days via dashboard; RFC 3339 expiration time via API), keeping both secrets valid during the window.

Internet Services · 2026-08-31

Cloudflare adds Content Signals crawl controls, new Workers AI models, symmetric JWT keys, MCP 2026-07-28 support, and Access token management improvements.

• Adds contentUse parameter to the POST /client/v4/accounts/{account_id}/browser-rendering/crawl endpoint, accepting values reference or full (default), to enforce Content Signals use directives from a target site's robots.txt; requests are rejected with a 400 if the site's declared level is more restrictive than contentUse.
• MCP server portal /mcp endpoint now accepts stateless MCP 2026-07-28 requests alongside earlier 2025 Streamable HTTP clients, with independent protocol negotiation for client and upstream connections; SSE connections continue to use the legacy protocol.
• Durable Objects can now have up to ten concurrent in-flight Dynamic Workers (increased from four), with the limit shared across all concurrent requests to the same Durable Object.

SAST / SCA / Code Security · 2026-08-31

Cloudsmith adds Nix format support, Conda/Docker cooldown policies, Broadcasts consumption tracking, and a Libraries upstream tab

• Supports the Nix package format, enabling hosting of public or private Nix binary caches with Ed25519-signed packages and upstream proxying/caching against NixOS release channels.
• Extends cooldown policies to Conda and Docker packages, protecting supply chains from newly published versions that may carry malware or lack sufficient community scrutiny.
• Adds a Libraries tab for quickly configuring library registries as upstreams, providing access to vendor-curated, pre-vetted, and security-scanned open source package feeds.

Endpoint Security (EDR/XDR) · 2026-08-31

Corellium adds the Arm RD-1AE automotive virtual hardware platform, supporting Type 1/2 hypervisors and safety islands.

• Adds the Arm RD-1AE virtual hardware platform to the Arm Virtual Hardware platform powered by Corellium, enabling virtualization of an advanced automotive reference design featuring Neoverse-V3AE application processors, Cortex-R82AE safety islands, and a Cortex-M55 Runtime Security Engine.
• Supports execution of Type 1 and Type 2 hypervisors on the RD-1AE virtual platform, including the Xen hypervisor from Arm's reference software package.
• Includes SystemReady IR support, Arm Trusted Firmware, and trusted services on the virtual RD-1AE platform.

IDS / IPS · 2026-08-31

CrowdSec adds appsec-challenge and appsec-challenge-infra bot-detection metric categories to cscli

• Adds appsec-challenge-infra metric category to cscli, exposing internal AppSec challenge runtime upkeep metrics: signing-key rotation, JS re-obfuscation, and cache eviction.

IDS / IPS · 2026-08-31

CrowdSec adds Prometheus metrics for AppSec challenge lifecycle, fingerprint mismatches, and Kubernetes datasource hits.

• Adds cs_appsec_challenge_requested_total counter tracking challenges served by the AppSec component.
• Adds cs_appsec_challenge_submitted_total counter tracking challenge responses received by the AppSec component.
• Adds cs_appsec_challenge_accepted_total counter tracking challenge cookies issued, with kind label distinguishing kind=solved (valid submissions) from kind=granted (via GrantChallengeCookie(reason)).

IDS / IPS · 2026-08-31

CrowdSec adds a Kubernetes data source to stream container logs from pods selected by labels.

• Adds a Kubernetes data source that streams container logs from pods selected by labels.

IDS / IPS · 2026-08-31

CrowdSec adds dns_cache config block with ttl, negative_ttl, and size controls for DNS lookup caching.

• Adds dns_cache configuration block with ttl (default 1h), negative_ttl (default 5m), and size (default 16384) keys to cache DNS lookups using an LRU cache, reducing repeated resolver calls.

IDS / IPS · 2026-08-31

CrowdSec v1.8.0 adds WAF bot detection with challenge/fingerprinting, a Kubernetes log datasource, and HTTP expression helpers.

• Adds WAF bot detection (waf challenge mode) that serves a challenge-and-fingerprinting page to clients before granting site access, with configurable score thresholds and cookie-disabled error messaging.
• Adds a dedicated Kubernetes datasource that fetches logs directly from the k8s API server, giving CrowdSec native k8s log acquisition without an agent proxy.
• Adds HTTP helpers to the expression language, enabling parsers and scenarios to query external services inline.

Identity & Access Management · 2026-08-31

CrowdStrike Falcon now integrates with CLEAR to trigger real-time biometric person-verification when Falcon detects identity risk.

• Correlates CLEAR1 identity verification results alongside other Falcon platform signals to determine whether activity should be allowed, investigated, or blocked.

SAST / SCA / Code Security · 2026-08-31

cve-lite-cli adds PR creation, license scanning, incomplete-data policy, and cache-bypass flags

• Adds --incomplete-policy flag to control behavior when scan data is incomplete: warn (default) prints diagnostics but exits on findings; error exits with code 3 when detection data is incomplete.
• Adds a flag to skip the query cache and force fresh results from OSV and the npm registry advisory API, with the next scan also re-fetching from all sources.
• License data for npm projects is read directly from package-lock.json with no network calls (works offline); for pnpm, Yarn, and Bun projects only direct dependencies are checked.

SAST / SCA / Code Security · 2026-08-31

• --check-licenses output supports --json and --sarif formats.

Web Application Security · 2026-08-31

Dalfox v3.2.2 adds WAF fingerprints for Wallarm/NAXSI/SafeLine, a javascript payload selector, and dalfox completion for shell completions.

• Adds dalfox completion subcommand to generate shell completions, installed alongside the man page by packages.
• Adds dalfox payload javascript selector to print canonical JavaScript execution payloads used in JS-string contexts.
• Adds slash-separated attribute breakout payloads to dalfox payload for bypassing space-stripping filters.

Web Application Security · 2026-08-31

DataDome v3 splits URL exclusion config and adds matrix-param and encoding checks by default

• Adds DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately, enabled by default with a standard list — freeing DATADOME_URL_REGEX_EXCLUSION for application-specific URL exclusions only.
• Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so matrix parameters (;) are stripped before regex evaluation, matching existing query-parameter behaviour.
• Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to inspect static-looking paths that contain any of %23, %25, %2f, %3b, or %3f.

Digital Forensics & Incident Response · 2026-08-31

dcfldd v1.8 adds runtime endianness detection for correct cross-architecture operation.

• Adds runtime endianness check so dcfldd correctly detects byte order at execution time on any supported architecture.

Vulnerability Management · 2026-08-31

DefectDojo v3.2.300 adds typed Custom Fields, GMP-over-SSH for OpenVAS, GitHub Issues import, and default deduplication identity ledger.

• Adds typed Custom Fields across seven datatypes attachable to six entity types, with values tracked in the audit log and readable/writable by Rules Engine 2.0 rules.
• Adds a new GitHub: Issues scan type so the GitHub Advanced Security connector can import repository issues as a fourth finding family; pre-existing mappings are backfilled automatically.
• The OpenVAS / Greenbone connector now supports GMP over SSH as a transport.

Reverse Engineering · 2026-08-31

Detect-It-Easy gains a documented Generic Heuristic Analysis engine for PE files with multi-pass anomaly detection and --heuristicscan --verbose support.

• Adds --heuristicscan flag (use with --verbose for the fullest report) to invoke the Generic Heuristic Analysis engine, which runs independent passes over PE images without executing the file.
• New PE heuristic engine performs surface-level emulation of native instructions around the entry point to expose proxy jumps, stack tricks, NOP padding, hidden TLS entry points, and packer stubs.
• Built-in known-plaintext attack (KPA) pass derives repeating XOR/XNOR, ADD/SUB, or reverse-subtraction keys up to 20 bytes from invariant PE-header fields to detect hidden payloads encoded in resources, sections, or overlays.

Reverse Engineering · 2026-08-31

Detect-It-Easy adds false-signature countermeasures to reduce misidentification.

• Adds false-signature countermeasures to reduce incorrect file-type or packer identification.

Reverse Engineering · 2026-08-31

Detect-It-Easy adds a documented Generic Heuristic Analysis engine for PE files with surface-level EP emulation, MSIL opcode modeling, and cross-layer evidence joining.

• Adds a Generic Heuristic Analysis engine for PE files that performs multiple specialized passes over native and managed PE images without executing the file, covering headers, data directories, sections, imports, exports, resources, .NET metadata, bytecode, overlays, debug records, and entry-point code.
• Adds operand-aware MSIL opcode modeling for managed assemblies to detect indirect calls, control-flow transformations, arithmetic mutations, invalid instruction sequences, and other .NET obfuscation patterns.
• Heuristic results are marked with (Heur) and kept visibly separate from exact signature matches; the engine can also reject misleading signature-database results and replace them with more precise heuristic conclusions (e.g. detecting Rust where a compiler signature would report C/C++).

Reverse Engineering · 2026-08-31

• Adds --heuristicscan together with --verbose CLI flags to enable and fully expose the Generic Heuristic Analysis engine, which performs multi-pass static analysis of PE files across headers, sections, imports, exports, resources, .NET metadata, bytecode, overlays, debug records, and entry-point code.
• New operand-aware MSIL opcode model for managed (.NET) PE images detects indirect calls, control-flow transformations, arithmetic mutations, encrypted strings, anti-tamper markers, fake metadata, and virtualization-like code.
• Heuristic engine includes a built-in known-plaintext attack (KPA) pass that derives repeating XOR/XNOR, ADD/SUB, or reverse-subtraction keys up to 20 bytes from invariant PE-header fields, then validates decoded payloads structurally.

Identity & Access Management · 2026-08-31

Didit adds REST API and MCP tool management for transaction-monitoring rules, plus AI-assisted rule migration from external providers.

• New /v3/transactions/rules/ Management API endpoints let you create, update, delete, and backtest transaction-monitoring rules programmatically, with matching library and install endpoints for browsing, installing, and removing preset rules from the rule library.
• New AI-assisted rule migration workflow lets the Didit assistant (or any MCP-connected agent) map a rule set exported from another provider (CSV or Excel) onto Didit's rule schema, backtest it against your transaction history, and create the rules in test mode for review before activation.

Identity & Access Management · 2026-08-31

• New endpoint DELETE /v3/biometric-templates/{template_uuid}/
• New endpoint GET /v3/biometric-templates/
• New endpoint GET /v3/biometric-templates/count/

Identity & Access Management · 2026-08-31

Didit Marketplace lets you swap identity verification engines per feature, with automatic fallback and API control via provider_key and fallback_to_native.

• Adds provider_key (string) and fallback_to_native (boolean, default true) fields to the feature config object in the Management API, enabling programmatic engine selection and fallback control outside the per-feature config reference.
• New Marketplace UI lets you connect third-party identity verification providers and select, per workflow feature node, which engine runs the check — with status labels (Active, Switch, Connect) and inline provider setup without leaving the workflow builder.
• Adds a 'Fall back to Didit if my provider fails' toggle per feature: when on (default), Didit's own engine runs automatically if the selected third-party provider is unavailable, preventing outright step failure.

Identity & Access Management · 2026-08-31

Didit workflow feature nodes now support third-party verification engines with automatic fallback via the Marketplace.

• Adds a Verification engine control to each feature node's first configuration tab, letting you run checks with Didit's own engine or switch to a third-party provider connected from the Marketplace, with automatic fallback to Didit if the provider is unavailable.

Identity & Access Management · 2026-08-31

Didit adds session deletion with granular face-biometric retention controls and retained_template source in Face Search.

• Adds DELETE /v3/session/{session_id}/delete/ endpoint that returns 200 OK with a face_retention_outcome JSON body (values: deleted, retained_with_user, none, ineligible_no_vendor_user) instead of the previous 204 No Content.
• Adds retain_face_embeddings request field to the delete endpoint: true keeps one image-free biometric template anchored to the session's User after deletion; false forces deletion regardless of application policy; null/omit follows the application's face_retention_policy.
• Adds face_retention_days field (max 3650) to the delete request body, setting a finite retention duration for a kept biometric template; required when retaining unless the application already configures face_retention_days.

Identity & Access Management · 2026-08-31

Didit adds biometric-template retention, a new Biometric Templates API, and richer Face Search match metadata.

• Adds opt-in biometric-template retention after session deletion: enable Retain biometric template (with a required finite retention period) in App Settings → Data, or set face_retention_policy and face_retention_days on PATCH /v3/webhook/.
• New Biometric Templates API: GET /v3/biometric-templates/, GET /v3/biometric-templates/count/, GET /v3/biometric-templates/{template_uuid}/, DELETE /v3/biometric-templates/{template_uuid}/, and POST /v3/biometric-templates/delete/ to list, count, inspect, and purge retained templates, with full audit trail.

Identity & Access Management · 2026-08-31

Didit adds session deletion with privacy erasure and a new Biometric Templates management API

• Adds DELETE /v3/session/{sessionId}/delete/ endpoint that returns a per-session face_retention_outcome and supports privacy_erasure instructions for GDPR-style data removal.
• Adds /v3/biometric-templates/ API to list, count, inspect, and purge image-free face templates retained after session deletion (opt-in feature).

Identity & Access Management · 2026-08-31

Didit adds biometric-template retention after session deletion, a full Biometric Templates API, and privacy-erasure controls.

• Adds face_retention_policy and face_retention_days fields on PATCH /v3/webhook/ to configure biometric-template retention at the application level, keeping image-free face embeddings alive for duplicate detection, Face Search, and biometric authentication after session data is purged.
• Adds retain_face_embeddings parameter on DELETE /v3/session/{sessionId}/delete/ and POST /v3/sessions/delete/ to override the application-level retention policy on a per-call basis.
• Adds UI control Retain biometric template (with a required finite retention period) in App Settings → Data to enable biometric-template retention.

Public Key Infrastructure (PKI) · 2026-08-31

CertCentral adds configurable default Key Usage setting for X9 PKI for TLS certificate request forms.

• Adds a configurable Default Key Usage setting on the X9 PKI for TLS Product Settings page, letting CertCentral Administrators choose whether Digital signature or Digital signature and key encipherment is pre-selected on the X9 PKI for TLS certificate request form.

Web Application Security · 2026-08-31

dirsearch gains a Python API with DirsearchFuzzer, FuzzerConfig, Wordlist, and WordlistTemplate for programmatic and agent-driven scans.

• Adds DirsearchFuzzer and FuzzerConfig Python classes — call DirsearchFuzzer(config).run() to run a scan and receive a list of FuzzerResult objects without touching the CLI.
• Adds FuzzerConfig fields headers, user_agent, http_method, timeout, follow_redirects, verify_tls, include_status_codes, and exclude_status_codes to control request behavior per scan.
• Adds session_factory parameter on FuzzerConfig to supply a pre-configured requests.Session for authenticated scans, proxy routing, client certificates, or custom retry adapters.

Web Application Security · 2026-08-31

dirsearch adds JSON-based scan session save/resume with --session, --list-sessions, and --sessions-dir flags

• Adds -s/--session flag to resume a previously saved scan session from a named directory.
• Adds --list-sessions flag to enumerate all resumable sessions, showing target URL, remaining targets and directories, jobs processed, error count, and last modified time.
• Adds --sessions-dir flag to specify a custom directory when listing or loading sessions.

Container & Image Security · 2026-08-31

Distroless hardens Node.js supply-chain trust with GPG signature verification and an update-node-keys subcommand in knife.

• Exposes update-node-keys subcommand in knife to sync committed Node.js release public keys from the upstream nodejs/release-keys repository, callable directly from CI workflows.
• Verifies Node.js SHASUMS256.txt.asc via GPG --decrypt against committed release keys stored in knife.d/nodejs_keys.asc, replacing the previous unsigned plaintext fetch — no network access for key material.
• Imports Node.js release public keys into an isolated temporary GNUPGHOME keyring (using gpg --batch --import) so GPG verification is hermetic and does not pollute the host keyring.

Secure Access (VPN / SASE / ZTNA) · 2026-08-31

DNSFilter adds DNS PreCheck v2 as default, Does Not Include query log filter, and dashboard usability upgrades

• DNS PreCheck v2 is now the default filtering mode for all Windows Roaming Clients on v3.6 and later, detecting and overriding network-level DNS hijacking (hotel Wi-Fi, captive portals, intercepting ISPs); active devices show HTTP/2.0 protocol in the DNS query log.
• Adds a Does Not Include operator to the Categories filter in the Query Log, letting admins exclude specific categories from view during investigations.
• Relay Manager v0.2.2 changes the default config file installation path to a shared system location on Windows, preventing configuration loss when user profiles are removed.

Reconnaissance & OSINT · 2026-08-31

dnsrecon 1.5.0 adds a REST API server via restdnsrecon.py, backed by FastAPI and rate-limiting.

• New restdnsrecon.py script launches a REST API server for DNSrecon, enabling programmatic DNS reconnaissance over HTTP.

Reconnaissance & OSINT · 2026-08-31

dnsrecon 1.5.3 adds recursion control to DnsHelper with new CLI options; 1.5.2 adds Python 3.14 support

• Adds recursion control to DnsHelper with corresponding CLI options, giving practitioners direct control over DNS query recursion behavior.
• Switches crt.sh certificate transparency enumeration from HTML scraping to the JSON API for more reliable subdomain discovery.

Reconnaissance & OSINT · 2026-08-31

dnsrecon 1.5.3 adds recursion control to DnsHelper with new CLI options and switches crt.sh enumeration to the JSON API.

• Removes the lxml dependency, simplifying installation with no external XML library required.

Reconnaissance & OSINT · 2026-08-31

dnsrecon 1.6.0 adds Shodan integration for netblock expansion during DNS enumeration

• Adds Shodan support for netblock expansion during DNS enumeration, plus API enhancements to leverage it.

Network Analysis & Monitoring · 2026-08-31

Driftnet 1.2.0 adds an HTTP/WebSocket-based display, Windows (Cygwin) support, interface listing, and monitor mode.

• Adds a new HTTP and WebSockets-based display mode as an alternative to the traditional GUI display.
• Lets operators run Driftnet under Cygwin to capture and view network images from Windows hosts.
• Adds options to list available capture interfaces.

Network Analysis & Monitoring · 2026-08-31

• Adds a new HTTP and WebSockets-based display mode for viewing captured media.

Network Analysis & Monitoring · 2026-08-31

Driftnet v1.4.0 adds WebP image capture support and libwebsockets >= 4.3.0 compatibility.

• Adds WebP image format support, enabling capture and display of WebP images from intercepted traffic.
• Adds support for libwebsockets >= 4.3.0, enabling use with newer versions of the websockets library.

Digital Forensics & Incident Response · 2026-08-31

• Adds a built-in BitLocker TPM exploit library supporting the YellowKey and GreatXML exploits, with the installer offering to build a second USB flash drive loaded with the exploit during setup.
• Adds checksum logging for disk images captured during triage.

SAST / SCA / Code Security · 2026-08-31

Endor Labs adds a real-time proxy that intercepts package manager requests and blocks known malicious packages before installation.

• Adds a real-time malicious-package interception layer that sits between package manager clients and public registries, blocking known malicious packages at install time while passing safe packages through unchanged.

SAST / SCA / Code Security · 2026-08-31

Endor Labs adds Bazel dependency resolution for iOS/macOS apps built with rules_apple 4.0.0+

• Supports SCA scanning of Bazel ios_application, ios_framework, macos_application, and related bundle and test rules built with rules_apple 4.0.0 or later, covering Swift, Objective-C, and prebuilt framework/XCFramework dependencies; scans must run on a macOS host with Bazel aspects enabled.

Secure Access (VPN / SASE / ZTNA) · 2026-08-31

API surface changed: +13 endpoints

• New endpoint GET /defender_devices
• New endpoint GET /defender_devices/{id}
• New endpoint GET /defender_posture_providers

Endpoint Security (EDR/XDR) · 2026-08-31

Fleet API adds is_personal_enrollment field to distinguish BYOD (personal) MDM enrollments on host records.

• Adds mdm.is_personal_enrollment field to host API responses, indicating whether the last MDM enrollment Fleet recorded was personal (BYOD); persists for unenrolled Android and Apple mobile hosts, and resets on macOS/Windows once the enrollment profile is removed.

Secrets Detection & Management · 2026-08-31

GitGuardian adds AI-agent verdicts on public leaks, AWS S3 bucket scanning, and auto-monitoring for Jira, Confluence, and Teams.

• Adds AI-agent analysis of public secret incidents, producing a Company-related verdict (Related, Uncertain, or Unrelated) available as a column, a filter, and three ready-made saved views — replacing the ML risk score on public incidents.
• Adds a new Analysis tab on public incidents showing the company the agents identified, their reasoning, the risk score with its rationale, and which agent concluded.
• New AWS S3 bucket scanning integration: connects via OIDC-assumed read-only IAM role (no long-lived keys), lets you select individual buckets and assign them to teams, scans objects and contents of archives (e.g. tar.gz), and surfaces findings as regular incidents with existing severity, validity, playbooks, and notifications.

Secrets Detection & Management · 2026-08-31

GitGuardian now scans AWS S3 buckets, including ZIP and tar.gz archives, for exposed secrets routed into existing incident workflows.

• Adds AWS S3 bucket scanning to GitGuardian's monitored perimeter, performing historical scans of accumulated objects — including backups, CI/CD logs, and Terraform state files — to surface exposed credentials as incidents.
• Extends S3 secret scanning into supported ZIP and tar.gz archives, surfacing credentials stored inside compressed objects that are not directly visible in the S3 console.
• Routes S3 findings into existing GitGuardian incident workflows, enabling triage, ownership assignment, and remediation alongside secrets found in other sources.

Secrets Detection & Management · 2026-08-31

GitGuardian Self-Hosted 2026.8.0 adds ClickHouse analytics, an MCP server, custom validity via API, AI-powered incident search, and 25+ new secret detectors.

• Adds clickhouse-backup sidecar and ClickHouse as an optional in-cluster column-oriented database (StatefulSet backed by S3-compatible object storage) deployable via Helm or KOTS, powering Endpoint Protection analytics; becomes mandatory in 2027.1.0.
• Adds a GitGuardian Remote MCP server deployment (Helm only, beta, disabled by default) that runs in-cluster so no traffic or secrets leave the network — point Claude, Cursor, or any MCP client at the instance to scan for leaked credentials, manage incidents, and deploy honeytokens from the IDE.
• Adds a Set your own validity status API call that accepts valid or invalid for secrets on internal systems GitGuardian cannot reach; incidents display Custom validity with the date set, recorded in the incident activity log and audit log.

SAST / SCA / Code Security · 2026-08-31

GitHub Copilot in VS Code gains side-chats, cross-window agent sessions, text search, token usage hover, and multi-language dictation.

• Adds /btw slash command to open a side chat that shares the primary chat's context and prompt cache while the main chat continues running.
• Adds experimental /rubber-duck command in a Copilot Agent Host session to ask a complementary model to surface missed details and edge cases.
• Adds text search across the complete chat transcript with options for case matching, whole words, and regular expressions.

SIEM · 2026-08-31

Google SecOps adds an Unroll processor for pipeline event-breaking and expands Mandiant Frontline Threats rule packs to Linux, macOS, and Google Cloud.

• Adds the Unroll processor (event breaking) to Google SecOps data processing pipelines, splitting log entries that contain arrays or slices of events into individual log events before parsing and ingestion.
• Requires a Transform processor (e.g., set(body, ParseJSON(body))) positioned before the Unroll processor in the pipeline execution sequence when inputs are raw string payloads.
• Adds three new Mandiant Frontline Threats rule packs to the Content Hub: Mandiant Frontline Threats for Linux, Mandiant Frontline Threats for MacOS, and Mandiant Frontline Threats for Google Cloud.

Exploitation & C2 · 2026-08-31

NodeZero adds Azure Cloud Pentest support with role-based gray-box testing and pre-launch quota validation.

• New Azure Cloud Pentest type available from the Pentests page under Run Assessment > Infrastructure > Azure Cloud Pentest, scoped per Tenant ID and Subscription ID.
• Role-based testing lets you select built-in Azure roles (Reader, Contributor, Virtual Machine Contributor) or any custom roles on the subscription to control gray-box depth.
• Pre-launch validation checks subnet IP space, NSG outbound connectivity on TCP 443, regional vCPU quotas (minimum 4 Total Regional vCPUs and 4 Standard DSv3 Family vCPUs), VM and network interface quotas, allowed VM SKUs (Standard_D4s_v3 required), allowed locations, denied resource types (Microsoft.Compute/virtualMachines), and managed-disk policy before the pentest is allowed to launch.

Exploitation & C2 · 2026-08-31

NodeZero adds Azure Cloud Connection setup, enabling Azure tenant and subscription authorization for Azure Cloud Pentests.

• New Pentests > Cloud Connections section in the NodeZero Portal lets practitioners create and manage Azure cloud connections for running Azure Cloud Pentests.
• Supports adding Azure subscriptions via direct Subscription ID entry or by uploading a CSV file with a required id column header.
• Tenant verification step reads Microsoft-verified domains from Microsoft Entra to confirm tenant ownership before granting access.

Exploitation & C2 · 2026-08-31

NodeZero adds Azure Cloud Pentest: assumed-breach assessment combining Azure API enumeration with an Internal Pentest, deployed via managed identity.

• New Azure Cloud Pentest type combines Azure API enumeration with an Internal Pentest in a single run, covering both cloud resources and workloads on Azure VMs — no on-premises infrastructure required.
• NodeZero deploys a temporary Standard_D4s_v3 VM into a subscriber-selected subnet and authenticates via a managed identity, eliminating the need to inject long-lived Azure credentials.
• A Horizon3 Cloud Connector Custom Role is provisioned with 28 permissions across Microsoft.Authorization, Microsoft.Compute, Microsoft.ManagedIdentity, Microsoft.Network, and Microsoft.Resources — the minimum needed to deploy and tear down the test VM.

Exploitation & C2 · 2026-08-31

NodeZero adds a WebApp test type for web application penetration testing.

• Adds a new WebApp test type to NodeZero, enabling web application-focused penetration tests alongside existing test types.

Exploitation & C2 · 2026-08-31

NodeZero adds Azure Cloud Pentest and Azure Entra ID support, including AD Password Audit capabilities.

• New Azure Cloud Pentest capability lets practitioners set up an Azure connection, run cloud pentests, manage connections, and perform manual cleanup.
• New AD Password Audit feature audits Active Directory passwords within Azure Entra ID.

Reconnaissance & OSINT · 2026-08-31

httpx v1.11.0 adds -kb knowledge-base classification flag and chrome/JA3 strategies for TLS impersonation

• Adds -kb / -knowledge-base flag to make page-type classification opt-in rather than always-on.
• Adds chrome and JA3 strategies to the existing -tls-impersonate flag for more realistic TLS fingerprint spoofing.

Identity & Access Management · 2026-08-31

iDenfy AML monitoring now supports up to 5 custom tags (max 100 chars each) for filtering and organizing monitored subjects.

• Adds support for up to 5 custom tags (maximum 100 characters each) per entry in the AML monitoring list, enabling filtering and organization of monitored subjects via the List AML monitorings endpoint.

Identity & Access Management · 2026-08-31

iDenfy adds standalone bank card verification API, RRE dataset for AML, 1:N face matching, liveness deepfake detection, and IP proxy risk checks.

• New POST endpoint to create a standalone bank card verification session via the iDenfy API, returning session URL, mobile code, and redirect details; requests with insufficient account balance are rejected with 402.
• New bank-card-verification-completed webhook delivers standalone bank card verification results including match statuses, no-match reasons, and card data returned — distinct payload from the KYC-linked result.
• New bank-card OpenAPI spec (/openapi/bank-card.yaml) published alongside updated specs for kyc, kyb, aml, bank, face-authentication, and age-estimation.

Post-Exploitation · 2026-08-31

Impacket gains AES-128-GCM for SMB3, new shadow-credentials backup options, and hardened-DC keylistattack support

• Adds --shadow-credentials and --interactive options to back up (and clear) existing msDS-KeyCredentialLink attributes.
• Adds AES-128-GCM cipher support to the SMB3 client.
• Extends keylistattack to support PAC-hardened domain controllers.

Post-Exploitation · 2026-08-31

Impacket PRs add PKINIT client (RFC 4556/5349/4557), MS-COMA/MS-FSRVP/MS-SCMR protocols, WMI kwargs calling, LSA dump relay attack, and more.

• Adds a PKINIT client implementing RFC 4556, RFC 5349, and RFC 4557 for certificate-based Kerberos authentication (#2260).
• Adds MS-COMA protocol implementation (#2266).
• Adds MS-FSRVP and MS-SCMR protocol implementations (#2265).

Threat Intelligence · 2026-08-31

API surface changed: 25 modified

• GET /action-center/overview: response schema changed
• GET /alerts/trends: response schema changed
• GET /blocklist/download/{filename}: response schema changed

Data Security & DLP · 2026-08-31

Jazz's Melody agentic investigator is now available as a native app in the CrowdStrike Foundry catalog.

• Adds Jazz as an installable app in the CrowdStrike Foundry app catalog, routing Falcon sensor data-protection signals through Melody's investigation pipeline and returning pre-investigated findings directly into the Falcon console.
• Melody automatically closes findings that require no human attention, with every closure documented and evidence attached, directly within the Falcon analyst workflow.
• Optional Jazz endpoint agent extends Melody's coverage beyond the Falcon sensor to prompt-level GenAI visibility, desktop applications, shadow IT, and personal cloud accounts, with under 1% CPU overhead.

SAST / SCA / Code Security · 2026-08-31

JFrog Platform Federation introduces a peer-to-peer mesh that syncs projects, access control, curation policies, and repositories across every site automatically.

• Adds Projects Federation, which synchronizes multi-tenant workspaces, project- and global-level roles, SDLC release-stage gates, and identity access tokens across every peer site in the mesh in seconds.
• Adds Curation Federation, which propagates open-source blocking rules, waivers, and approvals from any peer site to every regional pipeline worldwide within seconds of being set.
• Adds Automated Repository Provisioning, which creates and configures repositories on the correct sites automatically based on a Stage-to-Site mapping, eliminating per-repo and per-site manual administration.

SAST / SCA / Code Security · 2026-08-31

JFrog Platform Federation adds Projects Federation, Curation Federation, and Automated Repository Provisioning for peer-to-peer multi-site sync.

• New Automated Repository Provisioning creates and replicates repositories across sites based on a Stage-to-Site mapping, eliminating per-repo, per-site manual setup when a new site joins the mesh.
• New JFrog Platform Federation introduces a peer-to-peer mesh architecture that connects distributed JFrog sites into a single logical control plane, replacing hub-and-spoke and script-based coordination.

Identity & Access Management · 2026-08-31

JumpCloud Access Risk Detection adds per-user behavioral baselines, weighted anomaly scoring, and a Needs Review dashboard for proactive identity threat response.

• New Access Risk Detection capability builds a unique behavioral profile per user, drawing on 60 days of continuous activity or the last 50 successful logins to establish individual baselines.
• Introduces user-centric anomaly scoring that correlates concurrent signals (e.g., unfamiliar browser paired with impossible travel) into a single weighted risk score.
• Adds three-tier severity mapping — Low, Medium, and Critical — so admins immediately know which events require immediate action versus routine review.

SAST / SCA / Code Security · 2026-08-31

Lakera adds Custom Guardrails (beta): plain-language detection policies mixing pattern and semantic rules, no code required.

• New Custom Guardrails (beta) capability lets practitioners describe detection targets in plain language — the built-in AI assistant compiles the description into a detection policy, asking clarifying questions when scope is ambiguous.
• Supports two composable rule types: deterministic pattern rules (IP addresses, national identifiers, internal ticket/account ID schemes) and semantic rules that detect meaning and intent across languages and paraphrases.
• Semantic rules expose a LOW / MEDIUM / HIGH detection threshold (default HIGH) to tune recall vs. false-positive rate without rewriting the rule description.

SAST / SCA / Code Security · 2026-08-31

Lakera adds custom guardrails (beta) letting practitioners define bespoke detection policies in plain language.

• Adds custom guardrails (beta) that let practitioners describe detection logic in plain language; a built-in AI assistant compiles the description into a detection policy combining pattern rules for structured formats with semantic rules for content and intent.

SAST / SCA / Code Security · 2026-08-31

Lakera Guard adds beta access to custom security and content controls defined in natural language.

• New beta feature lets practitioners define and fine-tune custom security and content controls using natural language rules.

Identity & Access Management · 2026-08-31

Material Security adds granular Drive detections, natural-language detection creation, flexible remediation flows, and a file audit log

• Separates previously combined sensitive-content detections into distinct categories — passwords, payroll information, and social security numbers each now produce their own individual detection — giving analysts a clearer, more actionable risk view
• Extends natural language search to detection creation, so analysts can describe what they want to detect in plain English and activate it as a live detection without writing MQL or building a structured query
• Introduces configurable remediation flow options for overpermissioned files, letting security teams set the order of notifications, grace periods, and remediation actions to match organizational sharing policies

AI/LLM Security · 2026-08-31

Mend Renovate adds protobuf + gRPC exporter support and GitHub GraphQL rate-limit handling across v44.49–44.52.

• Adds protobuf + gRPC exporter support to instrumentation (closes #36073).
• Sets isExecutable on added and modified files in the manager/copier manager.
• Returns a RepositoryResult during the onboarding phase (closes #22198).

AI/LLM Security · 2026-08-31

Mend API 3.0 launches with JWT auth, cursor pagination, and OpenAPI specs in JSON and YAML

• Adds Mend API 3.0, a REST-compliant API with broader programmatic access for any user with Mend credentials, authenticated via a user key from the Mend Platform profile page.
• Introduces per-organization JWT token authentication with 10-minute expiration for improved security.
• Supports cursor pagination and result-size limiting for scalable data retrieval.

SAST / SCA / Code Security · 2026-08-31

Mend SAST 26.8.1 adds per-data-flow probability risk, new CWE detections for JS/TS and Rust, and branch-level project scanning on Azure DevOps and Bitbucket Cloud.

• Adds probability risk factor display next to each data flow in finding details, giving more granular triage information per finding.
• Adds detection for CWE-99 (Improper Control of Resource Identifiers / Client Resource Injection) in JavaScript and TypeScript.
• Adds detection for CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-321 (Use of Hard-coded Cryptographic Key) for Rust.

SAST / SCA / Code Security · 2026-08-31

Mend Renovate 44.50.0 adds protobuf + gRPC exporter for instrumentation and improves GitHub rate-limit handling.

• Adds protobuf + gRPC exporter support to Renovate's instrumentation pipeline (closes #36073).
• GitHub GraphQL responses with graphql_rate_limit errors are now treated as rate-limiting, enabling proper back-off behaviour.
• Sets isExecutable on added and modified files in the copier manager.

SAST / SCA / Code Security · 2026-08-31

Mend Platform API 3.0 launches with JWT auth, cursor pagination, and OpenAPI specs in JSON and YAML

• Cursor pagination and result-size limiting now supported across API responses for scalable data retrieval.
• OpenAPI description downloadable in 3.0.json and 3.0.yaml formats for integration with tooling and client generation.

SAST / SCA / Code Security · 2026-08-31

Mend SCA launches API 3.0 with JWT auth, cursor pagination, and OpenAPI spec in JSON/YAML

• New Mend API 3.0 REST API provides programmatic access to SCA workflows for any user with Mend credentials via a user key from the Mend Platform profile page.
• Supports cursor pagination and result-size limiting for scalable programmatic access to large datasets.

Digital Forensics & Incident Response · 2026-08-31

MVT gains a plugin management subsystem with mvt plugins list and mvt plugins check-updates commands.

• Adds mvt plugins list subcommand to audit installed plugin packages, showing each plugin's name, version, origin (pypi, git+<commit>, or local), number of forensic modules contributed, and any CLI commands it adds.
• Adds mvt plugins check-updates subcommand to immediately check all installed plugins for available updates, printing the exact pip install -U <package> command needed to upgrade — MVT never upgrades automatically.
• Adds automatic plugin update banner printed at command startup (at most once every 12 hours, caching the result between checks) that shows available plugin updates without a network lookup on every invocation.

Digital Forensics & Incident Response · 2026-08-31

MVT gains a namespaced plugin configuration API so third-party plugins can store settings, credentials, and data without touching MVT's own config.yaml.

• Adds MVTPluginSettings base class in mvt.plugin for plugin authors to declare typed, namespaced settings with defaults; subclass it, set plugin_name, and call load() / save() to persist configuration.
• Plugin settings are stored at ~/.config/mvt/plugins/<plugin name>.yaml (Linux) or the platform equivalent, created with 0600 permissions; MVT creates the plugins/ directory at 0700.
• Adds plugin_config_path() from mvt.plugin to retrieve the correct per-plugin settings file path without hard-coding platform-specific directories.

Digital Forensics & Incident Response · 2026-08-31

MVT gains a plugin system for custom CLI commands, loadable via entry points, --load-command, or environment variables.

• Adds --load-command <file-or-folder> flag to mvt, mvt-ios, and mvt-android for loading custom Click commands at runtime without reinstalling a package; repeatable and accepts folders of *.py files.
• Adds MVT_CUSTOM_COMMANDS, MVT_IOS_CUSTOM_COMMANDS, and MVT_ANDROID_CUSTOM_COMMANDS environment variables to auto-load command files or folders on every invocation of their respective CLIs.
• Supports registering custom commands as installable Python packages via pyproject.toml entry-point groups mvt.ios.cli_plugins, mvt.android.cli_plugins, and mvt.cli_plugins to permanently extend each CLI.

Digital Forensics & Incident Response · 2026-08-31

MVT gains a plugin system for custom forensic modules, with path-based loading, dependency declarations, and module replacement support.

• Adds --module flag support for selecting individual modules, including custom plugin modules, while running their transitive dependencies automatically.
• Introduces a plugin package system: a Python package installed alongside MVT registers custom forensic modules via an entry point (mvt_plugin_example_org:get_modules) and they load automatically into every supported command.
• Adds path-based module loading via a new flag (accepts a Python file or a folder of .py files) for developing modules locally before packaging; can be repeated and loads files in sorted order.

Digital Forensics & Incident Response · 2026-08-31

MVT adds mvt download-iocs command to automatically fetch the latest public indicator files.

• Adds mvt download-iocs command to automatically download the latest public indicator of compromise files, with per-platform equivalents for iOS and Android.

Digital Forensics & Incident Response · 2026-08-31

MVT adds a unified mvt completion command generating a single shell completion script for bash, zsh, and fish.

• Adds mvt completion command that generates a single shell completion script covering all MVT subcommands, replacing the previous per-command mvt-ios completion and mvt-android completion scripts.
• Supports bash completion via script output to ~/.mvt-complete.bash.
• Supports zsh completion via script output to ~/.mvt-complete.zsh.

Reconnaissance & OSINT · 2026-08-31

Nmap adds separate IPv4/IPv6 trie structures and a new SAP HANA database service probe

• Adds a SAP HANA database service probe, expanding Nmap's service/version detection coverage.

AI/LLM Security · 2026-08-31

nono adds deny_domain config key and --deny-domain CLI flag with three wildcard forms for precise host blocking.

• Adds deny_domain config key to block specific hosts through the proxy before the allowlist is checked, letting it carve exceptions out of broad network profile entries.
• Adds --deny-domain CLI flag as the command-line equivalent of the deny_domain config key.
• Supports three wildcard forms in deny_domain entries: a bare * matches any host; a leading * (e.g. *.example.com) matches one or more subdomain labels but not the apex; and a * occupying a whole label elsewhere (e.g. jenkins.*.ci.example.com) matches exactly one label at that position.

AI/LLM Security · 2026-08-31

nono CLI gains wildcard pattern matching and case-insensitive variable filtering for environment profiles

• Adds * wildcard support anywhere in environment variable patterns (leading, trailing, or middle) within profile config, matching any run of characters — e.g. *_TOKEN, AWS_*_SESSION, *SECRET*.
• Adds case_insensitive_vars: true config key to match variable names and patterns case-insensitively (ASCII only), so a pattern like gh_token also matches GH_TOKEN, Gh_Token, etc.
• case_insensitive_vars is sticky across extends: once a base profile sets it to true, child profiles cannot silently revert it.

AI/LLM Security · 2026-08-31

nono ambient credentials gain a format field to shape phantom token prefixes for picky clients

• Adds a format field to ambient credential declarations, accepting a literal template with exactly one {} placeholder (e.g. "sk-ant-oat01-{}"), so phantoms are issued with a recognizable prefix instead of a bare token — the template is stripped on egress so the real credential is never exposed upstream.
• format is rejected on non-ambient credentials, when the value contains control characters, or when the minting rule also sets shape: "jwt".

SAST / SCA / Code Security · 2026-08-31

Codex Security CLI gains a documented GitLab CI/CD pipeline for diff scanning, SARIF publishing, and verified automated remediation.

• Adds a GitLab CI/CD pipeline integration that installs @openai/codex-security@0.1.20 and runs codex-security scan . --diff <base> --head <sha> --auth api-key --output-dir <dir> --json to scan committed diffs in protected merge requests.
• Exports scan results with codex-security export <results-dir> --export-format sarif --source-root <project-dir> --output <file>.sarif for ingestion into GitLab Ultimate 19.2+ via the reports.sarif artifact key.
• Introduces a two-stage scan/gate pattern: a codex-security job in security_scan publishes SARIF artifacts, then a separate codex-security-gate job in security_gate restores the scanner exit code (0 = pass, 1 = findings, 2 = incomplete/error).

Post-Exploitation · 2026-08-31

Peirates adds multi-architecture distribution builds via make dist with DIST_COMPRESS and DIST_ARCHES controls

• Adds DIST_ARCHES=amd64 (and similar) environment variable to build a subset of architectures instead of all four.
• Adds make build as an explicit target (in addition to the default build) to generate a statically linked Linux AMD64 executable in the repository root.

Digital Forensics & Incident Response · 2026-08-31

Plaso adds an ESXi text log parser plugin (plaso.parsers.text_plugins.esxi).

• Adds plaso.parsers.text_plugins.esxi, a new text parser plugin for parsing VMware ESXi log files.

Digital Forensics & Incident Response · 2026-08-31

Plaso adds an ESXi log text plugin and new systemd journal event data fields for richer forensic parsing.

• Adds plaso.parsers.text_plugins.esxi module with ESXiLogTextPlugin and ESXiLogEventData classes to parse VMware ESXi log files, including the syslog_priority attribute on event data.
• Adds new attributes to plaso.parsers.systemd_journal.SystemdJournalEventData: audit_session_identifier, control_group, effective_capabilities, message_type_identifier, owner_user_identifier, systemd_invocation_identifier, systemd_session_identifier, and systemd_slice.

SAST / SCA / Code Security · 2026-08-31

Portkey MCP Gateway adds Gmail integration for reading, sending, and managing email from AI agents via OAuth 2.1

• Adds https://mcp.portkey.ai/gmail/mcp as a hosted MCP Gateway endpoint for Gmail, enabling AI agents to read, send, and manage email without running a self-hosted binary.
• Supports Gmail OAuth 2.1 with manual OAuth metadata — configure client_id, client_secret, redirect_uri, and scope in Portkey Advanced Configuration using slug gmail and server URL https://gmailmcp.googleapis.com/mcp/v1.
• Exposes Gmail MCP tools list_messages (with maxResults, labelIds, q, pageToken parameters) and get_message (with id and format parameters) for agent-driven mailbox operations.

General Utilities & Libraries · 2026-08-31

pipx 1.17.0 adds PIPX_COOLDOWN env var as a global default for --cooldown across all commands.

• Adds PIPX_COOLDOWN environment variable to set a global default for --cooldown, so a single release-age policy applies to every pipx command; an explicit --cooldown flag still takes precedence, --cooldown 0 opts a single command out, and locked installs ignore the variable rather than failing.
• Extends pipx run --spec <spec> <app> on the uv backend to build a pipx-managed venv when the app name differs from the spec's normalized distribution name, or when the spec carries no name at all, so pipx correctly honors the package's [pipx.run] entry point.
• Adds PIPX_MAX_LOGS as a valid value for pipx environment --value, so it can now be queried without exiting with invalid choice.

General Utilities & Libraries · 2026-08-31

• Adds --global option support that overrides default pipx home, app, and manual pages locations system-wide.
• Adds {human,json} output format selection across multiple commands.
• Adds {pip,uv} backend selection across multiple commands.

AI/LLM Security · 2026-08-31

Reality Defender adds a POST /api/files/social endpoint for submitting social content for deepfake detection.

• Adds POST https://api.prd.realitydefender.xyz/api/files/social endpoint to submit social media content for analysis, authenticated via the x-api-key header.

Continuous Control Monitoring (CCM) · 2026-08-31

RegScale CLI 6.43.0 adds dry-run milestone mapping for JCAM POA&M imports before committing data.

• The jcam dry_run command now follows POA&Ms through to their milestones, letting practitioners verify milestone mapping before a live import rather than after.
• Samples a subset of POA&Ms per system during jcam dry_run by default, so the mapping is proven without enumerating every record.

Identity & Access Management · 2026-08-31

SailPoint SecOps Identity Intelligence integrates with CrowdStrike Falcon Next-Gen SIEM to bring identity governance and access data into SOC workflows.

• Brings SailPoint identity governance, access, and risk data for human, machine, and AI agent identities into Falcon Next-Gen SIEM for use during security investigations.
• Enables correlation of SailPoint identity data alongside endpoint, cloud, threat intelligence, and third-party telemetry already present in Falcon Next-Gen SIEM.

Compliance Automation & Trust Management · 2026-08-31

Scrut Automation adds a HiBob integration to sync employee directory data into the People module for compliance workflows.

• New HiBob integration syncs employee and group data from HiBob into Scrut's People module, supporting onboarding, offboarding, and personnel compliance workflows.
• Syncs fields including employee name, work email, employment start/end dates, employment status, department, manager email, and approved leave dates from HiBob into Scrut.
• Calls HiBob's People Search API during sync; HiBob returns only fields the service user is permissioned to access, enabling data minimization by restricting service user permissions in HiBob.

Compliance Automation & Trust Management · 2026-08-31

Scrut adds Shadow AI governance, HiBob integration, AI-assisted SOC 2 descriptions, and vendor questionnaire import via CSV/XLSX

• New HiBob integration syncs employee data with read-only permissions, automates People directory updates, and supports onboarding and offboarding workflows.
• New AI-assisted SOC 2 System Description creation lets users generate, review, edit, and publish a System Description directly into the SOC 2 audit package, or upload an existing document.
• New vendor questionnaire import supports CSV and XLSX files with question formatting, answer options, risk scores, and conditional follow-up questions.

SAST / SCA / Code Security · 2026-08-31

SAST / SCA / Code Security · 2026-08-31

Socket adds Asana alert ticketing, PHP/Composer beta support, and Firefox extension scanning

• New Asana integration lets teams create and manage Asana tasks from Socket alerts, either manually or via ticketing rules that filter by event, type, priority, and repository — with configurable sync between task and alert status; available in beta on Business and Enterprise plans.
• PHP and Composer support promoted from Experimental to Beta and now available to all Socket users; PHP reachability analysis is generally available for Team plan customers and above without requiring Experimental access.
• New Firefox extension scanning covers every extension in Mozilla's official add-ons directory, monitoring for permission changes, network activity, malware, credential and clipboard theft, data exfiltration, remote loading, obfuscation, and impersonation; available in Experimental for Enterprise customers.

SAST / SCA / Code Security · 2026-08-31

SonarQube adds MCP server integration, Cursor/Copilot CLI plugins, SSO migration guide, and customer-managed encryption keys

• Adds SonarQube MCP server support via Vortex, enabling SonarQube code quality and security analysis inside any AI agent's agentic loop.
• Adds a SonarQube plugin for the Cursor IDE, Cursor CLI, and Cursor Agent Window, bringing code quality, security analysis, and secrets detection into AI coding sessions.
• Adds a SonarQube plugin for GitHub Copilot CLI to surface code quality and security analysis inside AI coding sessions.

Endpoint Security (EDR/XDR) · 2026-08-31

Sophos Mobile adds Apple Declarative Device Management (DDM) policies and improved Web Filtering guidance.

• Adds Apple Declarative Device Management (DDM) policies, enabling desired-state configuration where devices self-maintain status and report changes immediately without waiting for periodic sync.
• Improves Web Filtering pages in Mobile Threat Defense policies for Android and iOS, and the Chrome Security policy for ChromeOS, with clearer guidance that protocol prefixes such as https:// or chrome:// must not be included in the Allowed domains and Blocked domains fields.

SIEM · 2026-08-31

Sumo Logic lets you provision the SOC Analyst Agent as part of a child org baseline, with configurable daily investigation limits.

• Enables provisioning of the SOC Analyst Agent when creating or editing a child org baseline, with controls for Number of investigations per day and optional overage alongside existing Logs, Metrics, Traces, and Cloud SIEM Enterprise baselines.

SIEM · 2026-08-31

API surface changed: +7 endpoints, 5 modified

• New endpoint GET /v1/multi-account-management/content/sync
• New endpoint GET /v1/multi-account-management/content/sync/{jobId}/info
• New endpoint GET /v1/multi-account-management/content/sync/{jobId}/result

SIEM · 2026-08-31

Sumo Logic adds Druva app, four GA automation integrations, PostgreSQL support for Cloud SQL, and two new Terraform resources.

• Adds two new resources to the SumoLogic Terraform Provider v3.3.0: sumologic_async_aws_lambda_invocation and sumologic_s3_logging_lambda_enable.
• New Sumo Logic app for Druva - Platform Events enables monitoring of Druva via a webhook-based integration.
• Four Automation Service Integrations are now generally available: AWS Lambda, DFIR-IRIS, Google Cloud Functions, and LaunchDarkly.

SIEM · 2026-08-31

Sumo Logic dashboards gain auto-refresh guardrails: hidden-tab pause after 10 min and panel exclusion after 5 consecutive failures.

• Adds hidden tab pause guardrail: auto-refresh pauses when you navigate away from a dashboard tab for more than 10 minutes and resumes automatically on return.
• Adds panel failure exclusion guardrail: a panel is dropped from auto-refresh after 5 consecutive query failures, preventing it from disrupting other healthy panels.

Secure Access (VPN / SASE / ZTNA) · 2026-08-31

Tailscale releases tailcat, a netcat-like CLI and Go package using Tailscale's WireGuard data plane with no accounts, IPs, or control plane

• New tailcat CLI tool and open-source Go package lets two machines exchange bidirectional bytes over Tailscale's magicsock (WireGuard + NAT traversal + DERP relay) with no Tailscale account, no IP addresses visible to users, and no OS-level networking changes (no TUN devices, no routing table modifications).
• Client mode supports running a child process (e.g. curl) with an ephemeral local SOCKS proxy via an environment variable, letting tailcat-oblivious programs use the encrypted tunnel transparently.
• Supports optional key locking so the server can restrict which client public keys are permitted to connect.

Endpoint Security (EDR/XDR) · 2026-08-31

Endpoint Alerts now enforces Asset Visibility Management scopes, limiting alert and endpoint visibility per user.

• Endpoint Alerts now enforces Asset Visibility Management scopes so users only see alerts and impacted endpoints within their assigned visibility scope — navigate to Endpoint Security → Endpoint Alerts to observe the scoped view.

Endpoint Security (EDR/XDR) · 2026-08-31

Trend Vision One adds automatic inactive account disabling with configurable thresholds of 30, 60, 90, or 180 days.

• Adds Inactive user account auto-disable option in the User Accounts app Settings menu, with inactivity thresholds of 30, 60, 90, or 180 days to automatically disable local accounts that have not signed in within the configured period.
• Adds a Status set by column in User Accounts showing whether an account's current status was last changed by a user or by the system.
• All auto-disable configuration changes and every manual or automatic account disable action are recorded in the audit log.

Endpoint Security (EDR/XDR) · 2026-08-31

Trend Vision One adds automatic disabling of inactive local user accounts with configurable thresholds of 30–180 days.

• Adds an Inactive user account auto-disable option in the User Accounts app (Settings menu, top right of console) letting administrators automatically disable local accounts inactive for 30, 60, 90, or 180 days.
• Accounts disabled by any associated business now appear grayed out on the Select business page for multi-business users.
• Disabled users attempting to sign in now see a clearer message directing them to contact their administrator.

Data Security & DLP · 2026-08-31

Varonis adds AWS Org-scoped scans, unified Atlassian integration, scheduled scan pauses, and faster Snowflake monitoring

• Adds CSV export of filtered connected service accounts directly from the Connected Services page, with advanced filter criteria support.
• Adds scheduling of scan pauses by day of the week and time zone to align maintenance windows across distributed environments.
• Adds Data Classes as a building block for classification policies, automatically mapping related patterns and locale-specific criteria to reduce complexity and false positives.

Network Analysis & Monitoring · 2026-08-31

Wireblast v0.6.1 adds the mlx5 Direct Verbs backend with --rx-mode support and AF_XDP VLAN-filter safety checks.

• Adds the mlx5 Direct Verbs backend, enabling --rx-mode on Mellanox mlx5 NICs directly through the new backend.
• Warns when an AF_XDP receive binds fewer queues than the card has, alerting users to potential missed traffic.
• Refuses an AF_XDP receive when the kernel's VLAN filter would silently drop the traffic, preventing silent data loss.

AI/LLM Security · 2026-08-30

AI SAFE2 v3.1 adds 6 MCP controls, three enforcement planes, a protocol-independent persistence vocabulary, 12 new scanner rules, and a machine-readable manifest entry point.

• Adds ai-safe2.manifest.json at the repository root as a deterministic machine entry point exposing framework version, component versions, normative paths, control counts, enforcement planes, persistence vocabulary, conformance boundaries, and machine-readable datasets — so agents and compliance bots no longer need to infer structure from prose.
• Adds skills/mcp/data/mcp-profile-v3.1.json as a machine-readable profile of the 19-control CP.5.MCP security profile for agent and automated-consumer use.
• Adds skills/mcp/data/ai-safe2-controls-v3.0.json as the machine-readable 161-control core dataset.

Reverse Engineering · 2026-08-30

CHIPSEC adds an XML-based HOB definition parser for decoding GUID extension HOB payloads in platform configuration.

• Adds a HOB definition parser (chipsec.cfg.parsers.hob_parser) that reads GUID extension HOB structure layouts from XML files, making HOB payload contents inspectable as named registers in the platform hierarchy.
• Platform configuration files can now pull in HOB definitions via a <hob> block with a <definition name=... config=.../> element pointing to an XML file (e.g., HOB.hob0.xml).
• HOB XML files declare <structure> elements keyed by GUID and <field> elements per C-struct member, supporting types guid, uint32, and bytes (with explicit size for padding), in packed (no implicit alignment) layout order.

Reverse Engineering · 2026-08-30

CHIPSEC adds HOB (Hand-Off Block) parsing support and a new scan_image UEFI tool module.

• Adds chipsec.utilcmd.hob_cmd — a new utility command for interacting with HOB (Hand-Off Block) data from the command line.
• Adds chipsec.hal.common.hob, chipsec.cfg.parsers.hob_parser, chipsec.cfg.parsers.ip.hob, and chipsec.cfg.parsers.registers.hob — a new HAL and config-parser layer enabling structured parsing of UEFI Hand-Off Blocks for platform configuration and register inspection.
• Adds chipsec.modules.tools.uefi.scan_image — a new UEFI analysis module for scanning firmware images.

Reverse Engineering · 2026-08-30

• Adds chipsec.hal.common.hob HAL layer for programmatic HOB access.
• Adds chipsec.cfg.parsers.hob_parser to parse HOB data from platform configuration.
• Adds chipsec.cfg.parsers.ip.hob and chipsec.cfg.parsers.registers.hob to extend HOB parsing to IP and register configuration surfaces.

Post-Exploitation · 2026-08-30

Chisel 1.12 adds configurable retry intervals, socks5:// proxy URLs, SOCKS5 ACL enforcement, graceful SIGTERM shutdown, and stricter auth hardening.

• Adds --min-retry-interval and --max-retry-interval flags to tune client exponential-backoff retry timing.
• Adds socks5:// scheme support for client proxy URLs, enabling chisel clients to egress through a SOCKS5 proxy.
• Enforces SOCKS5 access in --authfile: users who should retain SOCKS5 access must now have an authfile entry matching socks; the wildcard "" continues to match everything including socks.

Identity & Access Management · 2026-08-30

ConductorOne AI Assistant can now explain access history and grant reasons for users and teams.

• Enables querying access history via the AI Assistant — ask which grants and revocations occurred over a time window for a team or user (e.g., 'what access changed for the Finance team in the last 30 days?'), ordered by most recent.
• Enables asking the AI Assistant why a user holds a specific entitlement, returning the source of the grant — access request, group automation, catalog membership, uplift, or similar.

Identity & Access Management · 2026-08-30

ConductorOne adds smart revocation, campaign review columns, access-history AI answers, push-rule execution history, and app-management APIs

• Adds --url flag (replacing the shadowed --local flag) on mcp servers register, mcp servers test-connection, and mcp servers update-credentials commands so the C1 tenant URL can now be selected via flag rather than requiring C1I_URL or ~/.c1i.yaml.
• New public API endpoints to list connector-discovered applications and their managed state, and to promote an unmanaged application to managed (returns 409 on repeat promotion and exposes the managed application ID in the response binding).
• Adds Smart Revocation (off by default, set per app): traces access to upstream sources — direct grants, nested groups, role hierarchies, delegated provisioning — and revokes the chain, not just the surface entitlement; shows a downstream-effects banner before an approver commits.

Compliance Automation & Trust Management · 2026-08-30

Credo AI adds JIRA webhook and ServiceNow Business Rule integrations to auto-create AI use cases from external ticketing systems.

• Adds JIRA webhook integration to automatically create Credo AI use cases when Jira issues are created.
• Adds ServiceNow integration that fires a server-side Business Rule on new record insertion into the AI intake table to create Credo AI use cases.

Compliance Automation & Trust Management · 2026-08-30

Credo AI adds a native ServiceNow integration that auto-creates use cases from AI intake table inserts via a Business Rule.

• Adds a native ServiceNow integration that triggers a Business Rule on AI intake table inserts and calls the Credo AI Integration Service to create a corresponding use case — no external server required.
• Introduces three ServiceNow System Properties for credential storage: x_credo_ai.integration_url (String), x_credo_ai.api_key (Password2, encrypted at rest), and x_credo_ai.tenant (String).
• Adds a CredoAIIntegration Script Include with a getToken() method (authenticates via POST /auth/token using X-API-Key and X-Tenant headers) and a createUseCase() method (posts to POST /use_cases with a Bearer token).

Web Application Security · 2026-08-30

Dalfox adds dalfox payload javascript subcommand to print canonical JS execution payloads for XSS testing.

• Adds dalfox payload javascript subcommand to print canonical JavaScript execution payloads covering JS-string contexts, backtick variants, and keyword-split variants (e.g. alert(1), alert\1\, prompt(1)).

Web Application Security · 2026-08-30

Dalfox server mode gains rate caps, concurrency limits, reverse-proxy host support, and JS payload context improvements.

• Adds --allowed-hosts flag to accept extra hostnames in the request Host header — required when Dalfox runs behind a reverse proxy that forwards a public hostname.
• Adds server-wide cap on each scan's outbound request rate (requests/sec) to limit scan throughput.
• Adds server-wide cap on each scan's total wall-clock runtime in seconds, with unbounded default.

Web Application Security · 2026-08-30

dirsearch adds backup file discovery, split help views, and dual response-saving formats (--save-response, --save-response-jsonl).

• Adds --save-response flag to save raw response files for matched results.
• Adds --save-response-jsonl flag to save versioned JSONL records of matched responses.
• Splits CLI help into a common view (-h / --help) and a complete view (-hh / --help-all).

SAST / SCA / Code Security · 2026-08-30

GitHub Copilot in Visual Studio gains org-level custom agents, thinking effort controls, and Git agent code review.

• Adds thinking effort controls — Low, Medium, and High — for supported models, letting you trade reasoning depth against token usage per task.
• Introduces organization-level custom agents: org and enterprise owners can publish custom agents that Visual Studio automatically detects, showing descriptions and organization source in the agent picker.
• Enables the Git agent to review uncommitted changes or commits before a pull request is opened, with findings surfaced inline in the editor and a navigable list in Git Changes, for both GitHub and Azure DevOps repositories.

SAST / SCA / Code Security · 2026-08-30

Copilot gains shared Slack/Teams agent sessions, defaultMode/defaultPermissionMode CLI defaults, a native Rust runtime, and a GA Customize tab.

• Adds defaultMode and defaultPermissionMode settings to GitHub Copilot CLI so every new session starts with your preferred execution and permission modes.
• Adds new management experiences for plugins, MCP servers, and skills via /plugin, /mcp, and /skills in the Copilot CLI.
• Copilot CLI now runs on a native Rust runtime for significantly faster performance while keeping the terminal interface in TypeScript.

Web Application Security · 2026-08-30

humble 1.65 adds 3 new fingerprint headers and 1 new insecure check to its HTTP header analysis engine.

• Adds 3 new fingerprint headers to the detection database (commits b83d699 and 732522f), expanding coverage to identify server/framework exposure via HTTP response headers.
• Adds 1 new insecure value check (commit 3b59c53), increasing the total insecure/deprecated header checks.

SAST / SCA / Code Security · 2026-08-30

OpenAI Codex Security ships a GitLab CI template with diff, full, and deep scan modes plus automated remediation.

• Adds CODEX_SECURITY_VERSION CI variable (default 0.1.20) to pin the @openai/codex-security npm package version used in the pipeline.
• Adds CODEX_SECURITY_FULL_SCAN_DEFAULT_BRANCH CI variable — set to true to run a full repository scan in standard mode at high effort on every push to the default branch.
• Adds CODEX_SECURITY_SCHEDULED_DEEP_SCAN CI variable — set to true to trigger a scheduled deep scan of the full repository at xhigh effort.

SAST / SCA / Code Security · 2026-08-30

OpenAI Codex Security gains a full GitLab CI/CD integration with SARIF publishing, policy gating, and verified auto-remediation via draft MRs.

• Adds a GitLab CI/CD pipeline integration for @openai/codex-security (pinned to 0.1.20) that scans committed diffs on protected merge requests and publishes SARIF 2.1.0 findings to the GitLab Security tab.
• Introduces the CODEX_SECURITY_API_KEY CI/CD variable (masked, hidden, protected, scoped to the codex-security/openai environment) to supply the OpenAI API key to the scan job.
• Adds --diff <base-revision>, --head <commit-sha>, --auth api-key, --output-dir <dir>, and --json flags to the codex-security scan subcommand for diff-scoped scanning.

SAST / SCA / Code Security · 2026-08-30

Codex Security preserves scan results across repo changes, carries forward false-positive decisions, and handles nested Git repos.

• Keeps completed findings and reports tied to the original revision or working-tree snapshot when files or the repository revision change mid-scan.
• Shows a completion warning when selected code changes or the target becomes unavailable, instead of discarding scan results.
• Archives an existing scan before reusing its output directory for another scan.

General Utilities & Libraries · 2026-08-30

pipx 1.17.0 adds PIPX_COOLDOWN env var for release-age policy and requires packaging>=26

• Adds PIPX_COOLDOWN environment variable to set a default for --cooldown, so a single release-age policy applies to every command without repeating the flag; an explicit --cooldown still takes precedence, --cooldown 0 opts a single command out, and locked installs ignore the variable rather than failing.
• Requires packaging>=26, which correctly serializes direct references as name @ url (PEP 508) instead of name@ url, ensuring the specifier pipx records and passes to the backend is consistent regardless of which version happened to be installed previously.

General Utilities & Libraries · 2026-08-30

pipx adds PIPX_COOLDOWN env var to skip recently uploaded index artifacts across install and upgrade commands

• Adds PIPX_COOLDOWN environment variable to set a default for --cooldown, causing install, install-all, inject, upgrade, and upgrade-all commands to ignore index artifacts uploaded fewer than the specified number of days ago; overridden by an explicit --cooldown flag, with --cooldown 0 opting a single command out and locked installs ignoring it entirely.

General Utilities & Libraries · 2026-08-30

pipx adds --cooldown flag and PIPX_COOLDOWN env var to ignore recently uploaded index artifacts

• Adds --cooldown DAYS flag (accepted by install, upgrade, run, and other commands) to ignore index artifacts uploaded fewer than DAYS days ago, reducing risk from freshly published or potentially malicious packages.
• Adds PIPX_COOLDOWN environment variable to set the default --cooldown value globally; pass 0 to opt out.
• Adds PIPX_DEFAULT_BACKEND environment variable, joining PIPX_FETCH_MISSING_PYTHON, PIPX_FETCH_PYTHON, PIPX_DISABLE_SHARED_LIBS_AUTO_UPGRADE, and PIPX_USE_EMOJI as newly documented env vars.

General Utilities & Libraries · 2026-08-30

• Adds --cooldown DAYS flag to install, install-all, inject, upgrade, upgrade-all, and run commands to skip index artifacts uploaded within the specified number of days, reducing exposure to compromised or broken releases before they can be yanked.
• Adds PIPX_COOLDOWN environment variable to apply a machine-wide cooldown policy to all supported commands without passing a flag each time.
• Translates the cooldown policy to both pip (--uploaded-prior-to P7D) and uv (--exclude-newer P7D) backends automatically; uv backend requires version 0.9.17 or newer for relative cooldowns.

General Utilities & Libraries · 2026-08-30

pipx gains a --cooldown flag and PIPX_COOLDOWN env var to delay installs/upgrades until a release is N days old

• Adds --cooldown <days> flag to pipx install to skip releases newer than the specified number of days, reducing exposure to broken or compromised fresh releases; the lag is persisted per-package so subsequent pipx upgrade calls honour it without repeating the flag.
• Adds PIPX_COOLDOWN environment variable to apply a global release-age lag to every tool install and upgrade without passing --cooldown each time.

Vulnerability Management · 2026-08-30

Quarry VRC v1.5.0 adds an incremental HackerOne poller, card/list views, and a leads_by_class Dashboard tile.

• Adds QUARRY_POLL_MINUTES environment variable to tune the incremental HackerOne poller interval (default: 15 minutes); set to 0 to disable the built-in timer and drive polls from an external scheduler.
• Adds a leads_by_class breakdown to the /api/stats endpoint, powering a new Leads by class tile on the Dashboard.
• Adds the incremental poller core/h1_watch.py that detail-fetches only reports whose HackerOne list-endpoint change signals moved, recording state and bounty transitions as events to keep Tracker badges, the report-update feed, and bounty alerts current between full syncs.

Vulnerability Management · 2026-08-30

Quarry VRC v1.4.0 adds evidence capture with timeline, HackerOne GraphQL collaboration management, and vendor-neutral hunting standards.

• Adds CAIDO_URL and BURP_URL environment variables to point capture backends at Caido and Burp proxy instances (use http://host.docker.internal:<port> inside a container) for request/response and full-screen OS screenshot capture.
• Adds --attach CLI flag to the report-intent flow for attaching files to drafted reports.
• New server routes and CLI for evidence capture: records an evidence timeline, a scope-filtered proxy feed, and supports drafting and attaching files to reports.

Vulnerability Management · 2026-08-30

Quarry VRC v1.3.3 launches with HackerOne sync, program scope management, advisory feeds, payload library, and a Bearer-token API for agentic-AI access.

• Adds QUARRY_MIN_PASSWORD_LENGTH environment variable (default 12) to enforce a configurable minimum password length for admin bootstrap and subsequent password changes.
• Adds scripts/check-no-private-data.sh and CI workflow .github/workflows/no-private-data.yml to gate every commit, refusing home paths, LAN IPs, real report IDs, private handles, and credentials from reaching the repository.
• Provides a Bearer-token API so external scripts and agents can query the console without a browser session.

CNAPP · 2026-08-30

InsightCloudSec adds Bot query preview, dedicated IaC worker pool, and a new PostgreSQL secure-transport insight.

• Adds DIVVY_IAC_WORKER_POOL_ENABLED feature flag to deploy a dedicated IaC worker pool, routing IaC jobs to their own queue and workers (disabled by default; when off, IaC jobs run on the shared P0/P1 queue).
• Adds a Bot Query Preview capability — a Preview Resources button on the Query Filters step during Bot creation/editing, and a Preview Matches action on the saved-Bot details page — so practitioners can see matched resources before saving or running a Bot, with pagination, a View in Resources link, and scope warnings.
• Adds a Database Instance Without Secure Transport Enabled (PostgreSQL) insight that identifies PostgreSQL instances missing the require_secure_transport server parameter.

Vulnerability Management · 2026-08-30

InsightVM 8.57.0 adds DISA STIG Amazon Linux 2023 v1r4 compliance policy content.

• Adds policy content for DISA STIG Amazon Linux 2023, Version 1 Release 4, enabling compliance assessments against the latest federal benchmark for Amazon Linux 2023 environments.

Compliance Automation & Trust Management · 2026-08-30

Scrut adds DPDPA 2023 framework, Google Drive policy import, Freshservice evidence monitoring, and audit cloning

• Scrut Monitor now supports Freshservice: fetch, filter by tag, and export tickets as CSV evidence with fields including subject, category, requester ID, responder ID, priority, status, and timestamps.
• Import .doc, .docx, and .pdf policy files directly from Google Drive into the Scrut policy editor or as attachments; spreadsheets, decks, and images can be added as non-editable policy attachments.
• Adds DPDPA 2023 (with DPDP Rules 2025) as an integrated framework in the Compliance → Frameworks module, with cross-framework mapping auto-populating up to 65% of requirements from existing ISO/IEC 27001:2022 and EU GDPR evidence.

Compliance Automation & Trust Management · 2026-08-30

Scrut adds ISO/IEC 27701:2025 support, AI policy/evidence gap detection, Trust Portal subscriptions, multi-zone Cloudflare, and a unified My Tasks view.

• Enables Trust Portal subscriptions via Trust Vault → Settings → Additional Settings, so viewers can opt in to email notifications when certifications, documents, or security updates are published.
• Adds Cloudflare multi-zone support to the Cloudflare integration, collecting evidence per selected zone and surfacing failing zones as separate resource rows.
• Introduces a My Tasks tab in the Task Center that consolidates tasks from Policies, Evidence, Vulnerabilities, Vendors, and audit requests, with filtering by module, assigned date, or task name.

Compliance Automation & Trust Management · 2026-08-30

Scrut adds manual link/unlink of automated tests to evidence tasks, plus on-demand test export attachment for compliance frameworks.

• Adds ability to manually link any automated test to an evidence task via Compliance → Evidence Tasks → Automation Sources → Add Automation Sources, independent of Scrut's automatic mappings — available for ISO 27001, SOC 2, GDPR, and HIPAA frameworks.
• Adds Export icon in the Automation Sources section to trigger on-demand export of a linked test's results and attach them to the current evidence period.
• Adds unlink icon in the Automation Sources section to remove a previously linked automated test from an evidence task.

Compliance Automation & Trust Management · 2026-08-30

Scrut Automation adds bulk offboarding: complete offboarding for multiple employees in a single action.

• Enables bulk offboarding — complete offboarding for multiple employees simultaneously, available when every selected employee is in Offboarding Needed status.
• Enforces that only employees with Active status can be added as Scrut users.

Compliance Automation & Trust Management · 2026-08-30

Scrut adds Shadow AI governance, automated test linking to evidence, and AI-assisted SOC 2 System Description authoring.

• New Shadow AI Governance module discovers AI applications through SSO integrations, lets teams review and categorize them, and runs automated compliance tests to identify AI-related risks.
• Adds ability to link and unlink automated tests to evidence tasks, attaching test results directly as evidence.
• Adds AI-assisted SOC 2 System Description creation, with options to upload an existing document, review, edit, and publish for inclusion in the audit package.

Network Analysis & Monitoring · 2026-08-30

SO-CRATES v4.1.0 adds DNS tunneling/DGA heuristics, community ID correlation, JA3/JA4 TLS fingerprinting, and paginated aggregation tables.

• Adds a DNS Heuristics tab that aggregates every DNS query by registrable domain and scores each 0–100 across five signals: high-entropy subdomain prefix (tunneling shape), high-entropy/low-vowel-ratio registrable domain (DGA shape), 15+ distinct subdomains under the same parent (fan-out), unusually long query name or label, and TXT/NULL record types; known CDN suffixes are allowlisted before scoring to reduce noise.
• Force-enables Suricata's community_id field on every analysis (off by default in Suricata) so flow/alert records can correlate against Zeek and other community-id-aware tools without manual configuration.
• Adds a Correlate entry to the pivot menu that searches all logs across a capture sharing the same community_id flow — network protocol events and alerts alike — when clicking any field on a row that carries a community ID.

Network Analysis & Monitoring · 2026-08-30

SO-CRATES v4.0.0 adds alert acknowledgment, full keyboard navigation, a command palette, and multi-file ZIP analysis.

• Adds Acknowledge this alert and Acknowledge all instances of this alert options in the pivot menu on Network Alert and Sigma Alert rows, immediately removing acknowledged rows from all views (Network Alerts, Sigma Alerts, All Events, Sankey diagram, and counts); acknowledged alerts appear in a new Acknowledged Alerts stat-card tab with per-type sub-sections and Un-acknowledge this alert support.
• Adds full keyboard navigation across the entire app: arrow keys move between stat-card tabs and data-table rows, Enter activates highlights (opens samples, expands/collapses rows), and Escape closes modals/menus one layer at a time before leaving an analysis.
• Adds a command palette — triggered by typing any letter or digit outside a text field — supporting mid-word substring matching and ranked results for themes, stat-card tabs, and named shortcuts including help, about, themes, rules, settings, notes, delete, re-analyze, search, clear, sankey, aggregation, advanced features, documentation, security onion, github repo, pcap samples, log samples, binary samples, upload, import, previous analyses, copy md5 hash to clipboard, and rename analysis.

Network Analysis & Monitoring · 2026-08-30

SO-CRATES v3.2.0 adds per-row evidence annotations, a pivot menu with custom lookups, AI rule summaries, and Security Onion Playbooks.

• Adds AI_SUMMARIES_DIR environment variable for manual installs to point at a locally-built AI summary index for Suricata, Sigma, and YARA rule explanations.
• Adds PLAYBOOKS_DIR environment variable for manual installs to point at a locally-built Security Onion Playbooks index for Suricata and Sigma alert investigation guidance.
• Adds show_protocol_decode_alerts setting (Rules modal) to make protocol-decode alert noise explicitly opt-in, with a dedicated Decoder Alerts tab when enabled.

Network Analysis & Monitoring · 2026-08-30

SO-CRATES v3.1.0 adds in-UI rule management, analysis notes, inline renaming, MD5 copy, and 24-hour YARA/Sigma auto-refresh.

• New POST /api/analysis-notes endpoint stores freeform analyst notes (e.g. 'suspected GuLoader, C2 at x.top') as notes.txt per analysis; supports multi-line text and empty submission to clear.
• New POST /api/rename-analysis endpoint lets analysts rename an analysis display name inline; original filename preserved in .meta's original field.
• GET /api/analyses now includes a date_range field ({"min": ..., "max": ...}, both null while still processing) per analysis, used for hover tooltips to distinguish same-named analyses.

Firewalls & Network Defense · 2026-08-28

Abnormal AI Phishing Coach gains Precision Training, Attack/Training/Campaign Creator, QR code simulations, and in-thread follow-up

• New Precision Training capability automatically adjusts simulation frequency and difficulty based on individual employee behavior signals — employees with elevated risk get more frequent, harder simulations; low-risk employees get fewer.
• New Attack Creator lets admins describe a phishing scenario in plain language to generate a realistic simulation stored in the Attack Library.
• New Campaign Creator enables ad hoc or baseline simulation campaigns to be scheduled and sent from the Attack Library, including AI-generated attacks.

Firewalls & Network Defense · 2026-08-28

Abnormal AI launches Email DLP Rules (Early Access): AI-assisted outbound email policy enforcement with a Triage Agent to cut false positives.

• New Email DLP Rules (Early Access) lets security and compliance teams define, validate, and enforce outbound email policies using a rule builder that supports regex, phrase matching, metadata conditions, and Boolean logic — including AND/OR nesting, condition groups, and exclusions.
• Includes prebuilt templates for common data types such as financial information and personally identifiable information (PII), reducing time to first policy.
• Rules scan outbound message content and supported attachments, with the ability to scope enforcement by department or workflow for controlled rollout.

Firewalls & Network Defense · 2026-08-28

Abnormal AI adds Control Center, Email DLP Rules with AI Triage Agent, and enhanced AI Phishing Coach (GA August 31).

• Adds Control Center, a no-cost capability of Inbound Email Security, with Custom AI Models (GA) and Custom Rules (Early Access) for organization-specific detection without detection engineering.
• Adds Custom Rules (Early Access) in Control Center: define precise block/allow conditions using more than 50 message attributes and validate rules against real message examples.
• Adds Custom AI Models (GA) in Control Center: create organization-specific detection models from plain-language descriptions to teach Abnormal patterns unique to the business.

Firewalls & Network Defense · 2026-08-28

Abnormal AI launches Control Center for Inbound Email Security with Custom Rules and Custom AI Models

• Introduces Custom AI Models (Generally Available): analysts describe a detection pattern in natural language to create a dedicated AI model, backtested against recent organizational mail before deployment, runnable in Passive mode before full enforcement.
• Introduces Custom Rules (Early Access): build organization-specific enforcement rules from more than 50 email attributes using AND, OR, and Except When logic — no proprietary query language required — with per-user or org-wide scoping.
• Adds Passive mode for both Custom Rules and Custom AI Models, letting teams observe which messages a rule or model would match before enabling enforcement, reducing risk when moving to Active mode.

AI/LLM Security · 2026-08-28

AI-Infra-Guard v4.6.0 adds an API security audit module, LLM API poisoning detection, and a v5.0.0 mutation engine for agent red-teaming.

• Adds detection for LLM API poisoning attacks.
• Merges workflow-attack into mutation-attack in the aig-agent-redteam v5.0.0 mutation engine refactor.
• Adds strict YAML validation enforcing required id and severity fields in vulnerability rules.

SAST / SCA / Code Security · 2026-08-28

Aikido adds agentic Android (APK) pentesting with ADB-based exploit confirmation, AutoFix, and joint app+backend assessment.

• New Android (APK) pentest capability: agents install a real APK on a test device, log in as a user, and attack the app over ADB — findings are exploit-confirmed before appearing in the report.
• Supports simultaneous assessment of the Android app and its backend API in a single run — API findings appear in the same report as app findings.
• Reproduction steps for every finding include the exact ADB commands needed to replay the exploit.

Digital Forensics & Incident Response · 2026-08-28

ALEAPP v2026.3.2 adds 35+ new app parsers including Uber, Facebook, Zoom, Threema, and TeleGuard for Android forensics.

• Adds parsers for over 35 new Android apps: Uber, Facebook, Threads, Twitch, Zoom, PayPal, Revolut, Outlook, Yahoo Mail, Adobe Acrobat Reader, Disney+, Amazon Prime Video, Pinterest, Hinge, NordVPN, Roblox, eBay, Etsy, Vinted, Booking.com, Ryanair, DHL, CapCut, Shazam, Truecaller, SimpleX Chat, TeleGuard (calls, account, drafts, downloads), Threema, Opera Browser, Samsung Bixby Routines, Spotify (6 artifacts), and Private Photo Vault.
• Adds TeleGuard artifact coverage for calls, account, drafts, and downloads on Android.
• Adds Threema account, contacts, and messages parsing (requires new sqlcipher3 version 0.6.2 dependency to decrypt Threema databases).

Identity & Access Management · 2026-08-28

Auth0 Custom Token Exchange is now GA, enabling token-for-token swaps with custom Action logic for enterprise and professional tenants.

• Introduces Custom Token Exchange (GA), allowing applications to exchange an existing token — issued by Auth0 or an external identity provider — for Auth0 access, ID, and refresh tokens, validated by a Custom Token Exchange Action.
• Supports delegated authorization so a service, AI agent, or support agent can act on behalf of a user, including calling APIs on their behalf or establishing a web session via Session Delegation.
• Adds Dashboard support to create and manage Custom Token Exchange Profiles and their associated Actions directly from the Auth0 Dashboard.

Runtime Security · 2026-08-28

Bubblewrap v0.12.0 adds --not-a-security-boundary flag, assume_kernel build option, and drops setuid support

• Adds --not-a-security-boundary flag, which makes failures in sandbox setup steps (such as remounting a submount) non-fatal — enabling fail-open behavior for use cases that do not require a strict security boundary.
• Adds assume_kernel meson build option; specifying 5.6.0 or later disables the fallback implementation of openat2(RESOLVE_IN_ROOT) and removes backward compatibility code for older kernels, resulting in hard failures at runtime on unsupported kernels.
• Removes support for building a setuid bubblewrap; unprivileged user namespaces are now the sole supported mechanism.

Attack Surface & Exposure Management · 2026-08-28

Censys API now documents concurrency and RPS limits with a 125-request burst allowance and per-IP throttling.

• Documents organization-level concurrency limits (1/1/25 concurrent requests by tier) shared across all PATs and users, returning 429 on breach — the get host enrichment endpoint is exempt.
• Documents a 25 RPS per-client-IP leaky-bucket rate limit (smoothed to one request every 40 ms) applied at ingress across all endpoints, returning 503 on breach.
• Documents a burst allowance of 125 queued requests before throttling kicks in, allowing short spikes above the steady 25 RPS rate.

Container & Image Security · 2026-08-28

API surface changed: +2 endpoints, 11 modified

• New endpoint GET /registry/v1/chart-image-bindings
• New endpoint GET /registry/v2/catalogImages
• GET /argos/v1/documents: param updatedSince (query) added

Reverse Engineering · 2026-08-28

CHIPSEC 2.0.8 adds HOB features, MSR scope checks, is_enabled filtering for controls, and exclusive fixed-address config support.

• Adds is_enabled field to controls, enabling filter_enabled filtering in object lists of controls.
• Adds HOB (Hand-Off Block) parsing and inspection features.
• Adds MSR scope correctness checks to catch misconfigured MSR definitions.

Container & Image Security · 2026-08-28

cilium-cli v0.20.0 adds reservedRanges for multi-pool IPAM and HTTP CONNECT support in Envoy

• Adds reservedRanges field to CiliumPodIPPools for multi-pool IPAM, enabling operators to exclude specific address ranges from pool allocation.
• Adds HTTP CONNECT support to the Envoy integration, enabling tunneled proxy traffic through Cilium-managed Envoy.

Integrated & IT Risk Management · 2026-08-28

CISO Assistant v3.21.3 adds UNESCO AI maturity framework, expanded workflow object registry, and audit tree requirement filtering.

• Adds filtering on the audit tree to show only requirements without controls or evidences, making compliance gap identification faster.
• Expands the workflow engine's read_objects registry to include requirements, risk objects, and validations, enabling workflows to act on a broader set of objects.
• Enables the workflow engine to write objects, schedule actions by date, and detect bulk edits as triggers.

Identity & Access Management · 2026-08-28

Clerk lets you control how recently users must have authenticated before they can perform sensitive actions.

• Adds the ability to customize the reverification window, defining how recently a user must have authenticated before sensitive actions are permitted.

Internet Services · 2026-08-28

API surface changed: +230 endpoints, −142 endpoints, 271 modified, 22 deprecated

• New endpoint DELETE /accounts/{accountId}/v1/images/{imageId}
• New endpoint DELETE /accounts/{account_id}/agent-memory/namespaces/{namespace_name}
• New endpoint DELETE /accounts/{account_id}/agent-memory/namespaces/{namespace_name}/profiles/{profile_name}

Internet Services · 2026-08-28

Cloudflare adds symmetric JWT keys, Durable Object alarm abort control, Log Explorer deletion, GLM-5.3 Flash multimodal model, and more

• Adds { retryAlarm: false } option to ctx.abort() on Durable Objects so interrupted alarms stop retrying instead of restarting after reset (requires Wrangler 4.126.0 or later for local dev).
• Adds deletion_protection field to Log Explorer dataset management: set it to false via the Update an account or zone dataset API method, then call the Delete an account or zone dataset method to permanently remove account or zone datasets.
• Symmetric HMAC keys (HS256, HS384, HS512) are now supported for JWT validation, configurable via the Cloudflare dashboard or API.

Internet Services · 2026-08-28

Cloudflare adds Durable Objects concurrency bump, scannable Access token secrets, Log Explorer deletion, and AI Search model updates.

• New Access service token secrets now include a recognizable prefix and checksum, making them detectable by credential scanning tools.
• Log Explorer datasets (account and zone level) can now be permanently deleted from the Cloudflare dashboard or API.
• AI Search adds six new Workers AI models for text generation, plus GLM-5.3 Flash support.

Internet Services · 2026-08-28

• Each Durable Object can now use up to ten Dynamic Workers with in-flight requests concurrently, raising the parallelism ceiling for stateful workloads.

Internet Services · 2026-08-28

API Shield JWT validation now supports symmetric HMAC keys (HS256, HS384, HS512) via dashboard or API.

• HMAC verification keys can be configured via the Cloudflare dashboard or the Cloudflare API; credentials are never stored in plaintext and are never returned in API responses.

SAST / SCA / Code Security · 2026-08-28

API surface changed: 6 modified

• GET /analysis/organizations/{provider}/{remoteOrganizationName}/pull-requests: response schema changed
• GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/commits/{commitUuid}/logs: response schema changed
• GET /analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests: response schema changed

General Utilities & Libraries · 2026-08-28

VS Code introduces the Agent Host — a persistent, portable process for agent sessions — plus the open Agent Host Protocol (AHP) and multi-language client libraries.

• Adds the code agent host (or code-insiders agent host) subcommand to start a standalone Agent Host process that keeps agent sessions alive independent of any editor window.
• Introduces the Agent Host Protocol (AHP), an open, URI-addressable protocol for coordinating multiple clients around the same long-running agent session, with channels for sessions, chats, terminals, and changesets.
• Ships AHP client libraries in Rust (ahp, ahp-types, ahp-ws), TypeScript (@microsoft/agent-host-protocol), Kotlin (com.microsoft.agenthostprotocol:agent-host-protocol), Go (github.com/microsoft/agent-host-protocol/clients/go), and Swift (Swift Package Manager: microsoft/agent-host-protocol).

Runtime Security · 2026-08-28

CubeSandbox v0.7.0 adds cross-node pause/resume, component multi-versioning, a network subsystem refactor, and a new CubeOps control plane split

• Adds CubeProxy support for a custom management port and the gRPC protocol.
• Adds Files.ForUser to the Go SDK to isolate file access by user identity.
• Adds Sandbox.setTimeout(timeout) to the Node SDK with support for NEVER_TIMEOUT.

SAST / SCA / Code Security · 2026-08-28

cve-lite-cli adds --create-pr, --base, and --debug flags for automated PR creation and diagnostics

• Adds --create-pr flag: after --fix, commits changes and opens a GitHub pull request automatically (requires gh CLI).
• Adds --base <branch> flag to set the base branch for --create-pr (defaults to main).
• Adds --debug flag that writes verbose runtime and network diagnostics to a timestamped log file.

SAST / SCA / Code Security · 2026-08-28

cve-lite-cli adds --create-pr to commit fixes and open GitHub pull requests, plus --debug logging for scan troubleshooting.

SAST / SCA / Code Security · 2026-08-28

HTML report now links package names to npm registry; package-registry navigation added to findings table.

• HTML report findings table now links each package name directly to its npm registry page, enabling one-click research from scan output.

Web Application Security · 2026-08-28

DataDome API adds AcceptLanguage, Via, SecCHUAFullVersionList, and three CustomFieldString fields to its reference.

• Adds AcceptLanguage field to the DataDome API reference for passing the request's Accept-Language header to the detection engine.
• Adds Via field to the DataDome API reference for forwarding proxy chain information.
• Adds SecCHUAFullVersionList field to the DataDome API reference for passing the Sec-CH-UA-Full-Version-List client hint header.

Web Application Security · 2026-08-28

DataDome launches a hosted MCP server giving AI agents direct natural-language access to Trend Reports data.

• New hosted MCP server exposes DataDome Trend Reports data to MCP-compatible AI agents and agentic workflows, authenticated via existing DataDome credentials — no custom integration or infrastructure required.
• Enables AI agents to query automated traffic trends, threat types, scraping activity, and credential-stuffing patterns in natural language directly from tools like Slack-connected assistants, enterprise copilots, or custom agent pipelines.

Vulnerability Management · 2026-08-28

DefectDojo Pro adds Sensei CSPM: onboard AWS, Azure, and GCP accounts for cloud misconfiguration scanning and automated remediation with an undo button.

• Adds Cloud Connection onboarding in DefectDojo Pro to connect AWS Organizations, Azure subscriptions, and GCP projects in bulk using a shared read-only credential that auto-discovers and onboards all visible accounts at once.
• Adds on-demand cloud posture scanning from the Sensei hub, with results landing in DefectDojo as deduplicated, prioritized findings tied to the specific cloud resource (S3 bucket, security group, etc.) and updated in place on re-scan.
• Adds Fix in Cloud direct remediation that applies changes through the provider API using a separate write credential, independent of the read-only scan credential, with a mandatory human-approval dialog showing the exact action, target resource, and required cloud permissions before execution.

Vulnerability Management · 2026-08-28

DefectDojo Pro adds Vulnerability Explorer with EPSS/KEV enrichment and Root Cause Correlation for one-row-per-CVE prioritization

• Adds the Vulnerability Explorer in DefectDojo Pro: a deduplicated, one-row-per-vulnerability-ID view that surfaces EPSS Score, EPSS Percentile, Known Exploited, Ransomware Used, and KEV Date columns alongside a Total Findings count that links directly to the filtered findings list.
• Adds a Sync KEV/EPSS data button at the top of the Vulnerability Explorer to pull the latest CISA KEV and FIRST EPSS data on demand, in addition to automatic daily sync.
• Supports Cap by KEV due date in SLA configuration, which tightens a KEV-listed finding's remediation deadline to CISA's official due date for that CVE.

SAST / SCA / Code Security · 2026-08-28

Dependency-Track 5.1.0 adds KEV support, CycloneDX 1.7, Checkmarx SCA, JVN data source, GitHub App auth, and compressed SBOM uploads.

• Adds isActive parameter to the BOM upload API endpoint, allowing projects to be marked active or inactive at upload time.
• Adds REST API endpoints to view and trigger KEV (CISA Known Exploited Vulnerabilities) mirroring runs.
• Exposes workflow run status on the BOM token polling endpoint.

Identity & Access Management · 2026-08-28

API surface changed: +23 endpoints, 2 modified

• New endpoint DELETE /v3/transactions/rules/install/
• New endpoint DELETE /v3/transactions/rules/{rule_uuid}/
• New endpoint GET /v3/organization/{organization_id}/application/{application_id}/business-sessions/{business_session_id}/networks/

Identity & Access Management · 2026-08-28

Didit adds Networks: cross-app fraud-ring clustering with graph, map, timeline views, blocklisting, and case creation.

• Introduces Networks, which automatically clusters applicants, businesses, and transaction parties across every application in an organization that share device, IP, biometric, document, or contact signals — surfacing a fraud ring as one investigation instead of dozens of unrelated flags.
• Flags high-degree signals (shared office IP, kiosk device, data-center IP) as hub signals for analyst review rather than auto-declining, distinguishing legitimate high-traffic environments from fraud.
• Enables analysts to create a case anchored to a network (rather than a single subject) to hand off to a compliance team for formal investigation.

Identity & Access Management · 2026-08-28

Didit adds standalone document OCR/fraud, AML screening, wallet-screening PDF export, and transaction-rule listing endpoints

• New POST /v3/aml/ endpoint screens a person or company against PEP, sanctions, watchlist, and adverse-media datasets, returning aml.status (Approved/In Review/Declined) and per-hit match_score and risk_score fields.
• AML two-score model is configurable per-request via aml_match_score_threshold (default 93), aml_score_review_threshold (default 100), aml_score_approve_threshold (default 80), aml_name_weight, aml_dob_weight, and aml_country_weight (must sum to 100, defaults 60/25/15).
• AML endpoint supports include_adverse_media=true for adverse-media enrichment (adds ~5–25 s latency; source recommends a client timeout of at least 60 seconds).

Identity & Access Management · 2026-08-28

Didit adds a /v3/transactions/rules/ Management API, nine MCP tools, and AI-assisted rule migration for transaction monitoring.

• Adds /v3/transactions/rules/ Management API endpoints to create, update, delete, and backtest transaction-monitoring rules programmatically, complementing the Business Console.
• Adds library and install endpoints under /v3/transactions/rules/ to browse, install, and remove preset rules from the rule library.
• Introduces nine didit_transaction_rule_* MCP tools covering list, create, update, delete, backtest, and library workflows for any MCP-connected AI agent.

Digital Forensics & Incident Response · 2026-08-28

Elcomsoft System Recovery 8.38 adds BitLocker TPM exploit USB creation, browser artefact extraction, and image checksum logging.

• Installer can now create a separate bootable USB drive preloaded with a BitLocker TPM exploit — supports YellowKey and GreatXML — turning a previously manual multi-step process into a guided setup click.
• New browser artefact extraction capability pulls saved passwords, payment card data, form autofill data, download history, bookmarks, and browsing history from Google Chrome, Chromium-based browsers, Microsoft Edge, Mozilla Firefox, and others.
• Disk imaging now automatically logs a checksum with each captured image's path and capture time, eliminating the need for a separate post-capture hashing utility.

Endpoint Security (EDR/XDR) · 2026-08-28

Fleet API adds bootstrap token escrow visibility, uninstall script detection, and installer targeting for failure policies.

• Adds mdm.bootstrap_token_escrowed field to macOS host responses, indicating whether Fleet holds a bootstrap token that authorizes remote wipe and OS update operations without a logged-in secure-token user.
• Adds software_package.has_uninstall_script field to software installer responses, signaling whether a non-empty uninstall script is configured — relevant for .tgz and script-only packages where the script is optional.
• Adds software_installer_id parameter to install-on-failure policies, letting callers target a specific package rather than defaulting to the title's first-added package.

Secrets Detection & Management · 2026-08-28

GitGuardian API adds risk score range filters for incidents and new scan byte counters.

• Adds risk_score minimum and maximum filter parameters to incident list endpoints, allowing queries that bound results by risk score range (incidents with a null risk score are excluded from filtered results).
• Adds data_downloaded_bytes and data_scanned_bytes counters to scan progress reporting, tracking byte-level scan telemetry alongside existing element counters (reported as null for sources that do not measure bytes, such as VCS repositories).
• Extends user name component handling so that omitting name fields on a member update preserves the existing stored name rather than blanking it, with given/family name derived by splitting the email local part on the first dot.

SAST / SCA / Code Security · 2026-08-28

GitHub Copilot unifies chat, cloud agent, and mobile into one policy; code review default shifts to Balanced effort level.

• Copilot Chat on github.com, Copilot Chat in GitHub Mobile, and Copilot cloud agent are merging into a single unified experience and policy, enabled by default no earlier than September 28th, 2026.
• Chat data retention extends from 28 days to the life of the account as the unified experience fully adopts the agent sessions model.
• Cloud agent gains Sandbox to provide a faster cloud execution environment in the unified experience.

SIEM · 2026-08-28

Google SecOps adds endpoints to list dashboard charts and export playbook action results as ZIP files.

• New GET /v1alpha/{parent}/dashboardCharts endpoint lists all dashboard charts for a given parent resource.
• New GET /v1alpha/{instance}/legacyPlaybooks:legacyExportActionResults endpoint exports action results for a given case and action result ID as a ZIP file.
• New endpoint documented: GET /v1alpha/{parent}/dashboardCharts

Endpoint Security (EDR/XDR) · 2026-08-28

Huntress adds ITDR Executive Summary PDFs, per-identity escalations, full IPv4 via ipv4_addresses API field, WSL visibility, and 7 new ISPM controls.

• Adds per-identity escalations for Unexpected Country and Unexpected VPN activity in Managed ITDR, so each affected identity generates its own escalation, notification, and — if a PSA integration is configured — its own PSA ticket.
• Adds an Executive Summary in plain text at the top of every ITDR incident report, with a standalone PDF export available via the Export PDF button in the portal.
• Adds 7 new Microsoft 365 security controls to Managed ISPM (approaching 80 total): Anti-Malware, Anti-Spam, and Anti-Phishing policies against the Microsoft Standard baseline in Exchange Online Protection; Safe Links, Safe Attachments, Safe Documents, and spoof-protection Anti-Phishing policies in Microsoft Defender for Office 365.

Compliance Automation & Trust Management · 2026-08-28

Hyperproof adds full Audits and Requests REST APIs plus new delete endpoints for custom apps, contacts, and comments.

• New GET https://api.hyperproof.app/v1/audits endpoint returns audits filtered by status.
• New POST https://api.hyperproof.app/v1/audits endpoint creates a new audit in an organization.
• New GET https://api.hyperproof.app/v1/audits/health endpoint returns the health score across all audits.

Compliance Automation & Trust Management · 2026-08-28

• New POST https://api.hyperproof.app/v1/roleassignments/filter endpoint queries role assignments with filters.

Digital Forensics & Incident Response · 2026-08-28

iLEAPP v2026.3.2 adds 13 new app parsers including Amazon Shopping, Google Photos, Netflix, and Firefox for iOS forensic analysis.

• Adds Google Calendar, Google Sheets, Google Docs, and Google Maps artifact support for iOS.
• Adds Netflix artifact support for iOS, reporting only rows an examiner can act on, including cached stream segments with subtitle cues.
• Adds Pinterest artifact support for iOS.

Data Security & DLP · 2026-08-28

Immuta adds Intents for context-aware access control, a Connections API, Google BigQuery viewless integration, and new Starburst (Trino) connection management.

• New Connections API available for programmatic registration and management of data connections, documented at the Connections API reference guide.
• New Intents API lets practitioners create, edit, and delete intents programmatically via the Immuta v1 API, with a dedicated Manage Intents API reference guide.
• New AWS Lake Formation Connection Registration Payloads Reference Guide documents parameters and payloads for registering a connection via the API.

Data Security & DLP · 2026-08-28

Immuta adds intent-based access control for Databricks Unity Catalog and expands subscription policy support to metric views.

• Introduces intents (public preview for Databricks Unity Catalog): policy authors can grant access based on a user's declared reason for accessing data, replacing birthright attributes with intent-specific attributes while the intent is active — enabling use-case-driven, auditable access to sensitive fields such as PII.
• Extends subscription policy support to Databricks Unity Catalog metric views, allowing access provisioning and governance for that object type through existing Immuta subscription policies.

Secrets Detection & Management · 2026-08-28

Infisical v0.164.1 adds PostgreSQL account discovery for PAM, gateway pool load balancing, and LDAP/SQL/Linux validation rules.

• Requires config.siteUrl in the infisical-nkp Helm chart configuration.
• Adds PostgreSQL account discovery for Privileged Access Management (PAM).
• Adds load balancing support for gateway pools.

Secrets Detection & Management · 2026-08-28

Infisical v0.164.0 adds cert profile creation inside applications and root encryption key rotation.

• Allows creation of certificate profiles from directly inside applications, streamlining PKI workflows without leaving the app context.
• Implements root encryption key rotation, enabling operators to rotate the platform's root encryption key.
• Gates cross-project secret sharing actions by settings, giving admins finer control over which projects can share secrets.

Secrets Detection & Management · 2026-08-28

Infisical v0.163.0 adds IAM auth for Postgres, RFC 8693 token exchange, KMS delete protection, and change policies for machine identities.

• Adds IAM authentication for Postgres in the PAM (Privileged Access Management) module, enabling passwordless database credential management.
• Adds RFC 8693 token exchange grant support for OAuth/OIDC flows.
• Adds delete protection for KMS keys, preventing accidental key removal.

Threat Intelligence · 2026-08-28

API surface changed: +3 endpoints

• New endpoint GET /gate/quota
• New endpoint GET /gate/url
• New endpoint POST /gate/scan

SAST / SCA / Code Security · 2026-08-28

• New Preview early-access track available in two forms: Closed Preview (invite-only) and Open Preview (all eligible customers), both free with opt-in.
• Activate Preview in the MyJFrog portal under Settings > Preview by enabling the Enable Preview toggle and accepting the Preview Terms of Service.

SAST / SCA / Code Security · 2026-08-28

JFrog launches a Preview early-access track so customers can opt into new capabilities before GA through MyJFrog.

• New Preview early-access track delivers two tiers — Closed Preview (invite-only feedback cohorts) and Open Preview (any eligible customer, fully supported, free) — so capabilities reach users as soon as they are production-ready.
• Opt-in is self-serve: navigate to Settings > Preview in the MyJFrog portal, enable the Enable Preview toggle, accept the Preview Terms of Service, and activate individual preview features on your subscription.

Container & Image Security · 2026-08-28

Kubescape adds vulnerability exceptions to SecurityException CRDs, letting teams suppress CVE findings per-image using VEX-compatible statuses.

• Enables vulnerability exceptions via the Helm value capabilities.riskAcceptance=enable (defaults to disable); without it, matching resources are silently ignored with only a startup warning.
• Supports VEX-compatible status values — not_affected, fixed, affected, under_investigation — to control whether a CVE finding is suppressed or kept visible with extra context.
• Adds vulnerability.id (required CVE ID) and vulnerability.aliases (alternate IDs) fields under spec.vulnerabilities[] to identify which CVE an entry targets.

SAST / SCA / Code Security · 2026-08-28

Manifest Supplier Risk adds a supplier-centric SBOM-grounded view of vendor risk with binary-generated SBOMs and a supplier CLI flag.

• Adds a --supplier flag to the Manifest CLI for associating an uploaded SBOM or binary directly with a named supplier at publish time.
• Introduces binary-generated SBOMs for vendors who cannot provide one, covering C++, unmanaged code, and embedded systems where traditional SCA falls short, with results folded into that supplier's record.
• New supplier portfolio view ranks every third-party vendor by risk score, asset count, open vulnerabilities, and last-updated date in a single screen.

Identity & Access Management · 2026-08-28

Material Security launches an MCP server exposing list_issues, get_issue, patch_issue, and get_message tools for AI-agent-driven email security triage

• Adds an MCP (Model Context Protocol) server, enabled via an MCP Server toggle in settings (defaults to off), exposing four tools to AI agents: list_issues, get_issue, patch_issue, and get_message.
• Adds new API v1 endpoints underlying the MCP tools, with guaranteed schema parity between the REST API and the MCP interface — anything callable via MCP can also be called through the REST API.
• Adds OAuth integration (rolled out in v1.60) so agents authenticate via the existing Material SAML/Google/Microsoft login instead of long-lived API tokens; supported agent harnesses include Cursor, Claude, ChatGPT, Codex, and Grok.

Endpoint Security (EDR/XDR) · 2026-08-28

Defender Experts MDR now covers third-party data sources via Microsoft Sentinel, including Palo Alto Networks, AWS, and Okta.

• Microsoft Defender Experts MDR now extends managed detection and response and threat hunting to third-party data sources ingested through Microsoft Sentinel — including Palo Alto Networks, AWS, and Okta — available under the MDR P2 tier.
• New Microsoft Defender Experts Threat Intelligence service delivers expert-led threat intelligence and actionable insights tailored to geography, industry, and risk profile.

Data Security & DLP · 2026-08-28

Microsoft Purview auto-labeling policies now process up to 500,000 SharePoint and OneDrive files per day, up from 100,000.

• Auto-labeling policies now support up to 500,000 SharePoint and OneDrive files per day (up from 100,000), expanding sensitivity-label coverage at scale.

AI/LLM Security · 2026-08-28

NeMo Guardrails v0.24.0 adds RailOutcome, rail manifests, F5 integration, health endpoints, and expands IORails to 59 built-in rails.

• Adds RailOutcome — an engine-neutral allow, block, or transform contract returned by rail actions and enforced by both LLMRails and IORails.
• Adds typed rail manifests so built-in rails can declare their configuration, actions, execution surfaces, requirements, and privacy properties for automatic discovery by both engines.
• Adds output-rail checking mode to the /v1/checks endpoint, which now selects a server-loaded configuration via config_id or the server default.

Threat Intelligence · 2026-08-28

OpenCTI now renders maps locally via bundled PMTiles, with admin upload for custom tiles and no external tile server required.

• Serves map tiles from a backend endpoint /maps/world.pmtiles using HTTP Range requests, eliminating any external map server dependency — including for air-gapped deployments.
• Adds app:map_bundled_file_path config key (APP__MAP_BUNDLED_FILE_PATH, default ./static/maps/world.pmtiles) to override the bundled PMTiles file location on disk.
• Administrators can upload a custom .pmtiles file via Settings > Parameters > Map configuration to replace bundled tiles with higher-resolution or region-specific data, stored in S3/MinIO.

Threat Intelligence · 2026-08-28

OpenCTI adds app:map_bundled_file_path config key to serve maps from a local PMTiles file on disk.

Threat Intelligence · 2026-08-28

OpenCTI 7.260828.0 adds human-in-the-loop AI approval, new vulnerability propagation rules, a Score field on key entities, and map widget export.

• Adds human-in-the-loop tool approval in Ask Ariane, requiring analyst confirmation before the chatbot executes tool calls.
• Adds new inference rule deriving System has Vulnerability from System uses Software + Software has Vulnerability relationships.
• Adds new inference propagation rule linking vulnerabilities to Infrastructure through used software.

Runtime Security · 2026-08-28

OpenSandbox v0.2.3 adds sandbox lifecycle hooks, QEMU VMState pause/resume, pool exhaustion signaling, OTLP HTTP metrics, and secure-access key injection from Kubernetes Secrets.

• Adds kubernetes.pool_acquisition_timeout_seconds config key (default 30s) so the server waits a bounded window on pool exhaustion, then returns HTTP 429 with KUBERNETES::POOL_CAPACITY_EXHAUSTED and Retry-After: 5 instead of a generic 504.
• Accepts OPENSANDBOX_SECURE_ACCESS_KEYS and OPENSANDBOX_SECURE_ACCESS_ACTIVE_KEY env overrides for secure-access signing keys; Helm chart adds server.gateway.secureAccess.existingSecret (mutually exclusive with plaintext keys) so GitOps flows never commit key material.
• New [docker] config fields sandbox_env and sandbox_binds apply fleet-wide environment variables and host bind mounts to every Docker sandbox container (request env wins over sandbox_env; config binds precede request-derived binds).

Runtime Security · 2026-08-28

OpenSandbox execd 1.1.0 adds init-mode PID 1, pre-exec hardening with seccomp/Landlock, eBPF audit, and lifecycle hooks

• Enables execd to run as PID 1 via EXECD_INIT=1 (or server-side runtime.execd_run_as_init), providing a single reaper with signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path; classic topology unchanged and off by default.
• Adds GET /v1/isolated/capabilities response field hardening object reporting per-layer state for the new opensandbox-launcher pre-exec hardening pipeline (env strip → KEEPCAPS → bounding-set trim → no_new_privs → identity drop → seccomp → execve); every layer degrades fail-open.
• New [landlock] layer in opensandbox-launcher applies a filesystem allowlist; fails open below ABI/kernel 5.13 and reports state as unsupported in the hardening object.

Runtime Security · 2026-08-28

• Adds EXECD_INIT=1 environment variable to run execd as PID 1 with signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned exit-code propagation, and a subreaper fallback for the Pool path; opt-in via server's runtime.execd_run_as_init for Docker/K8s Batch/Agent/Pool — classic topology unchanged and off by default.
• Adds CreateSandboxRequest.lifecycle field supporting preStart and periodic lifecycle hooks (OSEP-0020), transported to the sandbox via OPEN_SANDBOX_LIFECYCLE env on Kubernetes; execd starts HTTP before preStart and only releases the user process after preStart succeeds.
• Adds $HOME/.execd/lifecycle.toml as the persistent config path for lifecycle hooks, with EXECD_LIFECYCLE_CONFIG as an exact-path override; bootstrap sync and preStart shutdown are fail-closed with TERM/KILL watchdogs.

AI/LLM Security · 2026-08-28

OpenShell v0.0.115 adds OTLP driver trace export, native Windows MXC compute, gateway identity in traces, and OCI SBOM/provenance attestations.

• Exports Kubernetes driver traces over OTLP, enabling distributed tracing pipelines to ingest OpenShell gateway activity.
• Adds a native Windows MXC compute driver with full server wiring, extending supported compute platforms to Windows MXC.
• Tags exported traces with gateway identity so multi-gateway deployments can filter and correlate traces per gateway.

Secure Access (VPN / SASE / ZTNA) · 2026-08-28

Prisma Agent 26.3 adds IPv6 dual-stack, LDAP auth, Ubuntu 26.04, container traffic enforcement, and granular certificate selection across platforms.

• Adds Granular Certificate Selection for Prisma Agent via Agent Settings (Windows, macOS, and as part of Strata Cloud Manager R3).
• Adds Device Attribute Match Criteria for Prisma Agent App Settings on Windows and macOS.
• Adds IPv6 Dual-Stack Support for iOS Agents in Prisma Agent 26.3.

Firewalls & Network Defense · 2026-08-28

Strata Cloud Manager gains automated discovery and topological visualization of Cloud NGFW for Azure deployments.

• Strata Cloud Manager now auto-discovers and visualizes existing and newly deployed Cloud NGFW for Azure firewall resources in a unified topological view, mapping network dependencies across Azure infrastructure.

Post-Exploitation · 2026-08-28

Peirates adds multi-arch make dist builds with DIST_COMPRESS and DIST_ARCHES controls for Linux AMD64, ARM, ARM64, and 386

• Adds make dist target to build compressed Linux distribution archives for AMD64, ARM, ARM64, and 386, written to scripts/.
• Adds DIST_COMPRESS=no environment variable to keep unpacked (uncompressed) binaries when building distributions.
• Adds DIST_ARCHES=<arch> environment variable to build a subset of architectures (e.g. DIST_ARCHES=amd64).

Identity & Access Management · 2026-08-28

PingOne adds Snowflake provisioning, structured FIDO2 error routing in DaVinci, and extends client secret retention to 90 days.

• Adds a Use Legacy FIDO2 Error Handling toggle in the Form connector for FIDO2/WebAuthn capabilities in PingOne DaVinci flows — disabled by default — so client-side errors route to a typed error output object containing name, code, and message fields, enabling conditional branching without custom Functions connector logic.
• Adds Snowflake as a provisioning connection target, supporting user and group provisioning between a Snowflake account and PingOne.
• Increases the maximum client secret retention period for applications and custom resources from 30 days to 90 days.

Identity & Access Management · 2026-08-28

DaVinci Form connector now routes FIDO2/WebAuthn client errors to structured, typed outputs for precise flow branching.

• FIDO2/WebAuthn client-side errors in the Form connector now route to a structured error output object containing name, code, and message fields, enabling flow branching on specific failure conditions without custom Functions connector logic.
• New Use Legacy FIDO2 Error Handling toggle in the Form connector controls whether client errors route to the typed error outcome (default, toggle disabled) or continue to the success path (toggle enabled).

Identity & Access Management · 2026-08-28

• Adds a Use Legacy FIDO2 Error Handling toggle in the PingOne DaVinci Form connector to control whether client-side FIDO2/WebAuthn errors route to a structured typed error output (with name, code, and message fields) or continue to the success path; toggle is disabled by default, enabling structured error branching.

Cloud Security Posture · 2026-08-28

Prowler adds Slack alert destinations, NCSC Cyber Essentials 3.3, 15 new checks across 7 providers, and an Imported provider indicator.

• Adds rolesanywhere_profile_restricts_session_permissions check to flag IAM Roles Anywhere profiles referencing an administrative role without a scoping session or managed policy.
• Adds iam_workload_identity_pool_provider_attribute_condition GCP check to flag Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition.
• Adds oss_bucket_versioning_enabled Alibaba Cloud check to verify OSS buckets have versioning enabled.

Cloud Security Posture · 2026-08-28

Prowler Cloud adds Alerts for findings with delivery to email and Slack, plus a new Slack workspace integration.

• New Alerts feature lets you create alerts from Prowler Cloud findings and deliver them to email recipients and Slack channels, triggered after scans or on a daily digest schedule.
• New Slack Integration allows connecting a Slack workspace to Prowler Cloud or Prowler Private Cloud, authorizing specific channels for Prowler to post findings notifications into.

Cloud Security Posture · 2026-08-28

Prowler 5.40.0 adds 15 new checks across 7 providers, NCSC Cyber Essentials 3.3, and Slack alert destinations

• New ecr_repository_image_no_secrets check scans the latest image of each ECR repository — both configuration and filesystem layers — for hardcoded secrets.
• New bedrock_guardrail_contextual_grounding_filter_enabled check verifies that Bedrock guardrails enable both contextual grounding filters, blocking unsupported or off-topic responses.
• New bedrock_custom_model_encrypted_with_cmk check verifies that Bedrock custom models are encrypted at rest with a customer-managed KMS key rather than an AWS-owned key.

Threat Intelligence · 2026-08-28

Recorded Future launches AI Alert Filtering, automatically sorting alert references by relevance with custom intent per rule and optional auto-dismiss.

• New AI Alert Filtering feature, enabled per rule from the Alerts page in the Portal, automatically classifies every reference inside a fired Alert into High Relevance and Low Relevance sections before an analyst opens it.
• Adds per-rule custom intent configuration so analysts can define exactly what the AI should prioritize beyond the default rule intent (e.g. scoping a rule to a specific organization).
• Adds optional auto-dismiss: when no references meet the relevance threshold, the Alert can be automatically dismissed before reaching the analyst queue.

Continuous Control Monitoring (CCM) · 2026-08-28

RegScale 6.33.3.0 adds a consolidated dashboard experience and a new Key Risk Indicator (KRI) monitoring system.

• Introduces a Key Risk Indicator (KRI) system for organizations to monitor risk metrics.
• Consolidates the dashboard experience into a unified view for accessing and reviewing organizational metrics.

Continuous Control Monitoring (CCM) · 2026-08-28

RegScale CLI 6.42.32 adds FedRAMP SSP interconnect and cryptographic module import commands, plus optional SSP ID on docx import

• Adds a new FedRAMP SSP interconnect import command to the CLI.
• Adds a new FedRAMP SSP cryptographic module import command to the CLI.
• Adds an optional SSP ID parameter to the FedRAMP docx import command so an existing System Security Plan is updated in place rather than duplicated.

SAST / SCA / Code Security · 2026-08-28

Spectra Assure v3.7 extends the threat_details response object with reason, scanner_count, and scanner_match fields.

• Adds reason, scanner_count, and scanner_match fields to the threat_details response object, available when --with-threat-details is enabled, giving richer scanner-level context for each detected threat.

SAST / SCA / Code Security · 2026-08-28

sbomify-action v26.8.0 shrinks image 80%, adds SBOMIFY_FETCH_RUNTIMES, SBOMIFY_CLEARLY_CACHED_URL, git submodule discovery, and cross-run enrichment caching.

• Adds SBOMIFY_FETCH_RUNTIMES=0 env var to opt out of on-demand tool fetching in air-gapped environments.
• Adds SBOMIFY_CLEARLY_CACHED_URL env var to point the action at a self-hosted or local clearly-cached proxy instead of the default clearly-cached.sbomify.com.
• Introduces clearly-cached, a public caching proxy at clearly-cached.sbomify.com that sits in front of ClearlyDefined, returning a flat 0.4KB projection of license fields; resolves 76 of 76 packages in 5s warm vs 31 of 76 in 474s direct.

SAST / SCA / Code Security · 2026-08-28

sbomify v26.8.0 adds Security Advisories, gated Trust Center, CRA KPIs, risk_accepted state, and CSV exports

• New Security Advisories module lets you author vendor advisories with CVSS vector, affected/fixed version ranges, product associations, and a timestamped timeline, published directly to your Trust Center.
• Advisories support three visibility states — Private, Public, and Gated — where Gated requires both a workspace-level NDA grant and a link to a product the reader can already access; per-advisory product filtering redacts names the reader is not entitled to see.
• New CRA patch SLA targets, defaulting to Critical 7 / High 30 / Medium 90 days, gate five computable KPIs: mean time to triage, mean time to remediate, open criticals with KEV split, patch SLA compliance, and VEX publication latency.

Compliance Automation & Trust Management · 2026-08-28

Scrut adds Shadow AI Governance to discover, classify, and continuously verify AI tool usage across an organization

• New Shadow AI Governance module discovers AI applications employees are using via SSO integrations (Google Workspace, Microsoft Entra) and desktop sources (supported MDM integrations or the Scrut Agent).
• Automatically classifies discovered tools as AI Apps (tools where employees input organizational data) or AI Builders (tools that connect to technical environments such as repositories and APIs), surfacing distinct review questions for each.
• Assigns each discovered application an explicit governance status — Managed, Ignored, or Restricted — with Restricted decisions requiring a recorded justification to create an auditable trail.

SAST / SCA / Code Security · 2026-08-28

API surface changed: 1 modified

• POST /api/v1/deployments/{deploymentId}/scans/search: request body changed; response schema changed

AI-Powered Offensive Security · 2026-08-28

Shannon v2.7.0 adds xAI (Grok) subscription auth so pentests can run on an xAI plan instead of API credits.

• Supports running pentests authenticated via an xAI (Grok) subscription, removing the need for pay-per-token API credits.

AI/LLM Security · 2026-08-28

SkillSpector v2.10.0 adds transitive scanning, hidden/nested artifact inspection, EA5 detection, and new env var + report field for policy gates.

• Adds --transitive flag to opt into transitive scanning of referenced skills, with --transitive-depth, --transitive-allow-prefix, and --transitive-deny-prefix controls for bounded traversal.
• Adds SKILLSPECTOR_OUTPUT_LANGUAGE environment variable to set the language of human-readable LLM-generated finding text.
• Adds risk_assessment.max_issue_severity field to JSON output (value NONE when no active issue is reported) for machine-readable downstream policy gates.

AI/LLM Security · 2026-08-28

SkillSpector v2.11.0 adds npm lockfile scanning, BH1–BH3 hook/permission findings, and LLM sampling controls via new env vars.

• Adds SKILLSPECTOR_TEMPERATURE (values 0–1) and SKILLSPECTOR_SEED (integers) environment variables for optional LLM sampling control; forwarded to OpenAI-compatible and Azure OpenAI endpoints; leaving either unset preserves provider defaults.
• Expands skillspector scan --help to list all supported hosted, local, compatible, and CLI-backed LLM providers with their authentication paths.
• Introduces BH1–BH3 findings by analyzing hooks/hooks.json, .claude/settings.json, and .claude/settings.local.json for bundled lifecycle hook execution (BH1), directly proven remote transfer of sensitive event or file content (BH2), and broad or ignored project permission surfaces (BH3).

Exploitation & C2 · 2026-08-28

Sliver v1.7.6 adds Go c-archive output, Reflektor-backed BOF/extension execution, native macOS/Linux extensions, configurable keepalive, and profile-driven external builder generation.

• Adds c-archive as a supported Go output format for implant generation, enabling implants to be embedded as C static libraries.
• Enables profiles to generate implants via external builders with profiles generate external builder, decoupling build configuration from the server.
• Switches default BOF execution to use Reflektor, replacing the previous in-process execution model for improved isolation.

Web Application Security · 2026-08-28

slowhttptest v1.10.0 adds mTLS client certificate support and custom request headers for authenticated targets.

• Adds --with-openssl=DIR configure flag for builds where OpenSSL is installed in a non-standard path.
• Adds mTLS support, enabling client certificates when testing targets that require mutual TLS authentication.
• Adds custom request header injection, allowing arbitrary headers to be sent with slow HTTP test payloads.

SAST / SCA / Code Security · 2026-08-28

Socket adds Microsoft Edge Add-ons extension monitoring, bringing malware, credential-theft, and version-change detection to Edge.

• Adds continuous analysis of extensions published through Microsoft Edge Add-ons, covering malware, credential and clipboard theft, data exfiltration, remote code loading, obfuscation, and impersonation — the same detections previously available for Chrome and Firefox.
• Enables version-change comparison for Edge extensions, surfacing meaningful differences in code, permissions, network activity, and behavior between releases under the same extension identity.
• Identifies command-and-control infrastructure, suspicious endpoints, remote payload sources, and changes in domains contacted by Edge extensions.

SAST / SCA / Code Security · 2026-08-28

Socket for ClickUp integration launches in beta, enabling bi-directional alert-to-task sync with automated ticketing rules.

• New ClickUp integration (beta) lets teams create ClickUp tasks from Socket alerts via Settings → Integrations → ClickUp in the Socket dashboard.
• Automated ticketing rules route matching Socket findings into a chosen ClickUp Workspace and List, with configurable priority (Urgent, High, Normal, Low, or Auto to map Socket priority automatically), tags, and assignee.
• Bi-directional status sync keeps Socket alerts and ClickUp tasks updated: clearing an alert can move the linked task to completed, and closing or completing a task in ClickUp can triage-ignore the corresponding Socket alert.

SAST / SCA / Code Security · 2026-08-28

Socket launches native Asana integration with manual ticket creation, automated ticketing rules, and two-way sync.

• New Settings → Integrations → Asana UI in the Socket dashboard lets an Owner or Admin connect one or more Asana workspaces via OAuth, with no separate app to install.
• Adds a Create Ticket button on any Socket alert to manually create a linked Asana task — selecting workspace, project, tags, and assignee — with a bidirectional link between the alert and the task.
• Two-way sync keeps Asana tasks and Socket alerts current: Socket can mark an Asana task complete when an alert clears, and completing the Asana task can triage-ignore the linked Socket alert.

SAST / SCA / Code Security · 2026-08-28

SonarQube Hunter Agent is now GA on SonarQube Cloud, adding AI-driven broken access control and business logic flaw detection.

• Adds Hunter Agent to SonarQube Cloud (Enterprise plan), an AI security agent that detects broken access control (IDOR, missing authorization checks, privilege escalation, CSRF), business logic flaws (skipped workflow steps, missing rate limits), and authentication/session management flaws (session fixation, non-expiring sessions, weak password recovery, missing MFA) — vulnerability classes SAST structurally cannot evaluate.
• Validates every candidate finding for exploitability via a dedicated subagent before surfacing it, achieving 80–90% average precision.
• Surfaces confirmed findings directly as SonarQube issues in the existing triage workflow — no separate portal, dashboard, or installation required.

Detection Engineering · 2026-08-28

Splunk Security Content v6.5.0 adds 13 new detections across Python supply-chain, Vidar stealer, RoguePlanet/ShieldBreak privilege escalation, and EDRSilencer evasion.

• New analytic story Malicious Python Package Installation with four detections: Python Network Traffic During Package Build, Python PTH File Creation During Package Installation, Python PYTHONPATH Modification During Package Installation, and Python Site Hooks Creation During Package Installation — covering supply-chain threats that execute code during install or persist across Python sessions.
• New analytic story Vidar Stealer anchored by Windows Cloud Sensitive File Read Access By Uncommon Process, detecting collection of Azure CLI profile metadata, saved credentials, and cookies to support account takeover and cloud reconnaissance.
• Six new detections added to the RoguePlanet analytic story targeting Windows Defender race-condition and ShieldBreak techniques: Windows Alternate Data Stream Created Over Local Share, Windows Defender MpClient.dll Loaded by Non-Defender Process, Windows Defender Threat Detected on Kernel Object Path, Windows Error Report Created in ReportQueue Manually, Windows Phantom DLL Created on Disk, and Windows Wermgr Spawning System Integrity Process.

Exploitation & C2 · 2026-08-28

sslstrip 5.0.0: full Python 3.14 rewrite with new CLI subcommands, nftables lifecycle management, and gated traffic logging

• Adds sslstrip run, sslstrip doctor, sslstrip cleanup, and sslstrip --version subcommands replacing the old monolithic entry point.
• Adds --ca-file flag to supply extra lab certificate authorities for TLS verification in controlled environments.
• Adds --traffic-log and --traffic-log-file flags for gated, unredacted traffic logging (both flags required to enable).

SAST / SCA / Code Security · 2026-08-28

Dev Machine Guard gains a Credentials inventory page showing plaintext credential exposure across developer fleets, available from agent v1.16.0.

• Adds a Credentials page in the StepSecurity dashboard that aggregates credential source coverage fleet-wide, showing per-source device count, plaintext vs. protected breakdown, location count, and individual entry count — filterable by category (Cloud, Source control, Package registries, Containers, Infrastructure) and exportable as CSV.
• Covers thirteen credential source types across five categories, including ~/.npmrc, ~/.pypirc, ~/.vault-token, ~/.netrc, ~/.aws/credentials, ~/.aws/config, ~/.docker/config.json, gcloud application default credentials, kubeconfig, ~/.ssh private key files (id_rsa, id_ed25519, id_ecdsa), and ~/.git-credentials.
• Per-source detail view lists every affected device labelled Plaintext, Protected, or both, with per-device summaries (e.g. '3 locations · 3 entries (2 plaintext)') and direct links to each machine.

SAST / SCA / Code Security · 2026-08-28

Dev Machine Guard v1.16.0 adds a Browser Extensions inventory page covering Chrome, Edge, and Firefox across your developer fleet.

• Adds a Browser Extensions page in the StepSecurity dashboard showing a fleet-wide table of every extension detected, including name, extension ID, browser, store, version, device count, and last-seen timestamp — filterable by browser, capability, store, and engine, with an Export CSV download.
• Rolls raw browser permissions into ten named capabilities — Global website access, Global request observation, Script injection, Global script injection, Cookie access, Global cookie access, Browsing history, Debugger access, Clipboard read, and Extension management — reflecting what the browser is currently honouring, not just what the extension declared in its manifest.
• Per-device detail panel lists affected devices grouped by version (first 500 devices shown), enabling rapid scoping when an advisory names a specific bad version.

Firewalls & Network Defense · 2026-08-28

API surface changed: +5 endpoints, 8 modified

• New endpoint DELETE /v0/messages/export/{id}
• New endpoint GET /v0/messages/export
• New endpoint GET /v0/messages/export/dashboard/{dashboard_type}/estimate

Secure Access (VPN / SASE / ZTNA) · 2026-08-28

Tailscale adds PAM, Aperture AI gateway, and a new TS_BOOT_TIMEOUT env var for containers

• New TS_BOOT_TIMEOUT environment variable controls how long the Tailscale container waits for its initial connection to the coordination server; accepts durations like 90s or 3m, defaulting to 60s.
• Introduces Tailscale Privileged Access Management (PAM) beta, supporting database, RDP, and HTTPS service types with session recording for SSH, database, HTTPS, and Kubernetes Service types.
• PAM policies can be set for user access and in-service permissions through grants, with secrets store integration for credential injection.

Secure Access (VPN / SASE / ZTNA) · 2026-08-28

Tailscale now offers DNS filtering via Control D, with per-device/group rules applied through ACL nodeAttrs

• Adds DNS filtering by Control D as a purchasable add-on, integrable into a tailnet with per-group or per-device controls via the nodeAttrs ACL attribute (e.g., controld:<rule-id>).
• Supports mapping Control D filtering rules to Tailscale users, groups (group:), tags, or individual devices through the existing Tailscale ACL file.
• DNS queries from covered devices are routed through Control D over encrypted DNS, enforcing the assigned filtering ruleset (malware, phishing, content categories, custom block/allow/redirect rules).

Secure Access (VPN / SASE / ZTNA) · 2026-08-28

Tailscale PAM beta brings privileged access management — session logs, recordings, JIT access, and connector management — into the Tailscale admin console.

• New Tailscale PAM (privileged access management) product, now in beta, available through the Tailscale admin console for managing privileged access alongside network connectivity.
• Supports just-in-time access requests and approvals via Slack, scoped to a specific resource and time window, reducing standing access to production infrastructure.
• Enables per-service access policies controlling users, groups, time windows, and permissions — finer-grained than subnet-level network access.

Secure Access (VPN / SASE / ZTNA) · 2026-08-28

Tailscale Aperture GA adds built-in token purchasing, two new MCP endpoints (Tailscale and Tailscale SSH), Projects, and per-chat tool permissions.

• Adds two new MCP endpoints — Tailscale and Tailscale SSH — letting Aperture and coding agents add nodes to a tailnet and access them via Tailscale SSH without manually distributing keys.
• New Projects feature in the Aperture chat interface groups chats with shared instructions, tool access, and tailnet nodes, reducing per-chat re-prompting.
• New ability to define default tool permissions across all Aperture chats, controlling which tools agents can reach by default.

Detection Engineering · 2026-08-28

Tenzir Platform v1.39.0 adds Explorer Stream field controls, timestamp field selection for time ranges, schema browsing, and right-click field actions with cached value insights.

• Adds _ts, ts, timestamp, and time field selection to the Explorer time picker, plus custom field name entry, so time-range predicates target the correct timestamp field without overwriting unrelated pipeline filters.
• Adds display controls to the Explorer Stream view: open the Fields panel to show or hide fields across schema variants, Shift-click a field to show it exclusively, and toggle value wrapping and field-name visibility from the Stream toolbar.
• Adds a Stored data tab in the Explorer that lets you browse node-wide schemas and their fields, event counts, and schema variants before running a pipeline, with @name filter injection and direct stored-event access.

Detection Engineering · 2026-08-28

Tenzir adds statistical drift detection, session windows, lag operator, and native Splunk HEC ingestion in v6.14.0

• Adds native Splunk HEC ingestion, enabling Tenzir nodes to receive data directly from Splunk HTTP Event Collector sources.
• Adds mergeable statistical models in TQL to build, store, merge, and compare data distributions for detecting drift across pipelines and time windows.
• Adds session windows support for grouping events by inactivity boundaries rather than fixed time intervals.

Detection Engineering · 2026-08-28

Tenzir Platform v1.39.0 adds Explorer display options, custom timestamp field selection, schema browsing, and field-level value frequency previews.

• Adds display options for the Explorer Stream view, giving users new ways to control how streaming data is rendered.
• Adds custom timestamp field selection for Explorer time ranges, letting users choose which field drives time-based filtering.
• Adds node schema browsing in the Explorer so users can inspect stored schemas without leaving the interface.

Detection Engineering · 2026-08-28

Tenzir now accepts RELP (Reliable Event Logging Protocol) directly via the new accept_relp operator, enabling rsyslog fleets to forward with at-least-once delivery.

• Adds accept_relp operator to receive syslog events over the Reliable Event Logging Protocol (RELP), preserving message boundaries (including embedded newlines), peer address, and RELP transaction ID alongside the payload.
• Supports at-least-once delivery semantics: Tenzir batches accepted RELP transactions and coalesces ordered acknowledgements, reaching ~0.5M events/second in internal raw transport benchmarks.
• Enables TLS and mutual TLS on RELP connections for collectors crossing trust boundaries.

SAST / SCA / Code Security · 2026-08-28

Terraform v1.16 adds store blocks in terraform_data, -json for state/workspace, -format=mermaid for graphs, and module-level import blocks.

• Adds -json flag to terraform state show for machine-readable output.
• Adds -json flag to terraform workspace list for machine-readable output.
• Adds -format=mermaid flag to terraform graph to output dependency graphs in Mermaid format.

SOAR · 2026-08-28

API surface changed: +6 endpoints, 11 modified

• New endpoint DELETE /api/v1/skills/{skill_name}
• New endpoint GET /api/v1/skills
• New endpoint GET /api/v1/skills/{skill_name}

Identity & Access Management · 2026-08-28

Token Security launches the first NHI MCP Server, enabling natural-language querying, remediation, and posture insights for Non-Human Identities.

• New Token MCP Server exposes Token's NHI inventory, findings, risk data, and remediation guidance to any MCP-compatible AI client (Claude, ChatGPT, Gemini, Cursor) via the Model Context Protocol standard.
• Supports natural-language queries across NHI inventory, permission structures, authentication methods, environment criticality, ownership, and usage patterns — returning prioritized, actionable risk views.
• Delivers customer-specific remediation output including ready-to-use de-provisioning scripts and CLI commands tailored to the customer's environment, generated on demand through conversational queries.

Identity & Access Management · 2026-08-28

Token Security launches Enzo, a natural-language AI application builder for creating live identity security workflows, dashboards, and automations.

• Introduces Enzo, a new AI-native application builder inside the Token Security platform that generates live, runnable identity security applications from natural-language prompts — no code required.
• Generated applications connect to live identity data across human identities, non-human identities, AI agents, SaaS, cloud infrastructure, secrets, and credentials already ingested by the Token Security platform.
• Supports building interactive operational applications — not static reports — including dashboards, approval flows, remediation tools, governance apps, and recurring identity workflows.

AI/LLM Security · 2026-08-28

ToolHive v0.46.0 adds private-CA trust for OIDC upstreams and signer-rotation blocking on plugin upgrades

• Adds --allow-signer-change flag to thv ai-plugin upgrade, which re-records a new signer identity in the project lock file; without it, upgrades whose signature identity differs from the lock file (or that are unsigned) exit with code 4 and report signer-change-blocked.
• Adds caBundleRef field to OIDC and OAuth2 upstream specs, letting an embedded auth server trust a private CA for discovery, token, user-info, and dynamic client registration calls to an in-cluster identity provider.
• Controlled by the TOOLHIVE_PLUGINS_LOCK_ENABLED environment variable; lock entries with no recorded provenance are unaffected by the new signer-rotation check.

AI/LLM Security · 2026-08-28

ToolHive v0.45.0 adds Sigstore plugin verification, RFC 7523 auth flows, Prometheus diagnostics port, and a new qoder skill client.

• Adds Content-Type: application/json enforcement and Origin validation to the thv serve management API for TCP listeners, blocking CORS-based cross-origin attacks (GHSA-xv9h-79wp-q9w6).
• Constrains npx://, uvx://, and go:// package names to [A-Za-z0-9@/:._+=~[]-] at build time, preventing shell metacharacter injection into generated Dockerfiles.
• Adds end-to-end Sigstore bundle verification for plugin artifacts; stored bundles and git commit payloads/signatures are now size-capped at 1 MiB (rejected with 422 above that limit).

Data Security & DLP · 2026-08-28

Ubiq adds Access Intelligence: identity-to-data access graph resolving effective access across enterprise IAM, IGA, cloud, and database systems.

• Adds Access Intelligence, a new capability that ingests and normalizes authorization metadata from identity providers, IGA platforms, cloud environments, databases, data warehouses, and applications to build an identity-to-resource access graph.
• Surfaces privileged, broad, excessive, or otherwise risky access relationships where supported by connected source data, and exposes the full authorization path explaining why access exists.
• When combined with Sensitive Data Discovery, overlays sensitivity and classification context onto the access graph to identify which human and non-human identities can reach sensitive data.

Data Security & DLP · 2026-08-28

Ubiq adds Access Intelligence for mapping effective human and non-human identity-to-resource access across enterprise systems.

• Surfaces privileged, broad, excessive, or otherwise risky access relationships where supported by source data, including coverage of non-human identities such as service accounts, workloads, applications, and AI agents.

Data Security & DLP · 2026-08-28

• Investigations can start from either an identity or a resource and trace the full authorization path in either direction — answering what an identity can access, who can access a resource, and why that access exists.
• Access Intelligence surfaces privileged, broad, excessive, or otherwise risky access where supported by source data.
• Runtime Data Protection now evaluates requester identity, group membership, dataset policy, requested operation, and available runtime context to deliver per-identity data representations — cleartext, masked, tokenized, encrypted, or otherwise protected — without sitting inline between requester and application.

Data Security & DLP · 2026-08-28

• New Access Intelligence capability ingests and normalizes authorization metadata from identity providers, IGA platforms, cloud environments, databases, data warehouses, and applications to resolve effective access for human and non-human identities.
• Extends identity modeling to non-human identities including service accounts, workloads, applications, and AI agents for access analysis.

Compliance Automation & Trust Management · 2026-08-28

API surface changed: +9 endpoints, 10 modified

• New endpoint DELETE /customer-trust/tag-categories/{tagCategoryId}/product-contexts/{productContextId}
• New endpoint GET /customer-trust/questionnaires/{questionnaireId}/responses
• New endpoint GET /customer-trust/questionnaires/{questionnaireId}/responses/{responseId}

Data Security & DLP · 2026-08-28

Varonis Atlas integrates with Claude Inference Hooks for real-time inline prompt inspection and allow/deny enforcement before Claude sees the request.

• Adds integration with Claude Inference Hooks so Atlas sits in the request path, receiving the full conversation transcript from Anthropic and returning an allow-or-deny verdict before inference runs — denied prompts never reach Claude.
• Inspects prompt content and attachments in real time against customizable policies including PII exposure, malicious URL detection, and prompt injection.
• Extends consistent policy enforcement across the full Claude enterprise suite: Claude Chat, Claude Design, Claude Enterprise, Claude Platform, Claude Cowork, and Claude Code.

Data Security & DLP · 2026-08-28

Varonis Atlas adds Agent Intent-Based Access Control (IBAC) to detect, block, and quarantine AI agents that drift from their intended instructions.

• New Agent Intent-Based Access Control (IBAC) capability in Varonis Atlas compares an AI agent's received instruction against its reasoning, tool calls, and data access in real time — alerting, blocking, modifying, logging, or routing actions to a human for approval when drift is detected.
• Intent drift detection runs at three tunable sensitivity levels — lenient, balanced (default), and strict — to match enforcement aggressiveness to data sensitivity.
• Full-session evaluation tracks every prompt, response, and tool call across a conversation session (keyed by conversation ID) to catch gradual or multi-turn drift, including jailbreak attempts spread across individually benign prompts.

SAST / SCA / Code Security · 2026-08-28

Veracode adds region switching in VS Code OAuth, custom predependency commands in GitHub Workflows, and Next.js 16.x / Android 16 static analysis support.

• Adds support for custom predependency commands in the Veracode YAML file for the GitHub Workflow Integration v2.1.3, enabling project preparation steps before scanning.
• Adds a Current File filter to Static Scan Findings in Veracode Scan for VS Code v1.16.3, scoping displayed findings to the file open in the editor.
• Adds an option to filter and group Static Scan Findings by file name, with findings for each file grouped by severity, in VS Code v1.16.3.

Reconnaissance & OSINT · 2026-08-28

webanalyze v0.4.5 adds -header flag for injecting custom HTTP request headers during fingerprinting scans.

• Adds repeatable -header flag (format 'Name: Value') to send custom HTTP request headers with every probe, enabling scans against hosts requiring auth tokens, custom user-agents, or other header-gated content.

Secure Access (VPN / SASE / ZTNA) · 2026-08-28

Zscaler Zero Trust Browser gains WebMCP Security Controls to discover, monitor, and block AI agent tool calls in-page.

• Adds WebMCP Capability Discovery: the Zero Trust Browser Extension enumerates every tool a WebMCP-enabled site registers before any can run, capturing seven attributes per tool — webmcp.tool.name, webmcp.tool.description, webmcp.tool.arguments, webmcp.tool_count, webmcp.tool.provider_origin, webmcp.tool.is_cross_origin, and webmcp.tool.has_untrusted_content_hint — building a structured inventory of the agentic surface per site and user.
• Adds WebMCP Runtime Monitoring: every tool invocation is captured with full context (the seven webmcp.* attributes plus user identity, device posture, extension version, browser, IP, geolocation, and URL) and surfaced in the Zscaler admin console as a searchable, filterable, exportable detection in the same event stream as existing platform telemetry.
• Adds WebMCP Policy Enforcement: inline policies match on any of the seven webmcp.* attributes and apply one of three effects — Allow, Monitor, or Block — intercepting tool calls before the site's handler runs, with blocked calls surfaced to the user directly inside the agent's reply.

Abnormal AI 4 changes

• announced · Aug 26, 2026 · Feature · 2026-08-28
• announced · Aug 26, 2026 · Feature · 2026-08-28
• announced · Aug 26, 2026 · Feature · 2026-08-28
• announced · Aug 26, 2026 · Feature · 2026-08-28

Acunetix 360 2 changes

• changelog · Sep 1, 2026 · Feature · 2026-09-01
• v26.8.1 – 27 August 2026 (2026-08-27) · Feature · 2026-08-31

adscan 1 changes

• v11.3.0 · Feature · 2026-09-02

Aembit 3 changes

• announced · Sep 2, 2026 · Feature · 2026-09-02
• Aembit + CrowdStrike: More Judgment Behind Every AI Agent “Yes” (2026-09-01) · Feature · 2026-09-01
• changelog · Aug 31, 2026 · Feature · 2026-08-31

aflplusplus 1 changes

• v5.03c · Feature · 2026-09-02

AI-Infra-Guard 1 changes

• v4.6.0 · Feature · 2026-08-28

ai-safe2-framework 1 changes

• v3.1 · Feature · 2026-08-30

Aikido Security 1 changes

• announced · Aug 26, 2026 · Feature · 2026-08-28

ALEAPP 1 changes

• v2026.3.2 · Feature · 2026-08-28

Auth0 7 changes

• docs update · Docs · 2026-09-03
• Dashboard Navigation & IA Refresh is now in Early Access (2026-09-02) · Feature · 2026-09-03
• My Organization API and Embeddable UI Components - XAA and third-party app access configuration in Early Acces (2026-09-03) · Feature · 2026-09-03
• Advanced MFA Configurations are now Generally Available (2026-09-01) · Feature · 2026-09-02
• Cross-App Access Requesting App now in Early Access (2026-08-31) · Feature · 2026-09-01
• changelog · Aug 31, 2026 · Feature · 2026-08-31
• Custom Token Exchange is now Generally Available (2026-08-28) · Feature · 2026-08-28

Automox 1 changes

• Local Exclusion Window Scheduling & Targeted Warnings (2026-09-01) · Feature · 2026-09-02

Beelzebub 1 changes

• v3.9.1 · Feature · 2026-08-31

Belkasoft 2 changes

• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02

Bright Security 1 changes

• announced · Aug 31, 2026 · Feature · 2026-08-31

Bubblewrap 1 changes

• v0.12.0 · Feature · 2026-08-28

Bugcrowd 1 changes

• changelog · Aug 31, 2026 · Feature · 2026-08-31

Castle 1 changes

• SDKs page · Feature · 2026-09-01

Cato Networks 1 changes

• Cato Managed SASE for SMB: Flexible Capacity, Faster Onboarding (2026-09-01) · Feature · 2026-09-01

Censys 3 changes

• August 31, 2026 (2026-08-31) · Feature · 2026-08-31
• Guide to 2026 ASM Web Scanning Update (2026-08-31) · Feature · 2026-08-31
• api-docs-998015abb817 · API · 2026-08-28

Chainguard 7 changes

• changelog · Sep 2, 2026 · Feature · 2026-09-02
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• Week of 2026-08-31 · Feature · 2026-08-31
• v1 · API · 2026-08-28

Checkmarx 4 changes

• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-01
• docs update · Docs · 2026-09-01
• The Next Model Won’t Fix This: Three AppSec Imperatives From Black Hat USA 2026 (2026-08-17) · Feature · 2026-09-01

CHIPSEC 4 changes

• docs update · Docs · 2026-08-30
• docs update · Docs · 2026-08-30
• docs update · Docs · 2026-08-30
• 2.0.8 · Feature · 2026-08-28

chisel 1 changes

• v1.12.0 · Feature · 2026-08-30

cilium-cli 1 changes

• v0.20.0 · Feature · 2026-08-28

CISO Assistant 2 changes

• v3.21.4 · Feature · 2026-09-02
• v3.21.3 · Feature · 2026-08-28

Clerk 3 changes

• changelog · Sep 2, 2026 · Feature · 2026-09-02
• changelog · Sep 1, 2026 · Feature · 2026-09-01
• Customize the reverification window (2026-08-28) · Feature · 2026-08-28

Cloudflare 11 changes

• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02
• changelog · Aug 31, 2026 · Feature · 2026-08-31
• changelog · Aug 31, 2026 · Feature · 2026-08-31
• 4.0.0 · API · 2026-08-28
• docs update · Docs · 2026-08-28
• docs update · Docs · 2026-08-28
• docs update · Docs · 2026-08-28
• API Shield - Symmetric key support for JWT validation (2026-08-25) · Feature · 2026-08-28

Cloudmersive 1 changes

• Cloudmersive Cloud DLP AI API v2-9-0 Released (2026-09-01) · Feature · 2026-09-02

Cloudsmith 1 changes

• changelog · Aug 31, 2026 · Feature · 2026-08-31

Codacy 2 changes

• Adding Oxlint as new supported tool September, 2026 · Feature · 2026-09-03
• 3.1.0 · API · 2026-08-28

code-oss 5 changes

• docs update · Docs · 2026-09-03
• docs update · Docs · 2026-09-03
• docs update · Docs · 2026-09-03
• docs update · Docs · 2026-09-03
• announced · Aug 26, 2026 · Feature · 2026-08-28

ConductorOne 2 changes

• docs update · Docs · 2026-08-30
• docs update · Docs · 2026-08-30

Corellium 1 changes

• announced · Aug 31, 2026 · Feature · 2026-08-31

Credo AI 2 changes

• docs update · Docs · 2026-08-30
• docs update · Docs · 2026-08-30

cri-tools 1 changes

• v1.37.0 · Feature · 2026-09-01

CrowdSec 6 changes

• v1.8.1 · Feature · 2026-09-03
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• v1.8.0 · Feature · 2026-08-31

CrowdStrike 2 changes

• changelog · Sep 2, 2026 · Feature · 2026-09-03
• changelog · Sep 1, 2026 · Product launch · 2026-09-02

CrowdStrike Falcon Identity Protection 1 changes

• changelog · Aug 31, 2026 · Feature · 2026-08-31

CrowdStrike Falcon Onum 1 changes

• changelog · Sep 2, 2026 · Feature · 2026-09-03

CrowdStrike Falcon Secure AI Services 1 changes

• changelog · Sep 2, 2026 · Feature · 2026-09-03

CubeSandbox 1 changes

• v0.7.0 · Feature · 2026-08-28

cve-lite-cli 9 changes

• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02
• v1.33.0 · Feature · 2026-09-02
• v1.32.0 · Feature · 2026-09-01
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-28
• docs update · Docs · 2026-08-28
• v1.31.0 · Feature · 2026-08-28

Cycode 2 changes

• Introducing Agentic Code Scanning: The Holistic Cycode System Around the Model (2026-09-01) · Feature · 2026-09-01
• Introducing Agentic Code Scanning: The Holistic Cycode System Around Any Model (2026-09-01) · Feature · 2026-09-01

Dalfox 3 changes

• v3.2.2 · Feature · 2026-08-31
• docs update · Docs · 2026-08-30
• docs update · Docs · 2026-08-30

DataDome 8 changes

• docs update · Docs · 2026-09-03
• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-01
• docs update · Docs · 2026-09-01
• docs update · Docs · 2026-08-31
• api-docs-c11305f974b4 · API · 2026-08-28
• announced · Aug 27, 2026 · Feature · 2026-08-28

dcfldd 1 changes

• docs update · Docs · 2026-08-31

defectdojo 3 changes

• docs update · Docs · 2026-08-31
• announced · Aug 27, 2026 · Feature · 2026-08-28
• announced · Aug 25, 2026 · Feature · 2026-08-28

dependency-track 1 changes

• 5.1.0 · Feature · 2026-08-28

detect-it-easy 4 changes

• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31

Didit 19 changes

• changelog · Sep 2, 2026 · Feature · 2026-09-02
• changelog · Sep 1, 2026 · Feature · 2026-09-01
• docs update · Docs · 2026-09-01
• docs update · Docs · 2026-09-01
• docs update · Docs · 2026-09-01
• updated · Sep 1, 2026 · Feature · 2026-09-01
• changelog · Sep 1, 2026 · Feature · 2026-09-01
• changelog · Aug 31, 2026 · Feature · 2026-08-31
• 3.0.0 · API · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• updated · Aug 31, 2026 · Feature · 2026-08-31
• 3.0.0 · API · 2026-08-28
• docs update · Docs · 2026-08-28
• docs update · Docs · 2026-08-28
• updated · Aug 28, 2026 · Feature · 2026-08-28

DigiCert CertCentral 1 changes

• changelog · Aug 31, 2026 · Feature · 2026-08-31

dirsearch 3 changes

• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-30

distroless 1 changes

• commits-2026-08-01 · Code activity · 2026-08-31

DNSFilter 2 changes

• 09/01 September 1 – Web Application and API Update (2026-09-01) · Feature · 2026-09-01
• changelog · Aug 31, 2026 · Feature · 2026-08-31

dnsrecon 4 changes

• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31

driftnet 3 changes

• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31

Edgescan 3 changes

• Release Notes - Atomic (pre-release) · Feature · 2026-09-02
• Release Notes - 25th Aug 2026 · Feature · 2026-09-02
• Release Notes - 10th Aug 2026 · Feature · 2026-09-02

Elastic Security Labs 4 changes

• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02

ElcomSoft 4 changes

• docs update · Docs · 2026-09-03
• Elcomsoft Quick Triage 2.2 adds a timeline, a plugin system, and file system snapshots (2026-09-03) · Feature · 2026-09-03
• changelog · Aug 31, 2026 · Feature · 2026-08-31
• announced · Aug 26, 2026 · Feature · 2026-08-28

Endor Labs 3 changes

• docs update · Docs · 2026-09-01
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31

evil-winrm 2 changes

• v4.1 · Feature · 2026-09-03
• docs update · Docs · 2026-09-01

Fastly 2 changes

• docs update · Docs · 2026-09-02
• Add status 499 metric to Historical Stats, Real-Time Analytics, and Domain Inspector APIs (2026-09-01) · Feature · 2026-09-02

fhEVM 1 changes

• v0.14.1 · Feature · 2026-09-01

Finite State Platform 2 changes

• Changelog 2026-08-27 - Empty-license policy and Source column consistency (2026-08-27) · Feature · 2026-09-01
• Changelog 2026-08-24 - ESP32 and Bluetooth-audio firmware unpacking (2026-08-24) · Feature · 2026-09-01

Firezone 1 changes

• 1.0.0 · API · 2026-08-31

Fleet 4 changes

• fleet-v4.91.0 · Feature · 2026-09-03
• fleet-v4.90.2 · Feature · 2026-09-02
• api-docs-e62e4648a3e0 · API · 2026-08-31
• api-docs-dedc3ff95d39 · API · 2026-08-28

GitGuardian SaaS 4 changes

• docs update · Docs · 2026-09-01
• changelog · Aug 31, 2026 · Feature · 2026-08-31
• announced · Aug 31, 2026 · Feature · 2026-08-31
• api-docs-6d60f7883285 · API · 2026-08-28

GitGuardian Self-Hosted 1 changes

• changelog · Aug 31, 2026 · Feature · 2026-08-31

GitHub 13 changes

• Enterprise-managed settings support any default model (2026-09-02) · Feature · 2026-09-03
• Content exclusions generally available in Copilot app and CLI (2026-09-02) · Feature · 2026-09-03
• docs update · Docs · 2026-09-02
• Enterprise Live Migrations from GHES to ghe.com generally available (2026-09-01) · Feature · 2026-09-02
• Set an expiration date for individual user budgets (2026-09-01) · Feature · 2026-09-02
• Copilot code review can now approve pull requests (2026-09-01) · Feature · 2026-09-02
• Block users from discussion comments in personal repositories (2026-09-01) · Feature · 2026-09-02
• GitHub CLI: Media in issues, pull requests, and comments (2026-09-01) · Feature · 2026-09-02
• Claude Fable 5.1 is generally available in GitHub Copilot (2026-09-01) · Feature · 2026-09-02
• GitHub Copilot in VS Code, August 2026 releases (2026-08-31) · Feature · 2026-08-31
• GitHub Copilot in Visual Studio — August update (2026-08-28) · Feature · 2026-08-30
• GitHub Copilot weekly releases — August 24 (2026-08-28) · Feature · 2026-08-30
• Upcoming changes to GitHub Copilot policies and billing (2026-08-28) · Feature · 2026-08-28

GitHub CLI 2 changes

• docs update · Docs · 2026-09-02
• v2.99.0 · Feature · 2026-09-02

Google SecOps 3 changes

• docs update · Docs · 2026-09-01
• changelog · Aug 31, 2026 · Feature · 2026-08-31
• api-docs-b766a114a6e1 · API · 2026-08-28

Horizon3 NodeZero 7 changes

• docs update · Docs · 2026-09-02
• updated · Sep 1, 2026 · Feature · 2026-09-02
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• updated · Aug 31, 2026 · Feature · 2026-08-31

httpx-toolkit 1 changes

• v1.11.0 · Feature · 2026-08-31

humble 1 changes

• 1.65 · Feature · 2026-08-30

Hunter 1 changes

• 2.0.0 · API · 2026-09-03

Huntress 1 changes

• changelog · Aug 28, 2026 · Feature · 2026-08-28

Hyperproof 2 changes

• api-docs-c541f8879c01 · API · 2026-08-28
• api-docs-6406e6e6a90c · API · 2026-08-28

iDenfy 2 changes

• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31

iLEAPP 1 changes

• v2026.3.2 · Feature · 2026-08-28

Immuta 2 changes

• docs update · Docs · 2026-08-28
• updated · Aug 28, 2026 · Feature · 2026-08-28

impacket 2 changes

• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31

infisical 5 changes

• 0.0.1 · API · 2026-09-03
• v0.165.1 · Feature · 2026-09-02
• v0.164.1 · Feature · 2026-08-28
• v0.164.0 · Feature · 2026-08-28
• v0.163.0 · Feature · 2026-08-28

IntelOwl 1 changes

• v6.8.0 · Feature · 2026-09-02

isMalicious 2 changes

• 1.1.0 · API · 2026-08-31
• 1.0.0 · API · 2026-08-28

Jazz Security 1 changes

• announced · Aug 31, 2026 · Feature · 2026-08-31

JFrog 10 changes

• Extending the Single Source of Truth to the Agentic Software Supply Chain (2026-09-02) · Feature · 2026-09-03
• Live From the Show Floor: swampUP 2026 (2026-09-02) · Feature · 2026-09-03
• docs update · Docs · 2026-09-02
• Every Release Needs a Chain of Custody. AI Agents Just Made That Harder. (2026-09-02) · Feature · 2026-09-02
• The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development (2026-09-02) · Feature · 2026-09-02
• Every New Compliance Framework Restarts the Same Fire Drill. It Doesn’t Have To. (2026-09-02) · Feature · 2026-09-02
• Introducing JFrog Platform Federation: One Control Plane for Synchronizing Every Site in Your Software Supply Chain (2026-08-24) · Feature · 2026-08-31
• announced · Aug 24, 2026 · Feature · 2026-08-31
• announced · Aug 28, 2026 · Feature · 2026-08-28
• Introducing JFrog Preview: Getting New Capabilities Into Your Hands, Faster (2026-08-28) · Feature · 2026-08-28

JumpCloud 2 changes

• JumpCloud Agent Release Notes for August 31, 2026 (2026-08-31) · Feature · 2026-09-01
• announced · Aug 31, 2026 · Feature · 2026-08-31

Knocknoc 6 changes

• changelog · Sep 2, 2026 · Feature · 2026-09-02
• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-02
• docs update · Docs · 2026-09-01
• docs update · Docs · 2026-09-01
• v26.08 · Feature · 2026-09-01

kubescape 2 changes

• v4.0.13 · Feature · 2026-09-02
• docs update · Docs · 2026-08-28

Lakera 3 changes

• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31
• docs update · Docs · 2026-08-31

Landlock 2 changes