The week in full · Sep 4–10

Identity & Access Management · 2026-09-10

1Password: Adds a setting in Settings > Developer > Advanced to prompt for approval on every SSH request via the SSH agent (Ask approval for each new).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-10

Developer Environments gains CLI/SDK programmatic access options and environment ID copy; Watchtower adds breadcrumb navigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Developer Environments now includes programmatic access options for the 1Password CLI and SDKs, along with an option to copy the environment ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The Developer Watchtower page now includes breadcrumb navigation.
• Simplifies the steps to add an account from 1Password.com or via QR code scanned with 1Password on a mobile device.

Identity & Access Management · 2026-09-10

1Password for Mac adds MDM default sign-in address support, expanded macOS Autofill coverage, and CLI/SDK access in Developer Environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• macOS Autofill now works in more places, including when connecting to a server in Finder, with a confirmation prompt before filling.
• Adds a Settings > Autofill > 'Disable macOS Autofill' option to turn off macOS Autofill from within the app.

Identity & Access Management · 2026-09-10

1Password: When Unlock using Windows Hello is turned on, the Convenient and Balanced security presets now turn on Trusted Platform Module (TPM) support by default.

Identity & Access Management · 2026-09-10

Autofill on iOS now unlocks all accounts with a single Face ID scan and skips biometrics for password-only accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Improves Autofill unlocking so one Face ID prompt unlocks every available account, and skips biometric prompts when an account requires a password instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-10

1Password in the browser now saves logins on split username/password screens and shows which app version the extension is connected to.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Settings now shows whether the browser extension is connected to 1Password 7 or 1Password 8.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Offers to save your login when a site asks for your username and password on separate screens.
• Visual improvements to the single sign-on (SSO) migration prompt with a simpler, more compact design.

AI/LLM Security · 2026-09-10

AI-Infra-Guard v4.6.1 adds Gemini, Gemma, and GLM fingerprints to the API Checker.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Gemini, Gemma, and GLM fingerprints to the API Checker for model identification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates the GLM-5.3-Flash fingerprint baseline in the API Checker.

AI/LLM Security · 2026-09-10

safe2 CLI 0.2.0 adds offline Challenge evidence bundles, hardened skill gate scanning, and a --executable flag for the SkillSpector adapter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds safe2 challenge quickstart 001 --output-dir <dir> to generate an offline Challenge 001 evidence bundle with a Decision Card, requiring no model credentials or paid APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds safe2 challenge verify-bundle <dir> to verify an evidence bundle's internal consistency, rejecting missing or changed artifacts, unsupported versions, and inconsistent results.
• Adds --expected-sha256 flag to safe2 challenge verify-bundle to pin a complete bundle against a trusted manifest fingerprint obtained out-of-band.

Digital Forensics & Incident Response · 2026-09-10

ALEAPP v2026.3.3 adds 70+ new app parsers, deep Android system artifacts, MMKV decryption, and a combined SMS/MMS artifact.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a combined SMS and MMS Messages artifact that merges both transports into one table sorted by date, with a Message Type column (SMS or MMS) and a Source Table column naming the originating table (sms, spam_sms, or pdu).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new MMS Attachments artifact reporting every part row joined to its message, including unreferenced files under app_parts and parts with stored content type, sniffed type, size, and a status column.
• Adds MMKV decryption support via a vendored mmkv_parser, correct varint header handling, and a new MMKV - Recovered Records artifact.

Identity & Access Management · 2026-09-10

Auth0 Agent Skills adds HealthCheck skill for AI coding agents to audit tenant security, config, and plan fit via Auth0 CheckMate⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds npx skills add auth0/agent-skills to install the official Auth0 Agent Skills package into a local terminal or IDE-based AI coding agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Auth0 HealthCheck skill, which queries a live Auth0 tenant via the Auth0 Management API and Auth0 CheckMate to produce confidence-weighted security posture and capability-fit scores, then generates a prioritized findings report.
• Integrates Auth0 CheckMate automated scans covering token signing algorithms (RS256 vs HS256), DPoP configuration, CORS origins, attack protection settings, callback URLs, logout redirects, social connection keys, grant types, and database connection settings.

Identity & Access Management · 2026-09-10

Integration Client 26.2.1 adds session asset columns and configurable HTTP timeouts via new config keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DownloadTimeoutSeconds, ApiRequestTimeoutSeconds (default: 300 s), and ApiInfoTimeoutSeconds (default: 60 s) config keys so HTTP timeouts are bounded and tunable per environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds four nullable session columns — asset_type, asset_name, asset_comments, and asset_tag — to both the Analytics DB Plugin and the SQL Server Plugin, populated from the Reporting API, so reporting teams can correlate session activity with the worked-on asset without joining an external inventory source.

Post-Exploitation · 2026-09-10

API surface changed: +30 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v2/alert-webhooks/{alert_webhook_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /api/v2/alerts/{alert_id}
• New endpoint DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id}

AI/LLM Security · 2026-09-10

API surface changed: +5 endpoints, 126 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /backend/v1/agent-sessions/{agentSessionId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /backend/v1/campaign-runs/{campaignRunId}/access
• New endpoint GET /backend/v1/license

Malware Analysis · 2026-09-10

CAPEv2 adds a GCP Pub/Sub diagnostic loop with Cloud Monitoring integration and symlink preservation in NFS report copy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds _diagnostic_loop method to the GCP Pub/Sub service that periodically logs status and queue depth using google.cloud.monitoring_v3, with optional pip install google-cloud-monitoring for precise counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds symlinks=True to the shutil.copytree call in node_get_report_nfs, preserving symlinks when copying analysis results from workers over NFS.

AI/LLM Security · 2026-09-10

Certiv: Introduces Certiv Cost (now in public preview), providing session-level token attribution broken out by agent, endpoint, user, and model with historical trend data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per-endpoint dollar budgets with three enforcement modes — Report, Notify, and Block — where Block stops prompts at the endpoint before they are sent.
• Supports configurable custom rates per model so budget thresholds reflect negotiated pricing rather than list pricing.
• Adds a budget simulation feature that shows how often an endpoint would have hit a proposed threshold using historical usage, making it easier to calibrate limits before enforcing them.

Container & Image Security · 2026-09-10

Chainguard adds Go 1.27 images with runtime FIPS module selection and Chainguard Libraries support in JFrog Catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds go-openssl-fips container image for Go 1.27 that selects its FIPS-validated cryptographic module at deployment rather than at build time, enabling a single artifact to run with either the OpenSSL FIPS provider or the Go Cryptographic Module without recompilation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Go 1.27 support across the go, go-fips, and go-openssl-fips Chainguard container images.
• Integrates Chainguard Libraries with JFrog Catalog so joint customers can pull Chainguard-built packages through JFrog Artifact Repository without build errors, enabling JFrog Zero-Touch Remediation with patched Chainguard packages; Java support is live, JavaScript and Python to follow by end of September 2026.

Container & Image Security · 2026-09-10

API surface changed: +1 endpoint, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /registry/v2/repos/{repoUid}/digests/{digest}/stig:download⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GET /policies/v1/decisions: param artifactId (query) added

Reverse Engineering · 2026-09-10

checksec.sh gains --exploit for static mitigation-obstruction analysis with tiered verdicts, CI gating, and machine-readable output⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --exploit flag to append a static mitigation-obstruction section to the default table, reporting which memory-corruption techniques (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ stack-bof-overwrite, ret2libc, got-overwrite, shellcode-injection, format-string, ret2plt, ret2dlresolve) the binary's posture fails to block, with tier labels VIABLE, LIKELY, REQUIRES-LEAK, REQUIRES-INPUT-CONTROL, ENABLER, or BLOCKED.
• Adds --chain flag (implies --exploit) to assemble a labelled hypothesis exploit chain — a control-flow-hijack step plus compatible payload step — from VIABLE verdicts, always marked hypothesis.
• Adds --fail-if=exploit.viable and --fail-if=exploit.technique=<rule-id> predicates (used with --exploit) for CI gating on exploitability tier.

Reverse Engineering · 2026-09-10

checksec.sh gains -o llm output mode that emits self-grounding Markdown reports for LLM analysis, with optional --exploit verdicts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -o llm output format that emits a self-grounding Markdown report — including a grounding directive, a per-check knowledge block with fix guidance, and terse per-target result rows — designed to be pasted directly into an LLM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --llm-no-preamble flag to suppress the grounding directive when supplying a custom prompt.
• Adds --exploit flag (usable with -o llm) to include inline static exploitability verdicts labelled VIABLE per attack technique, with a barrier description.

Reverse Engineering · 2026-09-10

checksec.sh gains --exploit exploitability reasoning, --chain hypothesis chains, -o llm LLM-ready output, and CI gating predicates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --exploit flag to append exploitability reasoning on top of raw checks, reporting which memory-corruption techniques (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ stack-bof-overwrite, ret2plt, got-overwrite) the binary's mitigation posture fails to obstruct, with tier verdicts (VIABLE, LIKELY, REQUIRES-LEAK, REQUIRES-INPUT-CONTROL, ENABLER, BLOCKED) and supporting citations (imports, relocations, segment permissions).
• Adds --chain flag to include a labelled hypothesis exploit chain in the exploitability output (implies --exploit).
• Adds -o llm output format rendering a self-grounding Markdown report — including finding meanings, fixes, and a grounding directive — designed to be pasted directly into LLM assistants such as Claude or ChatGPT.

Reverse Engineering · 2026-09-10

checksec.sh adds --exploit exploitability reasoning and -o llm Markdown output for LLM-assisted analysis⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --exploit flag to reason about which attack techniques the mitigation posture fails to obstruct, with evidence-cited, honest tiers that never claim exploitable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -o llm output format that emits a self-grounding Markdown report designed to be pasted into an LLM assistant so it reasons from tool output rather than from memory.

Identity & Access Management · 2026-09-10

Clerk: Adds OAuth 2.0 Device Authorization Grant (beta, RFC 8628) for clients that cannot open a browser — CLIs, TVs, game consoles — enabling device-code polling flows without redirect URIs or PKCE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) in the Device Authorization Grant flow.

Identity & Access Management · 2026-09-10

API surface changed: +2 endpoints, 9 modified, 2 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /users/{user_id}/biometric_credentials

Internet Services · 2026-09-10

Cloudflare adds R2 Data Access Logs GA, 64 MiB Worker size limit, Images text rasterization, WSGI/ASGI Python Workers support, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per_cache_read_token and per_cache_write_token fields to the cf-aig-custom-cost header in AI Gateway, enabling custom cost metrics to reflect negotiated cache pricing for cache-read and cache-write token rates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds filter.metadata parameter to the .list() method in the Images binding, enabling metadata-based filtering with range operators such as { gte: 2, lte: 5 }.
• Adds wsgi.fetch() method from the workers module for manual control of WSGI dispatch inside a WorkerEntrypoint class.

Internet Services · 2026-09-10

Cloudflare: Adds full CRUD for payment methods via GET/POST /accounts/{account_id}/payment-methods, GET/PUT/DELETE /accounts/{account_id}/payment-methods/{payment_method_id}, and POST /accounts/{account_id}/payment-methods/{payment_method_id}/set-as-default.

• Adds POST /accounts/{account_id}/pay-invoice and POST /accounts/{account_id}/pay-bad-debt to pay invoices and bad debt directly via API.
• Adds GET /accounts/{account_id}/billing/credits, GET /accounts/{account_id}/billing/history, GET /accounts/{account_id}/billing/bad-debt, and GET /accounts/{account_id}/billing/unpaid-invoice for account billing visibility.
• Adds full CRUD for BGP filter profiles via GET/POST /accounts/{account_id}/magic/bgp/filter_profiles and GET/PUT/DELETE /accounts/{account_id}/magic/bgp/filter_profiles/{profile_id}.

Internet Services · 2026-09-10

AI Gateway gains custom cache token pricing, Radar search covers Internet events, and Python Workers now support Python 3.14⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports setting custom cache-read and cache-write token rates for requests routed through AI Gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• R2 Data Access Logs now record object operations with response status codes below 400 and expose per-request events in Workers Observability.
• Browser Isolation displays an inline tap-to-type prompt for iOS users.

Internet Services · 2026-09-10

Cloudflare: Adds per_cache_read_token and per_cache_write_token fields to the cf-aig-custom-cost header in AI Gateway custom costs, enabling cache-read and cache-write token rates to reflect negotiated cache pricing; an omitted cache rate defaults to per_token_in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports wsgi and asgi modules from the workers package in Python Workers, enabling WSGI frameworks (Django, Flask) via wsgi.entrypoint(app) and ASGI frameworks (FastAPI, Starlette) via asgi.entrypoint(app).
• Adds R2 Data Access Logs (GA) for non-jurisdictional buckets, recording object read, write, list, multipart upload, and delete operations with response status codes; filterable in Workers Observability by bucket, operation, interface, actor, and other request fields.
• Raises the Workers bundle size limit to 64 MiB (uncompressed) across all plans, removing the previous 3 MB (Free) and 10 MB (Paid) compressed-size checks; use wrangler deploy --outdir bundled/ --dry-run to inspect bundle size before deploying.

Internet Services · 2026-09-10

API surface changed: +7 endpoints, −1 endpoint, 58 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /accounts/{account_id}/field_extractors/{extractor}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /accounts/{account_id}/field_extractors/{extractor}
• New endpoint GET /accounts/{account_id}/workers/observability/zones/{zone_id}/observability/tracing/rules

Internet Services · 2026-09-10

Cloudflare: Adds successRetention and errorRetention fields to WorkflowInstanceCreateOptions (via env.MY_WORKFLOW.create({ retention: { ... } })) to control per-instance state retention on Workers Workflows, with a new seven-day default for Workers Paid (previously 30 days); maximum remains 30 days.

• R2 Data Access Logs are now generally available, recording object read, write, list, multipart upload, and delete operations (with response status codes) across the S3-compatible API, Cloudflare API, Workers bindings, and public buckets via r2.dev or custom domains; events appear in Workers Observability and are filterable by bucket, operation, interface, and actor.
• Raises the Workers bundle size limit to 64 MiB (uncompressed) across both Free and Paid plans, removing the previous compressed-size limits of 3 MB (Free) and 10 MB (Paid); use wrangler deploy --outdir bundled/ --dry-run to check bundle size before deploying.
• Cloudflare One Appliance dashboard now supports defining custom applications — matched by hostnames, IP subnets, and the new Source subnets field — for breakout and prioritized traffic steering, without requiring API calls.

Internet Services · 2026-09-10

Cloudflare: New Workflows on Workers Paid retain instance state for seven days by default.

• Improves iOS tap-to-type experience in Browser Isolation by displaying an inline prompt.

General Utilities & Libraries · 2026-09-10

VS Code Agent Customizations editor gains experimental migration flows and config keys to convert prompt files and location settings to Agent Host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.customizations.promptMigration.enabled setting (default true) to control prompt-file-to-skills migration in Agent Host sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.customizations.locationsMigration.enabled setting (default false) to migrate custom agents, instructions, and skills from locations configured via deprecated chat.agentFilesLocations, chat.modeFilesLocations, chat.instructionsFilesLocations, and chat.agentSkillsLocations settings.
• Adds Migrate Prompt Files and Migrate Location Settings migration cards in the Agent Customizations editor, surfaced when an Agent Host is selected and the corresponding setting is enabled.

General Utilities & Libraries · 2026-09-10

VS Code Agents window gains single-pane layout, Markdown editor, per-window settings overrides, and extension opt-in support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.agentHost.byokModels.enabled setting to make Bring Your Own Key models available to Agent Host sessions in the Agents window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.agentHost.allowSignedOutWhenUsable setting to enable Claude, Codex, and BYOK models in the desktop Agents window without GitHub sign-in (experimental).
• Adds sessions.layout.singlePaneDetailPanel setting to enable an experimental single-pane layout that replaces the separate editor and side panel with one docked pane sharing a tab bar for Changes, Files, Browser, and Search.

General Utilities & Libraries · 2026-09-10

VS Code agents gain layered approval controls, per-command terminal rules, and sandbox isolation for file system and network access⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.agent.sandbox.allowAutoApprove setting to require normal terminal approval flow for commands running inside the sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds object syntax with matchFullCommand to evaluate the full command line instead of each subcommand individually in terminal auto-approval rules.
• Adds chat.agent.terminalApproval.useOnlyCustomRules experimental setting to ignore built-in terminal approval rules and rely solely on user-defined rules.

General Utilities & Libraries · 2026-09-10

VS Code Agents window gains multi-harness support with handoff, worktree isolation, and cloud PR-based task delegation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Cloud target that runs an agent harness on remote infrastructure, implements a task on a branch, and opens a GitHub pull request for review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables session handoff, which carries conversation history and context when switching harnesses (Copilot, Claude, Codex, or Cloud) mid-task.
• Adds code isolation via Git worktree in the Agents window, keeping agent file changes separate from the active workspace.

General Utilities & Libraries · 2026-09-10

VS Code Automations let you schedule recurring agent tasks from a saved prompt, config, and schedule — no manual session start required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables chat.automations.enabled setting to unlock a new Automations panel in the Agents window sidebar for scheduling recurring agent sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new Automations feature that runs saved prompts on a schedule (Manual, Hourly, Daily, or Weekly) against a chosen workspace and agent, with run history and session review.
• Supports New Worktree isolation option for Git workspaces when creating an automation, letting the agent work on a separate branch without touching the main workspace.

General Utilities & Libraries · 2026-09-10

VS Code Agents window adds BYOK model support, Voice Mode, quick-chat-to-workspace promotion, Automations scheduling, and worktree isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables chat.automations.enabled to unlock Automations — a sidebar feature for scheduling recurring agent tasks from a saved prompt, running hourly, daily, or weekly on demand.
• Adds Voice Mode to the Agents window chat input, letting practitioners steer active agent sessions by speech instead of typing.
• Adds the ability to promote a quick chat into a full workspace session, preserving title, conversation history, and the in-flight request while giving the agent access to project files.

General Utilities & Libraries · 2026-09-10

VS Code ships Agent Host for persistent, portable agent sessions plus an open Agent Host Protocol (AHP) with multi-language client libraries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds code agent host (and code-insiders agent host for Insiders) CLI subcommand to start a standalone Agent Host process on your machine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Agent Host, a self-contained process that owns agent sessions independently of any editor window, keeping sessions alive after closing a folder or window.
• Introduces the open Agent Host Protocol (AHP) for coordinating multiple independent clients around the same long-running agent session via URI-addressable channels (sessions, chats, terminals, changesets).

Identity & Access Management · 2026-09-10

ConductorOne adds a dedicated Non-Human Identity (NHI) dashboard covering app registrations, assumable roles, and managed identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Identities > Overview dashboard that surfaces every human and non-human identity discovered across connected sources in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a dedicated NHI tab scoped to app registrations (Entra enterprise apps, OAuth apps, GitHub Apps, Databricks service principals), assumable roles (AWS IAM roles, GCP workload identities), and managed identities.
• Surfaces separate tabs for Human users, Service, Secrets, and Agents identity categories alongside the new NHI view.

Identity & Access Management · 2026-09-10

ConductorOne reorganizes admin nav and adds per-section Overview dashboards across all major areas.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Platform section housing Policies, Forms, Task log, and Integrations (excluding Connectors).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a per-section Overview dashboard for every nav section except Apps, replacing the single Analytics page.
• Moves Connectors into the Apps section to co-locate it with app governance.

Identity & Access Management · 2026-09-10

ConductorOne adds agent classifiers, MCP resource governance, new system log event classes, and four session-policy API endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a bulk request limit setting in Governance > Forms letting admins cap the number of entitlements a user can request at once (1–100, default 10).
• Adds a dedicated tab for MCP static resources and URI templates discovered on a server, where admins can approve them; each approved resource gets its own read entitlement governed separately from tool and toolset access.
• Adds per-section dashboard pages that break apart what previously lived in the single Product digest view.

Third-Party & Vendor Risk (TPRM) · 2026-09-10

Conveyor splits document preview vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ download analytics, adds NDA signature alerts to Slack, and surfaces legacy role migration guidance.

• Tracks document previews and downloads as separate actions in Trust Center analytics and reporting, replacing the previous behavior where previewing a PDF counted as a download.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Sends a Slack message when a visitor signs your NDA, surfacing the buying signal without requiring a manual app check.
• Adds a banner and inline help links to the Roles page prompting admins to migrate users off legacy roles to customized roles.

Third-Party & Vendor Risk (TPRM) · 2026-09-10

ConveyorAI for RFPs rebuilt with an agentic answering engine, improved Word doc handling, and a unified proposal workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the new agentic answering engine for RFP projects via Settings > Answering > Custom Instructions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a rebuilt Word document experience with improved loading, parsing, and export for RFP proposals.
• Introduces a unified proposal workspace that runs RFPs and security questionnaires from a single Conveyor knowledge base.

Third-Party & Vendor Risk (TPRM) · 2026-09-10

Conveyor lets reviewers approve or edit questionnaire answers directly from Slack without logging in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Slack-native questionnaire review: assigned reviewers receive a rich Slack notification with the draft answer and buttons to approve or edit in-channel, with the result synced back to Conveyor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables the Slack approval workflow per program under Settings > Self-Serve via Slack for existing customers.

Third-Party & Vendor Risk (TPRM) · 2026-09-10

Conveyor admins can now self-serve edits to automation rule settings directly in the UI — no support ticket needed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables admins to edit automation rule settings — including Content In Scope, Number of Questions, Update Requests, Answer Status Check, and Return complete materials to source — directly on the Automation Rules page without filing a support request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Third-Party & Vendor Risk (TPRM) · 2026-09-10

Conveyor adds an opt-in agentic answering pipeline for RFP proposal questions, with Labs support for security questionnaires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables security questionnaire teams to trial the agentic engine by creating a Test project (currently in Labs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-10

cve-lite-cli gains cve-lite overrides command with eight override-hygiene rules, auto-fix via RFC 6902 patches, and JSON output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cve-lite overrides [path] subcommand that audits override files and emits severity-grouped terminal output across eight rules (OA001–OA008).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --json flag to cve-lite overrides for structured JSON findings output, suitable for downstream tooling.
• Adds --fail-on <severity> flag to cve-lite overrides to set the minimum severity that causes a non-zero exit (default: critical); supported scale is critical > high > medium > low > info.

SIEM · 2026-09-10

Horizontal scaling for Databricks Apps comes to compliance security profile workspaces, enabling multi-instance apps behind a single URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables horizontal scaling for Databricks Apps in workspaces with the compliance security profile, running an app across multiple instances behind a single app URL for higher availability and concurrency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-10

Data Classification extends sensitive-data scanning to Unity Catalog views (Beta), using the same detection engine as tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Data Classification scanning to Unity Catalog views in addition to tables, classifying view columns for sensitive data using the same detection engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-10

DataDome adds static asset exclusion support, letting you skip CSS, JS, images, and other non-dynamic files from bot protection processing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports excluding static asset file types (including avi, avif, bmp, css, eot, flac, flv, gif, gz, ico, jpeg, jpg, js, json, less, map, mka, mkv, mov, mp3, mp4, mpeg, mpg, ogg, ogm, opus, otf, pdf, png, svg, svgz, swf, tif, tiff, ttf, wav, webm, webp, woff, woff2, xml, zip) from DataDome processing to reduce unnecessary inspection of non-dynamic content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-09-10

DefectDojo Pro v3.3 adds cross-domain finding correlation, PSIRT 2.0, API v3 alpha, FIPS 140-3 support, and major asset/connector overhauls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api/v3-alpha/ (API v3 alpha) with slim references, expansion, RBAC sub-resources, and the Pro importer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes Custom Fields on the token-authenticated /api/v2 API.
• Adds a CycloneDX/SPDX SBOM and CycloneDX VEX export API, and the Pro UI now accepts .spdx files on import.

Vulnerability Management · 2026-09-10

defectdojo: Adds POST /api/v2/api-tokens/revoke/ endpoint, allowing a superuser or Global Owner to revoke a token by its key value (returns 204 on success, 404 if key not found, 403 for non-superusers).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds token_expiry field to PATCH /api/v2/user_contact_infos/{id}/ so superusers can set or clear a per-user token expiry datetime; expired tokens receive 403 Forbidden with {"detail": "API token has expired."} rather than being deleted.
• Adds DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable to enforce an instance-wide maximum token lifetime (in days) measured from each token's creation time; defaults to no expiry.
• New endpoint documented: POST /api/v2/api-tokens/revoke/

Identity & Access Management · 2026-09-10

Didit adds email and phone risk intelligence endpoints with social-footprint add-on, plus expanded KYB registry search and select APIs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an email risk intelligence endpoint that returns deliverability, disposable-address, breach, cross-session match, and normalized risk signals via x-api-key authentication without sending an OTP; set enable_social to true to include an email_social block listing platforms the address is registered on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a phone risk intelligence endpoint that returns carrier, line-type, porting, disposable-number, cross-session match, and normalized risk signals without sending an OTP; set enable_social to true to include a phone_social block listing platforms the number is registered on.
• Exposes normalized intelligence objects under both email.email_intelligence / email.enrichment and phone.phone_intelligence / phone.enrichment as compatibility aliases — new integrations should read email.enrichment and phone.enrichment.

Identity & Access Management · 2026-09-10

Didit adds company registry search by name, registration number, and country to its API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds company registry search supporting lookup by name, registration number, and country, priced at up to $0.50 per successful request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-10

Didit adds KYB Registry API with company search and Lite profile selection endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v3/kyb/search/ endpoint to search for companies by registry (up to $0.50 per successful search; empty results and failures are not charged)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST /v3/kyb/select/ endpoint to retrieve a Lite profile — company details and officers — for a selected company ($2.00 per selected company, billed separately from search)

Identity & Access Management · 2026-09-10

Didit adds non-document ID lookup and per-country method controls, with assurance tiers surfaced in the decision API and webhooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds status.updated webhook payload fields and decision API fields carrying the verification method (Documentary, Data match, Cryptographic) and assurance tier for every ID Verification session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Countries tab on the ID Verification step to toggle document capture, non-document lookup, and digital wallet methods on or off per country, with the same controls available through the API.
• Adds Registry comparison result detail: every field comparison showing what the user provided, what the source held, and whether it matched, plus an error row when a source did not respond.

Secure Access (VPN / SASE / ZTNA) · 2026-09-10

DNSFilter MCP Server is now generally available, letting AI assistants like Claude, ChatGPT, and Codex query DNS data and manage policies in natural language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the DNSFilter MCP Server integration, reachable under Integrations → AI Connectors, enabling AI assistants (Claude, ChatGPT, Codex) to query DNS activity and threat data, manage policies and allow/block lists, and automate reports and investigations via the Model Context Protocol — no dashboard navigation required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Connected MCP clients stay authorized for seven days before requiring reconnection, and operate under the connecting user's existing DNSFilter permissions.

SIEM · 2026-09-10

Elastic Security 9.4.0 adds process events for memfd_create and kernel module loads on Linux, exposing fileless ELF execution in Defend telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds process.Ext.memfd.name, process.Ext.memfd.flags, flag_cloexec, flag_allow_seal, flag_hugetlb, flag_noexec_seal, and flag_exec fields to process events in Elastic Defend, capturing memfd_create syscall arguments for hunting fileless ELF execution chains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Elastic Defend now records a process event when a process calls memfd_create on Linux (requires kernel 5.10.16+ for eBPF-based event sourcing), starting from Elastic Security 9.4.0.
• Adds load_module event action to process events in Elastic Defend, reporting init_module and finit_module-based loadable kernel module loads for visibility into fileless kernel module activity.

SIEM · 2026-09-10

Elastic Defend 9.5.0 adds a dll.Ext.defense_evasions field that reduces DLL hijacking detection from 88 lines to one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dll.Ext.defense_evasions: "DLL Hijack: Masquerading" field in Elastic Defend 9.5.0 to detect DLL search-order hijacking in a single rule condition, replacing rules that previously required ~88 lines covering ~2,600 named libraries, 10 excluded Windows system paths, signature checks, and a drop-to-load time window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enriches DLL load events with DLL Hijack: Masquerading when a loaded DLL is not Microsoft-signed and its name matches a cached inventory of Windows and system-library DLLs, enabling direct field-based detection in detection rules.

Firewalls & Network Defense · 2026-09-10

Fastly Terraform Provider beta 0.1.0 rewrites on Plugin Framework with auto-managed services, TLS, and NGWAF resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces _auto service resources with provider-managed version lifecycle (auto-clone, validate, and activate on every CRUD operation).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Terraform resources for core service building blocks: domain, backend, ACL + ACL entries, config store + items, secret store, dictionary items, cache settings, response object, request setting, custom dashboard, syslog logging, and DNS zone.
• Adds TLS resources covering certificates, private keys, mutual authentication, activation, subscriptions, and Platform TLS.

Firewalls & Network Defense · 2026-09-10

Fastly Terraform Provider beta 0.1.3 adds Cloudfiles logging, TSIG key resources, and object storage access key management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds fastly_tsig_key resource and fastly_tsig_keys data source for managing TSIG keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new resource for managing Fastly object storage access keys.
• Adds support for Cloudfiles logging via logging_cloudfiles.

Firewalls & Network Defense · 2026-09-10

Fastly Object Storage gains Direct Fetch: server-side S3 transfers via fastly-object-storage-source-url header on PutObject/UploadPart⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds fastly-object-storage-source-url request header support on PutObject and UploadPart S3 API calls, letting Fastly pull object data directly from a source URL server-side instead of requiring the client to upload a payload (Content-Length: 0).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports partial range transfers in Direct Fetch via a standard Range header (e.g., bytes=0-41943039) on UploadPart requests, enabling multipart uploads from a source URL byte-range without client-side data handling.
• Accepts pre-signed URLs in the fastly-object-storage-source-url header to migrate private assets without exposing long-term credentials.

Web Application Security · 2026-09-10

ffuf v2.3.0 adds preflight/postflight requests with variable extraction and bounds response snapshot sizes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds preflight and postflight requests with variable extraction, enabling multi-step request chains where values captured from an earlier response can be injected into subsequent fuzz requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Bounds the -od/-audit-log response snapshot and response header size to cap on-disk and in-memory growth during large fuzzing runs.

AI/LLM Security · 2026-09-10

garak v0.17.0 adds EU AI Act risk mapping for probe results and Ollama auth/custom client support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds EU AI Act mapping that tags and groups probe results by EU AI Act risk categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds authentication and custom client kwargs support for the Ollama generator.
• Forwards generation parameters to the Ollama generator via an options dict.

Secrets Detection & Management · 2026-09-10

GitGuardian API adds external_provider_type field with Okta support for team management endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds external_provider_type field (with supported value okta) to team-related API endpoints, enabling teams to be associated with an external identity provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-09-10

GitGuardian Public Secrets Monitoring adds dual AI agents delivering company-related verdicts, risk scores, and visible reasoning for every public incident.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Analysis tab to the incident investigation details view, showing triage reasoning, deep-analysis findings, and the timeline of both AI agent passes so reviewers can inspect the logic behind each verdict.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a triage AI agent and a deep analysis AI agent that run over every public GitHub and Docker Hub incident, returning a company-related verdict (Related, Uncertain, or Unrelated) and an agent-computed risk score.
• Ships three pre-configured saved views covering company-related, unclear if company-related, and not company-related incidents, so teams open a pre-triaged queue instead of a flat incident list.

SAST / SCA / Code Security · 2026-09-10

CodeQL 2.27.0 adds Linux ARM64 support, a new Rust command-injection query, and Micronaut/PostgreSQL coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds native Linux ARM64 support for the CodeQL CLI and bundle, available via the linux-arm64 per-platform release assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the rust/command-line-injection query to detect uncontrolled command lines in Rust code.
• Adds PQexec, PQexecParams, PQprepare, PQsendQuery, PQsendQueryParams, and PQsendPrepare as SQL injection sinks for cpp/sql-injection and related C/C++ queries.

SAST / SCA / Code Security · 2026-09-10

GitHub Copilot admins can now centrally enforce per-operation agent permissions across shell, file, and network surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds enterprise-managed permissions for GitHub Copilot agent operations, letting admins block, require human approval for, or auto-allow shell commands, file reads and edits, and network domains — enforced across GitHub Copilot app, GitHub Copilot CLI, and Visual Studio Code Agent Host sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports per-team policy scoping so different enterprise teams can receive specialized agent permission rules.
• Managed restrictions override and cannot be weakened by user settings, workspace settings, auto-approval rules, or previously saved approvals.

SAST / SCA / Code Security · 2026-09-10

GitHub rulesets can now block PRs from merging when secret scanning alerts are open, configurable via UI, REST API, or GraphQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds require_secret_scanning_alert_resolution rule type to the REST API (with a secret_types parameter) to block PRs from merging when open secret scanning alerts exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds REQUIRE_SECRET_SCANNING_ALERT_RESOLUTION rule type in the GraphQL API for the same PR-blocking capability.
• Adds Require secret scanning alerts are resolved ruleset rule in repository, organization, and enterprise settings under Repository > Rulesets, blocking PR merges until all introduced secret alerts are cleared.

SAST / SCA / Code Security · 2026-09-10

GitLab gains a User Applications REST API, W3C Trace Context CI variables, SCIM token inspection, Scala code-graph support, and instance-wide Secret Push Protection enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the User Applications REST API to programmatically create, view, update, and delete user-owned OAuth applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SCIM token support to the Token Information API, enabling identity and access management systems to inspect SCIM tokens alongside other GitLab tokens.
• Introduces CI_TRACEPARENT and CI_TRACESTATE predefined CI/CD variables bringing W3C Trace Context into jobs for cross-pipeline and distributed-system trace correlation.

Reconnaissance & OSINT · 2026-09-10

Data Security & DLP · 2026-09-10

Immuta Request app now supports bulk multi-user access requests and email hover tooltips on user names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables requesting access for multiple users in a single submission via the Immuta Request app, replacing the need to create separate requests per person.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds email address display on hover over user names in the request form to disambiguate users with similar or identical names.

Secrets Detection & Management · 2026-09-10

Infisical v0.165.9 adds a global command menu, INFISICAL_RUN_MODES env var, Daytona duplicate-sync detection, and PKI license gating.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces INFISICAL_RUN_MODES environment variable to control which operational modes the Infisical server runs in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a global command menu to the UI for fast keyboard-driven navigation across the platform.
• Adds PKI license gating to enforce feature access based on license tier.

Attack Surface & Exposure Management · 2026-09-10

Intruder adds configurable additional domains for authenticated web app scans, covering subdomains and external identity providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Additional domains field in the authentication setup for web app targets, allowing subdomains (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ api.example.com, auth.example.com) and external services (identity providers, CDNs, third-party APIs) to be included in authenticated scan scope.

Endpoint Security (EDR/XDR) · 2026-09-10

Iru Vulnerability Management now supports Windows, bringing scan-and-patch in one console to match existing Mac coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports severity-based remediation controls, letting administrators set per-CVE enforcement actions: immediate update, timed enforcement, or no action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Inventories all installed Windows applications, maps them against the National Vulnerability Database (NVD), and ranks findings by severity with an active-exploitation flag.
• Tracks each CVE through statuses — active, remediated, or risk-accepted — with device-level counts for fleet-wide visibility.

Threat Intelligence · 2026-09-10

API surface changed: +1 endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint POST /monitoring/claim-pending⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-10

juice-shop adds a JSON-based NextGen B2B API at /b2b/v2 with JWT bearer auth and a POST /orders endpoint for enterprise order management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /b2b/v2/orders endpoint (createCustomerOrder) that accepts a JSON request body containing cid, orderLines, and orderLinesData fields and returns an OrderConfirmation with orderNo and paymentDue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Secures the new B2B API with HTTP Bearer authentication using JWT (bearerAuth security scheme), required on all /b2b/v2 routes.
• Introduces the OrderLinesData schema allowing order lines to be submitted in a customer-specific JSON string format, supporting fields such as couponCode and multi-value customerReference arrays alongside standard productId and quantity.

Identity & Access Management · 2026-09-10

JumpCloud: Adds MCP Discovery and Token & Cost Tracking options under Enhanced Discovery Options in device settings, enabling discovery of MCP servers and token/cost tracking from Cursor, Claude Code, OpenCode, Codex, VS Code, and Copilot CLI on managed Windows and macOS devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds App dropdown (mandatory application association) when adding a new MCP server in AI Gateway, scoping MCP server access to a specific SSO application or bookmark so User Group-based access control can be applied.
• Adds an MCP Connection column in AI & SaaS Management showing Discovered, Connected, or Not Available status for each app, with an Add MCP Server action and a View link in the right-hand app detail menu.
• Introduces Agent Identities (Public Preview) under Identity Management > Agents for non-human AI agent lifecycle management, with OAuth client credentials generation on the agent's Authentication tab and group-based SSO application assignment via Identity Management > Agent Groups.

Identity & Access Management · 2026-09-10

JumpCloud Enterprise Portal gains enterprise-level Active Directory Integration (ADI) management in Private Preview⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds enterprise-level Active Directory Integration (ADI) domain management to the JumpCloud Enterprise Portal (EP), allowing admins to create, share, and manage ADI domains across all managed sub-organizations from a single Enterprise Configuration interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Share Configuration workflow in the EP Configurations > Active Directory view to share a single enterprise-level ADI domain with selected sub-organizations.
• Enables per-org and per-user/user-group access control for enterprise-level ADI domains via the EP Organizations > Launch management session.

Identity & Access Management · 2026-09-10

JumpCloud: Introduces JumpCloud Access Requests, enabling configurable approval flows, request submission from the User Portal, and approve/deny management in the admin console.

• Access Requests events are tracked in Directory Insights and support webhook integration with ticketing systems such as JIRA.
• Renames JumpCloud SaaS Management to JumpCloud AI & SaaS Management and adds a Shadow AI Dashboard with visibility into generative AI app adoption, usage by department, and most active users.
• Adds proactive approval and restriction controls for AI app usage before apps are formally discovered.

Identity & Access Management · 2026-09-10

JumpCloud: Adds Agent Identities (Public Preview) under Identity Management > Agents for dedicated non-human identity management of AI agents, with OAuth client credential generation on the agent's Authentication tab, group-based access control via Identity Management > Agent Groups, and MCP server authorization via the agent Applications tab.

• Adds MCP Connection Status column (Discovered, Connected, or Not Available) and AI Gateway connection management to Access > AI & SaaS Management > Applications, so MCP servers discovered on managed devices can be connected to AI Gateway from the same view as other SaaS apps.
• Adds Password Vault to the JumpCloud Protect mobile app, enabling users to view, autofill, and launch credentials for vault items shared with them without leaving the Push/TOTP MFA app.
• Adds Password Vault to the User Portal (accessible from the left navigation after login), supporting bulk import of credentials via CSV or Excel file, sharing with Connect/View Secret/View Detail/Manage permissions, and management of websites, passwords, keys, and other credentials.

Identity & Access Management · 2026-09-10

JumpCloud adds AI-powered admin tooling: MCP Server, AI Gateway, Agent Identities, AI Admin Assistant, and AI Search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JumpCloud MCP Server for Admins, enabling admin workflows through the Model Context Protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI Gateway to proxy and secure AI client traffic, with integrations for Apollo.io, Asana, Atlassian Rovo, Cloudflare, Datadog, GitHub, GitLab, Google Workspace Apps, HubSpot, JumpCloud MCP Server, Linear, Slack, and Vanta.
• Adds Agent Identities and Agent Groups, including integration with Amazon Bedrock AgentCore, to manage non-human AI agent access within JumpCloud.

Identity & Access Management · 2026-09-10

JumpCloud adds Agentic IAM to govern AI agents alongside humans and devices, with shadow MCP discovery and PAM integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI Agent Identity & Access management, giving each AI agent a unique identity so admins can audit activity or revoke access independently of the owning employee.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Shadow AI to Secure MCP Connection: automatically discovers hidden Model Context Protocol (MCP) setups and routes them through the JumpCloud AI Gateway to eliminate shadow AI.
• Adds enforced approved SaaS access, applying security, device trust, and access policies uniformly across every AI tool and app in the environment.

Identity & Access Management · 2026-09-10

JumpCloud 2022 adds certificate-based RADIUS auth, TOTP for LDAP, Password Manager, Remote Assist, and a new Command After Agent Install type⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports certificate (passwordless) based authentication to JumpCloud RADIUS using any X.509-compliant certificate authority, allowing imported certificates to be used for RADIUS authentication.
• Adds JumpCloud Remote Assist for unlimited remote desktop access and support on Windows and macOS devices — free and limitless on sessions — requiring JumpCloud Agent v1.61.0 or later.
• Adds the SentinelOne integration, allowing the SentinelOne Agent to be downloaded and installed on macOS, Windows, and Linux devices via JumpCloud Commands.

Identity & Access Management · 2026-09-10

JumpCloud 2023 adds passwordless Go SSO, Android zero-touch enrollment, dynamic groups, remote background tools, and self-service device provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JumpCloud Go browser extension enabling hardware-protected, phishing-resistant passwordless login to JumpCloud-protected web resources using Apple Touch ID and Windows Hello on managed macOS and Windows devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Conditional access policies for SSO apps now default to JumpCloud Go as the MFA method, with user and device verification occurring on every application session.
• Adds Deel SSO Connector integration, enabling JumpCloud admins to create a Deel SSO integration.

Identity & Access Management · 2026-09-10

JumpCloud: Adds $lte and $gte filter operators for Dynamic Groups memberQuery filters in API requests, replacing the deprecated $le and $ge operators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Replaces the deprecated GET /systemusers/reactivate/{id} endpoint with POST /systemusers/reactivate/{id} (with activation_email in the request body) for account reactivation.
• Enables pipe | character to be escaped with backslash \ inside in and nin API filter search terms (e.g., GET /systemusers?filter=department:$in:Finance | Accounting|IT).
• Adds support for multiple IP addresses in a single RADIUS server configuration.

Identity & Access Management · 2026-09-10

JumpCloud adds Access Requests, MCP Server, Shadow AI Dashboard, AI Commands Builder, and a wave of new device and SSO capabilities in 2025.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Honors ForceAuthn='true' in SAML and prompt=login in OIDC so applications can trigger step-up authentication without ending the user's existing session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Includes Authentication Methods References (AMR) claims in both SAML assertions and OIDC ID tokens, tagging logins with proof of factors used (e.g., password + OTP).
• Launches JumpCloud Access Requests GA — configure approval flows, manage requests from the JumpCloud User Portal, and track events in Directory Insights; supports webhooks to integrate with ticketing systems such as JIRA.

Identity & Access Management · 2026-09-10

JumpCloud adds Password Vault, Agent Identities, Access Risk Detection GA, MCP Discovery, and Custom Query Builder in September 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP Discovery and Token & Cost Tracking toggles under Access > AI & SaaS Management > Settings > Enhanced Discovery Options to discover MCP servers and track token usage and estimated cost from Cursor, Claude Code, OpenCode, Codex, and VS Code Copilot CLI on managed Windows and macOS devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Password Vault to the JumpCloud Protect mobile app, enabling users to view secrets, autofill credentials into mobile apps, and autofill credentials in the mobile browser after authenticating.
• Adds Password Vault management to the Admin Portal, allowing administrators to enable the vault, assign access to users and user groups, manage shared credentials and folders with Connect/View/Edit/Manage permissions, and view audit logs in Directory Insights.

Identity & Access Management · 2026-09-10

Identity & Access Management · 2026-09-10

JumpCloud: Scales item storage capacity to up to 13,000 items with autofill enabled, or up to 30,000 items without autofill; a single shared folder supports up to 5,000 items.

• ARM build for macOS devices with M-series silicon (M1 and above) is now available, with automatic update to the ARM build on eligible devices.
• Users can now sort items by nicknames.

General Utilities & Libraries · 2026-09-10

kubernetes-helm: Adds --description flag to helm rollback to record a human-readable reason for the rollback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a rollback revision column to helm history output so operators can trace which revision triggered each rollback.
• Adds duration template functions to the Helm chart templating engine.
• Adds debug logging to the template engine when lookup returns empty results.

General Utilities & Libraries · 2026-09-10

Helm v4.3.0 adds --description to rollback, duration template functions, SOURCE_DATE_EPOCH support, and ownership verification before resource deletion⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --description flag to helm rollback to record a reason for the rollback (max 256 characters) in the release history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds duration functions to the Helm template engine for time-based calculations in chart templates.
• Honors the SOURCE_DATE_EPOCH environment variable when producing chart archives, enabling reproducible builds.

SAST / SCA / Code Security · 2026-09-10

Lakera Red adds tool tracing so red team scans capture every agent tool call and result, not just final replies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds LAKERA_RED_TOOL_INTERCEPT, LAKERA_RED_API_KEY, and LAKERA_RED_URL environment variables to opt agent runtimes into tool tracing — off by default with zero network egress when unset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds interceptTool (TypeScript) / intercept_tool (Python) module-level functions in lakera-red-sdk to report a tool's name, arguments, and result to the Red API and return the result unchanged, accepting any JsonValue (string, number, boolean, null, array, or object).
• Supports a dispatch-middleware integration pattern so tracing can be wired once into an existing tool-dispatch path — with optional per-tool allowlisting — rather than instrumenting each tool individually.

Threat Intelligence · 2026-09-10

MISP v2.5.46 adds SSRF hardening with UrlEgressValidator, 50x sightings query speedup, and expanded Overmind UI workflows including a first MISP Tutorial.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a shared UrlEgressValidator that enforces a common outbound URL policy — validating schemes and resolved addresses and blocking loopback, link-local, and private destinations across all remote-resource retrieval paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends CurlClient with host pinning, controlled and validated redirects, response size limits, and TLS peer verification enabled by default.
• Reduces event report count queries from one per event to one or two grouped queries per page — delivering roughly 19× to 35× improvements for that operation.

SAST / SCA / Code Security · 2026-09-10

Noir adds GraphQL Operations (GRAPHQL) to its list of supported specification formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for GRAPHQL (GraphQL Operations) as a recognized specification format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-09-10

OpenCTI 7.260910.0 adds ingestion logs for RSS, JSON, and stream feeds plus S3 offload metrics for event streams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds metrics and logging for stream events offloaded to S3, giving operators visibility into event offload activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ingestion logs for RSS feed ingestion, enabling operators to audit and troubleshoot RSS-based data pulls.
• Adds ingestion logs for JSON feed ingestion, enabling operators to audit and troubleshoot JSON-based data pulls.

General Utilities & Libraries · 2026-09-10

OpenSSL 4.1 Alpha adds DTLS 1.3, RFC 8701 GREASE, DTLS listener API, IKEv2 KDF, and Elbrus2000 architecture support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for DTLS 1.3 (RFC 9147), documented in the ossl-guide-dtlsv13(7) manual page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility) in TLS.
• Adds initial support for the Elbrus2000 (e2k) architecture.

General Utilities & Libraries · 2026-09-10

OpenSSL 4.1 adds DTLS 1.3 support, including PQC algorithms, faster handshakes, and SSL_new_listener() for DTLS⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DTLS 1.3 protocol support in OpenSSL 4.1, with fewer handshake round trips and removal of outdated cryptographic algorithms compared to DTLS 1.2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends SSL_new_listener() to support DTLS, enabling DTLS 1.3 listener workflows (note: DTLSv1_listen() does not support DTLS 1.3).
• Enables Post-Quantum Cryptography (PQC) algorithm support over DTLS 1.3, building on the PQC foundation introduced in OpenSSL 3.5.

Identity & Access Management · 2026-09-10

Ory Network v26.3.13 adds a temporary workaround for firewalls that reject post-quantum TLS handshakes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Provides a temporary workaround for firewalls that reject post-quantum TLS handshakes caused by Ory services offering ML-DSA post-quantum signatures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-10

ZAP retires AJAX Spider and DOM XSS add-ons from nightly/weekly releases and launches a new LLM Support add-on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new LLM Support add-on to OWASP ZAP, officially launched in August 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-09-10

Peirates v1.1.32 adds four new container escape techniques and a scanner to detect which are available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds docker-socket-breakout container escape that opens an interactive host-root shell when a Docker-compatible socket is accessible.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a container escape technique for when the node's root filesystem is mounted into the container.
• Adds a container escape technique exploiting a writeable /proc/sys/kernel/core_pattern.

CNAPP · 2026-09-10

Plerion adds Google Cloud workload security scanning for Compute Engine, Cloud Run, and Cloud Functions with keyless WIF access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Scans inside GCP workloads — Compute Engine instances, managed instance groups, and custom images — for vulnerabilities, software bill of materials, and secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends workload scanning to Cloud Run services and Cloud Functions (1st and 2nd gen) for vulnerabilities, SBOMs, and secrets.
• Runs all GCP workload scans inside a dedicated scanning project within your own organization, keeping data in-boundary.

Exploitation & C2 · 2026-09-10

Empire v7 adds 30+ BOF modules, AES-256-GCM, chunked uploads, persistent chdir, and a new ps-empire update subcommand⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ./ps-empire update subcommand that moves the checkout to the latest release tag, refreshes config.yaml, fast-forwards Starkiller, the plugin registry, and the Empire Compiler binary, and applies pending Alembic migrations; use -y to auto-confirm the backup prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds starkiller.directory config option to serve an already-built Starkiller instead of cloning from GitHub, enabling air-gapped and distro-packaged installs.
• Adds POST /api/v2/agents/{id}/tasks/chdir endpoint and TASK_CHDIR (opcode 44) for persistently changing an agent's working directory across PowerShell, Python, and IronPython agents.

Cloud Security Posture · 2026-09-10

Prowler image scans now support a persistent Trivy vulnerability database cache via TRIVY_CACHE_DIR, enabling air-gapped and faster rescans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports TRIVY_CACHE_DIR environment variable to persist Trivy's vulnerability database across scans, avoiding a fresh download on every run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports TRIVY_SKIP_DB_UPDATE=true and TRIVY_SKIP_JAVA_DB_UPDATE=true environment variables to run image scans against a pre-populated database with no network access, enabling air-gapped deployments.

Cloud Security Posture · 2026-09-10

Prowler adds OCSF findings import via UI, CLI, and API, plus Boto3 retrier and timeout configuration for AWS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports uploading OCSF scan results to Prowler Cloud via the UI, CLI, or API using the new Import Findings capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-09-10

InsightVM 8.58 adds credentialed pre-port discovery, letting the scan engine ask authenticated hosts for their open ports instead of probing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds credentialed pre-port discovery (available from version 8.58), a per-template checkbox under Asset Discovery that lets the scan engine authenticate via SSH (TCP 22), Scan Assistant (TCP 21047), or a direct Windows connection and retrieve the host's authoritative list of listening TCP and UDP ports — replacing the outbound network port scan for any host where authentication succeeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports automatic credential-method selection: the engine prefers Scan Assistant, then SSH, then a direct Windows connection, using the first that authenticates, and silently falls back to a network port scan for hosts with no matching credential.
• Exposes pre-port discovery configuration through both the InsightVM console (Asset Discovery template settings) and the REST API, as documented in the configuration guide.

Security Data Pipeline · 2026-09-10

Realm adds Reduction Rule Assessments with Reasoning and Considerations sections powered by Clarity AI for every recommended SIEM log reduction rule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Reduction Rule Assessments — AI-generated evaluations shipped with every recommended reduction rule, split into a Reasoning section (why the rule is likely effective) and a Considerations section (where it may not be appropriate for a given environment).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Realm Clarity AI now reasons over what your sources produce and what each destination needs to generate rule assessments tuned to the actual conditions defined in each rule, not generic category descriptions.
• Detection Integrity maps every candidate reduction against the detections you currently run, protects the log fields those detections depend on, and flags at-risk detections as findings rather than silently cutting their data.

Threat Intelligence · 2026-09-10

Recorded Future launches Digital Risk Protection, unifying brand and identity monitoring across five external threat surfaces in one workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Digital Risk Protection, a unified workspace covering five external threat surfaces: Malicious Site Monitoring, Impersonation Monitoring, Code Repository Monitoring, Dark Web Brand Monitoring, and Identity Exposure Monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces an AI Triage Agent for Malicious Site Monitoring and Dark Web Brand Monitoring that automatically evaluates high-interest detections and delivers an explicit verdict with reasoning, surfacing only critical, high-priority Alerts.
• Adds Malicious Site Monitoring, which flags newly registered lookalike domains and phishing infrastructure within hours of registration using logo detection and image OCR to catch impersonation beyond keyword matching.

Continuous Control Monitoring (CCM) · 2026-09-10

RegScale 6.34.0.1 introduces Artifact Hub for templated, recurring artifact generation with 16 ready-to-use templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Artifact Hub, a new workflow for creating reusable artifact templates, marking fields that change over time, and generating updated artifacts through a guided process.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ships 16 ready-to-use templates in Artifact Hub for standardized artifact creation out of the box.

Continuous Control Monitoring (CCM) · 2026-09-10

RegScale CLI 6.45.0 adds configurable console log format via init.yaml keys and environment variables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds logFormat and logDateFormat keys to init.yaml to configure console log output format and date format, overridable via REGSCALE_LOG_FORMAT and REGSCALE_LOG_DATEFORMAT environment variables (environment takes precedence).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-09-10

runZero: Enables account-level API clients to use granular authentication scopes in addition to roles, with permissions capped by the creating user's own access rights.

• Background MCP connections no longer count against API usage.

Identity & Access Management · 2026-09-10

SailPoint adds 10 new connectors: Absence.io, Attio, FreeAgent, GitGuardian, Holded, Movidesk, Ploomes, ProdPad, SOTI MobiControl, and StatusGator.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds native connectors for Absence.io, Attio, FreeAgent, GitGuardian, Holded, Movidesk, Ploomes, ProdPad, SOTI MobiControl, and StatusGator, extending identity governance coverage to these platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-10

SailPoint Identity Security Cloud adds Dark Mode across the platform, including Agentic Fabric, DAS, and custom branding support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Dark Mode across Identity Security Cloud, including SailPoint Agentic Fabric and most ISC modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports custom brand colors in Dark Mode, automatically switching between Light and Dark modes based on existing brand configuration.
• Adds color pickers for branding configuration.

Web Application Security · 2026-09-10

Salt Claude Connect gives Claude Enterprise orgs continuous read-only visibility into connected MCP servers via Anthropic's Compliance API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Claude Connect integration in the Salt Data Source Hub, authenticating to Anthropic's Compliance API with a read:compliance_activities-scoped Compliance Access Key to continuously inventory organization-managed MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Polls Anthropic's Compliance API Activity Feed at https://api.anthropic.com/v1/compliance/activities to surface each MCP server's name, identity, status (active vs. removed), and lifecycle timestamps into the Salt Agentic inventory.
• Discovered MCP servers appear in the Salt Agentic inventory labeled with the source Claude Connect, showing server name, status, and first- and last-seen times.

SAST / SCA / Code Security · 2026-09-10

API surface changed: +11 endpoints, 46 modified, 191 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v1/advisories/{advisory_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /api/v1/advisories/
• New endpoint GET /api/v1/advisories/public/{workspace_key}

Network Analysis & Monitoring · 2026-09-10

Security Onion 3.3.0 adds Agent Studio with agentic memory, AI Reports Tools, Logstash tuning, and MoM subgrid roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds log.level and log.format tuning for Logstash via SOC configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports tuning multiple Logstash pipelines in SOC ES.
• Introduces Agent Studio with agentic memory for Pro users.

SAST / SCA / Code Security · 2026-09-10

Semgrep enables Autofix for all customers, adds webhook incident policy actions, and makes Supply Chain Autofix independent of Upgrade Guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Autofix is now enabled for all customers; it remains opt-in per finding, triggered from the finding Details page or through the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports adding a webhook as an action on an incidents policy, in addition to Slack.
• Supply Chain Autofix is now independent of Upgrade Guidance — pull requests can be opened even when Upgrade Guidance is disabled or has not run.

SAST / SCA / Code Security · 2026-09-10

Socket's Coana reachability engine gains PHP support, smarter fix attribution, Go/Rust/JVM analysis improvements, and JS dynamic dispatch coverage⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --reach-version flag to socket scan reach to override the bundled Coana engine version and run a specific one instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Reachability scans now survive transient Socket backend failures with exponential-backoff retries, a human-readable outage explanation, and a dedicated exit code instead of a stack trace.
• Supports vulnerability patterns that identify vulnerable Rust/Cargo code by source location, including semver range scoping so a pattern only applies to crate versions within its range.

SAST / SCA / Code Security · 2026-09-10

Socket: Adds withheldFixes field to --dry-run --output-file JSON output, naming versions and flags that blocked a fix (e.g. --disable-major-updates).

• Adds grouping of npm, pnpm, and yarn workspace packages so they are analyzed together under their workspace root during reachability scans.
• Adds approximation of unresolved dynamic property reads and calls (e.g. obj[key]()) in JavaScript/TypeScript reachability analysis so reachable code behind dynamic dispatch is no longer missed.
• Streams large reachability reports to disk instead of serializing them as a single JavaScript string, removing the ~512 MiB RangeError: Invalid string length limit.

SAST / SCA / Code Security · 2026-09-10

New GET /v0/orgs/{org_slug}/alert-policies/migration/status endpoint reveals where your org stands in Socket's Policies migration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v0/orgs/{org_slug}/alert-policies/migration/status to query your organization's current position in the alert-policy migration, returning state, alert_policies_enabled, legacy_evaluation_enabled, finalized_at, deadline_at, window_end_at, and deadline_admin_paused_at fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-09-10

API surface changed: 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GET /v0/message-groups: param verdict__is_not (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-10

Sumo Logic C3M APIs now GA, letting MSSP parent orgs programmatically push Cloud SIEM rules, monitors, and templates to child orgs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Content and Configuration Management (C3M) APIs (GA) for MSSP parent org users to programmatically push and sync Cloud SIEM rules, rule tuning expressions, Library content, monitors, and source templates across child orgs — replacing manual distribution through the Organizations UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-10

Tailscale Kubernetes Operator 1.102 adds in-cluster PeerRelay CRD, IPv6 egress for ProxyGroup, and Let's Encrypt cert optimizations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new PeerRelay custom resource (apiVersion: tailscale.com/v1alpha1, kind: PeerRelay) so the Kubernetes Operator can deploy and manage in-cluster Tailscale peer relays automatically, with support for spec.replicas, tags, proxyClass inheritance, and tailnet configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds IPv6 destination support to ProxyGroup Egress, enabling egress to IPv6-only destinations including 4via6 subnet routers — previously only IPv4 destinations were valid.
• Cert issuance for multiple domains now runs in parallel instead of serially, preventing provisioning of many domains from stalling behind each other.

Detection Engineering · 2026-09-10

Tenzir v6.16 adds OCSF-native Sigma matching, M365 activity collection, Kafka Avro+Schema Registry decoding, and ClickHouse pushdown.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds schema_registry="https://registry.example.com" to from_kafka to decode Avro message values directly, with support for Confluent schema IDs in payload prefixes, schema GUIDs in Kafka headers, cached writer schemas, and independent registry TLS/auth settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds azure_auth record with web_identity field to from_azure_blob_storage and to_azure_blob_storage, enabling Entra workload identity federation per-operator so a single node can authenticate to multiple tenants; web_identity accepts token_endpoint, token_file, or inline token.
• Adds query_params record to web_identity.token_endpoint so OIDC audience parameters can be passed as structured key-value pairs (percent-encoded automatically) rather than concatenated onto the URL; accepts both string and secret values.

Detection Engineering · 2026-09-10

Tenzir Explorer loads stored schemas on demand and defaults to the Results tab.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds on-demand stored schema loading in the Explorer: click Load schemas in Stored data to retrieve schema names and event counts without loading all schemas upfront.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Explorer now opens the Results tab by default instead of the stored-data view.
• Expanding a schema in the Explorer loads field definitions for all schemas once and reuses them until Refresh is clicked, reducing redundant fetches.

Detection Engineering · 2026-09-10

Tenzir: Supports decoding Kafka Avro messages using a Schema Registry.

• Adds a blob conversion function.
• Collects Microsoft 365 audit activity as a new data source.
• The Explorer now loads stored schema names, event counts, and field definitions on demand, opens the Results tab by default, and caches definitions until you refresh.

Detection Engineering · 2026-09-10

Tenzir Platform v1.39.2 adds on-demand schema loading in the Explorer, fetching field definitions only when a schema is first expanded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Explorer now loads stored schema names and event counts on demand, fetching field definitions only when a schema is first expanded and caching them until a manual refresh.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Explorer opens the Results tab by default.

Detection Engineering · 2026-09-10

Tenzir's sigma operator now auto-translates stock SigmaHQ rule field names to OCSF paths, letting normalized telemetry match unmodified community rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The sigma operator now rewrites rule predicates to OCSF field paths (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Image → process.path, ParentImage → process.parent_process.path, CurrentDirectory → process.working_directory) when the input schema is OCSF-shaped, guided by the rule's logsource, so stock SigmaHQ rules match normalized telemetry without per-rule field mapping.
• The microsoft::windows::ocsf::normalize pipeline operator normalizes both Sysmon event 1 and Windows Security event 4688 to OCSF Process Activity events, enabling a single Sigma rule to fire across both producers.

SOAR · 2026-09-10

Tines 43.2.0 adds case-field API updates, audit-log retention config, MCP integration, and dashboard draft mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the ability to update case fields via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds audit log retention period configuration.
• Adds Cases tools in the Tines MCP (Model Context Protocol) integration.

SOAR · 2026-09-10

API surface changed: −1 endpoint, 15 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-09-10

tmux gains floating panes, modal panes, switch mode, copy-mode refresh/line-numbers, and a theme system⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds move-pane -X/-Y absolute positioning and -z/z-index options for floating panes, plus named positions (top-left, centre, bottom-right, front, back, forward-loop, backward-loop, and more).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -W (float) flag to break-pane (-abdPW) to lift a pane out of a tiled layout and make it floating, with -x/-y size and -X/-Y position options.
• Adds switch-mode command (-kswZ) to put a pane into an interactive fuzzy-match session/window chooser, with -s/-w to list sessions or windows.

General Utilities & Libraries · 2026-09-10

tmux: Adds -W flag to new-pane to wait for the pane's command to exit and return its exit status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -I flag to new-pane to create an empty pane and forward stdin to it.
• Adds move-pane with -x/-X, -y/-Y, and -z (z-index) options to reposition floating panes absolutely or to named corners/edges (top-left, centre, bottom-right, front, back, forward-loop, etc.).
• Adds modal pane support to new-pane: a modal pane is always active and blocks interaction with all other panes; closing on outside click is supported.

Endpoint Security (EDR/XDR) · 2026-09-10

Trend Vision One adds a Gmail add-in so users can report suspicious emails and manage quarantine without leaving their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Gmail add-in that lets users report suspicious emails for analysis with a single click directly from their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables self-service quarantine review and management for Gmail users when a quarantine mailbox is configured, reducing admin overhead.

Container & Image Security · 2026-09-10

• CVE-2026-55092: Path traversal via a crafted vulnerability database or other downloaded artifacts (CVSS 7.5, affects <0.71.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-09-10

Vanta adds CLI, MCP server access for non-admins, multi-framework audits, TISAX ISA 2027, and dozens of agent and API expansions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands the Deactivated Controls REST API to include framework associations and deactivation reasons for deactivated controls, making it easier to validate control scope and review deactivation decisions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Vanta CLI for scripting and managing trust programs from the terminal or a coding agent, with built-in skills for risk scenarios, controls, testing procedures, and reporting
• Opens Vanta's MCP server to users with editor, collaborator, or custom-role permissions, scoped to their existing permission set

Compliance Automation & Trust Management · 2026-09-10

Vanta: Exposes GitLab repository paths, project IDs, and URLs through the REST API, enabling automation across Vanta and GitLab project catalogs (Enterprise).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds framework associations and deactivation reasons for deactivated controls through the REST API, making it easier to validate control scope and review deactivation decisions.
• Extends MCP server access to users with editor, collaborator, or custom-role permissions, allowing them to connect and use capabilities permitted by their existing role.
• Adds Custom Agents event trigger for when a risk scenario is created or updated, enabling automated workflows on risk changes (Professional).

Compliance Automation & Trust Management · 2026-09-10

API surface changed: +1 endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint PATCH /groups/{groupId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-10

ZeroPath: Adds a remote MCP server at https://zeropath.com/mcp — point Claude, Cursor, Codex, or any Streamable HTTP client at it, authenticate via browser, and work with findings with no install and no API key required; connections are read-only until changes are approved, and administrators can revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Microsoft Teams channel notifications — paste an incoming webhook from Teams into ZeroPath to receive scan notifications and vulnerability alerts as Adaptive Cards, with no Azure AD app registration required.
• Adds Assistant skills — author reusable methodology (triage, dependency reachability, report writing, patch review) from the Skills tab; four built-in skills ship and are forkable into editable copies.
• Adds a quarterly period option to the dashboard, which now covers a full year at a glance.

Secure Access (VPN / SASE / ZTNA) · 2026-09-10

Zscaler Zero Trust Browser Extension now enforces existing policies inside the ChatGPT desktop app's embedded Chromium browser on macOS and Windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends the Zero Trust Browser Extension to run inside the ChatGPT desktop app's embedded Chromium browser, enforcing the same policies (DLP, paste controls, URL category blocking, file upload/download, credential protection, tenant restrictions) that already apply in Chrome, Edge, Firefox, and Safari — with no separate rulebook for the embedded case.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Deploys into the ChatGPT embedded browser via the same MDM-based method used for other browsers, requiring an explicit change to the deployment script to target the ChatGPT desktop app's embedded browser (installing for Chrome does not cover it automatically).
• Surfaces agent-driven page loads in the Zscaler admin console as standard detections carrying user identity, device posture, extension version, browser, IP, geolocation, and URL — making ChatGPT-opened pages visible alongside all other Chromium tab activity.

Identity & Access Management · 2026-09-09

1Password SaaS Manager adds public beta AI Assistant and a Google Calendar offboarding workflow action.

• Adds AI Assistant in public beta, available by default for new SaaS Manager customers.
• Adds a workflow action to remove all events from a user's primary Google Calendar during offboarding.

Identity & Access Management · 2026-09-09

1Password for Mac 8.12.36 adds MDM-configurable browser extension connections and per-request SSH approval prompts.

• Adds Settings > Developer > Advanced > 'Ask approval for each new' to configure the SSH agent to prompt for approval on every SSH request.
• Enables administrators to configure the 1Password app to connect to the 1Password browser extension in additional browsers through mobile device management (MDM).
• Improves performance when viewing items and browsing large vaults.

Identity & Access Management · 2026-09-09

1Password for Windows 8.12.36 adds per-request SSH agent approval prompts and OIDC workflow layout improvements.

• Adds SSH agent setting to prompt for approval on every SSH request, configurable under Settings > Developer > Advanced > Ask approval for each new.
• Improves layout of the custom workflow (OIDC) setup screen and workflow entries.
• Extends claude.ai login item suggestions to cover claude.ai, claude.com, and anthropic.com across all three domains.

Identity & Access Management · 2026-09-09

1Password for iOS 8.12.36 updates password suggestions with new requirements and adds cross-domain login hints for Anthropic/Claude sites.

• Updates password and website requirement suggestions shown when generating or changing passwords.

Identity & Access Management · 2026-09-09

1Password for Safari gains in-browser account creation, plus smarter password suggestions and cross-site claude.ai login matching.

• Adds the ability to create a 1Password account directly from the 1Password browser extension for Safari.

Exploitation & C2 · 2026-09-09

ADscan v12.0.0 adds native Windows support, in-process port scanning, CPU password cracking fallback, and smarter attack-path discovery for large AD environments.

• Adds ADSCAN_PORTSCAN_CONCURRENCY and ADSCAN_PORTSCAN_PER_HOST environment variables to tune the new Windows in-process TCP connect port scanner.
• Runs natively on Windows as a self-contained bundle — no Docker, no Python, no nmap, no Npcap required — allowing a low-privilege user on a domain-joined Windows host to run a full scan.
• Adds in-process async TCP connect port scanning on Windows, replacing the nmap/Npcap dependency that hardened Windows hosts cannot satisfy.

SAST / SCA / Code Security · 2026-09-09

Aikido adds code coverage visibility, 11 SIEM integrations, AI pentesting, new API endpoints, and a Terraform provider update.

• Adds new resource to manage default PR checks and new resource to manage PR check settings to the Aikido Terraform provider.
• Adds API - Manage defaults PR checks for new repos endpoint to control default PR check configuration via the API.
• Adds API - Report export for PCI and DORA compliance endpoint to export compliance reports programmatically.

Container & Image Security · 2026-09-09

Anchore Enterprise MCP server gives AI agents native access to vulnerability findings, policy results, and SBOM data without custom glue code.

• Exposes curated MCP tools covering key API properties for specific security objectives (triage, policy checks, risk reporting), with a fallback to generic API invocation for broader coverage.
• Handles large payload management, pagination, and consistent response handling automatically within the MCP server, enabling agentic workflows to query Anchore at scale.

Identity & Access Management · 2026-09-09

Auth0 Tenant ACL gains a match_all: true Deny All rule to block all incoming traffic without signal-specific matching.

• Adds match_all: true attribute to Tenant ACL rules, enabling a Deny All rule that rejects all incoming traffic to the assigned scope without requiring IP or geolocation signal matching.

Cloud Security Posture · 2026-09-09

AzureHound gains log rotation and management flags for persistent, size-bounded log file collection.

• Adds --log-file flag to write logs to a file, with automatic rotation when the active log reaches --log-max-size MiB (default: 100 MiB); rotated logs are timestamped and stored beside the active log.
• Adds --log-compress flag to gzip-compress rotated log archives (default: true).
• Adds --log-max-age flag to prune rotated log archives older than a given number of days (default: 14; set to 0 to disable age pruning).

Post-Exploitation · 2026-09-09

BloodHound pathfinding now supports up to two additional waypoint nodes via Add Destination

• Adds Add Destination control in the pathfinding UI to route attack paths through up to two additional intermediate destination nodes in a user-specified traversal order.

Post-Exploitation · 2026-09-09

BloodHound v9.7.0 adds multi-destination pathfinding, webhook alerts, Marketplace discovery, and expanded GitHub/Okta collection.

• Adds config.toml for OpenHound destination URLs and secrets.toml for sensitive credentials used in extension asset uploads.
• Adds Collector Offline signed webhook alerts to monitor collector availability.
• Supports separate REST and GraphQL endpoints for GitHub Enterprise Server collection via new configuration.

Post-Exploitation · 2026-09-09

BloodHound v9.7.0 adds multi-destination pathfinding, presigned artifact downloads, webhook test dialog, and snackbar alert notifications.

• Adds query parameter logging for /api/v2 requests to improve auditability of API calls.
• Adds multi-destination pathfinding with drag-and-drop reordering in the Explore graph.
• Adds an attack path selector to the findings table.

Malware Analysis · 2026-09-09

CAPEv2 improves Azure packet capture targeting for VMSS instances and refines Office/CAB file detection logic.

• Targets specific Azure Virtual Machine Scale Set instances during packet capture by deriving instance ID from machine label, constructing a per-instance resource ID under Microsoft.Compute/virtualMachineScaleSets/{vmss_name}/virtualMachines/{instance_id}.
• Excludes MSI Installer and Microsoft Cabinet archive file types from Office file detection via the new MS_EXCLUDE list in lib/cuckoo/common/demux.py, preventing CAB files from being misrouted to the Office password-protection branch.
• Simplifies Azure dependency installation to poetry install --extras azure in AzSniffer.py error messaging.

Attack Surface & Exposure Management · 2026-09-09

Censys adds interactive host distribution map, SentinelOne integration, AI asset label, and 14 new fingerprints/risks.

• Adds a new ai label for host services and web entities in ASM to surface exposed AI-related assets — covering tools including Ollama, Flowise, Langflow, LibreChat, ComfyUI, ChromaDB Admin, BentoML, Dify, FastGPT, LiteLLM, MLflow, and others.
• Adds a new SentinelOne integration to automatically or manually enrich IPs, web properties, and certificates in SentinelOne with Censys Platform data, initiate rescans, retrieve scan history for an IP, and launch CensEye automated pivoting jobs.
• Adds an interactive Host Distribution world map visualization to Platform search results, with a Select Area filter to spatially narrow host query results.

Container & Image Security · 2026-09-09

New guide: use Cloudsmith as a pull-through cache for Chainguard Free and Production container images

• Supports Cloudsmith as a pull-through cache for Chainguard Free containers by setting the upstream Proxy URL to https://cgr.dev/chainguard with Mode set to Cache and Proxy.
• Supports Cloudsmith as a pull-through cache for Chainguard Production containers by setting the upstream Proxy URL to https://cgr.dev/ and authenticating with a pull token generated via chainctl auth configure-docker --pull-token.
• Adds --ttl flag to chainctl auth configure-docker --pull-token to control pull token lifetime (e.g. --ttl=24h; default is 30 days).

Container & Image Security · 2026-09-09

Chainguard now supports Amazon ECR as a pull-through cache, letting you serve Chainguard Containers from your own ECR private registry.

• Adds support for Amazon ECR pull-through cache rules targeting cgr.dev, with credentials stored as a Secrets Manager secret whose name must begin with the ecr-pullthroughcache/ prefix and whose keys must be username and accessToken.
• Adds chainctl auth configure-docker --pull-token to generate a longer-lived Chainguard pull token suitable for registry mirroring tools like ECR, with an optional --ttl flag (e.g. --ttl=8760h) to control expiry.
• Supports scoping a pull-through cache rule to a single private namespace via --upstream-repository-prefix on aws ecr create-pull-through-cache-rule, so that downstream image paths omit the org namespace.

Container & Image Security · 2026-09-09

Chainguard Catalog Starter lets teams trial up to five production-grade container images free via console or chainctl

• Adds chainctl starter init command to sign up for a new Catalog Starter account interactively from the CLI.
• Adds chainctl starter request-access command to join an existing Catalog Starter organization from the CLI.
• Adds chainctl starter add-images command to select up to five non-FIPS images for a Catalog Starter plan from the CLI.

Container & Image Security · 2026-09-09

Chainguard ships Go 1.27 with runtime FIPS module selection, JFrog Catalog integration for Libraries, and 39 new container images including kubeflow-pipelines FIPS variants.

• Adds go-openssl-fips image for Go 1.27 that selects its FIPS-validated cryptographic module at deployment time rather than at compile time, enabling a single artifact to satisfy both OpenSSL FIPS provider and Go Cryptographic Module requirements without recompilation — with CNSA 2.0 readiness.
• Adds go and go-fips images updated to Go 1.27, alongside the new go-openssl-fips image, with Go 1.26 and earlier continuing to be supported until end-of-life.
• Adds JFrog Catalog recognition for Chainguard-built packages, allowing joint Chainguard and JFrog customers to pull Chainguard Libraries through JFrog — enabling JFrog Zero-Touch Remediation to swap in patched Chainguard packages without developer workflow changes or major version upgrades.

Container & Image Security · 2026-09-09

Chainguard: Adds Go 1.27 support across three Chainguard container images: go, go-fips, and go-openssl-fips.

• Integrates Chainguard Libraries with JFrog Catalog, allowing joint customers to pull Chainguard-built packages through JFrog and enabling JFrog Zero-Touch Remediation with Chainguard packages; Java support ships now, with JavaScript and Python scheduled by end of September 2026.
• Adds 39 new container images including kubeflow-pipelines-api-server-fips, kubeflow-pipelines-cache-deployer-fips, kubeflow-pipelines-cache-server-fips, kubeflow-pipelines-driver-fips, kubeflow-pipelines-frontend-fips, kubeflow-pipelines-metadata-envoy-fips, kubeflow-pipelines-metadata-writer-fips, kubeflow-pipelines-persistenceagent-fips, kubeflow-pipelines-scheduledworkflow-fips, kubeflow-pipelines-viewer-crd-controller-fips, dbmate, hadolint, jruby, kserve-huggingfaceserver, gubernator, fortiotel, packer, security-profiles-operator, aws-lambda-dotnet, opentelemetry-go-instrumentation, prom-label-proxy, kserve-sklearnserver-fips, presidio-anonymizer, and redpanda-console-fips.

SAST / SCA / Code Security · 2026-09-09

Checkmarx One 3.66 adds native SCA reachability engine, MCP Server triage actions, UV package manager support, and expanded AI T&R for SCA.

• Adds --skip-default-filter flag to the CLI to bypass default file filters and include all files in the .zip archive submitted for scanning.
• Adds Dast-to-code-initiator and Dast-AI-attack-initiator permissions to the dast-admin role, gating access to each DAST AI feature individually.
• Adds UV as a selectable option in the new Python Package Manager configuration setting (available at tenant and project level) for SCA dependency resolution, with pip remaining the default.

Secure Access (VPN / SASE / ZTNA) · 2026-09-09

Duo Desktop 7.21 adds 13 new endpoint security integrations and a one-time opt-out notification for data collection.

• Adds support for Check Point Endpoint Security (macOS and Windows) as a recognized endpoint security product.
• Adds support for Cynet Endpoint Security (macOS and Windows) as a recognized endpoint security product.
• Adds support for ESET Security (Windows) as a recognized endpoint security product.

Secure Access (VPN / SASE / ZTNA) · 2026-09-09

Duo Desktop 7.21.0 adds telemetry consent prompts, virtual environment detection for GCE and Azure, and OS update/agent status reporting for Secure Access.

• Detects Google Compute Engine and Microsoft Azure as virtual environments.
• Reports OS automatic update status and management agent detection for Secure Access.
• Adds an optional error and usage data collection preference, configurable per-user in app preferences or set system-wide by administrators to bypass the startup prompt.

Identity & Access Management · 2026-09-09

Clerk adds OAuth Device Authorization Grant support for CLIs, TVs, and input-constrained devices.

• Adds OAuth Device Authorization Grant flow to authenticate CLIs, smart TVs, and other input-constrained devices using a standards-based OAuth flow.

Identity & Access Management · 2026-09-09

Clerk: Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) in the device flow.

• Clerk's Account Portal serves as the hosted verification page, presenting the OAuth application name, requested scopes, Organization selection, and approve/deny actions to the authorizing user.
• Automatically advertises device_authorization_endpoint and grant type urn:ietf:params:oauth:grant-type:device_code via OAuth 2.0 and OpenID Connect metadata discovery when Device Authorization Grant is enabled and the verification page is reachable.

Internet Services · 2026-09-09

Cloudflare: Raises the uncompressed Worker bundle size limit to 64 MiB for all plans (free and paid), replacing the old compressed-size limits of 3 MB (Free) and 10 MB (Paid); use wrangler deploy --outdir bundled/ --dry-run to check bundle size before deploying.

• Adds .signedUrl(), .createDirectUpload(), and filter.metadata to the Images binding for server-side signing, direct creator uploads, and metadata-filtered image listing.
• Adds headers option to .response() in the Images binding to set response headers (including Cache-Control) in a single call.
• Supports bulk creation of multiple Cloudflare Tunnel and Cloudflare Mesh routes in a single action from the Routes UI, including comma-separated CIDR/hostname input and Add another staging.

Internet Services · 2026-09-09

Cloudflare API v7.10.0 adds billing management, payment methods, field extractors, and Spectrum analytics endpoints

• Adds POST /accounts/{account_id}/subscriptions/cancel-downgrade to cancel a delayed subscription downgrade.
• Adds POST /accounts/{account_id}/subscriptions/{subscription_identifier}/cancel-reason and GET /accounts/{account_id}/subscriptions/{subscription_identifier}/cancel-reason to create and retrieve subscription cancel reasons.
• Adds POST /accounts/{account_id}/subscriptions/{subscription_identifier}/action/append to append actions to a subscription.

Internet Services · 2026-09-09

Cloudflare adds Python 3.14 Workers, 64 MiB bundle limits, Radar event search, and One Appliance dashboard controls

• Supports Python 3.14 runtime for Python Workers.
• Raises the uncompressed Worker bundle size limit to 64 MiB for all plans (free and paid), removing the previous compressed-size caps of 3 MB and 10 MB.
• Adds Internet events and outages to Cloudflare Radar search, with links to relevant pages and historical context.

Internet Services · 2026-09-09

Cloudflare adds 64 MiB Workers bundles, Python 3.14 support, Radar Internet events search, and One Appliance custom apps and DHCP options

• Cloudflare Radar search now includes Internet events and outages, with links to relevant pages and historical context.

General Utilities & Libraries · 2026-09-09

VS Code lets you override the background utility model (commit messages, PR titles, intent detection) separately from your main chat model.

• Adds a setting to override the lightweight background model used for utility tasks — commit messages, pull request titles and descriptions, rename suggestions, branch name generation, prompt categorization, and intent detection — independently of the main chat model.

Identity & Access Management · 2026-09-09

ConductorOne adds agent classifiers, four new session-policy API endpoints, MCP resource governance, and four new system-log event classes.

• Adds four new read-only API endpoints to preview which session policy applies to a given user (by direct assignment, group membership, or tenant default) and list every user a policy covers — including the conferring group.
• Adds groups[] field and correlation_uid to system log events, plus four new Identity & Access event classes: Account Change, Entity Management, User Access Management, and Group Management.
• Adds agent classifiers that evaluate private-data sensitivity, untrusted-content exposure, and exfiltration capability at MCP tool-call time, routing matches to a hook, human approval, or block.

SAST / SCA / Code Security · 2026-09-09

cve-lite-cli gains --sbom SBOM export in CycloneDX 1.6 and SPDX 2.3 formats, plus --sbom-inventory-only for pure inventory output.

• Adds --sbom <format> flag to write a timestamped SBOM file; supported formats are cyclonedx (CycloneDX 1.6, .cdx.json) and spdx / spdx2.3 (SPDX 2.3, .spdx.json).
• Adds --sbom-inventory-only flag to omit the vulnerability overlay from --sbom output, producing a pure component inventory; requires --sbom.

SAST / SCA / Code Security · 2026-09-09

cve-lite-cli v1.34.0 adds SPDX 2.3 SBOM output with --sbom spdx2.3 and a prod/dev findings split in all report formats.

• Adds SPDX 2.3 SBOM output via --sbom spdx2.3 (also --sbom spdx); findings attach as SECURITY external references of type advisory, with severity and fix command in a package annotation; package licenses sourced from the npm lockfile at no network cost; pnpm, Yarn and Bun resolve to NOASSERTION; emits supplier, filesAnalyzed: false and DEPENDENCY_OF relationships to satisfy all seven NTIA minimum elements.
• Adds --sbom-inventory-only flag to emit an SBOM without the vulnerability overlay, for diffing, archival and attestation workflows.
• Adds --sbom cyclonedx as an alias path to CycloneDX output (alongside the existing --cdx), now emitting spec version 1.6 with tools.components object form using publisher.

SIEM · 2026-09-09

Unity Catalog gains ABAC DENY policies in Beta, letting you block MANAGE ACCESS CONTROL even for object owners.

• Adds ABAC DENY policies (Beta) in Unity Catalog to explicitly deny the MANAGE ACCESS CONTROL privilege to specified principals, including object owners, always taking precedence over any grant.

SIEM · 2026-09-09

Lakeflow Connect shifts Salesforce formula field ingestion from full snapshots to incremental by default, cutting cost and pipeline run time.

• Lakeflow Connect will default to incremental ingestion for Salesforce formula fields instead of taking a full snapshot on every pipeline run, improving performance and reducing cost.

SIEM · 2026-09-09

Lakebase PCI-DSS and HITRUST compliance now available in all AWS regions (previously us-east-1 only)

• Extends PCI-DSS and HITRUST compliance for Lakebase to all AWS regions where it is available, for workspaces with the compliance security profile enabled (previously limited to us-east-1).

SIEM · 2026-09-09

Databricks adds time_bucket SQL function for aligning timestamps to arbitrary fixed-width intervals.

• Adds time_bucket SQL function that returns the start of a fixed-width interval (e.g. 15-minute or 3-month buckets) aligned to a caller-specified origin, for cases where date_trunc calendar units are too coarse or misaligned.

SIEM · 2026-09-09

Databricks Lakeflow Connect: Zerobus Ingest into default storage tables now in Public Preview.

• Supports ingesting into tables backed by default storage using Zerobus Ingest in Lakeflow Connect, now in Public Preview.

Vulnerability Management · 2026-09-09

DefectDojo adds programmatic API token revocation, per-user token expiry, and an instance-wide default token lifetime setting.

• New POST /api/v2/api-tokens/revoke/ endpoint lets a superuser or Global Owner revoke a compromised token by its key value, without knowing which user it belongs to; returns 204 on success, 404 if no token matches, 400 if the key field is missing, and 403 for non-superusers.
• New token_expiry field on PATCH /api/v2/user_contact_infos/{id}/ lets superusers set or clear a per-user token expiry datetime; after expiry, requests return 403 Forbidden with {"detail": "API token has expired."} and the user must generate a new token.
• New DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable enforces an instance-wide maximum token lifetime in days for all tokens, including existing ones; setting it is retroactive and takes effect the next time each token is used.

Vulnerability Management · 2026-09-09

DefectDojo 3.3.0 adds a locations backfill cancel hook, Regulations support, and multiple API and Rules Engine 2.0 expansions.

• Adds a cancel hook to the endpoints-to-locations backfill via feat(locations).
• Sets finding mitigation automatically from Dependency Track affected version ranges.
• Adds an RSS feed to the changelog.

Detection Engineering · 2026-09-09

dev-v2.2.0 adds 30+ new detection rules spanning AWS, GCP, Linux, macOS, Windows, Kubernetes, and network threats.

• Adds free text support to KQL for detection rule queries.
• Adds new rule: AWS Root Console Login Password Spraying.
• Adds new rule: AWS S3 Bucket MFA Delete Disabled.

Exploitation & C2 · 2026-09-09

DHCPig gains dry-run recon, scoped targeting, session reports, CI exit codes, and new subcommands for exhaustion, release, and passive scanning

• Adds --dry-run flag for recon-only mode: ARP sweep and control transactions run without sending any mutating packets.
• Adds --scope CIDR flag (repeatable) to bound targets to a specific network range, defaulting to the interface's own network.
• Adds --report FILE flag to write a session report on run completion; format is inferred from the file extension (.json, .csv, or .html, defaulting to JSON).

Exploitation & C2 · 2026-09-09

dhcpig: Adds --fail-on LEVEL flag (values: fail, inconclusive, never) that exits with code 1 when a finding at the specified level is raised, enabling scripted/CI use.

• Adds --client-mac MAC flag (exhaust mode only, repeatable) to rotate through specific MACs instead of random ones.
• Adds release-previous subcommand for post-exhaustion recovery, replaying the on-disk lease journal ($XDG_STATE_HOME/dhcpig/leases-<iface>.jsonl) to return taken addresses, with --max-age filtering for stale entries.

Identity & Access Management · 2026-09-09

Didit: Exposes verification method and assurance tier through the decision API and session objects; document sessions report documentary and leave new fields empty.

• Adds non-document lookup as a new ID Verification method — user supplies a national ID number and personal details checked against a government register or credit/financial/utility/residential-records source, with no photograph or upload required.
• Adds per-country method controls on the Countries tab of the ID Verification step, toggling document capture, non-document lookup, and (future) digital ID wallets on or off per country; same settings available through the API.
• Adds automatic selfie, passive liveness, and portrait matching to non-document lookups for countries whose government register returns a photograph (South Africa, Nigeria, Argentina, Panama), included in the lookup price.

Exploitation & C2 · 2026-09-09

getsploit v3 adds offline FTS5 search, JSON/JSONL/TSV output formats, --mirror, --color, and --status commands

• Adds --update flag to download the full exploit corpus and build a local SQLite FTS5 index (~1.7 GB) for fully offline search.
• Adds --local flag to search the offline SQLite FTS5 index, supporting plain keywords, CVE IDs, and FTS5 column-filter expressions (id, title, published, description, source_data).
• Adds --status flag to inspect the local database location, size, and document count without a network connection or API key.

Exploitation & C2 · 2026-09-09

getsploit: Adds --local flag to run queries against the local FTS5 index, supporting plain keyword queries (wordpress 4.7, CVE-2024-3094) and full SQLite FTS5 expressions with column filters (title:, id:, published:, description:, source_data:).

• Adds --color always|never|auto flag to control ANSI colour output, enabling piping into pagers like less -R.
• Adds --set-key subcommand to store the Vulners API key via a hidden confirmation prompt instead of a command-line argument; key is also readable from the VULNERS_API_KEY environment variable.
• Supports --count above 100 with transparent pagination so large online result sets are fetched automatically.

Secrets Detection & Management · 2026-09-09

GitGuardian Detection Engine 2.171 adds Akamai API Credentials and Docker Hub analyzers, plus improved n8n and HashiCorp Vault detection.

• Adds generic_high_entropy_secret precision improvement: no longer reports secrets whose assigned variable ends with checksum, with no loss of recall.
• Adds a secret analyzer for Akamai API Credentials.
• Adds a new analyzer for Docker Hub personal access tokens.

SAST / SCA / Code Security · 2026-09-09

Copilot for JetBrains gains enterprise sandbox policies, cross-file cursor jumps, global project context, and /ide CLI integration.

• Adds enterprise-managed sandbox policies (public preview) so administrators can centrally control sandbox enablement, filesystem and network access, proxy settings, developer-tool access, and macOS Keychain access via managed restrictions that override user settings — visible under GitHub Copilot > Sandbox when the Editor Preview feature flag is on or a managed setting is configured.
• Adds /ide command in GitHub Copilot CLI (public preview) to connect a terminal session to JetBrains IDE context, including selections, diagnostics, and file references; shell commands can also consume IDE terminal environment variables and the project's configured Python interpreter, and can activate the project's local Python virtual environment.
• Adds cross-file cursor jumps in next edit suggestions, letting Copilot move your cursor directly to the relevant location in another file when a suggested change continues there.

SAST / SCA / Code Security · 2026-09-09

GHES 3.22 adds air-gapped Copilot CLI, enterprise teams GA, ruleset bypass by user, and required-reviewers rulesets

• Adds support for configuring Copilot CLI to work with GHES in disconnected or air-gapped environments — set up a model provider once in GHES and end users authenticate with their GHES credentials (technical preview).
• Promotes enterprise teams to general availability, letting enterprise owners manage users and access across all organizations and repositories from a single centralized team structure.
• Repository rulesets now support bypass by individual users, allowing administrators to add specific accounts (e.g., a service account) to a bypass list without creating a dedicated role or team.

SAST / SCA / Code Security · 2026-09-09

GitHub launches a unified customer portal at help.github.com with Copilot-powered search across support, docs, and community.

• New unified portal at help.github.com consolidates support, entitlements, docs, learning, community, and account resources into a single entry point.
• Copilot-powered search across all portal content is available without sign-in.
• Product status and important announcements are surfaced directly within the portal.

SAST / SCA / Code Security · 2026-09-09

Dependabot now reads private GitHub Packages registries via GITHUB_TOKEN — no PAT or dependabot.yml changes required.

• Dependabot's GITHUB_TOKEN now requests the packages: read permission automatically, sending that token when pulling from *.pkg.github.com and ghcr.io — no PAT-based registry entries in dependabot.yml needed.
• Dependabot reuses existing Manage Actions access grants on package settings pages to authenticate with private GitHub Packages registries, covering every GitHub Packages ecosystem Dependabot supports.

SAST / SCA / Code Security · 2026-09-09

GitHub Code Quality gets agentic autofix: assign up to 25 findings to Copilot in bulk and receive a reviewed PR.

• Adds Assign to Copilot bulk action that lets you select up to 25 standard Code Quality findings and have Copilot fix them agentically on a branch, validate its own changes, and open a pull request for review.
• Available for repositories with GitHub Code Quality enabled on GitHub Team and GitHub Enterprise Cloud, including GitHub Enterprise Cloud with data residency; governed by the existing enterprise GitHub Code Quality policy with no separate policy to manage.

SAST / SCA / Code Security · 2026-09-09

GitLab CI adds ci_spec_include_own_context flag so included files resolve include locations against their own repository and ref.

• Adds ci_spec_include_own_context feature flag (GitLab 19.4) so that include locations in a CI config file resolve against the repository and ref of the file that declares them, not the file that included them.

SAST / SCA / Code Security · 2026-09-09

GitLab Duo Self-Hosted can now use models deployed on Microsoft Foundry, with per-feature model assignment across GPT, Claude, Llama, and Mistral families.

• Adds azure/<deployment-name> as the model identifier format when registering a Microsoft Foundry deployment in GitLab Duo Self-Hosted, allowing GPT, Claude, Llama, and Mistral models to back individual Duo features.
• Supports per-feature model assignment in GitLab Duo Self-Hosted — a different model deployment (e.g., duo-chat, duo-code-gen, duo-code-completion) can be assigned to each Duo feature rather than applying one model globally.
• Adds Microsoft Foundry as a supported backend for the AI Gateway, enabling organizations to serve GitLab Duo inference through Azure-hosted endpoints while keeping inference data within their own Azure tenant.

SAST / SCA / Code Security · 2026-09-09

GPT-6 Astra is now available on GitLab Duo Agent Platform, running 43% faster and using 43% fewer tokens than GPT-5.6 Sol.

• Adds GPT-6 Astra as a selectable model on GitLab Duo Agent Platform, with admins able to assign it per feature via model selection settings.

Digital Forensics & Incident Response · 2026-09-09

Hayabusa gains a sort-csv command to sort, deduplicate, and merge post-scan CSV results.

• Adds sort-csv command that sorts a Hayabusa results CSV by the Timestamp column, removes duplicate detections (comparing every column except Timestamp), and supports -f/--file for a single file, a directory flag for bulk CSVs from multiple endpoints, -o/--output for file output (or stdout), and an overwrite flag.

Reconnaissance & OSINT · 2026-09-09

API surface changed: −2 endpoints, 1 modified

Digital Forensics & Incident Response · 2026-09-09

iLEAPP v2026.3.3 adds 25+ new app parsers including smart home/IoT, crypto, and social apps, plus iOS diagnostic report (.ips) ingestion and MMKV decryption support.

• Adds --emit flag to validate_sample_data.py to generate sample_data values directly from a test extraction image.
• Adds support for ingesting iOS diagnostic reports (.ips files) as a new input format.
• Adds a Sysdiagnose Extraction Helper to expand raw forensic input options.

Attack Surface & Exposure Management · 2026-09-09

Intruder adds Additional Domains configuration for authenticated web app scans, enabling subdomain and cross-domain coverage.

• Adds an Additional domains field when setting up or editing authentication for a web app target, allowing subdomains (e.g. api.example.com, auth.example.com) and external service URLs to be included in authenticated scan scope.
• Supports cross-domain scan coverage for external services an application depends on, such as identity providers, CDNs, or third-party APIs, preventing blocked requests from causing missed vulnerabilities.

Identity & Access Management · 2026-09-09

JumpCloud ADI gets smarter password sync, single-label domain support, and non-blocking user import workflows

• Adds support for single-label domains in the AD Sync Agent by refactoring Root DN validation, so domains with fewer than two components (e.g., DC=internal) sync correctly; jcadimportagent.config.json uses semicolons to separate DN components (e.g., DC=example;DC=com).
• Adds exponential backoff with jitter to AD Sync Agent connection streams, spacing out retry attempts during outages to reduce LDAP bind floods and DC stress.
• Adds exponential backoff with jitter to the AD Import Agent directives stream, preventing reconnection surges against the ADBridge service during mass restarts.

Identity & Access Management · 2026-09-09

JumpCloud Enterprise Portal gains Active Directory Integration management in Public Preview, enabling centralized ADI domain control across all managed orgs.

• Adds enterprise-level Active Directory Integration (ADI) domain creation and management to the JumpCloud Enterprise Portal (EP), accessible via Enterprise Configuration > Identity Management > Active Directories.
• Supports sharing enterprise-level ADI domains across sub-organizations via the Configurations > Active Directory tab in the EP.
• Enables centralized control of org-level and end-user access to enterprise ADI domains from a single EP dashboard, including per-user and per-user-group access grants via the User Group and Users tabs.

Identity & Access Management · 2026-09-09

JumpCloud: Supports certificate (passwordless) based authentication for JumpCloud RADIUS, accepting certificates from any X.509 compliant certificate authority.

• Adds Google Chrome Universal Browser Patch Management policy to keep Chrome up to date across macOS, Windows, and Linux from a single universal policy.
• Launches JumpCloud Remote Assist for free remote desktop access and support on Windows and macOS, with no limits on session time or number of sessions, available to customers running JumpCloud Agent version 1.61.0 or later.
• Adds JumpCloud agent support for Linux Fedora 37.

Identity & Access Management · 2026-09-09

JumpCloud: Introduces JumpCloud Go, a hardware-protected phishing-resistant passwordless login via browser extension using Apple Touch ID and Windows Hello on managed macOS and Windows devices.

• Integrates JumpCloud Go, SAML, and OIDC SSO with AWS Verified Access as a VPN-less solution for remote access to corporate web resources.
• Launches dynamic group automation for device and user groups, with attribute-based membership rules and an optional review step before changes take effect.
• Adds Vendor and Public IP Address as new attributes for dynamic device group rules.

Identity & Access Management · 2026-09-09

JumpCloud: Password Manager is now supported in the EU region, with region selection available on the activation page (desktop app) and the pairing page (browser extension).

• Scales item storage up to 30,000 items without autofill, or up to 13,000 items with autofill enabled; a single shared folder can store up to 5,000 items.
• Native ARM build for macOS devices with M1 and above silicon is now available, with automatic upgrade from the x64 build.
• Adds the ability to sort items by nicknames.

Identity & Access Management · 2026-09-09

JumpCloud: Adds GET /systemusers?filter=department:$in:Finance | Accounting|IT support — the pipe | character can now be escaped with \ inside in and nin API filter operator search terms

• Adds six new Windows MDM CSP-based policies: Windows Wi-Fi Configuration, Windows VPN, Install Certificate, Bluetooth Configuration, Control Policy Conflict, and Windows Notification Service
• Adds Account > Settings > Global MFA Requirement in the Multi-Tenant Portal to bulk-enforce MFA across all MSP admins
• Introduces JumpCloud Device Monitoring and Alerting — proactive monitoring of device health (availability, software, uptime, disk, battery), policy/command/software management results, directory events (user addition, privilege elevation), and custom alerts via command execution monitoring on Windows, macOS, and Linux

Identity & Access Management · 2026-09-09

JumpCloud Custom Admin Roles gains CRUD + No Access permissions for Identity Management and Application Management scopes

• Renames Policy Management scope to Access Management, System Management to Devices, and Authentication Policies to Conditional Access Policies and IP Lists.
• Splits Identity Management and Directory and Groups Management into separate scopes, with Directory Management and Group Management nested under Directory and Groups Management.
• Moves RADIUS Authentication under the Access Management scope and folds Application Templates into the Applications scope.

Identity & Access Management · 2026-09-09

JumpCloud: Adds MCP Discovery and Token & Cost Tracking toggles under Access > AI & SaaS Management > Settings > Enhanced Discovery Options to discover MCP servers and track token usage and estimated costs from Cursor, Claude Code, OpenCode, Codex, VS Code, and Copilot CLI on managed Windows and macOS devices.

• Adds App Delivery Method setting to JumpCloud App Catalog apps, accepting Auto (force-install) or Self Service (user-installable), enabling a Self Service App Catalog accessible from the macOS Menu Bar App and Windows Tray App.
• Adds device-level macOS Self Service App Catalog and Windows Self Service App Catalog policies to hide the catalog on specific devices.
• Adds the Manual Report Builder and AI Assistant paths under Insights > Reports as a Custom Query Builder supporting CSV and JSON export, scheduling, and operators including Equals, Contains, and Is Null.

Identity & Access Management · 2026-09-09

JumpCloud launches Enterprise Portal (Preview) with cross-org management, Google Workspace integration, global MFA, and ADI.

• Introduces the Enterprise Portal (Preview), a new management layer for administering multiple JumpCloud organizations from a single pane of glass.
• Adds Google Workspace integration to the Enterprise Portal (Preview), covering setup, configuration, day-to-day use, and maintenance.
• Supports Google SSO integration within the Enterprise Portal (Preview) for federated administrator authentication.

Identity & Access Management · 2026-09-09

JumpCloud adds AI Gateway, Agent Identities, MCP Server, and AI-powered admin tools for securing AI clients and workflows.

• Adds AI Gateway to proxy and secure AI client connections, with integrations for Datadog, Vanta, Google Workspace Apps, HubSpot, Apollo.io, Linear, Asana, Slack, GitHub, Cloudflare, GitLab, and Atlassian Rovo.
• Adds support for connecting AI clients — including Claude, ChatGPT, Gemini CLI, OpenAI Codex, Cursor, VS Code, and Copilot CLI — through the AI Gateway.
• Adds Agent Identities to represent non-human AI agents, with support for Agent Groups and integration with Amazon Bedrock AgentCore.

Identity & Access Management · 2026-09-09

JumpCloud 2022 adds passwordless RADIUS auth, TOTP for LDAP, Remote Assist, Password Manager, and expanded MSP command templates

• Adds Command After Agent Install command type so admins can specify enrollment commands to run immediately after the JumpCloud agent is installed on new devices.
• Adds a Running column to the commands queue to distinguish commands waiting in the queue from those actively running.
• Adds Certificate Based Authentication to RADIUS, supporting passwordless X.509-compliant certificate auth from any certificate authority — including imported org-managed certs.

Identity & Access Management · 2026-09-09

JumpCloud 2023 adds passwordless Go SSO, Android zero-touch enrollment, Remote Assist background tools, dynamic groups, and push-bombing mitigation.

• Adds JumpCloud Go browser extension for hardware-protected, phishing-resistant passwordless login on managed macOS and Windows devices using Apple Touch ID and Windows Hello.
• Adds JumpCloud Go as the default MFA method for conditional access policies on SSO apps, with user and device verification on every session.
• Integrates JumpCloud with AWS Verified Access via JumpCloud Go, SAML, or OIDC SSO for VPN-less remote access to corporate web resources.

Identity & Access Management · 2026-09-09

JumpCloud 2024 adds Device Monitoring & Alerting, SaaS Management, Windows App Catalog, CSP-based MDM policies, and expanded API filtering

• Adds | (pipe) escape support using \ in API filter in and nin operators, enabling pipe characters within search terms — e.g. GET /systemusers?filter=department:$in:Finance | Accounting|IT
• Replaces deprecated GET api/systemusers/reactivate/{id} with POST https://console.jumpcloud.com/systemusers/reactivate/{id} carrying activation_email in the request body
• Replaces deprecated $le and $ge Dynamic Groups memberQuery filter operators with $lte and $gte to align filter syntax across all API list endpoints

Identity & Access Management · 2026-09-09

JumpCloud adds Access Requests, MCP Server, AI Commands Builder, Shadow AI Dashboard, and major SSO/MFA upgrades in 2025

• Adds sso_auth event to logs to capture forced re-authentication events for compliance and security auditing.
• Adds JumpCloud MCP Server (GA) to connect compatible AI tools to JumpCloud via the Model Context Protocol for direct administrative interaction.
• Adds JumpCloud Access Requests with configurable approval flows, webhook integration (e.g. JIRA), and tracking via Directory Insights.

Identity & Access Management · 2026-09-09

JumpCloud adds Agent Identities, Access Risk Detection GA, Custom Query Builder, Self Service App Catalog, and MCP discovery in its 2026 releases.

• Adds MCP Discovery and Token & Cost Tracking options under Access > AI & SaaS Management > Settings > Enhanced Discovery Options to discover MCP servers and track token usage and estimated cost from Cursor, Claude Code, OpenCode, Codex, and VS Code Copilot CLI on managed Windows and macOS devices.
• Adds App Delivery Method setting to JumpCloud App Catalog apps with Auto and Self Service values, enabling the new Self Service App Catalog for macOS and Windows so users can install, update, and uninstall apps from the Menu Bar or Tray App without admin intervention.
• Adds Custom Query Builder in Insights > Reports supporting manual report builder and AI Assistant natural-language queries, with operators (Equals, Contains, Is Null), CSV/JSON export, and scheduled reports.

Identity & Access Management · 2026-09-09

JumpCloud RBAC preview adds CRUD-level granularity to Identity Management and Application Management scopes and reorganizes permission categories.

• Adds CRUD operations and No Access permission level to the Identity Management and Application Management scopes, enabling more granular admin role assignments for Users and Applications.
• Splits Identity Management into a standalone scope hosting only user-related permissions, with Directory Management and Group Management moved under a new Directory and Groups Management scope.
• Moves SaaS Applications and Asset Management scopes under a combined SaaS and Asset Management permissions group.

Identity & Access Management · 2026-09-09

JumpCloud adds RSS feed subscriptions for release notes, agent updates, and bug fix announcements.

• Adds RSS feed subscriptions for JumpCloud Help Center updates, including What's New content, product release notes, agent release notes, and bug fix reports via Subscribe to Support RSS Feed, Subscribe to Release Notes and Bug Fixes RSS Feed, Subscribe to Agent Release Notes RSS Feed, and Subscribe to Bug Fixes RSS Feed options on the Release Notes and Bug Fixes page.

Identity & Access Management · 2026-09-09

JumpCloud Password Manager Desktop App gains EU region support, raised item limits, ARM macOS build, and shared folder admin controls.

• Adds a region selector on the activation page (desktop app) and pairing page (browser extension) so users can choose the EU region before activating their account.
• Raises the item storage limit to 13,000 items with autofill enabled, 30,000 items without autofill, and up to 5,000 items per shared folder.
• Introduces a Move All button in shared folders to relocate all items from a folder in a single action.

Container & Image Security · 2026-09-09

Kubescape v4.0.14 adds fleet-wide multi-cluster scanning, --framework/--search filters for list controls, and structured MCP error responses.

• Adds --framework and --search filters to kubescape list controls to narrow the control listing by framework or keyword.
• Extends --kube-contexts fleet mode in kubescape scan to support framework, control, and workload scan targets across multiple clusters.
• Adds cross-cluster control matrix and fleet report types for fleet-wide posture aggregation.

Reconnaissance & OSINT · 2026-09-09

Maigret gains --input-file to batch-search usernames and mixed ID types from a file or stdin pipe

• Adds --input-file <path> flag to read identifiers from a file (one per line), supporting inline type prefixes like vk_id:12345 or gaia_id:109876543210 so a single run can mix usernames with social-network IDs and produce one unified report and connections graph.
• Supports - as the path for --input-file to read identifiers from standard input, enabling generators to be piped directly into Maigret without an intermediate file.

Reconnaissance & OSINT · 2026-09-09

Maigret: Adds --input-file flag to read identifiers from a file (one per line) or from stdin (pass - as the path), supporting mixed-type entries via id_type:value prefixes (e.g. vk_id:12345, gaia_id:109876543210) in a single run whose results land in one report and one connections graph.

• Supports piping a generator directly into Maigret via --input-file -, eliminating the need for an intermediate file when sourcing usernames from a script.
• Note: --permute applies only to positional usernames and is intentionally skipped for file-sourced identifiers.

Network Analysis & Monitoring · 2026-09-09

NETRESEC: Adds --connect socks5:<host>:<port> (and socks4) to route PolarProxy's outgoing connections through an upstream SOCKS4 or SOCKS5 proxy, enabling use cases such as TLS inspection before forwarding traffic through Tor.

• Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close connections idle beyond the specified period, preventing zombie connections.
• Adds --tlstimeout <seconds> flag for a dedicated TLS-handshake timeout (default 30 s), separate from the existing TCP-handshake --timeout <seconds>.
• Supports PP_-prefixed uppercase environment variables as an alternative to all command-line arguments, suitable for systemd, Docker, Podman, Kubernetes, and Helm deployments.

Network Analysis & Monitoring · 2026-09-09

NETRESEC: Adds --bypass switch to use PolarProxy purely as a protocol converter without decrypting or re-encrypting TLS.

• Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections on the client and server sides respectively; idle timeout is disabled by default.
• Adds --tlstimeout <seconds> flag to close connections that stall during the TLS handshake (existing --timeout covers the TCP handshake; default is 30 seconds for both).
• Supports environment variables as an alternative to command-line arguments; variables use uppercase names with the PP_ prefix (e.g., PP_SOCKS corresponds to --socks); run --helpenv to list all supported variables.

Network Analysis & Monitoring · 2026-09-09

PolarProxy gains Tor proxy mode, idle timeout controls, SOCKS4/5 connect chaining, and license key file support.

• Adds Tor proxy mode: PolarProxy can now run as a local SOCKS and/or HTTP proxy, relaying connections to Tor via --connect socks5:127.0.0.1:9050, with TLS decryption/re-encryption applied unless --bypass is used.
• Adds --connect flag supporting socks4:HOST:PORT and socks5:HOST:PORT targets to chain outgoing sessions through an upstream SOCKS4 or SOCKS5 proxy, or a plain HOST sinkhole.
• Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to terminate sessions idle beyond a configurable threshold (default: no timeout).

Network Analysis & Monitoring · 2026-09-09

NETRESEC: Adds --helpenv flag to print all supported environment variables, and introduces the PP_ prefix convention (e.g. PP_SOCKS mirrors --socks) so PolarProxy can be fully configured without command-line arguments — suited for Docker, Kubernetes, Helm, systemd, and Podman deployments.

• Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections, complementing the existing --timeout <seconds> (TCP handshake) and --tlstimeout <seconds> (TLS handshake) options.
• Ships a software bill of materials in SPDX format as polarproxy.spdx.json, enabling integration with vulnerability scanning and supply-chain compliance workflows.

Network Analysis & Monitoring · 2026-09-09

PolarProxy 2.0.2 adds SOCKS client tunneling, environment-variable config, idle connection timeouts, and an SPDX SBOM.

• Adds --connect socks5:<host>:<port> (and socks4) to tunnel outgoing connections through an upstream SOCKS4 or SOCKS5 proxy server, enabling use cases such as routing decrypted TLS inspection traffic through Tor.
• Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections on the client or server side; complements existing --timeout <seconds> (TCP handshake) and --tlstimeout <seconds> (TLS handshake) flags.
• Adds --writeall flag to extend PCAP-over-IP output to include all proxied traffic, not just decrypted TLS.

AI/LLM Security · 2026-09-09

nono audit gains cleanup subcommand with --keep, --older-than, --max-total-size, and --dry-run filters to prune old audit sessions from disk.

• Supports combining --keep, --older-than, and --max-total-size filters so each narrows further which sessions are removed.

AI/LLM Security · 2026-09-09

nono v0.76.0 adds --max-total-size to audit cleanup, Nix flake support, and unix_socket_bind for tool sandboxes

• Adds --max-total-size <MB> flag to nono audit cleanup to evict oldest sessions until total audit storage falls below a specified megabyte threshold.
• Adds unix_socket_bind field to CommandSandboxConfig in tool-sandbox profiles, allowing per-command Unix domain socket grants (e.g. Git fsmonitor socket) without widening the agent-level sandbox.
• Adds Nix flake support, enabling nix run github:nolabs-ai/nono and nix profile add github:nolabs-ai/nono installs without Homebrew or the install script.

Identity & Access Management · 2026-09-09

Nudge Security browser extension now supports Safari, enabling SaaS and AI visibility on every company Mac.

• Supports deploying the Nudge Security browser extension on Safari via Apple Business Manager and MDM for silent rollout across company Macs, with step-by-step instructions available in Nudge Security settings.
• Monitors SaaS and AI activity in real time through the Safari extension, including daily AI usage, logins, access patterns, and file uploads.
• Detects identity and access risks via the Safari extension, including weak or reused passwords, SSO or MFA bypass attempts, shared credentials, and risky password manager use.

General Utilities & Libraries · 2026-09-09

Obsidian 1.14.1 upgrades to MathJax 4.1.3 and adds RTL support to Bases table views.

• Upgrades math rendering to MathJax 4.1.3, replacing MathJax 3 and Temml.
• Adds right-to-left (RTL) support to Bases table views, including keyboard navigation, selections, and horizontal scrolling.

General Utilities & Libraries · 2026-09-09

Obsidian Mobile 1.14.1 adds a configurable Quick Capture Home Screen widget with Location shortcuts and OpenStreetMap template support.

• Adds {{openStreetMapLink}} template variable to Quick Capture templates to insert an OpenStreetMap link to your current position.
• Exposes --font-preferred-size CSS variable for plugin/theme developers to respect the system preferred text size, combining --font-text-size with --preferred-text-scale.
• Adds a configurable Quick Capture Home Screen widget on iOS 26, with shortcuts to capture directly to different Locations.

General Utilities & Libraries · 2026-09-09

OpenSSL adds EVP_SKEY_get0_algorithm_id and EVP_SKEY_get0_local_keyid to the symmetric key API

• Adds EVP_SKEY_get0_algorithm_id function to retrieve the algorithm identifier from a symmetric key object.
• Adds EVP_SKEY_get0_local_keyid function to retrieve the local key ID from a symmetric key object.

Identity & Access Management · 2026-09-09

Ory Hydra now validates grant_types on OAuth 2.0 client creation and update.

• Validates the grant_types field when creating or updating an OAuth 2.0 client in Ory Hydra, catching misconfigured clients at registration time.

SAST / SCA / Code Security · 2026-09-09

OX VibeSec adds Dependency Vetting to block malicious or freshly published packages before AI agents install them.

• Adds Dependency Vetting capability that inspects every AI agent install attempt against policy and blocks known-malicious packages outright before they touch the developer machine or SBOM.
• Introduces a configurable cool-down period that blocks freshly published packages until the community has had time to flag them.

Exploitation & C2 · 2026-09-09

./ps-empire update adds a one-step command to refresh Empire source, Starkiller, compiler, and plugin registries

• Adds ./ps-empire update -y flag to auto-confirm all cache-migration and database-migration prompts for non-interactive/CI use.
• Supports user-local config overrides via ~/.config/empire/config.user.yaml, which the server merges on top of the base ~/.config/empire/config.yaml at startup, preventing overrides from being lost on update.
• Clarifies that CertPath for HTTPS listeners is a directory containing empire-chain.pem and empire-priv.key, with a self-signed pair generated in ~/.local/share/empire/cert/ on first server start.

Cloud Security Posture · 2026-09-09

Prowler can now ingest external OCSF scan results into Prowler Cloud via UI, CLI, or API.

• Adds Import Findings capability to upload OCSF scan results to Prowler Cloud from the UI, the CLI, or the API.

Integrated & IT Risk Management · 2026-09-09

Rapid7 Cyber GRC adds Workday lifecycle integration, guided task creation, and automatic SSO URI validation

• Adds Workday integration covering the full employee lifecycle — onboarding, role changes, and offboarding — to automatically generate access review evidence tied to employment status changes without manual collection.
• Validates OIDC and SAML Authentication Provider URIs automatically to catch SSO misconfigurations before they cause login issues.
• Replaces the single long-form task creation screen with a guided, step-by-step workflow to reduce errors when creating new tasks.

Integrated & IT Risk Management · 2026-09-09

Rapid7 Cyber GRC: Automates evidence collection across the employee lifecycle with a new Workday integration.

• Adds a guided, step-by-step workflow for faster task creation.
• Validates SSO configurations automatically with Authentication Provider URI checks.

Attack Surface & Exposure Management · 2026-09-09

Remediation Hub gains AI-summarized reports and CrowdStrike remediation recommendations in a unified workflow.

• Adds a Top Remediations Report with AI Summary to Remediation Hub, exportable in HTML or CSV format, so stakeholders receive consistent, self-explanatory remediation context without manual explanation.
• Surfaces CrowdStrike remediation recommendations directly in Remediation Hub alongside data from other sources, requiring the latest CrowdStrike connector for Rapid7 Attack Surface Management.

Attack Surface & Exposure Management · 2026-09-09

Rapid7 Exposure Command: Adds a Top Remediations Report with AI Summary in Risk > Remediation Hub, exportable in HTML or CSV format, surfacing remediation impact and recommended next steps directly in the report.

• Surfaces CrowdStrike remediation recommendations inside Remediation Hub for a unified view of remediation activity across environments.

SIEM · 2026-09-09

Rapid7 Incident Command gains a unified Environment Health Dashboard for monitoring agents, collectors, sensors, and more.

• Adds the Environment Health Dashboard at Data Connectors > Environment Health, consolidating health metrics for agents, collectors, event sources, network sensors, orchestrators, honeypots, scan engines, and data exporters into a single page.
• Surfaces per-source-type counts by state (online, offline, stale) in a KPI bar and state bar chart.
• Provides an issue feed sorted by severity with direct links to relevant documentation to identify known problems across data sources.

Vulnerability Management · 2026-09-09

Rapid7 MDR gains a self-service Threat Hunts page with query replay, IOCs, and on-demand PDF/HTML reports

• Adds the Threat Hunts page under Response & Remediation > Threat Hunts for MDR customers, surfacing every completed Rapid7-performed threat hunt with summary metric cards, full hunt detail pages (Threat Brief, description, recommended actions, IOCs, and queries used), and a continuously updated searchable list.
• Enables replay of hunt queries directly in Log Search with the original time range pre-populated, letting analysts re-run Rapid7 hunting logic against their own data.
• Supports on-demand and scheduled report generation in PDF and HTML at both the individual hunt level and across a configurable time period.

Vulnerability Management · 2026-09-09

Rapid7 Command Platform adds endpoint user identity context, MDR Threat Hunting access, and an Environment Health Dashboard.

• Adds access to MDR Threat Hunting for continuous threat hunting visibility.
• Adds an Environment Health Dashboard to monitor data collection health.
• Supports navigation search via Ctrl/Cmd+K keyboard shortcut to quickly locate any page by old or new name.

SAST / SCA / Code Security · 2026-09-09

InsightAppSec 7.5.029 adds AWS Bedrock LDAP Injection AI validation, FP transparency logging, and ALF v2.1.1 with native OTP support.

• Adds AWS Bedrock LLM verification for LDAP Injection findings to the AI Vulnerability Validator, joining existing Blind SQL, Blind NoSQL, SQL Injection, and RFI validation models to automatically filter false positives.
• Enables automated generation of assessment log and report artifacts when the AI Vulnerability Validator is active, documenting every finding flagged as a false positive and excluded from scan results.
• Upgrades the Application Layer Framework (ALF) to v2.1.1, introducing native One-Time Password (OTP) support without manual hook setups, expanded ALF logging visibility, and optimized default configuration parameters.

CNAPP · 2026-09-09

InsightCloudSec 26.9.8 adds a new Kubernetes Scanner version plus new and enhanced Insights and Query Filters.

• Introduces a new Kubernetes Scanner version for improved cluster resource coverage.
• Adds new Insights for cloud security posture assessment.
• Enhances existing Query Filters with additional filtering capabilities.

SIEM · 2026-09-09

InsightIDR adds automatic user identity context to process start events and a new Environment Health Dashboard for data pipeline monitoring.

• Adds the Environment Health Dashboard under Data Connectors > Environment Health, consolidating health metrics for agents, collectors, event sources, network sensors, orchestrators, honeypots, scan engines, and data exporters into a single page with KPI bar, state bar chart, issue feed, and resourcing table.
• Supports exporting Environment Health Dashboard data as a PDF or HTML report.
• Process start events now automatically include a top-level user field and associated user RRN, surfacing attributed LDAP/AD identity in alerts and investigations without manual correlation.

Attack Surface & Exposure Management · 2026-09-09

Remediation Hub gains AI-summarized reports and CrowdStrike remediation recommendations, plus new Intune group and CrowdStrike host-group filtering.

• Adds a Host Groups setting to the CrowdStrike Falcon connector to restrict device imports (and their Alerts, Vulnerabilities, and Software) to comma-separated host groups; requires the Host Groups: Read permission.
• Adds a Group Type(s) setting to the Microsoft Intune connector to import MicrosoftIntuneGroup objects; requires Group.Read.All and GroupMember.Read.All permissions.
• Remediation Hub (Risk > Remediation Hub) now surfaces CrowdStrike remediation recommendations alongside data from other sources, giving a unified view of remediation activity without switching tools.

Attack Surface & Exposure Management · 2026-09-09

Rapid7 Surface Command: Adds Top Remediations Report with AI Summary to Remediation Hub (Risk > Remediation Hub), exportable in HTML or CSV format, surfacing AI-generated remediation context — including potential impact and recommended next steps — directly in stakeholder reports.

• Surfaces CrowdStrike remediation recommendations inside Remediation Hub for a unified view of remediation activity across environments.

Attack Surface & Exposure Management · 2026-09-09

runZero adds custom roles with fine-grained verb/area permissions assignable to users, groups, SSO enrollment, and API clients.

• Adds a Custom roles system at console.runzero.com/account/roles where superusers and all-organization administrators can define roles as any combination of read, annotate, write, or manage verbs across 16 permission areas (inventory, findings, tasks, events, alerts, explorers, sources, queries, directory, users, organizations, credentials, tokens, ai, reports, content).
• Enables custom roles to be assigned as a user's default role, as a per-organization role override, as the SSO enrollment default via the Default role in any organization field on the SSO settings page, or locked to an API client.
• Supports a tokens:manage permission to create, change, and revoke API keys, export tokens, and API clients, and to approve MCP connections — kept separate from credentials:manage to prevent privilege escalation paths.

Attack Surface & Exposure Management · 2026-09-09

runZero: Adds custom roles, definable on the Roles page, that grant exact permissions and can be assigned as a user's default role, a per-organization role, a group role, the SSO enrollment default, or locked to an API client.

• Adds account-bound API clients on the API clients page — credentials with an explicit set of permissions and organizations that are not tied to any user account.

Attack Surface & Exposure Management · 2026-09-09

runZero adds custom roles for API keys and MCP connections, reprocessing tasks from the UI, and SAML cert expiry warnings.

• Enables API clients to be created with custom permissions capped by the creator's own access rights, and account-level API clients can now use granular authentication scopes in addition to roles.
• MCP connections now work smoothly with Claude Desktop and similar tools, and background MCP connections no longer count against API usage.

Attack Surface & Exposure Management · 2026-09-09

runZero 5.1 adds custom roles for API keys and MCP connections, granular auth scopes for account-level API clients, and UI-driven task reprocessing.

• Enables custom roles to be assigned to API keys, default user roles, group permissions, SSO defaults, and MCP connections.
• Allows account-level API clients to use granular authentication scopes in addition to roles.
• Lets users create API clients with custom permissions capped by their own access rights.

Secure Access (VPN / SASE / ZTNA) · 2026-09-09

ScoutDNS Windows Client 2.2.9 adds automatic fallback to private resolvers for undeclared .local/.corp/.internal names.

• Adds a private-name fallback so queries for suffixes like .local, .corp, or .internal not covered by any Local Forwarder rule are forwarded to the adapter's private resolvers instead of returning SERVFAIL, enabling AD-joined devices to resolve domain controllers and internal hosts without a profile change.

Network Analysis & Monitoring · 2026-09-09

Security Onion 3.3.0 adds Logstash pipeline tuning and log-level controls in SOC, agentic memory with vector support, and Elasticsearch 9.4.5.

• Adds tuning of multiple Logstash pipelines directly in SOC, including exposed log.level and log.format settings.
• Adds agentic memory capability with a vector extension for Agent Studio.
• Upgrades Elasticsearch to 9.4.5.

SIEM · 2026-09-09

Sekoia.io adds a native playbook integration to push CTI IOCs into Palo Alto XSIAM Collections via the indicators/insert_jsons API

• New Push Sekoia.io IOCs to Palo Alto XSIAM Collection playbook template automates ingestion of STIX IOCs from a Sekoia CTI feed into a Palo Alto XSIAM Collection via POST /public_api/v1/indicators/insert_jsons.
• New CTI Feed Consumption module (Node 0) pulls STIX objects from a custom feed with configurable Batch Size Limit, Feed ID, Modified After (RFC-3339 timestamp), and Resolve Sources parameters, outputting results at {{ node.0.stix_objects_path }}.
• New Transform Sekoia STIX to XSIAM module (Node 1) converts STIX patterns into XSIAM-ready JSON with overridable class_override, comment, severity_mapping, reliability_mapping, and stix_objects_path parameters, mapping observable types (file → HASH, filename → FILENAME, directory → PATH, domain-name → DOMAIN_NAME, ipv4-addr → IP) and confidence scores to XSIAM severity (LOW/MEDIUM/HIGH/INFO) and reliability (A–E) bands.

SIEM · 2026-09-09

Sekoia.io adds a Palo Alto Cortex XSOAR integration via the SEKOIAIntelligenceCenter marketplace pack

• Exposes the !GetObservable XSOAR command to query Sekoia.io InThreat objects by value and type (e.g. value="eicar@sekoia.io" type="email-addr") from within Cortex XSOAR.
• Requires a Sekoia.io XDR API key scoped to the INTHREAT_READ_OBJECTS permission (8d9901dc-0508-4472-b3c1-5ad5efc96032) to authenticate the integration.

SIEM · 2026-09-09

Sekoia.io adds a Splunk SOAR app with three CTI API actions: Get Indicator, Get Indicator Context, and Get Observable.

SIEM · 2026-09-09

Sekoia.io adds a native Splunk app that syncs CTI feed IOCs nightly and enables lookup-table threat matching in Splunk searches.

• Adds | inputlookup sekoia_iocs_url | rename _key as indicator | convert ctime(valid_until) SPL query to search existing Sekoia IOCs with expiry dates inside Splunk.
• Supports HTTP_PROXY and HTTPS_PROXY environment variables so the Sekoia Splunk app inherits the global Splunk proxy configuration without a separate proxy entry.
• Adds a native Sekoia.io app for Splunk (Enterprise on-prem and Splunk Cloud) that pulls IOCs from the Sekoia CTI feed and populates a Splunk lookup table, updated on a nightly schedule.

SIEM · 2026-09-09

New OpenCTI Sekoia.io Intel Stream Connector syncs OpenCTI indicators to Sekoia.io IOC collections in real time

• Supports bidirectional operations: indicator creation and revocation in Sekoia.io IOC collections triggered by deletion events in OpenCTI.
• Supports multiple connector instances, allowing one stream-to-collection pair per instance with OpenCTI stream filters controlling which indicators reach each collection.
• Requires Python 3.11.x (not compatible with 3.12+), OpenCTI Platform 6.8.x or higher, pycti 6.8.x or higher, and a Sekoia.io API key with IoC Collections permissions.

SIEM · 2026-09-09

Sekoia.io threat intelligence can now be pushed to Microsoft Sentinel via a TAXII feed connector.

• Adds a Microsoft Sentinel integration that connects Sekoia.io CTI to Sentinel using the Threat intelligence - TAXII connector at API root https://app.sekoia.io/api/v2/inthreat/taxii-server.
• Supports configuring the TAXII feed to export only CTI indicators in JSON format for ingestion into Sentinel's Threat Intelligence section.
• Enables authentication to the TAXII server using a Sekoia.io API key (with the Intelligence Center Read-Only role) as the password field in the Sentinel connector form.

SIEM · 2026-09-09

Sekoia.io adds a MISP IDS Attributes to IOC Collection trigger that auto-imports MISP to_ids-flagged indicators into Sekoia IOC Collections for detection.

• Adds the MISP IDS Attributes to IOC Collection playbook trigger that periodically polls a MISP instance for attributes with the to_ids flag enabled and pushes them to a Sekoia.io IOC Collection.
• Supports MISP attribute types ip-dst, domain, url, sha256, md5, and sha1, mapping each to the corresponding Sekoia IOC field (ipv4-addr.value, domain-name.value, url.value, file.hashes.SHA-256, file.hashes.MD5, file.hashes.SHA-1).
• Trigger configuration accepts IOC Collection UUID, IOC Collection Server, Published Timestamp (look-back window in days), and Sleep Time (polling interval, default 5 minutes) to control import behaviour.

SIEM · 2026-09-09

Sekoia.io exposes its default intelligence feed as a MISP feed via a new API endpoint, consumable by any MISP instance.

• Adds a MISP feed endpoint at https://api.sekoia.io/v1/misp-gateway/misp (manifest at /manifest.json) serving all non-expired Sekoia.io intelligence, kept in sync so indicators are updated rather than duplicated.
• Requires an API key with the INTHREAT_READ_OBJECTS permission, passed as an Authorization: Bearer <APIKEY> header, with MISP input source set to Network and source format MISP Feed.

SIEM · 2026-09-09

Sekoia.io adds a Cortex analyzer integration to enrich TheHive with CTI indicators, context, and observables.

• Enables Sekoia.io CTI data (indicators, context, observables) to be searched and retrieved directly from a self-managed Cortex instance by configuring a Sekoia API key with the View intelligence permission under the SekoiaIntelligenceCenter Analyzers Config entry.

SIEM · 2026-09-09

Sekoia.io Intelligence Center now exposes a TAXII 2.1 server with HTTP Basic Authentication and cursor-based pagination.

• Exposes a TAXII 2.1 server with discovery endpoint at https://app.sekoia.io/api/v2/inthreat/taxii-server/taxii2 and API root at https://app.sekoia.io/api/v2/inthreat/taxii-server, enabling any TAXII-compatible platform to consume Intelligence Center feeds.
• Authenticates to the TAXII server via HTTP Basic Authentication using the Intelligence Center API key as the password, with any string accepted as the username.
• Supports cursor-based pagination via the next parameter and match[spec_version] filter on collection object endpoints (e.g. /collections/<id>/objects) to iterate incrementally over STIX 2.1 objects.

SIEM · 2026-09-09

Sekoia.io Intelligence Center API docs surface feed consumption, IOC lookup, and object context endpoints at https://api.sekoia.io/v2/inthreat/

• Adds GET v2/inthreat/collections/{feed_id}/objects endpoint to consume CTI feed objects, returning up to 2000 STIX objects per request via the limit parameter and paginating with the cursor parameter.
• Adds modified_after parameter to GET v2/inthreat/collections/{feed_id}/objects to filter intelligence entries created or modified after a specified ISO 8601 timestamp, avoiding full-feed re-download.
• Adds match[type] parameter to GET v2/inthreat/collections/{feed_id}/objects for filtering returned objects by a comma-separated list of STIX types (e.g. indicator).

SIEM · 2026-09-09

Sekoia.io adds Threat Landscape hub with real-time malware, MITRE technique, and adversary trend dashboards

• Adds the Threat Landscape dashboard — a centralised hub showing real-time trends on cyber threats and adversary activities, driven by global XDR telemetry and the TDR team's analysis.
• Includes a global time filter (default: last 30 days) at the top of the Threat Landscape page, letting users narrow all trend-type widgets to a custom time frame.
• Adds a Latest FLINT reports section giving quick access to finished intelligence reports published by the TDR team, with direct pivot to associated IoCs (requires Intelligence subscription).

SIEM · 2026-09-09

Sekoia.io Intelligence Center gains fully configurable dashboards with modular widgets, custom filters, and date range controls.

• Adds a configurable dashboard system to the Intelligence Center homepage, composed of modular widgets that can be repositioned, filtered by date range, and set to auto-refresh.
• Adds a preconfigured default dashboard showing community activity including risk level, alert counts, last posted comments, and last created alerts.
• Supports creating new dashboards from scratch via Settings > Create a new dashboard, with named widgets dragged into a workspace and shared across all community members.

SIEM · 2026-09-09

Sekoia.io adds IOC Collections: import, manage, and detect on external indicators from CSV, XLS, XLSX, or plain text

• Adds IOC Collections, a new feature to import external indicators (IPv4/IPv6, MAC address, domain, URL, MD5/SHA-1/SHA-256/SHA-512 hash, email) from sources outside Sekoia's own Threat & Detection Research team and use them in detection rules.
• Supports File Import using CSV, XLS, and XLSX files with column-mapping UI (including an Ignore option to discard columns) to import tabular IOC feeds.
• Supports Text Import for pasting a plain list of IOCs (one per line) sharing common properties such as Related Threats, Valid From, Valid Until, Kill Chain Phases, and Description (capped at 500 characters).

SIEM · 2026-09-09

Sekoia.io adds data export from Object and Report pages in CSV, TXT, JSON, and MITRE ATT&CK formats.

• Adds an export modal on Object and Report pages to download related items in CSV, TXT, JSON, or MITRE ATT&CK format, with the option to export all relationships or filter by a specific relationship type.
• CSV export converts TLP, sources, and kill chain phase values to human-readable text instead of IDs.
• MITRE ATT&CK format export produces output compatible with the MITRE ATT&CK Navigator for visual matrix generation.

SIEM · 2026-09-09

Sekoia.io adds External Reports: curated third-party threat intelligence publications browsable, filterable, and linked to STIX objects in-platform.

• Adds an External Reports section under Reports in the left-hand menu, surfacing curated publications from government CERTs, national cybersecurity agencies, security vendors, and independent research organizations alongside existing FLINT reports.
• Reports open in PDF view by default with a toggle to switch to text view for a summarized version of the publication.
• Enables filtering the reports list by feed — scoped by source, sector, or geography — using the filter bar at the top of the reports list.

SIEM · 2026-09-09

Sekoia.io adds a dedicated FLINT Reports page for browsing, reading, and pivoting from flash intelligence publications into investigation workflows.

• Adds a FLINT Reports page reachable via Reports > FLINTs in the left-hand menu, or from the Threat Landscape page's FLINT Reports widget, to browse and read flash intelligence publications.
• Supports PDF view and text view for each FLINT report, with zoom, a PDF download option, and a resizable report list panel.
• Enables direct pivot from a FLINT report into the platform by clicking any object or observable to open its detail page, or the report title to see all associated STIX objects and observables.

SIEM · 2026-09-09

Sekoia.io adds Graph Explorations: interactive, shareable CTI visualizations with layer management and team collaboration.

• Adds a New Graph Exploration tab on any intelligence object page to launch focused graph explorations from a specific threat actor, malware family, attack technique, or other CTI entity.
• Adds a Graph Explorations menu item providing a team-shared library of saved threat intelligence explorations for collaborative research, analytical continuity, and intelligence production.
• Introduces graph layer management — accessible from the top-left corner of the analysis panel — allowing analysts to create independent layers per threat actor, malware family, ATT&CK technique, or infrastructure category within a single exploration.

SIEM · 2026-09-09

Sekoia.io adds CTI feed-linked detection rules that check both live telemetry and historical events for feed indicator matches.

• Adds ability to create a detection rule directly from a CTI feed by selecting CTI as the detection pattern type and choosing a custom feed, enabling automatic monitoring of both incoming telemetry and historical events against feed indicators (requires Defend subscription).

SIEM · 2026-09-09

Sekoia.io Feeds deliver filtered CTI views via JSON/STIX, CSV, Text, or Custom formats over API and TAXII endpoints

• Exposes a Public API URL (https://app.sekoia.io/api/v2/inthreat/collections/...) and a Public TAXII URL (https://app.sekoia.io/api/v2/inthreat/taxii-server/...) per feed for direct integration with SIEMs, firewalls, and TIPs
• Introduces Feeds — filtered, scoped views of CTI objects — supporting output formats JSON/STIX, Text (firewall EDLs), CSV, and Custom (user-defined templates with variables $tlp, $id, $name, $observables)
• Provides a Default Feed covering the entire Sekoia CTI database with no filters, accessible out of the box via Feed ID d6092c37-d8d7-45c3-8aff-c4dc26030608

SIEM · 2026-09-09

Sekoia.io adds Observable and Threat Telemetry — heatmap-based sighting history for IPs, domains, hashes, and STIX threat objects across communities.

• Adds Observable Telemetry for public IPv4/IPv6 addresses, domain names linked to public TLDs, and file hashes — showing a daily sighting heatmap over the past year drawn from parsed events.
• Adds Threat Telemetry for all 8 STIX threat object types (attack patterns, campaigns, infrastructures, intrusion sets, malware, threat actors, tools, vulnerabilities) — recording an occurrence each time an alert fires from associated IOCs, correlation rules, or AI models.
• Adds a telemetry report for IOC collections, allowing analysts to verify the viability of imported IOCs by reviewing historical observable sightings before use.

AI-Powered Offensive Security · 2026-09-09

Shannon v3.2.0 adds custom pi model configs with registry-resolvable IDs and surfaces startup/preflight failures.

• Supports custom pi model configs with registry-resolvable model IDs and distinct model error codes.
• Surfaces startup and preflight failures so misconfiguration errors are visible before a scan begins.

SAST / SCA / Code Security · 2026-09-09

Socket reachability engine adds PHP support, JS dynamic dispatch approximation, --reach-version override, and smarter socket fix for Go and Cargo.

• Adds --reach-version flag to socket scan reach to run a different Coana engine version than the one bundled with the Socket CLI.
• Adds withheldFixes field in --dry-run --output-file JSON output when compute-fixes-and-upgrade-purls cannot apply a fix because a flag such as --disable-major-updates withheld the only patched version.
• Enables reachability analysis for PHP/Composer projects when running via the Socket CLI; a Composer project in a subdirectory is now analyzed in its own directory rather than at the repository root.

Firewalls & Network Defense · 2026-09-09

Sophos Central Firewall 2026.38 raises maximum Central Firewall Reporting storage entitlement for term-licence firewall models.

• Increases the maximum Central Firewall Reporting storage entitlement for firewall models using term licences, allowing more reporting data to be retained before the storage limit is reached.

Exploitation & C2 · 2026-09-09

Starkiller v4.0.0 adds a dashboard, per-agent stats, topology graph, multi-tab terminal, and a revamped tag system

• Adds a Dashboard overview page with summary metrics, agent check-ins, a recent-tasks list, an agents breakdown chart, and an interactive topology panel
• Adds an interactive agent topology graph panel on the Dashboard with fullscreen expand and a context-aware right-click menu (Open, Popout, Execute shell/module, Kill, Focus)
• Adds multi-agent selection on the Dashboard Check Ins card

Detection Engineering · 2026-09-09

Tenzir: Adds query_params record to web_identity.token_endpoint in azure_auth, enabling OIDC audience parameters (e.g. 'audience': 'api://AzureADTokenExchange' for GitHub Actions or 'sts.amazonaws.com' for AWS) to be passed without manual URL concatenation; accepts both string and secret values.

• Adds azure_auth record with web_identity field to from_azure_blob_storage and to_azure_blob_storage, supporting Entra workload identity federation via token_endpoint, token_file, or inline token — covering GitHub Actions, GCP metadata server, and Kubernetes projected service account tokens — to allow a single node to operate across multiple Entra tenants simultaneously.
• Adds from_microsoft_365_activity operator to collect unified audit records from Microsoft 365, handling Activity API subscriptions, backfills, continuous polling, pagination, retries, and snapshot-backed blob checkpoints; configured with auth (tenant_id, client_id, client_secret) and content_types (e.g. ['Audit.General']).
• Adds schema_registry parameter to from_kafka for direct Avro decoding, supporting Confluent schema IDs in payload prefixes and schema GUIDs in Kafka headers, with independent registry authentication and TLS settings.

Detection Engineering · 2026-09-09

Tenzir v6.16.0 adds automatic Sigma rule matching against OCSF-normalized events.

• Adds automatic Sigma matching for OCSF-normalized events, enabling Sigma rules to run directly against Open Cybersecurity Schema Framework data.

Detection Engineering · 2026-09-09

Tenzir: Adds a blob conversion function.

• Adds query parameters for web identity token endpoints.
• Pushes limit and field selection operations down toward sources for improved query performance.

Detection Engineering · 2026-09-09

Tenzir v6.16.0 adds automatic Sigma-to-OCSF matching, Microsoft 365 collection, Kafka Avro with Schema Registry, and more.

• Adds from_clickhouse operator that pushes filters, limits, and field selection into SQL for efficient ClickHouse queries.
• Adds automatic matching of stock Sigma rules against OCSF (Open Cybersecurity Schema Framework) events without manual mapping.
• Adds query parameters support for web identity token endpoints, expanding identity federation options.

Runtime Security · 2026-09-09

Tetragon tracing-policy selector expressions gain lsh() and rsh() bit-shift operators for CEL filter logic.

• Adds lsh() (left shift) and rsh() (right shift) bit-shifting functions to CEL expressions in tracing-policy selectors.

Runtime Security · 2026-09-09

Tetragon adds redact_str field and namespace_regex filter to event redaction configuration

• Adds redact_str field to redaction rules, letting operators specify a custom replacement string (e.g. <redacted:password>) instead of the default redaction placeholder, making individual redaction rules identifiable in alerts.
• Adds namespace_regex filter to scope event filtering by Kubernetes pod namespace using a list of regular expressions.

Runtime Security · 2026-09-09

Tetragon adds fentry/fexit hook support as a faster BTF-based alternative to kprobes for tracing kernel functions

• Adds fentries section to TracingPolicy specs, enabling fentry/fexit BPF programs that attach to kernel functions via BTF and the ftrace trampoline — faster than kprobes and available on kernels >= 6.1 with CONFIG_DEBUG_INFO_BTF=y.
• Supports tracing system calls via fentry by setting the syscall ABI field, applying the same symbol naming rules as kprobes.
• Supports multiple fentry specs in a single policy by listing multiple entries under the fentries section (e.g. tcp_connect and tcp_close).

SOAR · 2026-09-09

Tines 43.2.0 adds case management via API, MCP tools, formula support in AI URLs, and change-control tracking in the storyboard.

• Adds Update case fields via the API — case fields can now be modified programmatically through the Tines API.
• Adds Audit log retention period configuration — operators can now configure how long audit logs are retained.
• Adds Cases tools in the Tines MCP, exposing case management operations to the Model Context Protocol surface.

Endpoint Security (EDR/XDR) · 2026-09-09

Trend Vision One Intrusion Prevention Configuration gains AI-powered security action recommendations based on threat landscape and network behavior.

• Adds AI-powered security action recommendations in Intrusion Prevention Configuration that analyze threat landscape, network behavior, and current filter deployments to suggest optimal protection strategies and prioritize recommended action filters.

Endpoint Security (EDR/XDR) · 2026-09-09

Security Playbooks gain asset-attribute conditions and automated owner notifications for vulnerability-driven workflows.

• Adds asset attribute conditions to Security Playbooks — including asset group, custom tags, criticality, device service, operating system, application, and CVSS score — to filter vulnerabilities and trigger automated notifications.
• Adds container-specific attribute conditions to Security Playbooks, including cluster name, namespace, group, and custom tags.
• Adds cloud workload vulnerability conditions to Security Playbooks, covering CVSS score ranges, global exploit potential, exploit detection status, and prevention rule coverage.

Endpoint Security (EDR/XDR) · 2026-09-09

CVEs with global exploit potential security playbooks now cover containers and cloud VMs in Trend Vision One.

• Adds enhanced filtering capabilities within security playbooks to target vulnerable assets across a wider range of workloads, enabling more precise stakeholder notifications and accelerated remediation.

Endpoint Security (EDR/XDR) · 2026-09-09

Cloud Accounts now supports custom resource tagging for OCI compartments via Trend Vision One or Terraform variables.

• Supports custom key-value resource tagging for Oracle Cloud Infrastructure (OCI) deployments in Cloud Accounts, configurable as Terraform variables or through the Trend Vision One console (Cloud Security → Cloud Accounts).

Digital Forensics & Incident Response · 2026-09-09

UAC v3.4.0 adds 20+ AI coding agent artifact collectors (Claude, Copilot, Codex, Gemini, Cursor and more) plus new macOS and AIX artifacts.

• Adds files/applications/ai_tools/amp.yaml to collect Amp session data, config, and credentials [linux, macos].
• Adds files/applications/ai_tools/claude_code.yaml to collect Claude Code session logs, config, credentials, pre-edit file history, tool results, auto-memory, plans, shell snapshots, hook scripts, and IDE lock files [linux, macos].
• Adds files/applications/ai_tools/claude_desktop.yaml to collect Claude Desktop transcripts, config, credentials, storage, skill/plugin definitions, and app logs [macos].

Digital Forensics & Incident Response · 2026-09-09

New artifact Windows.ADCS.CertificateAuthority.EDB parses the ADCS ESE database directly from disk for certificate forensics

• Adds Windows.ADCS.CertificateAuthority.EDB artifact that reads the CA database at C:\Windows\System32\CertLog\*.edb via the ntfs accessor while CertSvc is running, returning all certificate requests with disposition, requester/caller identity, subject DN, template, timestamps, and serial number.
• Supports filtering via EDBGlob, DispositionFilter, RequesterRegex, SubjectRegex, TemplateRegex, DateAfter, and DateBefore parameters for targeted forensic triage.
• Performs ESE transaction log recovery using esentutl /r against a temp copy of the database so committed-but-uncheckpointed rows are visible and match certutil output.

SAST / SCA / Code Security · 2026-09-09

Veracode Fix adds AI-assisted remediation across IDE, CLI, and SCM surfaces for both SAST and SCA findings.

• Adds --remote flag requirement for Fix for SCA via the Veracode CLI, enabling backend sandbox execution with full source access for automated CI pipelines, scheduled jobs, and SCM workflows.
• Supports Fix for SAST in Eclipse, JetBrains, Visual Studio, and VS Code IDEs for interactive in-editor remediation.
• Supports Fix for SCA via SCM integration (Fix in SCM) that scans a repository, generates patches, and opens merge requests automatically.

SAST / SCA / Code Security · 2026-09-09

Veracode Fix gains SCA remediation via veracode fix sca CLI command, analyzing vulnerable dependencies and suggesting safe upgrade paths.

• Adds veracode fix sca CLI command (and source control management integration) to analyze SCA findings, generate remediation patches, and identify safe dependency upgrade paths (Limited Availability).
• Adds COBOL support with fix suggestions for CWE-78, CWE-209, CWE-248, CWE-489, and CWE-252, available in the Veracode CLI and in Visual Studio Code, Visual Studio, and JetBrains IDEs.

SAST / SCA / Code Security · 2026-09-09

Veracode integrations gain Fix for SCA in GitHub, new VS Code filters, ADO agent pool config, and platform-managed GitHub scan scheduling.

• Adds custom agent pool name parameter in veracode.yml for Azure DevOps Workflow Integration v2.4.3 to specify the agent pool used for pipeline execution.
• Implements a configurable retry mechanism for the Veracode Platform Applications API (appsec/v1/applications) in Java API Wrapper v26.2.18.0 to handle transient failures, timeouts, and network issues.
• GitHub Workflow Integration now supports Veracode Fix for SCA, generating fixes for vulnerable dependencies identified in SCA scans.

SAST / SCA / Code Security · 2026-09-09

Veracode training adds LLM security labs, OWASP Top 10:2025 courses, Get Lesson Progress API enhancements, and platform-integrated user management.

• Adds updatedAfter parameter to the Get Lesson Progress API to support incremental data loads.
• Adds excludeNotStarted=true parameter to the Get Lesson Progress API to filter out lessons that have not been started.
• Adds stack field and updated_on field to the Get Lesson Progress API response, and surfaces a Not Started status when both start_time and end_time are null.

Threat Intelligence · 2026-09-09

World Monitor v2.10.0 adds defense industrial intelligence, USDA food stocks, mineral production data, MCP agent endpoints, and expanded market panels.

• Exposes story corroboration to agents via MCP (feat(mcp): expose story corroboration to agents).
• Exposes WTO trade flows to agents via MCP, and names coverage-collapse causes.
• Adds safe live dashboard controls via webmcp.

SAST / SCA / Code Security · 2026-09-09

ZeroPath adds a remote MCP server, Microsoft Teams alerts, Gerrit/CVS support, Continuous Scanning, and Assistant skills in this release.

• Adds a remote MCP server at https://zeropath.com/mcp supporting Streamable HTTP clients (Claude, Cursor, Codex); connections are read-only until changes are approved, and administrators can revoke all org connections at once.
• Adds lastScanFailure to the repository object in the API, carrying both the message and the outcome of a failed scan.
• Adds Microsoft Teams channel notifications via incoming webhook — paste the webhook URL into ZeroPath to deliver scan notifications and vulnerability alerts as Adaptive Cards, with no Azure AD app registration required.

Web Application Security · 2026-09-08

Arcjet adds agent guards for Google ADK, TanStack AI, and Claude Managed Agents across JavaScript and Python

• Adds @arcjet/guard/google-adk/v2 package with guardPlugin() as a BasePlugin for Google ADK JS agents, enforcing policy on beforeToolCallback and defaulting to fail-closed on error.
• Adds @arcjet/guard/tanstack-ai/v0 package with onBeforeToolCall middleware hook for TanStack AI chat({ middleware }) workflows, with optional onDeny: 'abort' to stop the run.
• Adds @arcjet/guard/claude-managed-agents/v0 package with guardCustomTool, guardEvents, and claudeManagedAgentsContext (JS) and guard_custom_tool, guard_events, claude_managed_agents_context (Python) for Anthropic's hosted Claude Managed Agents harness, covering inbound user.message events, events.send, and custom tools on agent.custom_tool_use.

Web Application Security · 2026-09-08

Arcjet guards now wrap AI agent frameworks including LangChain, CrewAI, OpenAI Agents, and 12 others in JS and Python.

• Adds agent wrapping support for Vercel AI SDK, LangChain, CrewAI, LangGraph, Genkit, Google ADK, OpenAI Agents, Strands Agents, TanStack AI, Vercel Eve, Mastra, Claude Agent SDK, and Claude Managed Agents in JavaScript and Python.

Web Application Security · 2026-09-08

Arcjet adds a Guard adapter for Claude Managed Agents, covering inbound messages and custom tools in JavaScript and Python.

• Adds @arcjet/guard/claude-managed-agents/v0 adapter for JavaScript (requires @anthropic-ai/sdk >=0.86.0 <1) exposing guardEvents, guardCustomTool, and claudeManagedAgentsContext helpers to screen inbound user.message before events.send and gate custom tools on agent.custom_tool_use.
• Adds arcjet[claude-managed-agents] Python extra (requires anthropic>=0.92.0,<2) exposing guard_events, guard_custom_tool, and claude_managed_agents_context for the same inbound-message and custom-tool guarding via arcjet.guard.claude_managed_agents.
• On custom-tool DENY, instructs callers to return user.custom_tool_result with is_error set, providing a concrete denial-handling contract for Claude Managed Agents sessions.

Identity & Access Management · 2026-09-08

Auth0 adds self-service XAA config via My Organization API, Advanced MFA GA, and Cross-App Access Requesting App in Early Access

• Adds self-service configuration of Third-Party Application Access and Cross App Access (XAA) through the My Organization API and Embeddable UI Components (Open Early Access), letting Organization Admins configure third-party app access, connection-level third-party access, and XAA Resource Application roles without routing changes through the Auth0 Dashboard.
• Advanced MFA Configurations is now Generally Available, enabling configurable Remember this device idle lifetimes (1 hour to 30 days) and absolute lifetimes (up to 90 days), OTP lengths for SMS and email factors (4–10 digits), OTP lifetime for SMS MFA (30 seconds to 1 hour), and OTP lifetime for email MFA (5 minutes to 1 hour).
• Auth0 now supports acting as a requesting application in Cross-App Access flows (Early Access), built on Auth0 Token Vault using the ID-JAG (Identity Assertion Authorization Grant) protocol, allowing apps to fetch third-party API tokens for enterprise users without requiring manual Connect your account steps; supported on OIDC and Okta Workforce connections with org-aware resolution via org_id.

Digital Forensics & Incident Response · 2026-09-08

Belkasoft adds an Offline Map Server for air-gapped or network-restricted investigations

• Adds Belkasoft Offline Map Server, enabling map-based geolocation analysis in environments without internet access.

Digital Forensics & Incident Response · 2026-09-08

Belkasoft X v2.12 adds offline AI translation, SQLite classification, Remote Desktop cache reconstruction, and SRUM/BAM/DAM extraction.

• Adds BelkaGPT-powered offline evidence translation supporting bulk and per-message translation of chats, SMS, and other artifact text, with automatic language detection across 200+ source languages and 100+ target languages — all processing done locally within the forensic environment.
• Adds BelkaGPT SQLite database classification that scans a sample of database records and assigns predefined categories (communications, locations, financial information, credentials) or custom categories to help prioritize unfamiliar or proprietary databases.
• Adds custom SQLite artifact mapping, letting investigators map tables and columns from unsupported databases to standard Belkasoft X artifact fields (timestamps, participant names, message text, identifiers, geolocation) so the data can be searched, filtered, and reported alongside parsed evidence.

Vulnerability Management · 2026-09-08

Brinqa adds NowSecure Workstation, OSV, and Security Reporter as new data source connectors.

• Adds NowSecure Workstation connector, ingesting Application, Dynamic Code Finding, and Dynamic Code Finding Definition data objects into the graph.
• Adds OSV (Open Source Vulnerabilities) connector, ingesting Security Advisory data objects.
• Adds Security Reporter connector, ingesting Api Endpoint, Application, Assessment, Cloud Resource, Code Repository, Device, Host, Network, Pentest Finding, Pentest Finding Definition, Person, Site, and Team data objects.

AI/LLM Security · 2026-09-08

Certiv Cost enters public preview with session-level token attribution, per-endpoint budgets, and end-user spend visibility in Scout.

• Adds Certiv Cost (public preview) with session-level token attribution — tracking spend by agent, endpoint, user, and model — plus historical trend views to surface abnormal consumption.
• Adds per-endpoint dollar budgets with three enforcement modes: Report (logs overage, no interruption), Notify (fires alerts, work continues), and Block (stops future prompts at the endpoint before the request leaves).
• Supports entry of negotiated per-model rates so budget thresholds are computed against what your organization actually pays rather than list pricing.

Container & Image Security · 2026-09-08

Chainguard Libraries quickstart documents source-rebuilt Java, JavaScript, and Python packages with chainctl entitlement, pull-token, and verify commands

• Adds chainctl libraries entitlements create --ecosystems=JAVASCRIPT (also JAVA, PYTHON) to provision access to Chainguard Libraries from the CLI.
• Adds chainctl auth pull-token create --repository=java|javascript|python --ttl=<duration> to generate basic-auth credentials; default TTL is 720h (30 days), maximum is 8760h (365 days).
• Adds chainctl libraries verify /path/to/artifact to confirm which dependencies were built from source by Chainguard; requires libraries.java.pull, libraries.javascript.pull, or libraries.python.pull permission, or the Owner role.

Internet Services · 2026-09-08

Cloudflare adds 64 MiB Worker bundles, WSGI/ASGI Python support, Images text rasterization, and bulk tunnel route creation

• Adds --outdir and --dry-run flags to wrangler deploy to inspect uncompressed bundle size before deploying, now checked against a unified 64 MiB limit across Free and Paid plans (previously 3 MB / 10 MB compressed)
• Adds wsgi.entrypoint() and asgi.entrypoint() from the workers module to support WSGI frameworks (Django, Flask) and ASGI frameworks (FastAPI, Starlette) in Python Workers
• Adds .text() method to the Images binding to rasterize text into or over an image, with font, size, and color style options; also adds a text key to the draw array in cf.image

Web Application Security · 2026-09-08

CMSeeK gains an API mode — POST endpoint via Flask returns CMS scan results as JSON

• Adds a POST API mode backed by Flask that returns CMS scan data as JSON without printing to the console.
• Adds Silent flag to suppress output from the Results and Basics modules when running in API mode.
• Adds Should_Return flag to instruct modules to return scan data as a dictionary instead of relying on console prints.

Web Application Security · 2026-09-08

Dalfox adds GraphQL/XML scanning, adaptive WAF evasion with jitter, a REST API server, an MCP server, and a /_dalfox endpoint.

• Exposes a REST API server with a /_dalfox endpoint for programmatic XSS scanning.
• Adds an MCP server mode for tool integration.
• Adds adaptive WAF evasion that applies random jitter between requests and an escalating cooldown when blocked responses cluster, with WAF-specific pacing hints applied automatically on WAF detection even without the flag.

Web Application Security · 2026-09-08

Dalfox MCP integration gains paginated findings, size-capped pages, untrusted-content notices, and blind-XSS callback validation

• Adds _untrusted_content_notice as the first key in every MCP findings response, ensuring agents read the safety warning before acting on scan output whose evidence, response, payload, param, location, and message_str fields contain target-controlled bytes.
• Adds offset and limit parameters to page through large MCP result sets, with a pagination object reporting {total, offset, limit, returned, has_more} and truncated_by_size: true / max_page_bytes when a 4 MiB per-page cap cuts a page short.
• Validates blind_callback_url at call time — must be empty or start with a recognized scheme — so blind-XSS <script src=...> payloads are not silently injected into every parameter (query, body, header, cookie) with no viable callback.

Web Application Security · 2026-09-08

Dalfox gains native GraphQL and XML/SOAP body injection, treating inner values as individual XSS injection points.

• Adds graphql parameter type: when the POST body carries a GraphQL operation with a variables object (Content-Type application/json or application/graphql), every string leaf inside variables is registered as its own injection point, and each payload rebuilds the full request so the server receives a valid, parseable GraphQL document.
• Adds xml parameter type: when the POST body is an XML or SOAP document (Content-Type text/xml, application/xml, or application/soap+xml, or a body with an <?xml …?> prolog), each element text node and attribute value becomes a separate injection point, injected via byte-range splice so namespaces, sibling elements, and the SOAP envelope are preserved.

SIEM · 2026-09-08

Auto CDF reaches GA, delivering row-level change tracking at query time with ~15% faster MERGE/UPDATE and no per-table setup.

• Adds Automatic change data feed (Auto CDF), which computes row-level changes at query time using row tracking — no manual ENABLE CHANGE DATA FEED required on each Delta Lake or Apache Iceberg v3 table.
• Auto CDF makes MERGE and UPDATE operations approximately 15% faster on tables queried for changes by eliminating write-time overhead.
• Auto CDF works with batch queries, Structured Streaming, and Delta Lake Sharing when using Databricks Runtime 19 LTS or above with row tracking enabled.

Web Application Security · 2026-09-08

DataDome CloudFront v3 splits exclusion config into two env vars and adds two new default URI checks

• Introduces DATADOME_STATIC_ASSET_EXCLUSION environment variable to hold static-asset extension exclusions separately from custom URL exclusions, enabled by default.
• Moves custom URL exclusions to DATADOME_URI_REGEX_EXCLUSION exclusively — static-asset extensions must now be removed from this variable.
• Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) so DataDome strips matrix params (;) from URIs before regex evaluation.

Web Application Security · 2026-09-08

Nginx Module 3.1.0 adds tif, tiff, and pdf to static asset exclusion and adopts dynamic API-driven status codes.

• Extends the static asset exclusion regex pattern to cover tif, tiff, and pdf file extensions, skipping DataDome checks for those requests.
• Replaces hard-coded HTTP status codes with values sourced from DataDome Protection API response headers, enabling dynamic status code handling for upcoming features.

Vulnerability Management · 2026-09-08

DefectDojo v3.2.400 adds KEV-based rules, SPDX SBOM export, Skillspector scanner, engagement checklists, and a Cmd/Ctrl+K palette.

• Adds SPDX as an export format alongside CycloneDX in the UI SBOM export.
• Rules can now be conditioned on KEV (Known Exploited Vulnerabilities) listing and exploit evidence.
• Adds a searchable menu palette over the sidebar, opened with Cmd/Ctrl+K.

Secure Access (VPN / SASE / ZTNA) · 2026-09-08

DNSFilter makes Dashboards the default landing view, merges filters, adds live status indicators, and improves TLD labeling.

• Dashboards is now the default landing view for all users; the legacy Overview page is retired and existing bookmarks redirect automatically.
• Merges Quick Filters and Advanced Filters into a single Filters experience in the dashboard Filters drawer, grouped by Source (Organizations, Sites, Roaming Clients/Relays, Users) and Traffic (Result).
• Dashboard deployment widgets (Roaming Clients Protected, Sites Protected, Relays, Users, Collections) now show a pulsating green dot with a tooltip to indicate live data not affected by the time range filter.

Network Analysis & Monitoring · 2026-09-08

driftnet gains HTTP text extraction and live display of captured text in the web UI

• Adds text extraction from captured HTTP requests, displayable in the web (HTTP) interface alongside existing media.
• Extends the HTTP/WebSocket display to paint captured text media and send the text media type in WebSocket messages.

Digital Forensics & Incident Response · 2026-09-08

Elcomsoft Quick Triage 2.2 adds a timeline, plugin architecture, and file system snapshot artifact.

• Adds a timeline view that merges events from different artifacts into a single chronology.
• Introduces a plugin architecture that rebuilds artifact support as a plugin system.
• Adds file system snapshot as a new artifact type.

Secure Access (VPN / SASE / ZTNA) · 2026-09-08

Gateway 1.6.1 auto-creates flow-log storage, reports device serial/UUID, and moves Gateway naming to the Admin Portal.

• Removes the FIREZONE_NAME / -n Gateway option; the Gateway's name is now configured in the Admin Portal instead.
• Auto-creates the /var/lib/firezone directory to ensure that flow logs can be persisted.
• Now reports the device serial and UUID.

Secure Access (VPN / SASE / ZTNA) · 2026-09-08

Firezone Linux GUI 1.5.17 adds X.509 certificate-backed device trust and auto-download of updates on Linux.

• Adds support for device trust backed by X.509 certificates.
• Improves update notifications on Linux to also trigger the download of the new package immediately upon notification.

Secure Access (VPN / SASE / ZTNA) · 2026-09-08

Firezone adds X.509 certificate-backed device trust and removes the FIREZONE_NAME/-n Gateway option in favour of Admin Portal configuration.

• Improves update notifications to appear once per Client launch instead of only once per new version; on Linux, update notifications now also trigger the download of the new package right away.

Secrets Detection & Management · 2026-09-08

GitGuardian adds Docker Hub monitoring, intelligent perimeter-free attribution, unified exclusion rules, and a new agents overview page for public incidents.

• Adds a GitGuardian agents overview page under Public Monitoring showing how many public incidents the agents analysed and how company-attribution verdicts break down, with one-click filtering to matching incidents.
• Adds continuous Docker Hub monitoring, scanning public images daily and attributing exposures to your company as they appear after the initial historical scan.
• Adds intelligent attribution beyond your monitored perimeter for new GitHub commits, attributing public leaks to your company even when no perimeter rule matches.

Secrets Detection & Management · 2026-09-08

GitGuardian adds AI Hooks and agent/MCP inventory to Developer Endpoint Protection, plus IAM identity linking for stored AWS keys

• Adds AI Hooks to Developer Endpoint Protection, scanning prompt submission, pre-tool use, and post-tool use for secrets across Claude Code, Cursor, Copilot CLI, VS Code, Codex, and Mistral Vibe — a block names the secret and how to remove it so the developer or agent can fix and retry.
• Adds ggshield machine setup to configure hooks for every detected AI agent on a machine alongside git hooks, replacing per-agent manual setup.
• Adds a workspace setting to automatically remove sources deleted on the remote from team perimeters, while keeping them accessible to workspace managers.

Secrets Detection & Management · 2026-09-08

GitGuardian adds six new detectors (Firebase, Coze, Keycloak, Fish Audio, Azure Custom Vision) plus an Apify analyzer and Docker Hub PAT detection.

• Adds docker login --username / -u detection to the Docker Credentials detector, catching Docker Hub personal access tokens used in that login pattern.
• Adds new Firebase ID Token detector for Firebase ID tokens.
• Adds new Coze Access Token detector for Coze access tokens.

Secrets Detection & Management · 2026-09-08

GitGuardian adds ggshield machine setup and ggshield machine doctor to protect endpoints with AI Hooks, git hooks, and honeytokens.

• Adds ggshield machine setup command (requires ggshield 1.53.0+) to configure all three endpoint protections in one idempotent run: AI Hooks for every AI coding agent found, pre-commit/pre-push git hooks in the global git configuration, and a honeytoken decoy AWS credential profile.
• Adds --no-honeytokens, --no-ai-hooks, and --no-git-hooks flags to ggshield machine setup to selectively skip individual protections.
• Adds ggshield machine doctor command (requires ggshield 1.53.0+) to report per-AI-agent hook installation status, git hook status, and token scope validity.

Secrets Detection & Management · 2026-09-08

GitGuardian adds AI Hooks to block secrets in AI coding tool prompts and MCP tool calls, with ClickHouse-backed agent session scanning.

• Adds AI Hooks to block secrets in prompts and tool calls in AI coding tools before they leak via developer AI agents.
• Requires ClickHouse on self-hosted instances to support machine scans with secrets findings, MCP tool calls, and complete AI agent session recording.

Secrets Detection & Management · 2026-09-08

GitGuardian adds AI agent/MCP inventory and ggshield machine setup to block secrets leaking through AI coding tools.

• Adds ggshield machine setup command to configure AI Hooks and git hooks for every detected AI agent on a machine in a single step.
• Adds --history flag to ggshield ai discover to parse MCP tool calls from agent transcripts for post-compromise investigation.
• Adds AI Hooks coverage for Codex and Mistral Vibe, joining Claude Code, Cursor, Copilot CLI, and VS Code — scanning prompt submission, pre-tool use, and post-tool use, and blocking with a named secret and remediation hint.

Secrets Detection & Management · 2026-09-08

GitGuardian adds AI agent/MCP secret blocking and vault secret classification via ggshield 1.54.0 and ggscout 0.32.0

• Adds AI Hooks to block secrets at prompt submission, pre-tool use, and post-tool use for Codex and Mistral Vibe, alongside existing Claude Code, Cursor, Copilot CLI, and VS Code coverage.
• Runs the Secrets Detection Engine on every value ggscout collects, classifying vaulted secrets against 550+ detectors including multi-match detectors.
• Adds detector, detector type, secret family, secret category, and secret provider filters and sort options to the NHI inventory.

Secrets Detection & Management · 2026-09-08

Self-hosted gains real-time validity check processing and AWS IAM identity linking for secrets stored in vaults and Kubernetes.

• Validity check results and incident creation events are now processed immediately on self-hosted instead of queuing.
• AWS access keys stored in a secrets manager, Vault, or Kubernetes are now linked to their AWS IAM identity in the NHI Governance identity map.

SIEM · 2026-09-08

Google SecOps adds self-service Bindplane Enterprise license download and v2 feed types via Cloud Storage Transfer Service.

• Enables download of the Bindplane Enterprise (Google Edition) license key directly from the platform console under SIEM Settings > Collection Agents > Bindplane Enterprise (Google Edition) for Enterprise Plus and Google Unified Security (GUS) customers.
• Introduces v2 feed types that use the Google Cloud Storage Transfer Service (STS) for improved performance, scalability, and reliability.

SAST / SCA / Code Security · 2026-09-08

graudit 3.9 adds JWT and Docker signature databases, plus Git and SVN history-scanning misc scripts.

• Adds signatures/jwt.db signature database for scanning JWT-related patterns across all supported language rulesets.
• Adds signatures/docker.db signature database with rules flagging RUN sudo, USER root, and VOLUME /var/run/docker.sock in Dockerfiles.
• Adds misc/giterate.sh script to iterate through every Git commit and run graudit rules against each commit diff, with optional branch scoping.

Digital Forensics & Incident Response · 2026-09-08

Hashrat 1.23 documents full CLI surface: TOTP generation, network hashing via SSH/HTTP, xattr storage, memcached integration, and duplicate detection

• Adds -totp <secret> and -totp <url> flags to generate TOTP codes from a shared secret or an otpauth: URL, with -digits <n> and -period <n> to control code length and lifetime
• Adds -net flag to treat file arguments as ssh:// or http:// URLs, pulling and hashing remote files over the network; -idfile <path> supplies an SSH private key instead of a password
• Adds -xattr and -txattr flags to store and verify hashes in extended file attributes (trusted/root-only attributes under -txattr), with -cache to skip re-hashing files whose xattr hash is still fresh

Post-Exploitation · 2026-09-08

Impacket adds LDAP paged search, MS-NEGOEX Phase 3, and secretsdump trust-key file output in recent PRs

• Adds LDAP paged search support to findDelegation.py and GetNPUsers.py to handle large directories without truncation.
• Outputs trust keys to a dedicated .ntds.trustkeys file in secretsdump instead of mixing them into the main dump.
• Implements MS-NEGOEX Phase 3, extending the NEGOEX authentication protocol support in impacket.

Secrets Detection & Management · 2026-09-08

Infisical v0.165.7 adds break-glass emergency access for PAM requests and multi-sync LDAP connections.

• Adds break-glass emergency access capability for PAM access requests, enabling out-of-band approval bypass in critical situations.
• Allows a single LDAP connection to back multiple Linux and Windows syncs simultaneously, reducing connection overhead for directory-integrated environments.

Container & Image Security · 2026-09-08

Inspektor Gadget v0.56.0 adds Kubernetes multi-tenancy (RBAC-enforced), rootless ig image commands, and uprobe support for stripped Go binaries.

• Adds --oci-store-user flag to sudo ig run to read gadgets from the per-user OCI store at ~/.ig/oci-store (built rootlessly) without creating root-owned files in the user home directory.
• Adds experimental Kubernetes multi-tenancy mode: authenticates every kubectl-gadget request via TokenReview and restricts gadgets to RBAC-authorized namespaces using SubjectAccessReview, enforced in the gadget service via KubeManager.
• Enables ig image build, ig image list, ig image inspect, ig image push, and ig image pull to run as a normal (non-root) user against a per-user OCI store at ~/.ig/oci-store.

Web Application Security · 2026-09-08

Invicti adds WebRTC chatbot detection, rate-limit-aware scan pacing, Agentic Pentesting management, and INVICTI_MINIMUM_CONFIDENCE independent scan failure in scan-cli.

• The INVICTI_MINIMUM_CONFIDENCE environment variable in scan-cli now independently fails a scan when its threshold is exceeded, without also requiring INVICTI_MINIMUM_SEVERITY to be set.
• The INVICTI_IGNORE_SSL_CHECKS environment variable in scan-cli now applies to all outbound platform API calls made during a scan — including DAST, Inventory, Identity, and report/export endpoints — not just the ephemeral agent.
• Adds Bearer Token and API Key as dedicated, first-class authentication header types in target configuration, separate from functional headers, for easier authenticated scan setup.

AI/LLM Security · 2026-09-08

Mend SAST adds multi-base-branch scanning on Azure DevOps and Bitbucket Cloud with per-branch policy support.

• Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling per-branch monitoring and policy enforcement.
• Improves detection accuracy of the JavaScript/TypeScript analysis engine across 11 CWEs, including Path Traversal (CWE-22), OS Command Injection (CWE-78), XSS (CWE-79), SQL Injection (CWE-89), LDAP Injection (CWE-90), Code Injection (CWE-94), Log Injection (CWE-117), Improper Certificate Validation (CWE-295), Open Redirect (CWE-601), SSRF (CWE-918), and NoSQL/query-language injection (CWE-943).

AI/LLM Security · 2026-09-08

Mend AI 26.8.2 adds IDE/AI-agent suppression tooling and a unified vulnerability remediation experience with a Top Fix column.

• Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppress/unsuppress actions across all scanning engines, including SAST and SCA, with UI updates reflecting within seconds.
• Introduces a unified vulnerability remediation experience with standardized fix logic, a new Top Fix column in the Findings table, and an updated Remediation tab to reduce noise and improve fix consistency.

AI/LLM Security · 2026-09-08

Mend Renovate adds AWS S3 Helm chart repo support, pixi optional channel options, and pnpm no-frozen-lockfile handling

• Supports AWS S3 as a Helm charts repository source via datasource/helm.
• Adds support for optional channel options in the manager/pixi manager.
• Passes --no-frozen-lockfile to pnpm when performing lock file updates in manager/npm.

SAST / SCA / Code Security · 2026-09-08

Mend SCA 26.8.2 adds a unified vulnerability remediation experience with a new Top Fix column in the Findings table.

• Adds a Top Fix column to the Findings table and updates the Remediation tab as part of a unified vulnerability remediation experience across the platform, standardizing fix logic and recommendations for consistent metadata.

SAST / SCA / Code Security · 2026-09-08

Mend SAST adds multi-base-branch scanning for Azure DevOps and Bitbucket Cloud, plus JS/TS detection accuracy improvements across 11 CWEs.

• Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling security managers to monitor and set policies for each branch individually.
• Improves detection accuracy of the JavaScript/TypeScript analysis engine across 11 CWEs (CWE-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-117, CWE-295, CWE-601, CWE-918, CWE-943), including tuning for React controlled components to reduce false positives where query parameters flowing into escaped JSX attributes were incorrectly flagged as DOM-based XSS.

SAST / SCA / Code Security · 2026-09-08

Mend Renovate adds AWS S3 Helm chart repo support, pixi optional channel options, and pnpm --no-frozen-lockfile for lock file updates.

• Passes --no-frozen-lockfile to pnpm when performing lock file updates in the manager/npm manager.
• Supports optional channel options in the manager/pixi manager.
• Supports AWS S3 as a Helm charts repository in the datasource/helm datasource.

SAST / SCA / Code Security · 2026-09-08

Mend 26.8.2 adds in-IDE suppression for SAST and SCA findings and unifies vulnerability remediation with a new Top Fix column.

• Adds a suppression tool in Agentic Integrations supporting single and bulk suppression or unsuppression actions across all scanning engines, including SAST and SCA, with UI updates reflecting within seconds — reducing context-switching for developers working in their IDE or AI agent workflow.
• Introduces a unified vulnerability remediation experience with a new Top Fix column in the Findings table, an updated Remediation tab, and standardized fix logic and metadata across the Mend Platform.

SAST / SCA / Code Security · 2026-09-08

Mend SAST adds multi-base-branch scanning on Azure DevOps and Bitbucket Cloud, plus JS/TS detection accuracy improvements across 11 CWEs.

• Adds support for scanning multiple base branches into dedicated projects in the Developer Platform on Azure DevOps and Bitbucket Cloud, enabling security managers to monitor and set policies for each branch individually.
• Improves detection accuracy of the JavaScript/TypeScript analysis engine across 11 CWEs (CWE-22, CWE-78, CWE-79, CWE-89, CWE-90, CWE-94, CWE-117, CWE-295, CWE-601, CWE-918, CWE-943), including tuned handling of React controlled components to reduce false-positive DOM-based XSS findings.

SAST / SCA / Code Security · 2026-09-08

Mend SAST 26.8.2 adds IDE/AI-agent suppression tooling and a unified vulnerability remediation experience with a Top Fix column.

• Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppression or unsuppression across all scanning engines, including SAST and SCA, with UI updates reflecting within seconds.
• Introduces a unified vulnerability remediation experience with a Top Fix column in the Findings table, an updated Remediation tab, and standardized fix logic and metadata across the Mend Platform.

SAST / SCA / Code Security · 2026-09-08

Mend SAST 26.8.2 improves JavaScript/TypeScript detection accuracy across 11 CWEs including XSS, SQLi, SSRF, and NoSQL injection.

• Improves JavaScript/TypeScript analysis engine detection accuracy across 11 CWEs: CWE-22 (Path Traversal), CWE-78 (OS Command Injection), CWE-79 (XSS), CWE-89 (SQL Injection), CWE-90 (LDAP Injection), CWE-94 (Code Injection), CWE-117 (Log Neutralization), CWE-295 (Certificate Validation), CWE-601 (Open Redirect), CWE-918 (SSRF), and CWE-943 (NoSQL/query-language injection).

Exploitation & C2 · 2026-09-08

Metasploit adds four new modules: three HTTP exploit modules and a new auxiliary scanner/evasion module.

• Adds exploit/multi/http/mcpjam_inspector_rce remote code execution exploit module targeting MCPJam Inspector.
• Adds exploit/multi/http/papercut_ng_external_user_lookup_rce remote code execution exploit module targeting PaperCut NG external user lookup.
• Adds exploit/multi/http/simplehelp_oidc_auth_bypass_rce exploit module targeting SimpleHelp OIDC authentication bypass leading to RCE.

AI/LLM Security · 2026-09-08

nono Tool Sandbox gains unix_socket_bind grants, @git:fsmonitor-socket token, and macOS per-session isolation for mediated commands

• Adds unix_socket_bind grant type to tool sandbox policy, accepting a path array to allow connect(2) and bind(2) on named AF_UNIX socket files, with implied ReadWrite filesystem grants on the socket file or its parent directory.
• Adds @git:fsmonitor-socket dynamic path token that resolves to fsmonitor--daemon.ipc under the current worktree's private git-dir without spawning a process, enabling core.fsmonitor=true to reach its daemon socket inside a sandbox.
• On macOS, every mediated command now runs in its own POSIX session (setsid before exec), making session membership an unforgeable proof of descent for orphaned child processes.

Identity & Access Management · 2026-09-08

Ping Identity adds Friendly Captcha support, no-JS QR codes for MFA registration, IGA identity/role certification, and correlation rules for unmanaged apps.

• Adds esv.am.secrets.gsm.stableid.version.only environment variable to retain legacy Google Secret Manager JWK kid behavior when ESV secrets would otherwise use the new unique name-and-version identifier.
• Adds support for Friendly Captcha to the v2 CAPTCHA node as a privacy-focused CAPTCHA provider alternative.
• Adds an option to the Combined MFA Registration, OATH Registration, and Push Registration nodes to render QR codes without requiring JavaScript.

CNAPP · 2026-09-08

Plerion Kubernetes collector manager now ships as a multi-arch image supporting arm64 (Graviton) alongside amd64.

• Publishes the Kubernetes collector manager as a multi-architecture image for both amd64 and arm64, enabling deployment on Graviton node pools without requiring a dedicated x86 node or nodeSelector configuration.

AI-Powered Offensive Security · 2026-09-08

RAPTOR v3.1.0 lands bulk audit mode, OCI/Dockerfile substrate, SCA supply-chain detection, multi-LLM provider support, and Frida reachability integration.

• Adds --audit-verbose flag for strace-style verbose output during sandbox audit runs.
• Adds --audit-budget <n> flag to cap the maximum number of audit events collected per run.
• Adds --compiler-scan / --no-compiler-scan flags to enable or disable a compiler-analyzer channel using gcc -fanalyzer or clang --analyze.

AI/LLM Security · 2026-09-08

Reality Defender adds POST /api/v2/user-feedback endpoint for submitting analyst feedback via API.

• Adds POST https://api.prd.realitydefender.xyz/api/v2/user-feedback endpoint accepting JSON with x-api-key authentication to submit user feedback programmatically.

Compliance Automation & Trust Management · 2026-09-08

Scrut adds native ClickUp integration, letting teams push compliance tasks directly to ClickUp from Policies, Evidence, Risk, and Audit modules.

• Adds ClickUp as a supported Project Management Platform integration, accessible via Integrations Library > Project Management Platforms > ClickUp tile in Scrut.
• Supports region-specific OAuth redirect URLs for India (https://app.scrut.io/settings/integration/clickup), US (https://app.us.scrut.io/settings/integration/clickup), EU (https://app.eu.scrut.io/settings/integration/clickup), and Australia (https://app.au.scrut.io/settings/integration/clickup).
• Enables Create ClickUp Task from any of the following Scrut modules: Policies, Evidence Tasks, Tests, Cloud, Risk Management, and Audit Center (Requests, Findings, and Corrective Actions).

Compliance Automation & Trust Management · 2026-09-08

Scrut Automation adds Shortcut Story creation directly from Policies, Evidence Tasks, Tests, Cloud, Risk, and Audit Center artifacts.

• Adds Create Shortcut Story action accessible from Policies, Evidence Tasks, Tests, Cloud, Risk Management, and Audit Center (Requests, Findings, and Corrective Actions) artifacts via the three-dot menu.

Compliance Automation & Trust Management · 2026-09-08

Scrut Automation adds Linear issue creation directly from Policies, Tests, Risks, Audit findings, and more

• Adds the ability to create a Linear issue from Scrut artifacts — Policies, Evidence Tasks, Tests, Cloud, Risk Management, and Audit Center (Requests, Findings, and Corrective Actions) — via a three-dots menu on each artifact page.

Compliance Automation & Trust Management · 2026-09-08

Scrut Automation: Adds a Create Asana Task action (via the three-dots menu) on Policies, Evidence Tasks, Tests, Cloud, Risk Management, and Audit Center artifacts (Requests, Findings, Corrective Actions) to create Asana tasks directly from Scrut.

• Adds a Tickets (Asana) tab on each artifact, showing Asana ID, Title, Assignee, Status, Created On, and Action for all linked tasks.
• Supports linking existing Asana tickets to Scrut artifacts via Link Existing Tickets using a pasted Asana task URL.
• Bidirectional real-time sync keeps Asana task changes (including completion status) reflected automatically in Scrut.

Compliance Automation & Trust Management · 2026-09-08

Scrut Automation adds Azure DevOps integration for creating and managing compliance work items directly from the platform.

• Adds Azure DevOps integration under the Project Management Platforms section of the Integrations Library, enabling creation of work items from Scrut compliance artifacts (Policies, Evidence Tasks, Tests, Cloud, Risk Management, and Audit Center Requests, Findings, and Corrective Actions).
• Supports OAuth-based authorization with Azure DevOps using scopes vso.graph, vso.project, and vso.work_write to read users/groups, read projects/teams, and create or update work items.
• Provides a Configure Additional Fields option on the Azure DevOps integration page to select extra fields included when creating work items from Scrut.

Compliance Automation & Trust Management · 2026-09-08

Scrut MCP connects compliance data to Claude, ChatGPT, Cursor, Claude Code, and Codex via the MCP standard

• Adds Scrut MCP server integration for Claude (Desktop and Claude.ai Web), using OAuth Client ID vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U and region-specific MCP server URLs (India, US, EU, Australia) configured under Customize → Connectors → Add.
• Adds Scrut MCP server integration for ChatGPT via Developer Mode (Settings → Plugins), using OAuth with User-Defined OAuth Client registration and the same Client ID vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U.
• Adds Scrut MCP server integration for Cursor IDE, configured under Cursor Settings → Integrations & MCP → Add New MCP Server with region-specific MCP server URLs and OAuth.

Compliance Automation & Trust Management · 2026-09-08

Scrut adds Zinc Work and HiBob integrations, plus a Risk Management quick-start guide.

• Adds integration with Zinc Work, enabling practitioners to connect their Zinc Work account to Scrut.
• Adds integration with HiBob to securely sync employee data, configure read-only permissions, automate People directory updates, and support onboarding and offboarding workflows.
• Adds a Quick Start Guide for Risk Management to help practitioners manage risks in Scrut.

Container & Image Security · 2026-09-08

Snyk Container surfaces source repository info for locally built images via BuildKit metadata.

• Container scans now surface source repository information for locally built images using BuildKit metadata.

SAST / SCA / Code Security · 2026-09-08

SonarQube adds R language analysis, Bitbucket Forge app migration, CLI local scanning with AI fixes, and UI theme selection.

• Adds R language support to SonarQube Cloud analysis.
• Adds migration path from the legacy SonarQube Cloud Connect app to the SonarQube Cloud for Bitbucket Cloud (Bitbucket Forge) app for Bitbucket Cloud workspace bindings.
• Adds SonarQube CLI capability to detect secrets, verify local changes against SonarQube Server or Cloud, and apply AI-suggested fixes before a pull request is opened.

SAST / SCA / Code Security · 2026-09-08

StepSecurity now supports up to ten webhooks per tenant, each with independent endpoints, event subscriptions, and repository scopes.

• Supports up to ten webhooks per tenant, each configured with its own endpoint URL, HTTP method, headers, message format, and Envelope template — replacing the previous single-webhook-per-tenant limit.
• Adds per-webhook event subscriptions choosing from four event types: Insights, Detections, Secure Registry Audit Logs, and API Audit Logs, in any combination.
• Adds per-webhook repository scope, so one endpoint can be scoped to a subset of repositories while another covers all current and future repositories.

Detection Engineering · 2026-09-08

Tenzir v6.15.0 adds Splunk HEC acknowledgement support to the Tenzir Node.

• Adds Splunk HEC acknowledgement support to the Tenzir Node, enabling confirmed event delivery over the HTTP Event Collector protocol.

AI/LLM Security · 2026-09-08

ToolHive v0.47.0 adds SPIFFE trust config, key-signed artifact verification, configurable proxy body limits, and Cedar delegation without upstream sessions.

• Adds SPIFFE trust configuration and exposes SPIFFE client-auth registration through the operator CRDs.
• Verifies key-signed skill and plugin installs against a public key, and records the pinned cosign key in the lock schema.
• Honoured pinned cosign key is now applied on sync and upgrade operations, and plugin pushes are signed with the lock feature gate removed.

SAST / SCA / Code Security · 2026-09-08

Veracode adds IDE/CLI usage analytics, a Custom PDF REST API, OAuth on XML APIs, and several new Reporting API fields and filters.

• Adds the Custom PDF REST API to programmatically generate custom PDF reports.
• Adds support for OAuth Client Credentials authentication with the Veracode XML APIs (previously REST APIs only).
• Adds the most_recent_scan filter to the Reporting API Scans report; when set to true, returns only the most recent scan per asset.

SAST / SCA / Code Security · 2026-09-08

Veracode integrations gain GitHub Platform install, scan scheduling, VS Code file filters, ADO agent pool config, and expanded API pagination support.

• Adds debug configuration option in veracode.yml for debugging and troubleshooting pipeline runs (GitHub Workflow Integration v1.0.6, Azure DevOps Workflow Integration v2.3.6).
• Adds analysis_branch support in veracode.yml so scheduled scans run against a specified branch instead of the default branch (Azure DevOps Workflow Integration v2.3.10).
• Adds custom agent pool name parameter in veracode.yml to specify the agent pool used for pipeline execution (Azure DevOps Workflow Integration v2.4.3).

Network Analysis & Monitoring · 2026-09-08

Wireshark 4.7.4 adds column freezing and pinned-row strip to the packet list for easier horizontal and vertical navigation.

• Adds Freeze Column context menu item to freeze a column and all columns to its left so they remain visible while scrolling horizontally, with Unfreeze Columns to clear them.
• Adds Pin Row to Top toggle to pin a packet's row in a persistent strip above the packet list, keeping it visible regardless of scroll position or display filter, up to a fixed maximum number of pinned rows.
• Adds Go to Packet context menu item in the pinned-row strip to scroll the main packet list to a pinned packet's current position.

SAST / SCA / Code Security · 2026-09-08

ZeroPath adds SLO/SLI tracking and audit trail under Settings → Service levels

• Adds Settings → Service levels → Policies to configure SLO targets on individual policies.
• Adds Settings → Service levels → SLO / SLI section with trend charts that turn SLA activity into a time-series view.
• Adds Audit trail section under Settings → Service levels to record SLA-related activity.

SAST / SCA / Code Security · 2026-09-08

ZeroPath adds org-level toggle to redact AI-generated descriptions and exploit walkthroughs for secret findings across all surfaces.

• Adds a Hide Descriptions toggle in the Repositories & data section for organization admins, which redacts AI-generated descriptions and exploit walkthroughs for secret findings across the dashboard, API responses, webhook payloads, notifications, and exported tickets.

SAST / SCA / Code Security · 2026-09-08

ZeroPath: Adds a unified Scanner workspace in the main sidebar that consolidates all scanning configuration — Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks) — into one place.

• Adds consistent five-category scanner settings layout (General, Full scans, Pull requests, Dependencies, Remediation) at organization, tag, and repository scope, so any setting is found in the same place regardless of which scope you are overriding.
• Adds scoped scanner permissions: rules, repository context, and scan locations now reflect the viewer's permissions, surfacing only the actions they are authorized to perform, with inline reasons when Add, Save, or Delete are unavailable.
• Enables members with scanner permission on individual repositories to access the Scanner workspace and select from a searchable list of only the repositories they are authorized to configure.

SAST / SCA / Code Security · 2026-09-08

ZeroPath adds a unified Scanner workspace, purpose-grouped Settings navigation, and scope-aware scanner permissions.

• Adds a dedicated Scanner workspace in the main sidebar that consolidates all scanning configuration under Configuration (scanner settings, scan locations) and Detection (repository context, rules, sources and sinks).
• Groups Settings sidebar pages by purpose: Workspace (general, members, teams, billing), Security (scanner settings, repository tags, service levels), and Connections (integrations, notifications, API keys).
• Surfaces scanner settings across five consistent categories — General, Full scans, Pull requests, Dependencies, and Remediation — at organization, tag, and repository scope so overrides appear in the same location at every level.

Exploitation & C2 · 2026-09-07

Bugcrowd adds Jira linking for Vulnerability Detections

• Enables linking Vulnerability Detections to Jira issues directly from the Bugcrowd platform.

Exploitation & C2 · 2026-09-07

Bugcrowd Autonomous Pentest adds Jira integration for linking Vulnerability Detections directly to Jira issues.

• Adds the ability to link Vulnerability Detections from Autonomous Pentest to Jira issues.

Exploitation & C2 · 2026-09-07

Bugcrowd Jira integration now supports Vulnerability Detections — push or link detections from the Security Inbox alongside submissions.

• Adds Push and Link actions in a Vulnerability Detection's Integrations panel to create a new Jira issue or connect to an existing one, keeping remediation tracked in Jira in sync with risk data in Crowdcontrol.
• Enables bidirectional comment sync and on-demand update pushes for Jira-linked Vulnerability Detections, with the ability to edit or remove the link at any time.

Container & Image Security · 2026-09-07

Calico adds BGP filter support for fine-grained control over BGP route advertisement and acceptance.

• Adds BGP filter support, enabling control over which routes are advertised or accepted via BGP peering.

Container & Image Security · 2026-09-07

API surface changed: +2 endpoints, 4 modified

• New endpoint GET /iam/v1/scimUsers
• New endpoint POST /vulnerabilities/v2/vulnCountReports:list
• GET /iam/v2/roles/{uid}: response schema changed

Secure Access (VPN / SASE / ZTNA) · 2026-09-07

Duo Desktop gains optional error/usage data collection, admin-controlled system-wide preference, and implicit password detection via Microsoft Entra ID join status.

• Adds an administrator-controlled system-wide preference to bypass the startup error/usage data collection prompt for all users.
• Adds optional error and usage data collection consent prompt at startup, which can be enabled or disabled at any point in the app's preferences.
• Adds support for implicit password detection based on Microsoft Entra ID join status, preventing lockouts from health checks.

SIEM · 2026-09-07

ClickHouse now publishes an API — 148 endpoints across 12 areas: Clickstack, Service, Clickpipes, …

• Clickstack (30 endpoints) — create, read, update, delete
• Service (26 endpoints) — create, read, update, delete
• Clickpipes (18 endpoints) — create, read, update, delete

Internet Services · 2026-09-07

API surface changed: 15 modified

• DELETE /accounts/{account_id}/devices/networks/{network_id}: request body changed
• DELETE /accounts/{account_id}/devices/policy/{policy_id}: request body changed
• DELETE /accounts/{account_id}/devices/posture/integration/{integration_id}: request body changed

Secure Access (VPN / SASE / ZTNA) · 2026-09-07

VNS3 Controller adds OpenLDAP integration for managing user accounts via directory services.

• Adds OpenLDAP integration to manage VNS3 user accounts through a directory service.

Secure Access (VPN / SASE / ZTNA) · 2026-09-07

VNS3 snapshot-20260907 adds idempotent tunnel bounces, strict CIDR parsing, licensed EdgeGRE/VXLAN/Geneve and firewall objects, and optional plugin recovery on snapshot restore.

• Adds recover_plugins argument to the snapshot-restore API, defaulting to true, with a corresponding UI tick box (defaulting to false) to make plugin recovery from configuration snapshots optional.
• Adds EdgeGRE, VXLAN, and Geneve connection types to the VNS3 licensing system.
• Adds firewall object count to the licensing system, covering rules in main and sub-tables, sub-tables themselves, and firewall sets (fwsets).

SIEM · 2026-09-07

OpenAI GPT-6 Astra now available on Databricks Unity Gateway via Foundation Model APIs pay-per-token.

• Adds OpenAI GPT-6 Astra to Unity Gateway, accessible via Foundation Model APIs pay-per-token, supporting enterprise reasoning, structured document processing, coding, agentic search, multimodal inputs, and long-context workloads.

SIEM · 2026-09-07

Databricks dashboards gain embedded filter APIs, cross-dataset filtering, Slack/Teams CSV attachments, and color-by-name mappings.

• Adds embedded dashboard filter APIs to set and retrieve filter values programmatically in embedded dashboards.
• Adds support for ranked table calculations when importing reports via the /importBI Genie Code command from Power BI and Tableau.
• Adds Data attachments to dashboard subscriptions delivered to Slack and Microsoft Teams, supporting CSV, TSV, or Excel format.

SIEM · 2026-09-07

Databricks adds environment version 6 as a selectable base environment for serverless and standard classic compute.

• Adds environment version 6 as a selectable base environment for serverless and standard classic compute.

SIEM · 2026-09-07

Genie Agents now surfaces SQL function descriptions when a function is attached as a tool.

• Displays the function description when a SQL function is attached as a Genie Agents tool, giving users immediate context on what each function does.
• Upgrades the large language models used in Genie Agents chat mode.

SIEM · 2026-09-07

Genie mobile app gains push notifications for scheduled tasks on iOS; embedded dashboards hide unsupported Ask Genie button.

• Enables push notifications for scheduled tasks to iOS devices in the Genie mobile app (Public Preview).
• Hides the Ask Genie button in embedded dashboards when the feature is not supported.

SIEM · 2026-09-07

Databricks adds OpenSharing support for metric views, enabling cross-metastore and cross-account sharing (Beta).

• Enables sharing metric views with Databricks users in other metastores or accounts using OpenSharing (Beta).

SIEM · 2026-09-07

Genie One (Beta) gains public web search to answer questions requiring current information, with cited source links.

• Genie One can now search the public web to answer questions requiring current information (recent releases, third-party documentation, news), automatically deciding when to search and citing each source as an openable link.

SIEM · 2026-09-07

Databricks AI Search gains struct/map column indexing and filter-only queries without vector or keyword retrieval.

• Enables indexing and filtering of struct and map columns in AI Search indexes.
• Supports filter-only queries in AI Search that return matching rows without requiring vector or keyword retrieval.

SIEM · 2026-09-07

Databricks Git Folder Serverless (Beta) shares serverless compute and a pyproject.toml-managed environment across notebooks in a Git folder.

• Supports a pyproject.toml-managed environment shared across notebooks and files within a Git folder via Git Folder Serverless (Beta).

SIEM · 2026-09-07

Databricks Model Serving adds Google Gemini 3.8 Flash as a Databricks-hosted model via Foundation Model APIs.

• Adds Google Gemini 3.8 Flash as a Databricks-hosted model accessible through Foundation Model APIs in Model Serving.

SIEM · 2026-09-07

Databricks Unity Gateway adds Anthropic Claude Fable 5.1 as a hosted model accessible via Foundation Model APIs.

• Adds Anthropic Claude Fable 5.1 as a Databricks-hosted model in Unity Gateway, accessible via Foundation Model APIs.

SIEM · 2026-09-07

Apache Arrow Flight support for Zerobus Ingest in Lakeflow Connect is now generally available.

• Adds Apache Arrow Flight support for Zerobus Ingest in Lakeflow Connect, now generally available.

SIEM · 2026-09-07

Genie Code scheduled tasks are now GA, enabling recurring AI-driven analysis to run unattended as background jobs.

• Enables scheduling Genie Code to run a prompt on a recurring schedule, producing a continuable Genie chat with results for each run — accessible via chat prompt or the Schedules menu.

SIEM · 2026-09-07

Databricks Genie Code gains scheduled task support for compliance security profile workspaces in October 2026.

• Enables Genie Code scheduled tasks for workspaces with the compliance security profile, allowing prompts to run on a recurring schedule as unattended background tasks that produce a continuable Genie chat with results.

SIEM · 2026-09-07

Genie One and Genie Agents now support models served through OpenAI on Databricks when partner-powered AI is enabled.

• Enables Genie One and Genie Agents to use models served through OpenAI on Databricks when the partner-powered AI features setting is enabled.

SIEM · 2026-09-07

Genie One gains public web search (Beta) to answer questions using current external sources with citations.

• Enables Genie One to search the public web for current information — such as recent release notes, third-party documentation, or news — and cite external sources as links in its responses.

Identity & Access Management · 2026-09-07

Didit session view now highlights and decodes QR codes and barcodes found on scanned documents

• Adds QR code and barcode review to the session view: Document AI highlights the code's location on the image or PDF preview and displays the decoded payload; codes that could not be decoded are shown as detected-only with no payload.

Identity & Access Management · 2026-09-07

Didit adds per-country ID verification method controls with document, non-doc lookup, and digital wallet configuration

• Adds document.enabled and documents_allowed config keys on the ID Verification node to control whether document capture is accepted and which document types are permitted per country.
• Adds id_lookup.enabled, id_lookup.max_attempts, and id_lookup.skip_liveness_and_face_match config keys to control non-document lookup availability, attempt limits, and whether Liveness and Face Match steps are bypassed after a portrait-backed match.
• Adds id_lookup.on_partial_match, id_lookup.on_no_match, and id_lookup.on_provider_error fallback switches to define per-country behaviour when a non-document lookup does not succeed.

Identity & Access Management · 2026-09-07

Didit adds per-country ID method configuration, document subtypes, non-doc lookup controls, and digital identity wallet support to ID Verification workflows.

• Adds Countries and allowed ID methods configuration in ID Verification to set document capture, non-doc lookup, and digital identity wallets per country.
• Adds Additional settings panel with document subtypes, lookup attempt limits (one to five), and fallback rules.
• Supports routing users in workflows by document subtype, date of issue, age, months since issue, risk score, webhook JSON response paths, and custom rules — in addition to existing country, document type, and verification status routing.

Identity & Access Management · 2026-09-07

Didit adds three new risk-scoring endpoints for email, IP, and phone signals without sending OTPs

• Adds POST /v3/email/risk/ to score an email address for deliverability, disposable-address, breach exposure, and cross-session match — returning Approved, In Review, or Declined — without sending an OTP; response exposes risk signals under both email.email_intelligence and email.enrichment aliases.
• Adds POST /v3/ip/risk/ to score an IP address for geolocation, VPN/Tor, data-center flags, threat data, and country_mismatch against a claimed_country — returning Approved or In Review — without sending an OTP.
• Adds POST /v3/phone/risk/ to score a phone number for carrier, line-type, porting, disposable-number, and cross-session match signals — returning Approved, In Review, or Declined — without sending an OTP.

Identity & Access Management · 2026-09-07

Didit ID Verification adds non-document national-ID lookup and per-country method controls, with new assurance-tier fields on sessions and webhooks.

• Adds a Registry comparison result block showing each compared field: what the user provided, what the source held, and whether it matched — plus an error row when a source did not respond.
• Adds a Credential details result block for wallet-based verifications, including the wallet, its issuing authority, the level of assurance it asserted, and whether the signature checked out.
• Adds configurable failure handling per non-document method — for partial match, no match, no source response, or cancelled/timed-out wallet sign-in — each routing the user to document capture or declining the session.

Identity & Access Management · 2026-09-07

Didit adds digital ID wallet support, non-doc lookup, and event-based transaction monitoring with velocity and sequence rules.

• Adds SDK event submission for device-side capture of non-monetary events using a scoped monitoring credential.
• Supports non-document identity lookup by checking a national ID number against a government or other authoritative source, available per country.
• Supports digital ID wallets for identity verification: MitID, BankID, itsme, UAE PASS, gov.br, and EUDI Wallet.

Identity & Access Management · 2026-09-07

Didit ID Verification gains non-document national-ID lookup and a digital-wallet method path, selectable per country.

• Adds status.updated webhook fields carrying the verification method (Documentary, Data match, or Cryptographic) and the corresponding assurance tier for every ID Verification session.
• Adds non-document lookup as a second ID Verification method: the user supplies their national ID number and personal details, which are checked against a government register or credit-bureau/financial-services/utility/residential-records source — no photograph or upload required.
• Adds digital ID wallet support to the ID Verification method roadmap (MitID, BankID, itsme, Vipps, iDIN, UAE PASS, gov.br, and EUDI Wallet), configurable as Coming soon in the console but not yet live for end users.

Identity & Access Management · 2026-09-07

API surface changed: +2 endpoints, 4 modified

• New endpoint POST /v3/kyb/shareholders/
• New endpoint POST /v3/kyb/ubo/
• GET /v3/session/{sessionId}/decision/: response schema changed

AI/LLM Security · 2026-09-07

Docker Sandboxes adds --kit-arg, --kit-args-file, and OCI/Git kit references in v0.42.0+

• Adds --kit-arg name=value flag to sbx run / sbx create to supply typed inputs to schema v2 kits that declare an args: block, with ${{ kit.args.<name> }} interpolation in setup entries and static files.
• Adds --kit-args-file <path> flag to load reusable name=value argument files (blank lines and # comments ignored); later files and explicit --kit-arg values override earlier ones.
• Supports kit-specific argument targeting by prefixing --kit-arg values with the kit's name field and a period (e.g. --kit-arg my-mixin.version=2.0.0), taking precedence over unprefixed shared values.

AI/LLM Security · 2026-09-07

Docker Sandboxes adds configurable sandbox volume size via environment variable and registry mirror support for Docker Hub pulls.

• Supports setting sandbox volume size at creation time via an environment variable (minimum 512 MiB; default 10 GB sparse file); does not resize existing volumes.
• Supports routing Docker Hub image pulls through an organization's registry mirror infrastructure.

AI/LLM Security · 2026-09-07

Docker Sandboxes MCP Gateway adds SSRF protection, --skip-ssrf-check, --skip-auth, --scope, --no-scope, and --json flags to MCP server registration and auth flows.

• Adds --skip-ssrf-check flag to sbx mcp add to suppress the SSRF warning and check when registering a trusted internal MCP server whose hostname resolves to a private, loopback, link-local, or cloud-metadata address.
• Adds --scope flag to sbx mcp auth to override recorded default scopes for a single authorization, selecting from the scope resolution order: --scope argument, sbx mcp add --scope defaults, protected-resource required scopes, then no scope parameter.
• Adds --no-scope flag to sbx mcp auth to suppress both recorded default scopes and the resource's required scopes for a single authorization (cannot be combined with --scope).

AI/LLM Security · 2026-09-07

Docker Sandboxes gains registry mirror support via platform.images.registryMirror, routing Hub pulls through your org's registry infrastructure.

• Adds platform.images.registryMirror setting (via sbx settings set) to route Docker Hub pulls for sandbox templates and OCI kits through an organization's registry mirror, with optional port and path-prefix support.
• Propagates the mirror to Docker Engine inside the sandbox when the setting is a non-loopback host without a path prefix, enabling in-sandbox docker pull to use the same mirror.
• Adds sbx settings unset platform.images.registryMirror to disable registry mirroring; an empty value also disables it.

AI/LLM Security · 2026-09-07

Docker Sandboxes gains sbxenv.yaml environment files with parameterized args, lifecycle hooks, sbx env plan/create/run/destroy, and user-level defaults.

• Adds sbx env plan [PATH...] subcommand to preview what applying an environment would change without modifying or approving anything.
• Adds sbx env create --auto-approve to approve and apply an environment plan and create the sandbox in a single unattended invocation.
• Adds sbx env run --env-arg NAME=VALUE and --env-args-file <file> flags to supply declared argument values to any sbx env command at runtime.

AI/LLM Security · 2026-09-07

Docker Sandboxes adds registry mirror support in sbxenv.yaml to route Hub pulls through your org's mirror.

• Adds registry mirror configuration in sbxenv.yaml to route Docker Hub template, kit, and in-sandbox image pulls through an organization's registry mirror.

AI/LLM Security · 2026-09-07

Docker Sandboxes gains sbx skills subcommands to install, list, update, and remove agent skills from a persistent shared store.

• Adds sbx skills add to install all skills from a Git repository using owner/repository shorthand or HTTPS/SSH URLs.
• Adds --skill flag on sbx skills add to install specific skills by name or comma-separated list (e.g. --skill frontend-design --skill pdf).
• Adds sbx skills ls to list all skills in the persistent shared store.

AI/LLM Security · 2026-09-07

Docker Sandboxes adds native Devin agent support via sbx run devin, with managed credentials and project-level config.

• Adds sbx run devin subcommand to launch a Devin agent inside a Docker sandbox, with an optional workspace path argument that defaults to the current directory.
• Uses docker/sandbox-templates:devin-docker as the base image for Devin sandboxes, with support for customization to pre-install tools.
• Reads AGENTS.md from the workspace directory to supply agent-specific instructions to Devin inside the sandbox.

AI/LLM Security · 2026-09-07

Docker Sandboxes adds mountless sandbox support, named sandbox reattachment, sbx cp file transfer, and read-only workspace mounts.

• Adds mountless sandbox creation via sbx create --name <name> <agent> (no host directory bind mount) and later attachment with sbx run --name <name>, available from version 0.42.0.
• Adds sbx cp to copy files between host and sandbox by absolute sandbox path, e.g. sbx cp ./config.json my-sandbox:/home/agent/workspace/ and sbx cp my-sandbox:/home/agent/workspace/output.log ./.
• Supports appending :ro to a workspace path to mount an extra workspace read-only inside the sandbox.

AI/LLM Security · 2026-09-07

Docker Sandboxes adds a machine-wide MSI installer for administrator-managed Windows deployments.

• Adds DockerSandboxesMachine.msi for silent, machine-wide installation via msiexec.exe /i DockerSandboxesMachine.msi /quiet, installing to %ProgramFiles%\DockerSandboxes and adding its bin directory to the system PATH — no per-user install required.
• Adds per-user DockerSandboxes.msi installation via WinGet, placing files in %LOCALAPPDATA%\DockerSandboxes and updating the user PATH without requiring administrator privileges.

AI/LLM Security · 2026-09-07

Docker Sandboxes v0.42.0 adds cloud-hosted sandboxes via sbx --cloud, kit args, env-file args, and a new Devin agent.

• Adds sbx --cloud to run AI agents on Docker-managed cloud infrastructure with commands such as sbx --cloud run, sbx --cloud cp, sbx --cloud secret, and sbx --cloud policy for file transfer, credentials, and outbound network policy.
• Adds sbx move to copy a sandbox filesystem between local and cloud environments.
• Adds --json output to read-only commands including secret ls, version, mcp ls, skills ls, policy inspect, and the kit verification commands.

SAST / SCA / Code Security · 2026-09-07

Endor Labs adds Package Firewall for VS Code extensions and incremental container scanning to focus on build-introduced findings.

• Extends Package Firewall to block or warn on malicious VS Code extensions from the Microsoft Marketplace before they install, deployable via MDM tools such as Microsoft Intune, Jamf, or Kandji.
• Adds incremental container scanning to compare a new build against a baseline scan and surface only findings the build introduced, fixed, or shares with the baseline — with the option to suppress shared findings so only new ones remain.

SAST / SCA / Code Security · 2026-09-07

Endor Labs Package Firewall now blocks malicious VS Code extension installs from the Microsoft Marketplace via MDM deployment.

• Extends Package Firewall to block malicious VS Code extension installations from the Microsoft Marketplace, deployed separately through MDM.

SAST / SCA / Code Security · 2026-09-07

Endor Labs AI SAST now ingests IaC, repo context files, user feedback, and uploaded threat models to continuously sharpen finding prioritization.

• Automatically parses AGENTS.md, CLAUDE.md, skills files, and AI rules files in the repository to extract security-relevant context (authentication model, internal vs. external users) for every scan.
• Automatically ingests Dockerfiles, Terraform, CloudFormation, Kubernetes YAML, and Helm charts to build a deployment model used during PR scans and local developer scans, with no configuration required.
• Enables users to upload architecture and threat model context as plain natural language, which AI SAST verifies against the codebase and auto-classifies into project context, true-positive patterns, and false-positive patterns, scopable to a single project, a set of projects, or the entire tenant.

Secure Access (VPN / SASE / ZTNA) · 2026-09-07

API surface changed: 101 modified

• DELETE /actors/{actor_id}/client_tokens: response schema changed
• DELETE /actors/{actor_id}/client_tokens/{id}: response schema changed
• DELETE /actors/{actor_id}/external_identities/{id}: response schema changed

Endpoint Security (EDR/XDR) · 2026-09-07

New API endpoint to manually clear a policy's pass/fail results for custom automations.

• Adds an API endpoint to clear a policy's pass/fail results, enabling custom automations to reset policy status outside of Fleet's automatic triggers (query edits, script swaps, software package or VPP app changes).

Secrets Detection & Management · 2026-09-07

GitGuardian Detection Engine 2.170 adds six new detectors (Firebase, Coze, Keycloak, Fish Audio, Azure Custom Vision) and a new Apify token analyzer.

• Adds new detector for Firebase ID tokens.
• Adds new detector for Coze access tokens.
• Adds new detector for Keycloak access tokens.

SAST / SCA / Code Security · 2026-09-07

GitHub Copilot gains HydraFusion research preview: a multi-model orchestration engine selectable like any other model

• Adds HydraFusion as a selectable model in GitHub Copilot that dynamically orchestrates multiple models across providers using Single, Cascade, or Critique execution patterns to balance quality, cost, and latency per task.
• Supports /feedback in Copilot CLI to submit HydraFusion preview feedback directly from the command line.

SIEM · 2026-09-07

Hunters Pathfinder AI adds unified anomalous login detection, Windows password-change enrichment and scoring, and four new AXON threat hunting reports.

• Adds the Context Unified Anomalous Login detector, which evaluates successful anomalous logins across identity providers, SaaS applications, cloud platforms, VPNs, and other integrated login sources using per-user behavioral baselines covering geolocation, IP address, and user agent category.
• Introduces the Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity detector, identifying authentication activity from offensive-related distributions and tools including Kali Linux, Parrot Linux, BackBox Linux, BlackArch Linux, Scout Suite, TrailBlazer, and TruffleHog.
• Adds a Windows Recent Password Change enrichment that queries Windows Security Event Logs for Event ID 4723 (self-initiated password change) and Event ID 4724 (privileged password reset), surfacing last change time, initiating user, and source computer as lead context.

Data Security & DLP · 2026-09-07

Immuta adds intent-based access control for Databricks Unity Catalog, plus metric view subscription policy support.

• Introduces intents (public preview) for Databricks Unity Catalog: policy authors configure groups authorized to use an intent and attributes that replace a user's birthright attributes while the intent is active, enabling use-case-driven, auditable access to sensitive data such as PII.
• Adds subscription policy support for Databricks Unity Catalog metric views, enabling access provisioning and governance for that object type through existing Immuta policies.

Attack Surface & Exposure Management · 2026-09-07

Intruder authenticated web app scans now support additional domains, including subdomains and cross-domain external services.

• Adds an Additional domains field in authenticated web app target configuration, allowing subdomains (e.g. api.example.com, auth.example.com) and external services (identity providers, CDNs, third-party APIs) to be included in scan scope.
• Enables cross-domain crawling and testing during authenticated scans so API backends and external auth providers are no longer blocked at the domain boundary.

Malware Analysis · 2026-09-07

Joe Sandbox v45 adds 625 new signatures, 55 config extractors, 133 Suricata rules, and improves DOM/QR/Live Interaction analysis.

• Adds 50 new behavior signatures covering emerging malware families including RatonRAT, REMUS Stealer, EtherHiding, GehennaLocker, PureLogs Stealer, PhantomGate, QuimaRAT, and others.
• Adds 575 new custom YARA rules to detect ransomware, stealers, RATs, and phishing frameworks.
• Adds 55 new malware configuration extractors — including ZigClipper, BlakcSee Stealer, Sirius RAT, OverLordRat, CastleRat, WikiKit, PhantomGate, Remus Stealer, SantaStealer, and GenericBot — to automatically extract IOCs and family configuration data without manual reverse engineering.

SAST / SCA / Code Security · 2026-09-07

Lakera AI Guardrails gains filesystem-based policy loading via FORCE_POLICY_MANAGER=fs, Helm chart support, and S3 policy sourcing with new env vars

• Adds FORCE_POLICY_MANAGER=fs environment variable to force AI Guardrails to read policies from a mounted local directory instead of S3, with FORCE_POLICY_MANAGER taking precedence over container-default detection when both are set.
• Adds LOCAL_POLICY_DIR environment variable to point the container at a mounted policy directory for filesystem-based self-hosted deployments.
• Adds S3-based policy sourcing via POLICY_BUCKET_NAME, POLICY_ENDPOINT_URL, and POLICY_PREFIX environment variables alongside standard AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY credentials.

SAST / SCA / Code Security · 2026-09-07

Lakera adds Dangerous Deviation detector and runtime Tool Allow/Deny List policies

• Adds the Dangerous Deviation detector to Lakera's SaaS policy options.
• Adds a runtime Tool Allow/Deny List to Lakera's SaaS policy options.

SAST / SCA / Code Security · 2026-09-07

Lakera adds Dangerous Deviation detector (beta) to catch unauthorized agent tool calls — data leakage, privilege escalation, and system destruction.

• Adds Dangerous Deviation detector (beta) to the Guard API, flagging agent tool calls that are both dangerous and lack a warrant in trusted user or system role messages.
• Detects three danger types: data leakage, access and privilege escalation (sudo/admin grants, widened ACLs, public resource sharing), and system destruction (deleting/wiping persistent resources).
• Returns an explanation object per detection — with reason_code (machine-readable, stable, routing-safe), reason (user-facing text), agent_guidance (instruction to feed back into the agent context), and debug_info.dev_tips (developer remediation guidance) — when tool definitions are provided in the top-level tools field.

SAST / SCA / Code Security · 2026-09-07

Lakera: Adds the Dangerous Deviation detector to identify agent actions that fall outside the agent's trusted mandate.

• Adds the Tool Allow/Deny List to control which tools an agent may call at runtime.

SAST / SCA / Code Security · 2026-09-07

Lakera: Adds Dangerous Deviation detection for agent behavior defense, identifying when an agent deviates unexpectedly from expected behavior.

• Adds Tool Allow/Deny List controls to restrict or permit specific tools available to agents, limiting propagation of compromised behavior.
• Extends Prompt Defense coverage to tool responses and tool descriptions in addition to inputs.

SAST / SCA / Code Security · 2026-09-07

Lakera adds AI Agent Security early access, Policy Impact Simulator, audio debugging flag, and self-hosted request logging.

• Adds audio_payload flag in Guard audio requests to expose debugging information about the audio sample.
• Adds POLICY_RELOAD_INTERVAL_SECONDS environment variable to control the configurable policy reload period for self-hosted containers.
• Adds MAX_WARMUP_TOKENS environment variable (default 50000) to cap warmup tokens in self-hosted containers, using the minimum of MAX_WARMUP_TOKENS and MAX_INPUT_TOKENS.

SAST / SCA / Code Security · 2026-09-07

Mend SCA 26.8.2 adds a unified vulnerability remediation experience with a new Top Fix column and updated Remediation tab.

• Adds a Top Fix column in the Findings table to surface the recommended remediation action per vulnerability.

Digital Forensics & Incident Response · 2026-09-07

MVT gains concurrent backup decryption with --jobs, a new SysdiagnoseInfo module, and fixes env-var leakage to config.yaml.

• Adds --jobs option to mvt-ios decrypt-backup to control the number of concurrent decryption workers (integer, 1 to MAX_DECRYPT_WORKERS, defaults to DEFAULT_DECRYPT_WORKERS).
• Adds a SysdiagnoseInfo module to check-sysdiagnose, extending IOC scanning to sysdiagnose archives.
• Replaces the unmaintained iOSbackup dependency with iphone_backup_decrypt for iOS backup decryption, fixing decrypted-file truncation caused by inaccurate sizes in backup metadata.

Network Analysis & Monitoring · 2026-09-07

nfdump 1.7.9 adds %gra geo-enriched exporter tag, IPFIX nsec elements 156/157, and srcasn/dstasn/ext aggregation

• Adds %gra geo-enriched router/exporter address tag for use in fmt output, plus geo info in output_raw
• Adds IPFIX nanosecond-precision time elements 156/157 (compatible with VPP 17.07)
• Adds missing srcasn, dstasn, and ext fields to flow aggregation

Reconnaissance & OSINT · 2026-09-07

Nmap gains NSE execution time and memory limits, DHX2 AFP auth, and a new afp.uam script argument

• Adds afp.uam script argument to afp.lua to select the user authentication method, e.g. 'DHCAST128' or 'DHX2'
• Adds DHX2 (Diffie-Hellman Exchange 2) authentication method support to afp.lua
• Introduces execution time limits for NSE scripts: threads running more than 5 seconds without yielding are killed

Threat Intelligence · 2026-09-07

OpenCTI now provides FIPS 140-3 compliant container images for regulated deployments.

• Adds FIPS 140-3 compliant images for deploying OpenCTI in FIPS 140-3 compliant mode.

Threat Intelligence · 2026-09-07

OpenCTI 7.260907.0 adds entity creation inside investigation graphs, FIPS 140-3 Docker images, ingestion logs for CSV feeds, and connector activity logging.

• Adds a Create Entity button to the investigation graph and the add-entity drawer, enabling analysts to create new entities without leaving an investigation.
• Adopts the FIPS 140-3 validated python-nodejs-fips base image for the Docker deployment.
• Adds ingestion logs for CSV feeds, surfacing feed-level activity for operators monitoring data ingestion.

SIEM · 2026-09-07

Panther v1.129 adds an Infrastructure Cost Dashboard to track usage and billing trends.

• Adds an Infrastructure Cost Dashboard that tracks Panther usage and billing trends.

SIEM · 2026-09-07

Panther v1.126 adds Cursor audit logs, Palo Alto NGFW log source, Log Forwarder for on-prem, and a redesigned Settings page.

• Adds a new Panther Log Forwarder source to send on-prem logs to Panther.
• Adds ingestion of Cursor audit logs over an HTTP webhook for visibility into Cursor platform activity.
• Adds a new log source for Palo Alto Next-Generation Firewall logs to bring on-prem firewall activity into Panther.

SIEM · 2026-09-07

Panther v1.127 adds Claude Code/Cowork log sources, AI auto-triage deferral, Log Forwarder for Palo Alto NGFW, and new admin RBAC for AI scheduled prompts.

• Adds ManageAIResponses permission so admins can manage other users' private scheduled prompts.
• Adds ViewAIPrivateResponses permission granting view-only admins read access to private scheduled prompts without modify rights.
• Supports managing Panther AI scheduled prompts as code via GitHub PR.

SIEM · 2026-09-07

Panther v1.128 adds STIX/TAXII log enrichment, Slack Bot AI Triage, REST API/Terraform management for Log Forwarder sources, and a new sidebar nav.

• Adds WithinTimeFrameMinutes option to group correlation rules for CTE-based matching.
• Supports managing Panther Log Forwarder sources as code via the REST API and Terraform provider.
• Adds STIX/TAXII enrichment for ingested logs.

SIEM · 2026-09-07

Panther v1.129 adds an Infrastructure Cost Dashboard and expands normalized event filters with enriched-field support.

• Normalized event filters can now filter events using Panther-enriched fields.
• Scheduled lookups now support Databricks-backed queries.

Identity & Access Management · 2026-09-07

API surface changed: +9 endpoints, −4 endpoints

• New endpoint DELETE /favorites/{favoriteId}.json
• New endpoint GET /actionlog/folder/{folderId}.json
• New endpoint GET /actionlog/logs.json

AI/LLM Security · 2026-09-07

Promptfoo adds Docker Model Runner, MCP server support, Google Imagen, Grok-4, and JKS/PFX certificate support for HTTP providers.

• Adds HTTP provider support for JKS and PFX client certificates, enabling mTLS connections to secured endpoints.
• Adds Docker Model Runner provider to run models in isolated Docker containers for better security and reproducibility.
• Adds MCP (Model Context Protocol) provider to connect to MCP servers, including a red-team agent testing example with tool call results.

Reverse Engineering · 2026-09-07

Radare2 6.2.2 adds a JNI analysis plugin, NVIDIA PTX SASS support, Haiku debugger, CIL/ESIL for .NET, and s390 pseudo-code.

• Adds the jni analysis plugin to resolve typed JNI table calls, interface tables, indirection, and materialize JNI native methods during analysis.
• Adds initial encode/decode/pseudo support for NVIDIA PTX SASS architecture.
• Adds native debugger support for Haiku (x86-32/64), including data watchpoints and asynchronous thread exit handling.

Data Security & DLP · 2026-09-07

Securiti launches Consent Agent: agentic Build-Assess-Remediate automation for cookie consent across 80+ jurisdictions with continuous monitoring and a compliance dashboard.

• Introduces Consent Agent, a three-stage agentic workflow (Build, Assess, Remediate) that automatically configures jurisdiction-correct consent banners, runs 20+ compliance tests, and applies or escalates fixes across all domains.
• Adds automated compliance testing across 20+ checks covering banner correctness, pre-consent tracking, TC string validity, GPC signal handling, dark pattern detection, accessibility, and privacy policy completeness, each mapped to a specific legal requirement with pass/fail/NA results and jurisdiction-aware risk and confidence scoring.
• Adds continuous domain rescanning on a schedule so configuration drift — new pixels, misfiring tags, pre-consent script loads — is caught and flagged against a specific test and point in time rather than discovered at the next audit.

AI/LLM Security · 2026-09-07

SkillSpector v2.11.1 raises the default workflow deadline to 600s and adds SKILLSPECTOR_MAX_WORKFLOW_SECONDS to make it configurable.

• Adds SKILLSPECTOR_MAX_WORKFLOW_SECONDS environment variable to set a custom positive finite aggregate workflow deadline; invalid, zero, negative, infinite, and NaN values fall back to the 600-second default.
• Raises the default aggregate end-to-end workflow and transitive traversal deadline from 60 seconds to 600 seconds, preventing larger valid scans from timing out.
• Applies the configured deadline consistently across direct CLI, recursive, transitive, and multi-skill analysis paths.

SAST / SCA / Code Security · 2026-09-07

SonarQube Cloud adds automatic analysis for MuleSoft DataWeave, Gosu, Groovy, and PowerShell — no plugins or manual setup required.

• Adds MuleSoft DataWeave language support to SonarQube Cloud, automatically analyzing integration flows for bugs, security vulnerabilities, and maintainability issues across GitHub, GitLab, Bitbucket, and Azure DevOps.
• Adds Gosu language support to SonarQube Cloud, bringing deterministic bug, vulnerability, and maintainability analysis to Guidewire-based insurance and enterprise systems.
• Adds Groovy language support to SonarQube Cloud, covering Jenkins pipeline definitions, Gradle build scripts, and standalone Groovy applications with a dedicated rule set.

SIEM · 2026-09-07

Splunk ES 8.2 adds AI Assistant for investigations, TAXII 2.x feed support, expanded REST APIs, detection versioning, and a KV Store retention policy.

• Adds expanded API capabilities to create findings, add findings to investigations, and create/read/update/delete notes.
• Adds support for TAXII version 2.0 and TAXII version 2.1 threat intelligence feeds via Add a TAXII 2 feed.
• New Splunk Enterprise Security APIs are now searchable using the SPL REST command.

SAST / SCA / Code Security · 2026-09-07

StackHawk adds native OS certificate trust for transparent TLS proxies and a non-interactive browser auth flow for hawk init.

• Adds native OS certificate trust store support so Zscaler, Netskope, and corporate CA proxies work with zero configuration; disable with --no-native-truststore or USE_NATIVE_TRUSTSTORE=false.
• Adds --browser flag to hawk init for non-interactive device-flow authentication, skipping TTY prompts and the manual key-entry menu.

Firewalls & Network Defense · 2026-09-07

API surface changed: 1 modified

• GET /v0/binexplode/scan/{id}: response schema changed

SOAR · 2026-09-07

API surface changed: +1 endpoint, 46 modified

• New endpoint DELETE /api/v2/case_inputs/{field_id}
• GET /api/v1/audit_logs: param team_id (query) added; response schema changed

Endpoint Security (EDR/XDR) · 2026-09-07

Trend Vision One can now automatically migrate Worry-Free agents to TrendAI Vision One Endpoint Security with policy settings preserved.

• Adds automatic upgrade path for managed Worry-Free agents to TrendAI Vision One Endpoint Security, with agents assigned to a Standard Endpoint Protection Manager and enrolled in Endpoint Security Policies — accessible via Endpoint Security → Endpoint Inventory.
• Supports optional migration of default group and policy settings from Worry-Free to preserve existing configurations during upgrade.

Endpoint Security (EDR/XDR) · 2026-09-07

Security Playbooks can now automate end-to-end response to container image vulnerabilities, from notification to quarantine and remediation.

• Adds container image vulnerability response actions to Security Playbooks, enabling automated notification, third-party ticket submission, container quarantine, and remediation without manual intervention.
• Security Playbooks are accessible via Workflow and Automation → Security Playbooks in the Trend Vision One console.

Endpoint Security (EDR/XDR) · 2026-09-07

Zero Trust Secure Access adds All untrusted cloud apps predefined category for use in Internet Access and risk rules.

• Adds the All untrusted cloud apps predefined custom cloud app category to Zero Trust Secure Access, auto-updating to include every cloud app with an untrusted status, usable in Internet Access rules and risk rules alongside All trusted cloud apps and All poor reputation cloud apps.

Data Security & DLP · 2026-09-07

Ubiq adds native Postgres/Greenplum integration for on-database column-level encryption and Partial Encryption across six SDKs.

• Adds native integration for Postgres and Greenplum enabling on-database column-level encrypt/decrypt directly from SQL.
• Adds EncryptforSearch support to the Go Client Library.
• Adds Partial Encryption support for C/C++, Go, Python, Java, C#.NET, and NodeJS Client Libraries (version 2.0.0+) to mask or partially encrypt Structured Data.

AI/LLM Security · 2026-09-06

safe2 CLI gains multi-harness discovery, drift tracking, environment policy enforcement, and Decision Cards via safe2 doctor and expanded subcommands.

• Adds safe2 doctor command for multi-harness discovery, identifying command and configuration indicators for Codex, Claude Code, Antigravity, Hermes, OpenClaw, and Grok alongside host, shell, CI, and WSL metadata.
• Adds --assess, --output, --card-format, and --card-output options to safe2 doctor to evaluate environment posture and emit Markdown or HTML Decision Cards.
• Adds --inspect-config opt-in to safe2 doctor to collect an allowlisted structural summary of supported local JSON/TOML configurations, including selected approval and sandbox settings, without emitting raw configuration values.

Integrated & IT Risk Management · 2026-09-06

CISO Assistant v4.0.1 adds URL custom fields, reopenable requirement assignments, findings/TPRM evolutions, and clickable compliance badges.

• Adds URL type for custom fields, enabling hyperlink values to be stored and displayed on any entity.
• Adds the ability to reopen a requirement assessment's assignment after it has been submitted.
• Introduces findings and TPRM (Third-Party Risk Management) evolutions as a major feature epic.

Web Application Security · 2026-09-06

DOMPurify 3.4.15 hardens clobbering defenses for XML content and tightens several sanitization edge cases.

• Adds stronger DOM-clobbering hardening specifically for XML content parsing paths.
• Adds several smaller hardening improvements and edge-case fixes to the sanitization engine.

Reconnaissance & OSINT · 2026-09-06

API surface changed: +173 endpoints, 2 modified

• Adds full CRUD APIs for leads, custom attributes, and lead lists, including bulk existence, deletion, move, enrichment, tagging, folders, favorites, and merge operations.
• Adds full CRUD APIs for companies, company lists, and company tags, including bulk copy, deletion, move, tagging, list membership, folders, and favorites.
• Adds sequence APIs for recipients, follow-ups, lifecycle control, and statistics, including start, pause, archive, and recipient removal operations.

Secrets Detection & Management · 2026-09-06

API surface changed: +17 endpoints, 31 modified

• Adds Daytona app-connection APIs for availability and name lookup, lifecycle management, and credential rotation.
• Adds Daytona secret-sync APIs for name lookup, lifecycle management, and importing, removing, or synchronizing secrets.
• Updates request or response schemas across OIDC authentication identity endpoints, including create, retrieve, update, and delete operations.

SAST / SCA / Code Security · 2026-09-06

skill-scanner adds CEL correlation gating and ATR rule packs with per-invocation mode override via new CLI flags

• Adds --cel-mode off|shadow|enforce flag to override the active CEL gate policy for a single invocation without changing the global configuration.
• Adds --rule-packs atr flag to opt in to the ATR rule pack as an optional input outside the core + CEL release gate.
• Adds cel.mode configuration key supporting off, shadow, and enforce values to control CEL decision behavior globally.

SAST / SCA / Code Security · 2026-09-06

skill-scanner gains --trusted-rule-pack and --cel-mode flags for administrator-trusted schema-v2 pack loading and CEL policy control.

• Adds --trusted-rule-pack PATH flag to load an administrator-trusted schema-v2 signature/YARA/CEL pack; repeatable for multiple packs.
• Adds --cel-mode MODE flag to override policy CEL mode with off, shadow, or enforce.
• Extends validate-rules to validate bundled rules and optional trusted schema-v2 packs, including CEL parse/type checks.

SAST / SCA / Code Security · 2026-09-06

skill-scanner adds CEL-based correlation mode and a validate-rules subcommand with trusted rule pack support

• Adds skill-scanner validate-rules --trusted-rule-pack <path> subcommand to validate rules against an org-supplied rule pack

SAST / SCA / Code Security · 2026-09-06

Skill Scanner 2.1.0 adds a CEL decision layer with off/shadow/enforce modes and expands Python static detection for shell-enabled subprocess calls.

• Adds CEL policy modes off, shadow, and enforce — a bounded CEL decision layer (backed by cel-go v0.32.0) that correlates typed analyzer facts after deterministic detection and before optional LLM/Meta analysis.
• Adds a versioned protobuf fact contract (skill_scanner.semantic.v1.ScanFacts) with strict schema-v2 pack validation, immutable compiled rule generations, expression hashes, and fail-open telemetry.
• Expands static detection to identify shell-enabled subprocess calls through aliases and class scopes, constructed sensitive-file reads, import aliases, and commands hidden by supported repeating-XOR encoding.

Identity & Access Management · 2026-09-05

1Password SaaS Manager adds per-API-key OpenAI cost attribution, Google Gemini provisioning, and duplicate access policies with distinct request durations.

• Adds per-API-key cost attribution for OpenAI Platform when the provider supplies API-key cost data.
• Adds support for provisioning users in Google Gemini.
• Enables administrators to create duplicate access policies with different request durations.

AI/LLM Security · 2026-09-05

AI SAFE² v3.1 adds a unified safe2 CLI, AISM Decision Cards, NEXUS and SkillSpector evidence integrations, and a 27-requirement UAS regulatory profile.

• Adds the safe2 CLI with subcommands including safe2 scan project and safe2 example verify for scanning AI implementations, evaluating evidence, and validating packaged examples in CI/CD and automated agent workflows.
• Adds AISM Decision Cards that transform technical assessment findings into structured decision-quality summaries covering scores, evidence quality, conflicts, alternatives, pros/cons, and recommended paths forward.
• Adds NEXUS integration so NEXUS findings can be incorporated as structured evidence within AI SAFE² assessments, connecting implementation observations to governance and assurance requirements.

SAST / SCA / Code Security · 2026-09-05

Aikido launches Deep Review, an agentic PR reviewer that traces logic across repos and posts findings with suggested fixes directly on pull requests.

• Introduces Deep Review, an agentic pull request reviewer that reasons across your full codebase — including middleware, global config, and linked repositories — to catch deeply nested security issues, broken access control, business logic flaws, and cross-tenant data leaks.
• Saves accepted-risk and false-positive decisions to memory so future reviews learn from prior feedback on the same repository.
• Runs after existing PR checks (SAST and dependency checks) to build on their findings instead of repeating them, and is enabled and configured per repository with linkable related repos and a configurable review level.

SAST / SCA / Code Security · 2026-09-05

Arnica adds a cross-SCM identity inventory covering every person and service account with code access.

• Adds an Identities inventory view that surfaces every person and service account with access to your code across all connected SCM platforms.

AI/LLM Security · 2026-09-05

Aurascape launches Coding Assistant Guardrails to govern live AI coding sessions — blocking secrets, destructive commands, and prompt injection in flight.

• Introduces Coding Assistant Guardrails, a new solution that inspects and enforces policy on live AI coding-assistant sessions — covering Claude Code, GitHub Copilot, and Cursor — before any artifact exists to scan.
• Decodes coding-assistant streaming protocols (Server-Sent Events, WebSockets, Protobuf, gRPC, and MCP) inline without buffering, preserving native streaming speed for developers while enabling content inspection.
• Detects and blocks or redacts secrets and credentials pasted into prompts in flight, before the model receives them, with the event captured as auditable evidence.

Web Application Security · 2026-09-05

Caido v0.58.3 adds inline autocomplete in the HTTP request editor and lets you add existing Replay requests to pipeline sessions.

• Adds inline autocomplete hints to the HTTP request editor.
• Enables adding existing Replay requests directly to a pipeline session.

Identity & Access Management · 2026-09-05

Clerk adds AI-native developer tooling: MCP server, Skills packages, Agent Tasks, CLI, and an AI prompt library

• Adds npx clerk@latest init CLI command to set up and manage Clerk authentication from the terminal, with auto-detection of agent vs. human mode and the ability to install Clerk Skills for AI agents.
• Adds clerk mcp install command to register Clerk's MCP server in all AI clients detected on the local machine in one step.
• Adds npx skills add clerk/skills to install Clerk Skills — packages that give AI coding agents (Claude Code, Cursor, Windsurf, GitHub Copilot, Codex, Gemini CLI, and others) specialized knowledge about Clerk authentication, Organizations, and user sync.

Identity & Access Management · 2026-09-05

Clerk CLI adds clerk init for accountless, agent-friendly auth setup — no browser or API keys needed.

• Adds clerk init CLI command that provisions a claimable Clerk app, writes dev keys to .env.local, and wires up the SDK, provider, middleware, and auth routes — no Clerk account required.
• Adds clerk enable orgs and clerk config patch CLI commands for configuring accountless apps before claiming.
• Supports agent/non-interactive mode via clerk init: detects agent environments and runs fully non-interactive so no step blocks waiting on user input or passes keys through a conversation.

Data Security & DLP · 2026-09-05

fhEVM v0.13.4 backports the Polygon CLI and expands the relayer to return all user-decrypt shares.

• Backports the Polygon CLI to the 0.13.x release line, enabling Polygon-targeted workflows on the stable branch.
• Relayer now returns all user-decrypt shares per request, rather than a subset.

Reverse Engineering · 2026-09-05

Finite State Platform adds a License Policy setting to flag and severity-label Components with no license on the Bill of Materials.

• Adds a License Policy setting for Components with no license, letting you assign a severity and label that appears on the Bill of Materials.

Reverse Engineering · 2026-09-05

Finite State now unpacks ESP32 and Airoha Bluetooth-audio firmware and exports CycloneDX 1.6 SBOMs with author metadata.

• Unpacks Espressif ESP32 firmware images, including full flash dumps, so those devices are analyzed as firmware rather than as an unidentified blob.
• Unpacks Airoha Bluetooth-audio firmware and identifies the vendor SDK and DSP components, producing a complete SBOM for those images.
• Exports binary scan SBOMs as CycloneDX 1.6 with author metadata included.

Secrets Detection & Management · 2026-09-05

GitGuardian ggscout 0.32.0 brings Secrets Detection Engine classification to vaulted secrets, with 550+ detectors and multi-match grouping

• Requires ggscout version 0.32.0 or later to enable Secrets Detection Engine classification on vault, CI, and Kubernetes secrets.
• Runs the Secrets Detection Engine — the same 550+ detectors used for code scanning, including multi-match detectors — against every value ggscout collects, classifying vaulted secrets as real credentials, noise, or Unknown.
• Adds Detector column and filter controls to the NHI inventory, letting you filter and sort by detector, detector type, secret family, secret category, and secret provider.

Secrets Detection & Management · 2026-09-05

GitGuardian runs its 550+ Secrets Detection Engine on vaulted secrets, with detector/family/category/provider filters in NHI Governance.

• Adds Detector column to the NHI Governance → Identities inventory, filterable by detector, detector type, secret family, secret category, and secret provider — the same filter set used for code-scanning incidents.
• Runs the Secrets Detection Engine (550+ detectors, including multi-match detectors) on every value ggscout collects from vaults, CI systems, and Kubernetes clusters, classifying each secret by its actual value rather than its name or path.
• Groups sibling fields that form a single credential (e.g. PostgreSQL username, password, host, and port) into one inventory entry instead of four separate items.

SAST / SCA / Code Security · 2026-09-05

Copilot adds Claude Fable 5.1 and Gemini 3.8 Flash, gains content exclusions in CLI, and ships Agent Merge in VS Code

• Adds Claude Fable 5.1 model availability for Copilot Pro+, Max, Business, and Enterprise users.
• Adds Gemini 3.8 Flash model rolling out to Copilot Pro, Pro+, Max, Business, and Enterprise users.
• Copilot app and CLI now honor content exclusions, keeping sensitive code out of context across agentic workflows.

SAST / SCA / Code Security · 2026-09-05

GPT-6 Astra, OpenAI's agentic long-horizon coding model, is now selectable in GitHub Copilot across all major IDEs and surfaces.

• Adds GPT-6 Astra as a selectable model in the Copilot model picker across VS Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, the Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.
• Copilot Enterprise and Business admins can enable or restrict GPT-6 Astra access via the model policy in Copilot settings, under the default model enablement control.

SAST / SCA / Code Security · 2026-09-05

GitHub adds a privacy-safe REST API endpoint to retrieve repository star history with timestamps, without exposing stargazer identities.

• Adds a new star history REST API endpoint that returns historical star counts with timestamps without exposing individual stargazer identities.

SIEM · 2026-09-05

Google SecOps Enterprise Plus and GUS customers can now self-serve their Bindplane Enterprise license key from the platform console.

• Enables self-service download of the Bindplane Enterprise (Google Edition) license key directly from the platform console under SIEM Settings > Collection Agents (Preview, US and EU regions; Enterprise Plus and GUS customers only).

AI-Powered Offensive Security · 2026-09-05

Hacktron adds separate Automation/Whitebox credit accounts, Microsoft account linking, on-prem archive uploads, air-gapped Git support, and glob author filters.

• Glob patterns (*, **, ?, {a,b}) now accepted in repository and organization author filters, in addition to exact names, with bounded limits on pattern length, wildcard count, and brace alternatives.
• Billing now shows separate accounts for Automation credits and Whitebox Scan Credits, each with its own balance, current-period usage, purchase flow, and history; auto top-up is available for Automation credits only.
• On-premises deployments can now select enabled GitHub Enterprise Server repositories or upload .zip, .7z, .tar.gz, and .tgz source archives when starting a Whitebox Scan.

Endpoint Security (EDR/XDR) · 2026-09-05

Iru adds customizable directory sync schedules, on-demand sync, Android managed Google account controls, and iOS hardware health data.

• Adds customizable directory sync schedules and on-demand sync in Iru Identity.
• Adds managed Google account support and credential manager controls for Android work profiles.
• Adds hardware component health data visibility for iPhone and iPad devices.

General Utilities & Libraries · 2026-09-05

Joplin Android v3.7.7 adds readonly mode for mobile editors and same-note ID linking in Markdown.

• Implements readonly state for the mobile rich-text editor and disables the interactive table editor for readonly notes.
• Supports opening same-note links to elements with id="..." attributes in the Markdown editor.
• Enables the new notebook sharing key format for sync.

General Utilities & Libraries · 2026-09-05

Obsidian 1.14.0 adds iOS Quick Capture with Live Activity, kanban layout in Bases, and color highlights in the editor.

• Adds SettingDefinitionItem#id to the plugin API for setting a unique ID on individual settings, enabling stable references when a setting or settings page is renamed.
• Adds native Quick Capture on iOS 26, allowing note capture from the Lock Screen, Control Center, or Shortcuts without loading the vault; active captures appear as a Live Activity on the Lock Screen and Dynamic Island.
• Adds Quick Capture template variables {{latitude}} and {{longitude}} for inserting current GPS position into captured notes.

Identity & Access Management · 2026-09-05

Okta Identity Governance adds configurable resource catalog visibility, controllable per-group or org-wide via resourceCatalogVisibility API.

• Adds resourceCatalogVisibility API setting to control who can see resource catalog entry points — all org members, no users, or a specific set of Okta groups — covering the End-User Dashboard Request Access button, the Okta Access Request app, Slack, and Microsoft Teams integrations.

SAST / SCA / Code Security · 2026-09-05

Openlayer's Amazon Bedrock integration now traces embedding invocations for Titan and Cohere models

• Extends the Amazon Bedrock integration to trace embedding model invocations, recording them as a dedicated step named AWS Bedrock Embedding (distinct from LLM steps) with model, input, latency, vector dimensions, and vector count captured; supports amazon.titan-embed-* and cohere.embed-* model families.

SAST / SCA / Code Security · 2026-09-05

Openlayer MCP connector adds OAuth 2.1 resource-server mode, configurable via environment variables, with tools for pipelines, traces, and governance.

• Adds OPENLAYER_MCP_OAUTH_ISSUER environment variable to set the Authorization Server base URL, used as token issuer and advertised sign-in endpoint.
• Adds OPENLAYER_MCP_PUBLIC_URL environment variable to set the connector's public base URL; MCP is served at <OPENLAYER_MCP_PUBLIC_URL>/mcp.
• Adds OPENLAYER_MCP_OAUTH_JWKS_URI environment variable to optionally override the jwks_uri advertised by the Authorization Server.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds configurable data retention periods for monitoring data, with options from 7 days to indefinite.

• Adds a Data retention section under Project settings → General to control how long monitoring data is kept, with selectable periods of Indefinite, 7 days, 30 days, 90 days, 180 days, or 365 days.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds project-scoped Secret and Plain environment variables with workspace inheritance and LLM-as-a-judge connection testing.

• Adds Secret and Plain variable kinds under Settings > Environment: secrets are encrypted at rest and value-masked to workspace members; plain variables are readable and suited for client IDs, regions, and endpoints.
• Adds project-level Settings > Environment page for variables scoped to a single project, with the same Secret variables and Plain variables sections as the workspace page.
• Workspace-level variables are automatically inherited at the project level, shown with an INHERITED FROM WORKSPACE badge, and can be overridden by setting a different value at the project level.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds opt-in default-deny project visibility via Hide projects without access group workspace setting

• Adds Hide projects without access group under Workspace settings → Security → Access control to make projects invisible to non-admins unless they are explicitly added via an access group, inverting the default open-visibility posture

SAST / SCA / Code Security · 2026-09-05

SAML SSO directory sync gains a No access group mapping and ongoing reconciliation that corrects role drift and removes stale members.

• Adds No access as a mappable role in SAML SSO group configuration, letting you include IdP-pushed groups (such as a company-wide directory group) without granting any workspace permissions or surfacing the workspace in members' switchers.
• Reconciliation events are recorded in the workspace audit trail for review.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds a No access role for IdP directory sync group mapping, letting synced groups exist without granting workspace permissions.

• Adds a No access role assignable only through directory sync group mapping, allowing IdP groups to be recognized in Openlayer without granting any workspace permissions to their members.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds workspace security controls: domain restrictions, project visibility, connected apps management, and audit trail export

• Adds Restrict workspace creation by domain toggle under Workspace settings → Security to prevent users with a verified organization domain from creating new workspaces, routing them into the existing governed workspace instead.
• Adds Hide projects without access group control under Access control to limit non-admins to only projects they have been explicitly added to via an access group (off by default).
• Adds Connected apps panel listing authorized applications (such as the Openlayer MCP connector) with full or read-only access, with per-connection revocation to immediately cut off access.

SAST / SCA / Code Security · 2026-09-05

Openlayer gateway gains workspace connections, traffic-routing destinations, and multimodal media attachment support in traces.

• Adds workspace connection management under Settings, where you supply an Openlayer API key and optional Base URL for on-premises installs; the gateway verifies, encrypts, and stores the credential and reflects back project and member counts.
• Supports connecting more than one workspace so a single gateway can publish traces into separate Openlayer workspaces simultaneously.
• Adds destinations that route traces by target — Group, User, All traffic, or Unclaimed — to a chosen workspace, project, and data source, with fan-out semantics so multiple matching destinations each receive a copy.

SAST / SCA / Code Security · 2026-09-05

Openlayer Gateway adds model access rules to allow or block specific models per API key, user, group, or deployment

• Adds model access rules under Policies > Model access to allow or block specific model names (e.g. gpt-4o, claude-sonnet-4-5) per API key, user, group, or all traffic — before routing occurs.
• Supports prefix wildcard matching (e.g. claude-opus-*) so rules continue to cover a model family when vendors append new date suffixes to names.
• Refused requests return 403 mapped to permission_error in the caller's dialect, and GET /v1/models is filtered by the same policy so blocked models never appear in a client's model picker.

SAST / SCA / Code Security · 2026-09-05

Openlayer Gateway gains stackable guardrails for PII, prompt injection, and content safety on LLM traffic

• Adds PII guardrail type with Blocked entities (reject on match) and Redacted entities (replace matched spans with placeholders) lists, covering universal types like emails, phone numbers, and credit card numbers as well as country-specific identifiers, with a configurable confidence threshold to reduce false positives.
• Adds prompt injection guardrail type that scores user turns only (skipping system prompts and assistant/tool turns) and always blocks, with a configurable confidence threshold.
• Adds content safety guardrail type scoring text across six categories — Toxic, Severe toxic, Obscene, Threat, Insult, and Identity hate — with a per-category threshold probability and block-or-allow outcome (no redaction path).

SAST / SCA / Code Security · 2026-09-05

Custom metric parameters now support enum to restrict inputs to a dropdown of fixed values in the test creation modal.

• Adds enum to custom metric parameter definitions, restricting the parameter to a fixed set of allowed values and rendering it as a dropdown in the test creation modal instead of a free-form input.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds bulk test management — run, pause, duplicate, tag, archive, and delete multiple tests at once from the Results page.

• Adds bulk actions to the Results page overflow menu: Run selected, Pause selected, Duplicate selected, Tag selected, Archive selected, Unarchive selected, and Delete selected for managing multiple tests at once.
• Adds Archive selected bulk action that hides tests while preserving result history, reversible from the platform.
• Adds openlayer tests delete CLI command to remove or archive tests outside the Results page UI.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds automatic thresholds, filter value suggestions, and test pausing to test configuration

• Adds an Auto threshold tab to tests so Openlayer learns the historical metric distribution and fails a test when the observed value falls outside predicted bounds, with Both bounds, Upper only, or Lower only directionality controls.
• Adds Sample size (%), Data limit (rows), and Sampling method controls under Judge settings for LLM-as-a-judge tests, configurable per-test or project-wide under Settings → LLM-as-a-judge.
• Adds Evaluation windows settings in monitoring mode — Cadence (Scheduled or Manual), Evaluation delay, Include historical data in each run, and Anchor evaluation windows toggles.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds data export from records and test-result tables in CSV, XLSX, and JSON formats with score filtering

• Adds an Export data control to the Records table and test-result tables in both monitoring and development, supporting CSV, XLSX, and JSON output formats.
• Adds score filtering in the export modal — choose No scores, All scores, or Scores for {testName} to control which test scores are attached to the exported file.
• Adds openlayer export CLI command to download a monitoring pipeline from the command line.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds AI-powered trace, session, and test summaries with workspace- and project-level controls and semantic search

• Adds AI summary button in the trace details view to summarize, analyze, and get up to speed with a trace without reading line-by-line spans.
• Adds Session summaries feature that summarizes user sessions, configurable under Settings → AI features.
• Adds Test summaries feature that summarizes test result sets, with an optional Generate automatically control to summarize results as they finish computing, configurable under Settings → AI features.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds four new integrations: Google Conversational Search, Portkey, Palantir Foundry AIP Agents, and Databricks AI/BI Genie.

• Adds tracing for Google Cloud Discovery Engine conversational search calls via the Openlayer Ruby SDK.
• Adds tracing for Portkey completions with Openlayer.
• Adds monitoring support for Palantir Foundry AIP Chatbots with Openlayer.

SAST / SCA / Code Security · 2026-09-05

Openlayer adds gateway guardrails, PII redaction, A2A protocol tracing, bulk delete API, and integrations with Portkey, Databricks, and Palantir.

• Adds Guardrails gateway feature to block or redact PII, stop prompt injection, and screen for unsafe content on requests and responses.
• Adds Redact PII capability to strip personally identifiable information from trace data before it is stored.
• Adds bulk-delete REST endpoint to delete multiple records by their IDs from a data source (formerly inference pipeline).

Malware Analysis · 2026-09-05

quark-engine adds dextrace as a supported core library option, now the default for APK analysis

• Adds dextrace as a selectable and now-default core library via --core-library [androguard|rizin|radare2|shuriken|dextrace], joining the existing androguard, rizin, radare2, and shuriken options for APK analysis

Malware Analysis · 2026-09-05

DexTrace becomes the default analysis library; fall back to Androguard with --core-library androguard.

• Sets DexTrace as the default analysis library, with --core-library androguard available to fall back to Androguard.

Identity & Access Management · 2026-09-05

SailPoint adds 11 new connectors including Huntress, Scalefusion, and Recruitee for compliance coverage

• Adds AlertOps connector for compliance integration.
• Adds Bill4Time connector for compliance integration.
• Adds Canny connector for compliance integration.

Identity & Access Management · 2026-09-05

Delimited File Connector gains SSH key auth for SFTP and TLS client certificate auth for FTPS, beyond Basic username/password.

• Adds Public Key option to the Authentication Type dropdown for SFTP (File Transport = SFTP), enabling SSH private key authentication with SSH Private Key (PEM, OpenSSH, or OpenSSH v1 format) and optional SSH Private Key Passphrase fields.
• Adds Client Certificate option to the Authentication Type dropdown for FTPS (File Transport = FTPS), enabling TLS mutual auth via a Base64-encoded PKCS12 (.p12) certificate pasted into FTPS Client Certificate, with an optional FTPS Client Certificate Passphrase field.
• SSH private keys, client certificates, and passphrases are stored as encrypted attributes in Identity Security Cloud source configuration — no key files need to be uploaded to the Virtual Appliance filesystem.

SAST / SCA / Code Security · 2026-09-05

Semgrep adds exception requests, read-only tokens, multi-webhook policies, and is_partial_scan to the scans API.

• Introduces developer exception requests (public beta): admins can gate ignored findings behind an approval workflow by adding Require exception requests to any policy.
• Supports adding more than one webhook action to a single remediation policy automation.
• Adds an Incident scan type to the filter on a project's Details > Scans page, alongside Full and Diff.

SAST / SCA / Code Security · 2026-09-05

Snyk Assist brings an AI-powered support and guidance assistant — including vulnerability lookups and support case creation — directly into the Snyk UI.

• Adds Snyk Assist, an AI-powered assistant accessible from the top right of every page in the new Snyk UI, answering product, setup, and troubleshooting questions grounded in Snyk documentation, release notes, and support knowledge articles — available on Team, Ignite, and Enterprise plans.
• Enables read-only account information retrieval via Snyk Assist: issue summaries by severity, issue triage and single-issue detail, projects and import targets, collections and container images, scan settings, integrations and their connectivity status, members and their roles, and a project's current ignore rules — scoped to the current organization and group using your existing permissions.
• Allows Snyk Assist to look up known vulnerabilities for a package or specific package version against the Snyk Vulnerability Database without leaving the UI.

Endpoint Security (EDR/XDR) · 2026-09-05

Sophos Anti-Virus for macOS 2026.2.0 adds macOS 27 Golden Gate support and updates the threat detection engine to v3.99.0.

• Adds support for macOS 27 Golden Gate.
• Updates the threat detection engine to version 3.99.0.

Endpoint Security (EDR/XDR) · 2026-09-05

Sophos ITDR gains on-premises Active Directory support, a redesigned Identity Overview dashboard, and posture check filtering.

• Adds on-premises Active Directory (AD) support to Sophos ITDR — deploy the new sensor to an AD server to extend monitoring and posture assessments beyond cloud identity.
• Redesigns the Identity Overview dashboard with new widgets for risk trends, MFA coverage, dormant accounts, credential leaks, and VIP users.
• Redesigns the Posture Check page with filtering, sorting, and searching by category, provider type, and status, plus tag chips, a live match counter, and a NEW badge for recently published checks.

Firewalls & Network Defense · 2026-09-05

Sophos Email Security adds Data Control notification recipients and automatic Intelix-based quarantine release.

• Adds configurable notification recipients for Data Control rule actions.
• Automatically releases quarantined emails from quarantine when an Intelix scan determines the email is not malicious or suspicious.

Endpoint Security (EDR/XDR) · 2026-09-05

Sophos Mobile adds Apple declarative device management (DDM) policies for real-time device status enforcement.

• Adds Apple declarative device management (DDM) policies, enabling desired-state configuration where devices self-enforce compliance and report changes immediately without waiting for periodic sync.

AI-Powered Offensive Security · 2026-09-05

Strix v1.6.2 adds Exa as a web search provider alongside Perplexity and improves error telemetry with phase and exception-class classification.

• Adds Exa as a web search provider alongside Perplexity for agent-driven reconnaissance.
• Classifies error beacons by phase and exception class in telemetry for richer operational diagnostics.

AI-Powered Offensive Security · 2026-09-05

T3MP3ST adds a WPScan JSON parser, known-debt adapter templates, a format-string CTF lab, and a synthetic memory-forensics fixture.

• Adds parseWpscan to src/arsenal/parsers.ts, ingesting wpscan --format json output and mapping WordPress core, plugin, and theme vulnerabilities to structured ToolFinding records with severity levels (high for core insecure labels, medium for confirmed component vulns, info for interesting findings).
• Adds ARG_TEMPLATES for five previously KNOWN_DEBT adapters — feroxbuster (-u/-w, --json -q), osv-scanner (--format json --recursive <path>), hashcat (receipt-gated with --potfile-disable), apktool (d -f <apk> -o apk-out), and yara (explicit ruleset required) — emptying the invocation-honesty guard's KNOWN_DEBT set.
• Adds a reproducible native format-string CTF lab (ctf/docker/pwn/format-string/vuln.c) exposing an intentional dprintf format-string write primitive on port 9002, with digest-pinned images, loopback-only publish, and a deterministic solver.

SOAR · 2026-09-05

Tines adds case API updates, MCP cases tools, audit log retention config, and formula-driven AI provider URLs

• Adds the ability to update case fields via the API, enabling programmatic case management.
• Exposes Cases tools in the Tines MCP (Model Context Protocol), bringing case operations into AI-driven workflows.
• Adds audit log retention period configuration for admins, giving control over how long audit logs are kept.

Identity & Access Management · 2026-09-04

authentik 2026.8 adds PAM, agent accounts, user switching, scheduled offboarding, OAuth token exchange, DCR, and OpenID Certification

• Adds AUTHENTIK_WEB__BASE_URL environment variable (and the Base URL setting under System > Settings and via API) to record the external URL of the instance; required in 2026.11.
• Adds OAuth 2.0 token exchange, enabled per-provider under the Grant Types setting, letting applications trade a trusted token for an authentik access token representing the same user.
• Adds RFC 8693 on-behalf-of (OBO) token exchange: clients supply actor_token and actor_token_type to receive a token carrying both the user and the actor via the act claim.

Attack Surface & Exposure Management · 2026-09-04

Axonius 9.0.6 adds Jira ticketing from asset queries, Risk Scores for sub-assets, Okta Universal Logout, three new adapters, and expanded enrichment controls.

• Adds Number of Supported Major OS Versions setting under Settings > Enrichment, which controls how many recent major OS versions are considered supported per OS type and populates the Is Supported OS Version Device field (default: one supported major version per OS type).
• Adds two new global Network Routes enrichment settings: Network Routes Enrichment (enables/disables the enrichment pipeline during discovery cycles) and Zones to Exclude (names of zones whose subnets are excluded from enrichment).
• Adds Fetch Licenses advanced setting to the Cisco Catalyst Center adapter, creating License assets and enriching device records with expiry status, feature license details, and Smart Account pool usage metrics.

Digital Forensics & Incident Response · 2026-09-04

Belkasoft X v2.12 adds offline AI translation, SQLite classification, custom artifacts, offline maps, and deeper Android/Windows forensics.

• New BelkaGPT Hub installer for Windows simplifies deployment of distributed offline AI processing to GPU-equipped workstations and servers in a local network, with selectable GPU and CPU resources.
• Adds offline evidence translation via BelkaGPT directly within the artifact review workflow, supporting bulk translation of chats and SMS, per-message translation, translated message search, and report inclusion — covering 200+ source languages into 100+ target languages, all processed locally.
• Adds BelkaGPT-powered SQLite database classification that scans database contents and assigns predefined categories (communications, locations, financial information, credentials) or custom user-defined categories, enabling triage of unfamiliar or proprietary databases without a dedicated parser.

Reverse Engineering · 2026-09-04

Binary Ninja API adds LicenseAddon introspection and StatCollector bit-length histograms via get_stat_histograms.

• Adds get_stat_histograms() to retrieve per-tag bit-length histograms collected by StatCollector instrumentation during analysis; returns a dictionary mapping tag names to {"total": int, "buckets": [int; 65]} where buckets[k] counts samples with bit_width == k for k in 0..64.
• Adds LicenseAddon class exposing fields id, license_serial, product, created, created_timestamp, expiration, expiration_timestamp, and signature for inspecting verified add-ons attached to the active license.
• Adds core_license_addons property returning a List[LicenseAddon] of all add-ons present in the current license file.

Reverse Engineering · 2026-09-04

Binary Ninja 6.0 adds a first-party MCP server, Binary Similarity diffing platform, TMS320C6x arch, and up to 2× faster analysis.

• Enables the built-in GUI MCP server via the ui.mcp.enabled setting (restart required) or Plugins > MCP > Start Server; listens at http://127.0.0.1:24642/mcp by default.
• Adds ui.mcp.token setting to require clients to send a matching bearer token for locking down MCP server access.
• Provides Plugins > MCP > Copy Connection Info to copy the exact URL and authorization header for the active MCP session.

Web Application Security · 2026-09-04

Burp Suite DAST 2026.9 adds CSV export of issues from the Issues tab.

• Adds the option to download issues as a CSV file from the Issues tab.

Container & Image Security · 2026-09-04

Calico introduces Mylo, an AI agent layer delivered via the Calico MCP Server for Kubernetes network diagnostics.

• Introduces the Calico MCP Server, which exposes Mylo's tools and skills to any MCP-compatible AI agent (Claude, Cursor, terminal agents, etc.) without requiring a new chat interface.
• Adds the diagnose_connectivity tool via the MCP Server, which returns an ordered, opinionated trace of a network path down to the specific Calico policy rule allowing or denying traffic, with a suggested fix — rather than a raw dump.
• Supports two run modes: live cluster (via existing kubeconfig path, compatible with kubectl and calicoctl) for real-time diagnostics, and fully offline against a Calico diagnostics bundle for air-gapped or post-incident analysis.

Container & Image Security · 2026-09-04

API surface changed: +2 endpoints, 15 modified

• New endpoint GET /libraries/v1/malware/blocklist/statistics
• New endpoint GET /registry/v2/repos/{repoUid}/digests/{digest}/stig
• GET /iam/v2/roles/{uid}: response schema changed

Cloud Security Posture · 2026-09-04

Cloud Custodian 0.9.52 adds 40+ new AWS/Azure/GCP resources, filters, and actions across Bedrock, WAF, CloudFront, Vertex AI, and more.

• Adds delete action to aws.vpc-endpoint resources, enabling policy-driven removal of unwanted VPC endpoints.
• Adds last-usage filter to aws.kms-key resources for identifying dormant keys.
• Adds termination-policy filter to aws.emr clusters.

Internet Services · 2026-09-04

API surface changed: +42 endpoints, −1 endpoint, 421 modified

• New endpoint DELETE /accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags/{tag_id}
• New endpoint DELETE /accounts/{account_id}/cloudforce-one/v2/threat-signals/curated-feeds/{curated_feed_id}
• New endpoint DELETE /accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Internet Services · 2026-09-04

Cursor Cloud Agents can now run inside customer-controlled Cloudflare Sandbox environments via Cursor Self-Hosted Machines.

• Supports running Cursor Cloud Agents on Cloudflare Sandboxes as a self-hosted worker, keeping tool calls (terminal, filesystem, browser actions) inside the customer's Cloudflare account rather than on Cursor-managed infrastructure.
• Supports Cursor self-hosted worker pools as named routing targets, allowing new agent chats to queue until an available worker claims them, with pool orchestration to scale capacity on demand.
• Exposes a Cloud Agents API for integrating self-hosted machine status and pool routing into external systems.