This Week's Highlights — issue 012, September 18, 2026

Ships a new packet source enabling Zeek clusters to act as a UDP server that ingests encapsulated packet streams directly for cloud environments, without packet-sniffing workarounds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Invoked via zeek -i udp::0.0.0.0:4789:vxlan (bundled zeek-packet-source-udp plugin), it uses SO_REUSEPORT for multi-worker kernel load-balancing, and the policy/frameworks/conn_key/packet_source/udp/vxlan_vni policy script adds VNI-aware connection tracking so each VXLAN tenant network is tracked separately.

$ zeek -i udp::0.0.0.0:4789:vxlan

$ zeek -i udp::0.0.0.0:4789:vxlan policy/frameworks/conn_key/packet_source/udp/vxlan_vni

Zeek 9 switches the default cluster communication backend from Broker to ZeroMQ, enabling direct worker-to-worker eventing, cluster-wide event publishing, and single-point cluster event tapping; scripts relying on Broker-specific eventing must re-enable it explicitly. Broker's legacy embedded WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. server is fully removed — Broker::BrokerProtocol, Broker::default_port_websocket, Broker::default_listen_address_websocket, Broker::web_socket_buffer_size, and Broker::web_socket_overflow_policy no longer exist, and the BrokerProtocol enum and the Broker manager's Listen() C++ method argument are removed — use Cluster::listen_websocket() and the ZEEK_WEBSOCKET_* environment variables instead. zeromq/main.zeek options are split into a separate zeromq/options.zeek file so standalone Zeek processes can connect to the ZeroMQ layer without participating in cluster node events.

⤢

Adds ech_kdf_id and ech_aead_id fields to ssl.log (via the protocols/ssl/ssl-log-ext.zeek policy script) reporting HPKE KDF and AEAD identifiers from the TLS 1.3 ECH extension. Adds a new ssl_extension_encrypted_client_hello event carrying information about the TLS encrypted_client_hello extension, and a new ssl_extension_signature_algorithms_cert event raised for the signature_algorithms_cert extension.

$ @load protocols/ssl/ssl-log-ext

Adds multiple configuration options for handling binary data in JSON logging, resolving a long-standing ambiguity, including Log::json_string_escape_policy (type JSON::STRING_ESCAPE_POLICY_*) to make control-character and invalid UTF-8 escaping configurable; the default remains JSON::STRING_ESCAPE_POLICY_HEX.

redef Log::json_string_escape_policy = JSON::STRING_ESCAPE_POLICY_TSV;

Adds a new, optional ZIP file analyzer that reports contained files to files.log; policy/files/zip/register.zeek maps the bundled Spicy ZIP analyzer to the application/zip MIME type, with recursive ZIP depth controlled by Spicy::max_file_depth.

Replaces the MD5-hashed auth_ticket and new_ticket fields in kerberos.log with auth_ticket_sha256 and new_ticket_sha256 (via protocols/krb/ticket-logging.zeek); load the protocols/krb/md5-ticket-logging.zeek policy script to restore the original MD5 fields.

Replaces the host_key fingerprint field in ssh.log with a new host_key_fingerprint field using SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. in the same format as ssh-keygen -l; the protocols/ssh/md5-host-key-logging.zeek policy script restores the old field.

Extends the HTTP analyzer with nine new weirds — HTTP_bad_chunk_size, HTTP_chunked_multi, HTTP_content_length_0_and_expect_100_cont, HTTP_content_length_leading_zeros, HTTP_bad_content_length, HTTP_obsolete_line_folding, HTTP_content_length_and_chunked, HTTP_content_range_and_chunked, and HTTP_expect_not_100_continue — for unusual Content-Length, Transfer-Encoding, and Expect header usage.

Extends the known-certs, known-hosts, and known-services scripts with storage-framework options including enable_hosts_persistence, host_store_prefix, host_store_backend_type, and host_store_backend_options, using a SQLite backend under Cluster::default_store_dir by default.

Adds Software::parse_cache_interval, Software::found_cache_interval, and Software::max_software_cache_size tunables to the software framework for finer control over version-detection caching.

redef Software::max_software_cache_size = 5000;
redef Software::parse_cache_interval = 1min;
redef Software::found_cache_interval = 5min;

Adds a new declarative zeek.conf cluster configuration file consumed by Zeek's systemd generator (zeek-systemd-generator) to produce systemd unit files for orchestrating Zeek clusters, including multi-machine deployments; later extended to support multiple interfaces and multi-host deployments.

Adds the ?as operator to Zeek's scripting language for safely checking type-conversion compatibility at runtime, and extends the as casting operator to cover all type conversions previously requiring explicit BiFs such as interval_to_double(), plus additional natural companions.

Calling zeek::fmt() from non-main threads now emits a warning (and aborts in debug builds); plugins spawning threads must switch to threading::BasicThread::Fmt() or std::format().

Adds Reporter::limit_reached_weird BIF to report size-limit violations, logging a named weird and appending X to the connection history field.

Adds opcode and opcode_name fields to dns.log to support DNS notifications (RFC 1996); removable via the protocols/dns/disable-opcode-log-fields.zeek policy script.

TruRisk Eliminate adds AI-powered Patch Reliability Scoring that combines LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-analyzed public sentiment with Qualys telemetry on patch rollback and vulnerability reopen rates to produce a pre-deployment reliability score (Low / High) for each patch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ In the Patch Management app (Patches > Windows), the patch.kb QQL filter surfaces Patch Reliability assessments for specific KBs, and clicking Patch Reliability: Low opens an AI Assessment window showing known issues and source links via Detailed Report.

⤢

TruRisk Eliminate can automatically isolate a host natively through the Qualys Cloud Agent when a user-defined QQL policy is met, with no EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. integration required, quarantining the host within seconds and writing a timestamped audit record of which rule, host, and deadline triggered the action. A built-in CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. isolation use case applies the QQL vulnerabilities.status:[ACTIVE,NEW,REOPENED], vulnerabilities.riskFactor.cisaKEVDueDate < 'now-1s', and vulnerabilities.riskFactor.cisaKnownExploits:TRUE to isolate hosts where a KEV remediation deadline has passed and the vulnerability remains open.

⤢

$ vulnerabilities.status:[ACTIVE,NEW,REOPENED] AND vulnerabilities.riskFactor.cisaKEVDueDate < "now-1s" AND vulnerabilities.riskFactor.cisaKnownExploits:TRUE

Teams can upload frameworks, benchmarks, vendor guidance, or internal policies and use AI assistance to map controls to policy logic, assessment criteria, and expected values, with human review and approval required before the mapped policy is published.

⤢

Adds Security > Distributed Cloud Firewall > IPS > Rule Feeds (labeled ET Pro in CoPilot) as a Premium IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. feed applied alongside custom Suricata rulesets, with traffic actions governed by severity thresholds in the active IPS Profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds DCF intra-cluster enforcement, enabled per-cluster from CoPilot under Security > Distributed Cloud Firewall > Settings > Intra-Cluster, supporting Calico, Cilium, Antrea, AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. CNI (v1.14+), Weave Net, and Canal.

Adds independent gateway instance sizing, allowing a single instance to be resized from CoPilot at Cloud Fabric > Gateways > (transit or spoke) > gateway group > Instances tab without affecting HA or the group default size; surfaces a Multiple Sizes label when a group has diverged.

Adds VRF for multi-tenancy with end-to-end propagation across transit-to-transit peering, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes.-spoke-to-transit peering, and intra-group backup links; enabled by a Controller feature flag (off by default) plus per-attachment opt-in, supporting up to 200 network domains.

Adds DCF for Private Kubernetes Clusters (Preview), enabled per cluster in CoPilot or Terraform, supporting EKS, AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., and GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.; requires an Aviatrix spoke gateway in the same VPC with a security-group rule allowing TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 443 to the Kubernetes API server.

Adds DCF Spoke Local Breakout, recording the egress path taken in every DCF log entry; requires Single IP SNAT (or customized SNAT), the 10.1 gateway image, and a supported instance size on Aviatrix Transit (FireNet) and AWS TGW centralized topologies.

Adds DCF Quick Time-to-Value dashboard with a system-defined, Aviatrix-managed read-only threat intelligence ruleset (defaults to Watch Mode) and ten Recommended Security Control cards covering ToR traffic, sanctioned-country traffic, cleartext legacy protocols, cryptomining pools, and outbound proxy/relay; requires Controller 8.2+ and CoPilot 4.37.

Adds DCF East-West Layer 7 inspection for AWS, with symmetric routing enabled per spoke group in CoPilot or Terraform, also reducing cross-AZ data transfer cost and latency.

Adds GCP Global VPC Regional Spoke Egress (Phase 2), letting operators choose which regions egress locally vs. through FireNet, with both modes coexisting in the same Global VPC; the CoPilot Egress page now shows Global VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. in a nested tree displaying each region's egress mode.

Adds Smart Gateways Phase 3 (Preview) covering transit gateways, Edge as Spoke, Edge as Transit, and BGP spoke gateways, controlled by three tiered feature flags (fabric-wide kill switch, per-group underlay flag, per-group route-resolver flag) all off by default.

Adds Flexible Gateway Deployment (private subnet, no public IP), enabled per gateway group at creation time on AWS (including GovCloud) and Azure, via CoPilot and Terraform.

Adds AZ Affinity Across Transit, enabled per peering (disabled by default) on AWS same-region HPE peerings, and opt-in AWS inter-region jumbo frame support for transit peering (AWS only, excluding partitions such as AWS GovCloud that do not support jumbo frames).

Adds FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 validated IPsec data plane as a separate FIPS-validated gateway build; existing gateways must be replaced (not toggled) to enter FIPS mode.

Adds SNAT and HPE support on Azure spokes with subnet groups for both HPE and non-HPE deployments, configurable via the existing Controller API/CLI or Terraform.

Adds detection_subcategory_map and nist_ai_rmf_subcategories lookups to support analytic categorization and alignment with the NIST AI Risk Management Framework, plus an alpha nist_ai_rmf_control_coverage dashboard mapping AI-related ESCU detections to the NIST AI RMF Govern, Map, Measure, and Manage functions to help identify coverage gaps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Adds GET /api/v1/tools and GET /api/v1/tools/{tool_id} endpoints to query the new Global Tool Registry, giving published capability Python tools and command wrappers stable, organization-scoped identities with immutable revision history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

$ curl -s -H 'Authorization: Bearer <token>' https://<your-instance>/api/v1/tools | jq '.[].id'

Adds three traditional ML attack targets — fraud tabular, MNIST image, and IMDB text — now available across all organizations, covering extraction, membership inference, evasion, and inversion attack types, provisionable by name via the SDK or TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..

$ dreadnode env provision ml-extraction-fraud-tabular

Adds replicated.isAirgap=true Helm CLI setting to prevent the Replicated SDK pod from attempting outbound connections to replicated.app in air-gapped installs, and a broader air-gap deployment mode that vendors all front-end resources locally, hides the analytics notebook, serves model pricing from a bundled catalog, and pre-bakes capability dependencies into the runtime image so sandbox boot requires no network access.

$ helm upgrade --install dreadnode ./dreadnode-chart --set replicated.isAirgap=true

Runtime cold start reduced by more than 60%, dropping time-to-ready from 18.8s to 6.6s, and now surfaces a full cold-start timing breakdown (total, platform overhead, provider provisioning, boot, installs, slowest step) via dn runtime start and GET /runtimes/{id}.

$ dn runtime start && curl -s -H 'Authorization: Bearer <token>' https://<your-instance>/runtimes/<id> | jq '.timing'

Adds caBundle config key for self-hosted deployments to inject a custom CA bundle into the Node frontend, completing CA trust support across all workloads (API, LiteLLM, and frontend); also adds support to self-hosted Helm charts for non-root container execution and custom CA bundle mounts for outbound TLS trust in private-CA environments.

caBundle: |
  -----BEGIN CERTIFICATE-----
  <your-internal-CA-cert>
  -----END CERTIFICATE-----

Adds DREADNODE_TUI_THEME=light environment variable to switch the TUI from its default dark palette to a light theme; adds /reload slash command to reload the current agent without leaving a chat session; adds /transcript command to toggle between compact and full agent transcript views; and adds /status slash command showing current session, model, user, org, workspace, and project at a glance.

$ /status

Adds --mine flag to dn runtime ls to filter runtimes to only those you own; also marks runtimes you do not own in the default listing.

$ dn runtime ls --mine

Adds HTTP desync and request-smuggling detection to the web-security capability, covering 11 smuggling families with fingerprinting, payload construction, cache-poisoning detection, and victim-response classification.

Expands postMessage handler detection in the web-security capability's DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. analysis to cover window.onmessage, MessagePort/MessageChannel, and monitoring-shim wrappers, plus additional origin-validation bypass patterns including unescaped-dot and missing-anchor regex bugs.

Adds two honeytoken tools to the ai-red-teaming capability — mint canary tokens (exfil or RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. variants) and check whether a target agent leaked them across an output boundary; adds algorithmic multi-step tool-attack search to the AI red-teaming agent for finding replay-stable read-then-exfiltrate causal paths across HTTP agent tool call chains; and adds a turnkey OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against.-ASI agentic attack suite runner, argument-aware tool-evidence scoring, and a honeytoken harness for black-box exfil and RCE detection to the SDK.

Adds Cloudflare Workers support via wrangler to the web-security capability for deploying programmable OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. endpoints, enabling blind XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. payload hosting, callback logging, and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. chain redirection.

Adds environment-agnostic attack-success detection to the airt SDK using canary exfiltration, OAST beacons, dataflow taint, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. judge scoring, and optional customer-defined success policies to produce confidence-rated verdicts.

Adds geo-distributed DNS resolution to the web-security capability, resolving target hostnames through open resolvers in multiple countries (via Shodan or Censys) to detect geo-fenced infrastructure, GSLB routing, and region-locked DNS responses.

Adds an indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. web task where agents must detect injections hidden via HTML comments, hidden CSS, off-screen ARIA, white-on-white text, and Unicode tags across a public web page.

Adds SDK transforms and scorers covering search-query and trusted-domain image exfiltration channels plus dedicated browser-attack scorers for visual injection, ClickFix execution, navigation hijacking, and domain-validation bypass.

Adds provision as an accepted alias for create in dreadnode env, and bare public task names (e.g. ml-extraction-fraud-tabular) now resolve without requiring an org prefix.

$ dreadnode env provision ml-extraction-fraud-tabular

Bulk workspace member addition now lets you select and add multiple members to a workspace at once from the workspace settings page; adds bulk share-with-workspace action for multiple agent sessions via the floating action bar; and adds bulk archive and unarchive for agent sessions from the Sessions tab, with context-aware actions for active, archived, or mixed selections.

The workspace_mount runtime option is now a no-op; /home/user/workspace is ordinary sandbox-local storage, and object-storage access must now go through the SDK instead.

Adds 12 multi-agent AI red-teaming tasks covering access-control bypass, indirect injection, memory poisoning, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. poisoning, reasoning hijack, supply-chain, data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels., DevOps RCE, and sector-specific meshes to the task catalog under the airt-generative-ai set.

Adds pagination and full-text search by title, model, agent, and label to the chat session list, removing the previous 100-session cap.