The week in full · Sep 11–17

Identity & Access Management · 2026-09-17

Aembit adds MCP Tool Access Control and CrowdStrike AIDR integration for governing AI agent tool access⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP Tool Access Control Content Security Provider with independent Tool Visibility (controls which MCP tools an agent can discover in a listing) and Tool Invocation (controls which MCP tools an agent can call) controls, configurable per Access Policy via glob-syntax tool name rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds CrowdStrike AIDR as a Content Security Provider that inspects MCP tool calls and tool listings on both the request and response paths before forwarding to the MCP server or AI agent, applied via Access Policy.

Identity & Access Management · 2026-09-17

Aembit adds multi-provider AWS STS selection in GitHub Actions, MCP Tool Access Control enforcement, and glob-pattern tool filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds aws-access-key-id input to the Aembit GitHub Action (minimum version 1.3.0) to name the Access Key ID selector of a specific AWS STS Federation Credential Provider within an Access Policy, letting GitHub-hosted runners reach any IAM role without a self-hosted runner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The Edge API credentials endpoint now carries the AWS STS Credential Provider selector alongside selectors for multiple JWT Credential Providers, enabling direct programmatic selection.
• Edge SDKs for TypeScript and Python (minimum Edge SDK 1.34.0) accept the Credential Provider selector as connection metadata on the credential request.

Identity & Access Management · 2026-09-17

Aembit adds MCP Identity Gateway, MCP Authorization Server, Blended Identity, and an MCP Server for AI assistant-driven tenant management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Aembit MCP Server, which exposes tenant configuration to MCP clients so practitioners can query and manage Aembit from an AI assistant, with a published Prompt Library and MCP Server Reference.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-17

Aembit introduces MCP Identity Gateway for managing AI agent identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces MCP Identity Gateway, enabling identity management for AI agents whether user-driven (such as Claude Desktop) or autonomous services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-09-17

AI-Infra-Guard v4.6.2 adds FORGE-Bench loss-of-control benchmark and RogueHandoff-20 benchmark for autonomous agent red teaming.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds forge_bench (FORGE-Bench) — a deterministic Loss-of-Control benchmark for evaluating autonomous agents, with a built-in OpenAI-compatible client and bilingual quickstart.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds RogueHandoff-20 benchmark under the Research module for autonomous agent handoff security evaluation.
• Updates AIG rules dataset (2026-09-11 ruleset).

Identity & Access Management · 2026-09-17

Auth0 B2B Connect Early Access adds real-time connection event streaming, automatic IdP-driven session termination, email-domain SSO resolution, and direct Auth0 connections without an external authorization server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Streams enterprise connection events (created, updated, deleted) to a webhook, Amazon EventBridge, or a custom event pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Automatically terminates active application sessions when the enterprise IdP ends the corresponding session, keeping app and IdP session state in sync.
• Supports connecting an application directly to Auth0 without an external authorization server, with new quickstart guides to get started.

Identity & Access Management · 2026-09-17

Auth0 adds real-time enterprise connection events — subscribe to created, updated, and deleted via webhook or Amazon EventBridge, no polling required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds connection.created, connection.updated, and connection.deleted event subscriptions for enterprise connections (Azure AD, ADFS, Google Workspace, Active Directory, LDAP, and Ping), eliminating the need to poll the Management API for connection changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Delivers connection events to a webhook or Amazon EventBridge as CloudEvents-formatted JSON.

Endpoint Security (EDR/XDR) · 2026-09-17

Automox now supports macOS 27 (Golden Gate) with Agent 2.6.53.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for macOS 27 (Golden Gate), verified with Agent 2.6.53.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-17

ECM 1.6.2609 adds configurable certificate validation and field-debugging settings via named appSettings keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds requireCertificateRevocationCheck appSettings key (default false) to reject certificates whose revocation status cannot be determined, for hosts without a reachable CRL or OCSP endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds allowUntrustedApplianceCertificate appSettings key (default false) to accept appliance certificates that do not chain to a trusted root, for hosts where the issuing CA is not yet installed.
• Adds MaxReturnedCredentials appSettings key to override the credential result limit in configuration (raised ceiling: 750) without requiring a rebuild.

Vulnerability Management · 2026-09-17

Brinqa 12.3.295 adds vulnerability deduplication, a no-code SmartFlows builder, a broad public API with MCP tools, and scheduled PDF dashboard reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds BQL grammar reference endpoint and a debugging option on the BQL API to inspect generated queries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds UNION ALL support in BQL, letting you combine multiple filter criteria in a single Metric.
• Adds string-literal output columns in BQL, including within unions.

Secure Access (VPN / SASE / ZTNA) · 2026-09-17

Cisco Duo Desktop: Adds a system-wide administrator preference to pre-configure the telemetry consent setting and bypass the start-up prompt for end users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-09-17

Compyl adds Azure PIM/Intune/Entitlement coverage, ServiceNow Catalog support, and AI answer-mapping in Questionnaire Assist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds inline + New buttons on Control records to create Blueprints and Tasks with automatic linking to the parent Control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends inline creation to Contracts for Vendors, Clients, Assets, and Tasks.
• Expands the Azure integration to cover Privileged Identity Management role assignments, Entitlement Management access packages, Intune compliance policy status, and backup protected items for automated evidence collection.

Third-Party & Vendor Risk (TPRM) · 2026-09-17

Conveyor Trust Center access request form now collects product line interest and supports custom description and placeholder text.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds product line selection to the Trust Center access request form so approvers see which product a visitor wants access to before approving.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables rewriting the access request form's description and placeholder text to collect custom information from visitors upfront.
• Enables opt-in product line display via Settings > Trust Center > NDA & Access.

Third-Party & Vendor Risk (TPRM) · 2026-09-17

Conveyor adds a dockable nav, redesigned cmd+k with products picker, and renames AI Answers to Ask ConveyorAI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a dockable navigation panel to reclaim screen space while working.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Redesigns cmd+k with a cleaner layout, a products picker matching the launchpad, and an empty-state guide clarifying when you are querying Ask ConveyorAI versus running a keyword search.
• Renames the AI Answers feature to Ask ConveyorAI with a clearer state displayed when no answer is found.

Security Data Pipeline · 2026-09-17

Cribl adds backend functions for Apps, an MCP server for external AI clients, and muting rules for Cribl Insights alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces backend functions for Cribl Apps — server-side logic declared in an App that Cribl deploys and runs alongside it, enabling scheduled work and other operations that should not run in the browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an embedded MCP server in Cribl.Cloud that lets external MCP clients (such as Cursor, Claude Code, or Codex) connect to your Cribl environment and interact with Sources, Destinations, Pipelines, metrics, and Search Notebooks through natural language; an admin enables it and a Bearer token is copied from Settings > Global > Information.
• Adds Muting Rules to Cribl Insights, allowing teams to suppress outbound notifications for matching alerts during a configured time window.

Security Data Pipeline · 2026-09-17

Cribl Apps reach GA in 4.20 with backend functions: HTTP endpoints and scheduled jobs for custom app workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds onRequest handler model to Cribl Apps, letting developers expose app-specific HTTP endpoints that run server-side logic without a user session active.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds scheduled function support to Cribl Apps, enabling recurring background jobs such as periodically pulling from a threat feed, updating a Stream lookup table, and making the latest entries available to a pipeline for enrichment.
• Promotes Cribl Apps to general availability, making them a supported foundation for building and deploying custom applications on Cribl Stream.

SAST / SCA / Code Security · 2026-09-17

cve-lite-cli v1.35.0 adds override-hygiene rule OA010 and full multi-path dependency display in HTML reports⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds override-hygiene rule OA010: flags an override floor that itself admits a known-vulnerable version, surfacing floors that appear protective but are not.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Shows every known dependency path for a finding in the HTML report (capped at five paths per panel), replacing the previous single-primary-path display.

SIEM · 2026-09-17

Unity Gateway API for model, model-provider, and MCP services reaches GA with full CRUD across Terraform, CLI, and six SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Unity Gateway API is now generally available with full create, read, update, list, and delete support for managing model services, model provider services, and MCP services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Unity Gateway management via Terraform provider 1.132.0 and later.
• Supports Unity Gateway management via Databricks CLI v1.17.0 and later, including Declarative Automation Bundles support (Beta).

SIEM · 2026-09-17

Databricks Automatic CDF computes row-level changes at query time without per-table enablement, rolling out through October 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Automatic Change Data Feed (Auto CDF), which computes row-level changes at query time using row tracking — eliminating the need to enable change data feed on each individual Delta Lake or Apache Iceberg v3 table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Requires Databricks Runtime 19 or above with row tracking enabled on the table.

SIEM · 2026-09-17

JAR tasks on serverless compute coming to compliance security profile workspaces in early October 2026⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables running JAR tasks (Java or Scala Spark code) on serverless compute within Lakeflow Jobs for workspaces that have the compliance security profile enabled, removing the need to provision or manage clusters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-17

Databricks adds counter_diff SQL window function for time-series counter analysis with reset handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds counter_diff analytic window function to Databricks SQL and Databricks Runtime 19+ to calculate differences between consecutive cumulative counter values and handle counter resets in time-series analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-17

macOS Roaming Client v2.4.6 Beta keeps DNSFilter active over VPN via DNS-over-HTTPS fallback with ENABLE_DOH_FALLBACK=true⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ENABLE_DOH_FALLBACK=true install-time flag to maintain DNSFilter enforcement over DNS-over-HTTPS when a corporate VPN blocks the DNS-over-TLS port.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updated macOS certificate profiles now bundle all DNSFilter roots — including the new DNSFilter Root CA G1 — in a single push profile, replacing prior installs in place.

SAST / SCA / Code Security · 2026-09-17

Endor Labs adds Threat Center, VS Code extension firewall, malware exposure classification, and background SBOM/VEX exports⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Potentially Affected Finding Severity parameter to the Malware finding policy, letting you raise findings for dependencies whose version constraints could resolve to a malicious package version even when the currently resolved version is clean.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Threat Center, a tenant-wide dashboard tracking newly discovered malware, open-source packages, vulnerabilities, and AI models — including which monitored projects may be exposed before risk surfaces in project-level scans.
• Extends Package Firewall to block or warn on malicious VS Code extensions from the Microsoft Marketplace, enforcing minimum package age and malware policy before installation; deployable via MDM tools such as Microsoft Intune, Jamf, or Kandji.

SAST / SCA / Code Security · 2026-09-17

Endor Labs adds Coding Agent Governance with MDM deployment and Claude Code compliance API support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Deploy Coding Agent Governance with MDM support, enabling generation of Cursor hooks, Claude Code settings, Codex requirements, GitHub Copilot policy hooks, or a macOS configuration profile for managed developer machines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Connect the Anthropic Compliance API integration to enroll a Claude Enterprise directory so Coding Agent Governance can match Claude Code sessions to organization roles and groups.
• Adds Understand blocked package responses documentation covering each Package Firewall block reason, its meaning, and resolution steps.

SAST / SCA / Code Security · 2026-09-17

Endor Labs launches Threat Center for real-time malware monitoring and extends Package Firewall to VS Code extensions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Threat Center, a real-time view of malicious packages landing on public registries (npm, PyPI, and others), with impact mapping showing which of your projects pull in an affected package, malware behavior details, and alerts regardless of whether you are impacted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends Package Firewall to VS Code extensions, scanning every new extension or update against the policy engine and blocking disallowed extensions before they appear in the marketplace inside the editor.
• Adds research context to Threat Center entries, with the security team supplementing automated analysis with deeper write-ups, blog links, and ongoing updates as a campaign develops.

SIEM · 2026-09-17

Exabeam Threat Center gains a new API endpoint for retrieving full case lifecycle history and audit events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a GET API endpoint under Threat Center > Cases > Get case lifecycle history for retrieving the comprehensive lifecycle history, stage transitions, and audit events of a case.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-17

GitHub Enterprise Cloud admins can now bulk-authorize classic PATs and SSH keys for up to 50 orgs via a new API and GitHub App permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new enterprise_credentials:write permission for enterprise-installed GitHub Apps, enabling credential delegation to automate SSO authorization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new REST API for enterprise credential authorizations that bulk-authorizes a classic PAT or SSH key for up to 50 organizations in a single request, identified by non-secret token ID or SSH key fingerprint.
• Adds a new enterprise setting to opt in to credential delegation through enterprise-installed GitHub Apps, replacing manual per-organization SSO authorization.

SAST / SCA / Code Security · 2026-09-17

GitHub SCIM user responses now include a profileUrl attribute linking each record directly to its GitHub account URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• SCIM /Users endpoint responses now include a profileUrl attribute containing the absolute URL of the linked GitHub account, eliminating extra lookups to match SCIM records to GitHub users — available across both organization and enterprise SCIM APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-17

GitHub Copilot now lets members request more AI credits at the limit, with owners approving from org or enterprise settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a self-service budget increase request flow for Copilot users who exhaust their AI credits, routing requests to the paying account (org or enterprise) for review under Requests from members.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables organization owners, enterprise owners, and billing managers to approve, adjust, or deny budget requests — setting a new credit amount and immediately restoring access — without leaving settings.

SAST / SCA / Code Security · 2026-09-17

GitHub AI Scan for pull requests now runs without CodeQL default setup, expanding coverage across eligible repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• AI Scan for pull requests now runs on repositories where CodeQL default setup is not configured, broadening security vulnerability detection across eligible repositories without additional setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-09-17

Hudson Rock Cavalier API adds supply-chain risk views, company/account management, and six new search endpoints including PC-name and advanced search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Supply Chain Risks capability to surface infostealer exposure across third-party vendor relationships.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Company Management functionality for organising and administering monitored companies.
• Adds a Company Search endpoint for querying companies within the Cavalier dataset.

Endpoint Security (EDR/XDR) · 2026-09-17

Huntress adds three macOS Gatekeeper bypass detections covering quarantine stripping via scripts, disk images, and combined fake-installer sequences.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Detects quarantine attribute removal from files in common malware staging folders by a script or shell — covering the ClickFix and AMOS dropper pattern.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Detects quarantine attribute removal from files on mounted disk images — the technique fake installers use to silently bypass Gatekeeper.
• Detects a combined sequence of a fake installer mount and a quarantine strip on the same machine within five minutes — a high-confidence pre-execution signal.

Endpoint Security (EDR/XDR) · 2026-09-17

Huntress agent overview now shows last logged-in user for macOS endpoints, requiring Agent v0.14.196 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends the last logged-in user field on the agent overview page to macOS endpoints (previously Windows-only), showing the most recent interactive console/GUI login and excluding system-owned login windows and shutdown records; requires Agent v0.14.196 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-17

Huntress Managed Antivirus now lets you toggle Network File Scanning and Archive File Scanning for Microsoft Defender.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds configurable Network File Scanning toggle for Microsoft Defender in Managed Antivirus, accessible at EDR → Managed Antivirus → Defender Configuration → Scans (off by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds configurable Archive File Scanning toggle for Microsoft Defender in Managed Antivirus, accessible at EDR → Managed Antivirus → Defender Configuration → Scans (on by default, covers ZIP, RAR, and similar formats).

Identity & Access Management · 2026-09-17

iDenfy: Adds a Blocklist API endpoint for managing blocklisted identities.

• Adds Bank Card Verification as a new verification type.
• Adds KYB shared identity verification across companies.
• Extends injection detection to images that did not go through the iDenfy capture flow (experimental).

Identity & Access Management · 2026-09-17

iDenfy adds iOS SDK quickstart, plus two KYB company API endpoints for listing and retrieving company records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /kyb/companies/ endpoint to list companies ordered oldest-first; supports filtering by status, client ID, company name, or country is not available — use for bulk enumeration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds iOS SDK support via Swift Package Manager or CocoaPods for running identity verification sessions.

Secrets Detection & Management · 2026-09-17

Restores Oracle Database PAM support, adds AWS US ISO/ISOB regions for external KMS, and introduces certificate audit log details for PKI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports AWS US ISO and ISOB regions for external KMS key management.
• Adds audit log details for PKI certificate events.

SAST / SCA / Code Security · 2026-09-17

JFrog Artifactory adds native LuaRocks repository support for hosting, proxying, and caching Lua rocks for NGINX, OpenResty, and Kong.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds LuaRocks as a native repository type in Artifactory, supporting local, remote, and virtual repository tiers for Lua packages (rocks and rockspecs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a remote repository type that proxies and caches luarocks.org rocks on first request, so subsequent pulls are served from Artifactory rather than the public registry.
• Adds a local repository type for storing private first-party rocks, internal libraries, and custom Kong plugins as versioned .rock files.

Identity & Access Management · 2026-09-17

JumpCloud: Adds Client secret basic and Client secret post client authentication type options on an agent's Authentication tab, controlling how the agent platform sends the client ID and secret when requesting an OAuth token from JumpCloud (e.g., for Amazon Bedrock AgentCore compatibility).

Identity & Access Management · 2026-09-17

JumpCloud: Adds new Case Portal for viewing and managing support cases and ideas submitted by any administrator in an organization, with filtered searches and one-click case detail views.

• Introduces MDM Upcoming Certificate Expirations widget on the JumpCloud homepage for at-a-glance certificate lifecycle visibility.
• Adds interactive, as-you-type password complexity dialog with mobile-responsive and WCAG-compliant design.

Identity & Access Management · 2026-09-17

JumpCloud: Supports Duo Universal Prompt for MFA, ahead of Duo's March 30, 2024 end-of-life for the traditional prompt.

Identity & Access Management · 2026-09-17

JumpCloud: Adds a Windows MDM policy framework using Configuration Service Providers (CSPs) enabling IT admins to configure any company policy via CSP.

• Adds manual app addition to SaaS Management so admins can track, warn, and block apps before automatic discovery.
• Supports Android 15 fully in MDM.
• Replaces deprecated GET api/systemusers/reactivate/{id} with POST https://console.jumpcloud.com/systemusers/reactivate/{id} for user reactivation.

Identity & Access Management · 2026-09-17

JumpCloud adds Access Requests, MCP Server, AI Commands Builder, Shadow AI Dashboard, and major SAML/OIDC enhancements in 2025⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sso_auth event to Directory Insights logs to capture forced re-authentication events for SAML and OIDC sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• IdP now honors ForceAuthn="true" in SAML and prompt=login in OpenID Connect, triggering fresh credential prompts even during active sessions.

Identity & Access Management · 2026-09-17

JumpCloud: Adds client authentication type configuration on an agent's Authentication tab, supporting Client secret basic (credentials in authorization header, default) and Client secret post (credentials in request body) to match external OAuth platform requirements such as Amazon Bedrock AgentCore.

• Adds a Dashboard tab to AI Gateway with org-wide MCP server usage metrics, tool call volume, error rates, trend charts, and per-server drill-down.
• Adds AI Assistant knowledge base uploads, supporting PDF, TXT, DOCX, and MD files (10 MB per file, 25 files per org) with source attribution in chat responses.

Identity & Access Management · 2026-09-17

JumpCloud: Adds RSS feed subscriptions via Subscribe to Support RSS Feed, Subscribe to Release Notes and Bug Fixes RSS Feed, Subscribe to Agent Release Notes RSS Feed, and Subscribe to Bug Fixes RSS Feed options on the Release Notes and Bug Fixes page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-17

JumpCloud: Adds ability to sort items by nicknames.

SAST / SCA / Code Security · 2026-09-17

KICS v2.2.0 adds Synapse managed VNet queries for Terraform and ARM, and removes the --disable-full-descriptions flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new Synapse Workspace Managed Virtual Network Not Enabled queries for Terraform (azurerm_synapse_workspace resource, managed_virtual_network_enabled field) and Azure Resource Manager (Microsoft.Synapse/workspaces resource, managedVirtualResource field) to detect when managed virtual network isolation is disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Removes the --disable-full-descriptions CLI flag along with the pkg/descriptions package it backed.

AI/LLM Security · 2026-09-17

Renovate adds minimumReleaseAgeBuffer, Dockerfile apk add extraction, Forgejo support, and an uppercase template helper⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds minimumReleaseAgeBuffer config option to control a buffer window around minimum release age checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extracts apk add packages from RUN instructions in Dockerfiles via manager/dockerfile.
• Adds uppercase template helper via util/template for use in Renovate template expressions.

AI/LLM Security · 2026-09-17

Mend AI Guardrails SDK download now requires a Mend Activation Key at install time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Mend Activation Key authentication step to the Guardrails SDK installation procedure, requiring credentials at download time in addition to the existing runtime authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-09-17

MISP v2.5.47 adds PostgreSQL support, AI-assisted analysis, a ledger-based migration system, and major Overmind UI improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Plugin.AI_* settings under a new AI tab in server settings to configure the AI-assisted analysis integration, gated by the new perm_ai_tools role permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds cake Admin migrationStatus, cake Admin migrationApply (with --dry-run to preview SQL), and cake Admin migrationCreate console commands for the new ledger-based migration system.
• Adds INSTALL/POSTGRESQL.sql and a PostgresObserverExtended datasource to support fresh installs on PostgreSQL 16, with install steps documented in docs/CONFIG.postgresql.md.

AI/LLM Security · 2026-09-17

nono v0.78.0 adds backend-signed approval webhooks, macOS DNS opt-out, and a Nix #prebuilt flake output⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CapabilitySet::block_dns() (and C-API nono_capability_set_block_dns() / nono_capability_set_dns_enabled()) on macOS to opt out of implicit mDNSResponder grants in Blocked and ProxyOnly network modes.
• Adds #prebuilt Nix flake output to fetch the official release binary directly from GitHub Releases, skipping source compilation.
• Removes all remaining deprecated surfaces and legacy aliases as part of v1.0.0 preparation.

Reconnaissance & OSINT · 2026-09-17

OpenOSINT v2.29.0 adds Apify cloud actor support, enabling browser-based email recon with no local install required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Apify cloud actor integration, letting users run OpenOSINT Email Recon from a browser or as an MCP tool in Claude, Cursor, and Windsurf via the Apify MCP Server — no Python, binaries, or API keys required locally.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-17

Passbolt adds Offline mode API endpoints to get, save, and delete org-wide offline access settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /offline/settings.json endpoint to retrieve the organisation's current Offline mode settings (max_session_duration, data_retention_period, max_items), returning an empty body when Offline mode is disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST /offline/settings.json endpoint (admin-only) to enable Offline mode by saving settings: max_session_duration (300–86400 s), data_retention_period (1–30 days), and max_items (1–5000 items per user).
• Adds DELETE /offline/settings/{id}.json endpoint (admin-only) to disable Offline mode for the organisation and purge all users' locally stored offline items.

Identity & Access Management · 2026-09-17

Passbolt: Adds offlineMode plugin block in /etc/passbolt/passbolt.php (or PASSBOLT_PLUGINS_OFFLINE_MODE_ENABLED=false env var) to enable or disable the Offline Mode plugin instance-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds offlineModePolicies plugin block in /etc/passbolt/passbolt.php (or PASSBOLT_PLUGINS_OFFLINE_MODE_POLICIES_ENABLED=false env var) to control whether Pro Edition customisable policy settings are active.
• Adds max_session_duration API setting (any whole number of seconds, 300–86400) to control how long a user stays authenticated offline before re-entering their passphrase.
• Adds data_retention_period API setting (any whole number of days, 1–30) to set the maximum time encrypted offline data is stored on a user's device before automatic deletion.

Identity & Access Management · 2026-09-17

Passbolt: Adds contain[offline] query parameter to resource listing endpoints to include per-item offline availability status in the response body.

Identity & Access Management · 2026-09-17

Passbolt 5.16.0 adds Offline Mode (Beta) for secure read-only access and autofill when the server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Offline Mode (Beta) giving users secure read-only access and autofill for selected credentials when the Passbolt server cannot be reached.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-09-17

Plerion renames custom reports to custom dashboards and adds homepage assignment, widget builder, and per-user home dashboard override.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Assign as homepage action in Settings > Custom dashboards to designate a dashboard as the landing page for selected users and user groups on sign-in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Add widget panel of ready-made widgets and Build your own flow with Show me, Broken down by, and Shown as fields for creating custom dashboard widgets.
• Adds Profile > Home dashboard setting that lets individual users override any admin-assigned homepage dashboard, with clearing restoring the assignment.

Continuous Control Monitoring (CCM) · 2026-09-17

RegScale CLI 6.47.0 adds JCAM import for NIST 800-63 digital identity data including assurance levels and federation rationale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JCAM import support for NIST 800-63 digital identity data, including assessed and implemented Identity, Authenticator, and Federation assurance levels, rationale for differences between them, comparability demonstrations, and rationale for not accepting federated identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MCP Servers & Tooling · 2026-09-17

Runlayer adds Enterprise Grok Bot monitoring and DPoP sender-constrained tokens for agent accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Central Grok Bot setup for Enterprise Team deployments, enabling credential provisioning and per-member shadow AI monitoring coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds DPoP (RFC 9449) sender-constrained token binding for agent accounts, tying tokens to a client-held ES256 key so a leaked token cannot be replayed.

MCP Servers & Tooling · 2026-09-17

Runlayer 1.28.515 adds DPoP-bound agent tokens, calendar LLM budget windows, recursive delete detection, and zip skill import.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DPoP binding for agent-account tokens at issuance, enforced at the MCP proxy via a per-agent require DPoP flag and admin UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds calendar-based budget windows (e.g. monthly caps) to LLM gateway usage rules.
• Adds per-tool enrollment diff for recommended security-setting enrollment, showing the effective per-tool diff with scan-direction safety checks before applying.

MCP Servers & Tooling · 2026-09-17

Runlayer 1.28.478 adds a Gmail label-added poll trigger, a Vercel OAuth connector, and agent approval run continuations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Gmail label-added poll trigger that fires an agent whenever a label is added to a Gmail message.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Vercel as a connector available through the OAuth broker.
• Agents now post to Slack as the agent bot by default unless explicitly configured to act as the connected user.

Firewalls & Network Defense · 2026-09-17

Sophos Switch Central 2026.41 surfaces switch names as the primary identifier and adds name-based search on management pages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds name-based search to the search box on switch, site, and stack management pages, alongside existing search criteria.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-09-17

Sysdig Secure: Risk acceptances scoped to an operating system or CPU architecture are now evaluated against the scanned asset's platform in the CLI Scanner.

Secrets Detection & Management · 2026-09-17

TruffleHog Enterprise adds Scan Details UI and read API to track per-integration scan runs, coverage, errors, and live-secret deltas.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Scans tab on each integration in TruffleHog Enterprise UI showing per-run status, start time, active duration, item coverage (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 95 of 98), error count, and live-secrets change delta.
• Exposes a read API for scan runs with endpoints, filters, and response fields documented in the API reference, enabling practitioners to pull scan history into external reporting pipelines.
• Surfaces per-item error details in a drill-down drawer (searchable by name, expandable per entry) opened by clicking the errors count on any run.

Secrets Detection & Management · 2026-09-17

TruffleHog v3.97.5 adds Humio and Resend detectors, S3 object filtering, a --no-ignore-tag flag, and low-memory Git scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --no-ignore-tag global flag to report secrets even when the source line carries a trufflehog:ignore comment, overriding the usual suppression.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds object filtering in S3 scanning, enabling scans to target specific objects within a bucket rather than the entire contents.
• Adds HumioAPIToken detector to classify and validate leaked Humio API tokens.

Digital Forensics & Incident Response · 2026-09-17

Unfurl v2026.09 adds parsers for Gmail, Safe Links, Facebook, Instagram, GitHub, Fernet/itsdangerous tokens, defanged IOCs, and more, plus Tree/Text/dark-mode UI and a layered config system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds UNFURL_BITLY_API_KEY, UNFURL_VIRUSTOTAL_API_KEY, and UNFURL_GOOGLE_KG_API_KEY environment variables for API key configuration, replacing the old bare lowercase names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds UNFURL_REMOTE_LOOKUPS environment variable to enable or disable remote lookups from the environment, overriding both config files.
• Adds unfurl.local.ini as a gitignored, user-local config overlay that overrides unfurl.ini without risking committed secrets.

Data Security & DLP · 2026-09-17

Varonis launches Data Lifecycle Management to automatically find, prioritize, and quarantine ROT data across enterprise data sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Data Lifecycle Management (DLM), a new capability that automatically identifies, prioritizes, and quarantines redundant, obsolete, and trivial (ROT) data across connected data sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Combines data classification, permissions mapping, and activity analysis to surface stale, duplicate, overexposed, and expired data for remediation.

SAST / SCA / Code Security · 2026-09-17

Veracode integrations gain GitHub Fix for SCA, VS Code file filters, custom agent pools in YAML, and platform-managed GitHub install/scheduling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for custom predependency commands in the Veracode YAML file to prepare projects before scanning (GitHub Workflow Integration v2.1.3).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a custom agent pool name parameter in veracode.yml to specify the agent pool for pipeline execution (Azure DevOps Workflow Integration v2.4.3).
• Adds analysis_branch support in veracode.yml so scheduled scans run for the specified analysis branch instead of the default branch (Azure DevOps Workflow Integration v2.3.10).

Web Application Security · 2026-09-17

Wallarm's WAF rules interface gains a unified panel, inline request-path visibility, address-bar filters, and in-list rule management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a unified WAF rules panel listing every rule type in one view, with each filtered view having its own bookmarkable URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Shows the full request-targeting path inline on each rule row (e.g. HEADER › AUTHORIZATION › JWT › jwt_header › BASE64 › JSON › alg) without opening individual rules.
• Adds application and scope filters — distinguishing Default (Wallarm-managed, read-only) rules from team-created rules — persisted in the address bar across reloads.

AI/LLM Security · 2026-09-17

Zenity adds Blue Agent triage, a Boundaries CLI, OTel/gen_ai span ingestion, and GA coverage for GitHub Copilot, OpenAI Codex, and Microsoft Foundry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Boundaries CLI that lets teams manage boundaries, custom taints, and reusable values as version-controlled files, with coding agents like Claude Code and Codex authoring policy against Zenity's schema.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Custom Agents integration that ingests OpenTelemetry (OTel) and gen_ai spans for visibility and inline enforcement via the Evaluate API, connecting any agentic application to Zenity without a dedicated connector.
• Introduces Blue Agent, the first Guardian Agent, which triages every new finding in suggest mode — returning a verdict (benign true positive, false positive, or true positive) with reasoning, confidence level, and full trace attached.

Identity & Access Management · 2026-09-16

1Password SaaS Manager adds AI Assistant public beta and ChatGPT Enterprise org selection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI Assistant (public beta) enabled by default for new SaaS Manager customers, with per-customer disable control available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the ability to choose which ChatGPT organization is used for AI usage tracking when automatic detection selects the wrong organization, preventing authorization errors for customers with separate OpenAI Platform and ChatGPT organizations.
• Adds support for mapping select-type custom fields from Google Workspace to SaaS Manager.

Identity & Access Management · 2026-09-16

Aembit adds CrowdStrike AIDR as a Content Security capability attached to Access Policies, covering MCP tool listings, inputs, and outputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Content Security as a new capability type on Aembit Access Policy objects, enabling administrators to attach a CrowdStrike AIDR content-security configuration to the same enforcement path that governs MCP access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Covers three MCP inspection checkpoints per policy — tool listings, tool inputs, and tool outputs — with AIDR returning an allow, block, or transform verdict that Aembit enforces inline.
• Correlates every CrowdStrike AIDR finding with Aembit's identity and policy context (agent, target MCP server, applicable policy, Content Security decision) in a single workload event.

AI/LLM Security · 2026-09-16

AI SAFE² CLI 0.5.0 adds safe2 evidence diagnose and two strict JSON contracts for evidence-bounded AI agent failure localization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds safe2 evidence diagnose command to rank evidence-supported failure locations across an identified agent system, with --system-identity, --output, --card, and --strict flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces safe2.failure-source.v1 JSON contract as a provider-neutral schema for supplying observations and competing failure candidates to the diagnostic engine.
• Introduces safe2.failure-diagnosis.v1 JSON contract returning deterministic rankings, evidence assessments, ownership, and recommended actions from a diagnosis run.

Web Application Security · 2026-09-16

Arcjet adds a Guards policy authoring system with visual builder, plain-English generation, Rego editor, and a full MCP server API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds list-guard-policies, get-guard-policy, validate-guard-policy, evaluate-guard-policy, describe-guard-policy, suggest-guard-policies, put-guard-policy, delete-guard-policy, and retry-guard-policy MCP server tools for authoring, validating, and publishing guard policies from a coding agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a guard() SDK call (generated per-policy in JavaScript, Go, and Python) that sends typed inputs to evaluate a named policy by label at runtime.
• Introduces Guard policies — site-scoped, label-selected rules that change what a guarded action can do without modifying application code, authored in the Arcjet Console or over MCP.

Web Application Security · 2026-09-16

Arcjet introduces Rego-based agent guard policies evaluated at the edge with a sandboxed OPA subset and fail-closed semantics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports writing agent guard policies in Rego (Open Policy Agent language) under the arcjet.guard package, compiled to an OPA intermediate representation at publish time and interpreted at the edge on every guard call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Policies read a structured input document with four top-level fields: label, actor, values (declared server-side inputs), and signals (detector results keyed by detector ID).
• Detector results are readable under input.signals.<detector-id>.<input-name>.detected and .entities, enabling context-sensitive logic (e.g. block prompt_injection only when input.values.destructive is also true).

Web Application Security · 2026-09-16

Arcjet adds agent activity observability via OpenTelemetry ingest and Claude Compliance API polling — no code changes required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CLAUDE_CODE_ENABLE_TELEMETRY, OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, OTEL_LOG_USER_PROMPTS, and OTEL_LOG_TOOL_DETAILS environment variables to stream Claude Code audit telemetry to Arcjet's OTLP ingest endpoint at https://decide.arcjet.com.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Accepts OTLP exports over HTTP (http/protobuf and http/json) at https://decide.arcjet.com — logs via POST /v1/logs become capture events, traces via POST /v1/traces become capture events (best effort), and metrics via POST /v1/metrics are acknowledged but not recorded.
• Supports org-wide rollout of Claude Code telemetry through Claude Code managed settings, shipping the OTLP env vars centrally instead of relying on each developer's shell.

Web Application Security · 2026-09-16

Arcjet: Adds a response field on guardApproval() accepting a GuardApprovalResponsePolicy (action, rules, metadata, onGuardError) to authorize and rate-limit who may approve a parked HITL request.

• Adds a packaged coding-agent skill at node_modules/@arcjet/guard/skills/integrate-arcjet-guard-eve — copy it to ~/.claude/skills/ and run /integrate-arcjet-guard-eve in Claude Code to scaffold the integration automatically.

Web Application Security · 2026-09-16

Arcjet: Adds @arcjet/guard/vercel-ai/v7 export (no unversioned @arcjet/guard/vercel-ai alias) requiring Node.js >=22.21.0 <23 || >=24.5.0, ai >=7 <8, and @ai-sdk/provider-utils >=5 <6 as optional peers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds createAgentContext() helper to build a typed agent context with a correlationId (1–256 printable ASCII characters; auto-generates a ULID if omitted) and metadata.
• Adds captureAction() helper to record that an action occurred without blocking — never denies.
• Adds guardTool() option inputs accepting policyInput.server.* or policyInput.local.* builders (e.g. policyInput.server.string(), policyInput.server.stringList()) to pass named values readable by remote policies under input.values.

Web Application Security · 2026-09-16

Arcjet: Supports per-call dynamic action, rules, actor, inputs, metadata, and sessionId options on guardMiddleware() as functions of { toolName, input } for per-tool policy customization.

• Installs via @arcjet/guard with @tanstack/ai (>=0.8.0 <1) as an optional peer, requiring Node.js >=22.21.0 <23 || >=24.5.0.

Web Application Security · 2026-09-16

Arcjet: Adds @arcjet/guard/strands-agents/v1 (JS/TS) adapter — import path @arcjet/guard/strands-agents/v1 — exposing guardTool(), guardHooks(), and strandsAgentContext() to enforce Arcjet policy on Strands Agents authored and MCP tools before their callbacks execute.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds arcjet.guard.strands_agents (Python) adapter — installed via arcjet[strands-agents] — exposing guard_tool, guard_hooks, and strands_agent_context for the same enforcement surface in Python agents.
• Adds guardTool() helper that wraps a Strands tool({ callback }) and returns a plain ArcjetDenialResult on DENY without throwing or calling event.interrupt().
• Adds guardHooks() Plugin that registers BeforeToolCallEvent as an invoke-wide gate, setting event.cancel to a JSON-stringified ArcjetDenialResult on DENY; skips tools already wrapped with guardTool() so MCP and unwrapped tools are still gated.

Web Application Security · 2026-09-16

Arcjet: Adds @arcjet/guard/openai-agents/v0 JavaScript adapter that wraps FunctionTool.invoke via guardTool(), blocking the authored handler on DENY before any side effect runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-16

Arcjet: Adds actor and inputs options to guardTool, guardProcessor, and guardHooks, accepting a value or a per-call resolver; inputs must be built with policyInput.server.* or policyInput.local.* — plain values are rejected.

• Supports MASTRA_THREAD_ID_KEY and MASTRA_RESOURCE_ID_KEY set on RequestContext before generate/stream to correlate agent turns without calling createAgentContext.

Web Application Security · 2026-09-16

Arcjet: Adds a @arcjet/guard/langgraph/v1 import path (versioned, no unversioned alias) for the LangGraph adapter, requiring @langchain/langgraph >=1 <2, @langchain/core >=1 <2, and Node.js >=22.21.0 <23 || >=24.5.0.

Web Application Security · 2026-09-16

Arcjet adds LangChain agent guard adapter for JS/TS and Python, enforcing policy at every tool call boundary⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @arcjet/guard/langchain/v1 JavaScript/TypeScript adapter (requires @arcjet/guard 1.11.0+, Node.js >=22.21.0 <23 || >=24.5.0) exposing guardTool(), guardMiddleware(), and langchainContext() to enforce policy before LangChain tool calls run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds arcjet[langchain] Python extra providing guard_tool, ArcjetCaptureHandler, and ArcjetAsyncCaptureHandler for wrapping individual BaseTool instances and observing chains without blocking.
• Adds arcjet[langchain-agents] Python extra providing ArcjetMiddleware and ToolPolicy for agent-level gating via create_agent (requires langchain>=1.3,<2 and langgraph>=1.2,<2).

Web Application Security · 2026-09-16

Arcjet: Adds guardPlugin() from @arcjet/guard/google-adk/v2 as a Runner-wide policy gate that hooks beforeToolCallback on new Runner({ plugins }) or new InMemoryRunner({ plugins }), returning an ArcjetDenialResult deny dict to block tool execution or undefined to allow it — without throwing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-16

Arcjet: Adds the sessionId option on guardTool() and guardMiddleware() as a caller-owned fallback for tool-time correlation when the tool options or hook context do not carry one.

• Supports rules, actor, inputs, and metadata options on both guardTool() and guardMiddleware(), accepting static values or per-call resolver functions of the parsed tool input.
• Requires @arcjet/guard 1.11.0 or later, Genkit >=1.0.0 <2 (verified against 1.41.0, with guardMiddleware needing Genkit >= 1.33 for the generateMiddleware tool hook), and Node.js >=22.21.0 <23 || >=24.5.0.

Web Application Security · 2026-09-16

Arcjet: Adds sanitize_tool_name helper that normalises tool names to match CrewAI's tools= filter convention (e.g. Send Email and send_email resolve to the same tool).

• Adds ArcjetCrewAIHooks handle returned by register_arcjet_hooks, with a handle.unregister() method (also callable as unregister_arcjet_hooks(handle)) to remove the process-wide hook, e.g. in tests.
• Supports actor, inputs, rules, metadata, correlation_id, and policies options on register_arcjet_hooks for attaching identity, typed remote-policy inputs, SDK rules, capture metadata, caller-owned sequence IDs, and per-tool overrides to every gated tool call.

Web Application Security · 2026-09-16

Arcjet: Adds guardTool(client, toolDefinition, policy) from @arcjet/guard/claude-agent-sdk/v0 to wrap authored Claude Agent SDK tools, returning an MCP CallToolResult with isError: true and ArcjetDenialResult on structuredContent when the policy denies the call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds claudeAgentContext() from @arcjet/guard/claude-agent-sdk/v0 to read a caller-owned UUID session_id from hook input or options.sessionId for request correlation.
• Adds guard_tool from arcjet.guard.claude_agent_sdk (Python) to gate authored @tool handlers, returning JSON of ArcjetDenialResult in content with is_error: True on DENY.
• Supports exclude option on guardHooks (JS) and guard_hooks (Python) to skip tools already wrapped with guardTool/guard_tool; accepts { server, name } for authored MCP tools or a bare string for built-ins such as 'Bash'.

Web Application Security · 2026-09-16

Arcjet adds Agent guards — deterministic policy checks before tool-handler actions in JavaScript, Python, and Go.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Agent guards, a new enforcement point that places a deterministic Arcjet policy check immediately before agentic actions (tool handlers, queue consumers, workflow steps, MCP tools) — with no HTTP request required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports writing Agent guard policies in Rego over caller-supplied inputs, with access to Arcjet's own detector findings as facts for conditions.
• Enables sensitive-information detection inline, over strings that never leave your process, as part of an Agent guard decision.

Web Application Security · 2026-09-16

Arcjet adds coding agent policies: Rego-based rules that intercept tool calls and prompts from Claude Code and GitHub Copilot⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds input.values.<name> contract for coding-agent policy rules, exposing fields like tool_kind, tool_name, command, command_tokens, paths, domains, mcp_server, mcp_tool, and prompt in Rego policies under the coding-agent/v1 contract version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tool_kind normalization across Claude Code and GitHub Copilot, mapping vendor-specific tool names to canonical values: shell, file_read, file_write, web, mcp, agent, or other.
• Adds input.signals.prompt_injection.injection.detected signal for use in Rego policies to block turns where prompt injection is detected in prompt events (user-prompt-submit, user-prompt-expansion, user-prompt-transformed).

Web Application Security · 2026-09-16

Arcjet now secures GitHub Copilot sessions via hooks in .github/hooks/arcjet.json, intercepting prompts and tool calls without workflow changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds .github/hooks/arcjet.json hook configuration to intercept GitHub Copilot preToolUse, postToolUse, permissionRequest, userPromptSubmitted, userPromptTransformed, agentStop, sessionStart, and sessionEnd events via HTTP calls to https://decide.arcjet.com/v1/agent-hooks/copilot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports administrator-enforced policy lock by placing the hook config at /etc/github-copilot/policy.d/arcjet.json (root-owned, not group- or world-writable), preventing users from disabling hooks in Copilot CLI.
• Authenticates hooks via the ARCJET_KEY environment variable passed as Authorization: Bearer $ARCJET_KEY, and attributes sessions to developers via the X-Arcjet-Principal header using $USER (or $USERNAME on Windows).

Web Application Security · 2026-09-16

Arcjet now integrates with Claude Code via managed-settings hooks to observe, enforce policy, and record every prompt and tool call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds allowManagedHooksOnly, allowedHttpHookUrls, and disableBypassPermissionsMode lockdown keys to managed-settings.json to prevent developers from injecting their own hooks or bypassing the agent permission flow.
• Delivers hooks via endpoint-managed settings at /etc/claude-code/managed-settings.json (Linux/WSL), /Library/Application Support/ClaudeCode/managed-settings.json (macOS), or C:\Program Files\ClaudeCode\managed-settings.json (Windows), as well as server-managed settings via the claude.ai Admin console and repository-level .claude/settings.json.
• Supports supplying the Arcjet key via an env block in managed-settings.json (exposing $ARCJET_KEY to all agent subprocesses) or as a literal Authorization: Bearer ajkey_… header value that never enters the agent environment.

Web Application Security · 2026-09-16

Arcjet adds agentless policy enforcement for coding agents (Claude Code, GitHub Copilot) with prompt injection screening and full session audit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds policy enforcement for coding agent tool calls via HTTP hooks, evaluating inputs including tool_name, tool_kind, command, command_tokens, paths, domains, mcp_server, and mcp_tool at the pre-tool-use and permission-request execution points — no SDK or code changes required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Screens developer prompts for prompt injection and sensitive information at the user-prompt-submit and user-prompt-expansion execution points.
• Supports reconciling sessions against OpenTelemetry or the Compliance API to identify sessions that ran with no hook decisions.

Web Application Security · 2026-09-16

Arcjet adds agent guard integrations, guard()/capture() primitives, content moderation, and framework-specific tool-call wrappers across 13 AI agent SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guard() method for protecting tool calls, queue consumers, and agentic pipelines without an HTTP request, returning an enforcement decision inline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds capture() method to record that an allowed agent action happened for audit-trail visibility without affecting decisions.
• Adds clientIpDetails() / findIpDetails() (JavaScript), client_ip_details() (Python), and ClientIPDetails() (Go) to inspect client IP provenance before shipping to production.

Web Application Security · 2026-09-16

Arcjet: Adds agent runtime security for LLM tool calls via the arcjet-go SDK (go get github.com/arcjet/arcjet-go@v1.0.0-rc.2), enforcing budgets, blocking prompt injection, and protecting personal information.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes list-guard-policies over MCP to enumerate a site's guard policies and their labels.
• Exposes get-guard-policy over MCP to retrieve a policy's full contract — its label, every declared input, its kind and exposure — so the agent can write calls that match exactly.
• Exposes describe-guard-policy over MCP to author a new guard policy from a natural-language description or a pre-built draft with an execute-on setting and contract.

Managed Detection & Response (MDR) · 2026-09-16

Arctic Wolf launches Aurora MDR Connect, a new MSP-exclusive MDR tier with agentless deployment and full-attack-surface telemetry ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Ingests telemetry from endpoint, network, cloud, identity, SaaS applications, and other sources to deliver detection and response across a broader attack surface than endpoint-only approaches.

Endpoint Security (EDR/XDR) · 2026-09-16

Automox Remote Tools: Splashtop Streamer now auto-reinstalls on re-imaged devices and retries failed installs automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Re-imaged devices with auto-install enabled now have the Splashtop Streamer reinstalled automatically, without manual intervention after an imaging batch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Failed Splashtop Streamer installs now retry automatically when the failure is transient (network interruption, locked file, or antivirus interference), while permanently unresolvable failures (e.g. unsupported OS) are reported immediately.

Identity & Access Management · 2026-09-16

BeyondTrust Remote Support 26.3 introduces automatic version upgrades with configurable Fast Track, Standard Track, and Enterprise Track channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables automatic version upgrades during configured maintenance windows via the Automatic Updates Channel setting (Fast Track, Standard Track, or Enterprise Track), building on the channel setting introduced in 25.3.1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a rollout schedule that staggers upgrades by channel: Fast Track sites begin upgrading to 26.3.x in mid-November 2026, Standard Track after 27.1 GA, and Enterprise Track after 27.2 GA — no deployment is ever moved to a version older than 26.3.
• Allows opting out by clearing Automatically install the latest updates during maintenance day(s) and time in the /appliance Updates > Maintenance Window interface, while retaining manual update capability.

Container & Image Security · 2026-09-16

Chainguard adds 26 new container images this week, including FIPS variants for MongoDB, Kafka, OpenTelemetry, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds clamav-prometheus-exporter (application + FIPS) container image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds crossplane-azure-marketplaceordering (application) container image.
• Adds kserve-sklearnserver (ai) container image.

Secure Access (VPN / SASE / ZTNA) · 2026-09-16

Cisco Duo Desktop adds support for macOS 27 (Golden Gate).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for macOS 27 (Golden Gate).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-16

Duo Desktop 7.21 adds optional telemetry consent, virtual environment detection for GCE and Azure, and OS update status reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Prompts users at startup to opt in to error and usage data collection, configurable at any time in app preferences or set system-wide by administrators to bypass the prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Detects Google Compute Engine and Microsoft Azure as virtual environments.
• Reports OS automatic update status and management agent detection for Secure Access.

Digital Forensics & Incident Response · 2026-09-16

cloud-forensics-utils adds a zone parameter to ExportImage, container explorer deps, and updates the compute-image-import reference.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds zone parameter (default 'us-central1-a') to the ExportImage method, allowing callers to specify the zone for Cloud Build imaging instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds libbtrfs-dev and libgpgme-dev to the forensics packages startup script, expanding container explorer support in imaging instances.

Internet Services · 2026-09-16

Cloudflare adds Workflow event streaming, Browser Run guardrails, DLP Passive Detection, and per-Worker role-based access controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds WorkflowInstance.subscribe() method and GET /subscribe API endpoint to stream Workflow instance events (steps, attempts, sleeps, waits, rollbacks) without polling; supports filter for specific event types and cursor to start at a specific event.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds byok_only: true field on the PUT gateway API request to require provider credentials for AI Gateway third-party requests and prevent fallback to Unified Billing; adds per-request cf-aig-no-wholesale: true header for request-level enforcement.
• Adds include_shadow_metadata=true query parameter to the DNS records API to return shadow metadata identifying delegating NS records and glue A/AAAA records for shadowed DNS entries.

General Utilities & Libraries · 2026-09-16

code-oss gains automatic Agent Host session cleanup settings and an application-icon badge for session attention counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.agentSessions.autoMarkAsDoneMergedSessionsAfterDays setting to automatically mark inactive merged Agent Host sessions as done after a configurable number of days.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.agentSessions.autoDeleteArchivedMergedSessionsAfterDays setting to permanently delete automatically-completed merged sessions after a separate configurable grace period.
• Adds sessions.showApplicationBadge setting (defaults to true in Insiders, disabled in Stable) to show a dock/launcher/taskbar badge counting Agent sessions that have unread results, are waiting for input, or have failing CI checks on an open non-draft PR.

General Utilities & Libraries · 2026-09-16

VS Code adds agent sandboxing (Preview/Experimental) to restrict file system and network access for agent-executed terminal commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds agent sandboxing (Preview on macOS, Linux, and WSL2; Experimental on Windows) to restrict file system and network access for agent-executed terminal commands using OS-level isolation, independent of the selected permission level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-09-16

VS Code adds OS-level agent terminal sandboxing with configurable file system and network boundaries on macOS, Linux, WSL2, and Windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables agent terminal sandboxing via chat.agent.sandbox.enabled (macOS, Linux, WSL2) or chat.agent.sandbox.enabledWindows (Windows), defaulting to off, with a shield indicator in the permissions picker showing effective state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.agent.sandbox.fileSystem.mac, chat.agent.sandbox.fileSystem.linux, and chat.agent.sandbox.fileSystem.windows settings to control sandbox file system access using allowRead, allowWrite, denyRead, and denyWrite rules.
• Adds chat.agent.sandbox.allowNetwork (default true) to toggle network isolation independently of file system restrictions for sandboxed terminal commands.

General Utilities & Libraries · 2026-09-16

VS Code agent automations add .automation.md export/import, scheduling, and plugin-contributed templates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds agent automations that run saved prompt-and-schedule tasks on demand or on a recurring (manual, hourly, daily, or weekly) schedule without starting each session manually.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports exporting an automation as a .automation.md file (readable Markdown with YAML frontmatter) to share or reuse across machines.
• Supports importing a .automation.md file via the Import Automation button in the Automations view, or by dragging the file onto the view.

General Utilities & Libraries · 2026-09-16

Agent Host sessions can now run inside a Dev Container, giving agents access to project-defined tools and dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Use Dev Container option in the workspace picker for eligible local folders, with a - Dev Container suffix on the workspace label to indicate container mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Dev Container sessions support the Copilot harness and Codex (in Interactive mode) on the Agent Host, scoped to local folders only.

General Utilities & Libraries · 2026-09-16

code-oss: File system boundary limits read and write access to configured paths, protecting sensitive locations such as SSH keys and shell configuration, with policies inherited by child processes like package managers and build scripts.

• Network boundary limits outbound connections to configured domains to reduce the risk of data exfiltration and unintended actions on external services.
• On Windows, Microsoft MXC process containers apply file system and network policies to the command process (requires installing the applicable Windows security update).
• By default, terminal commands running inside the sandbox are automatically approved without a confirmation prompt, since they already execute in a controlled environment.

Web Application Security · 2026-09-16

Dalfox v3.2.3 adds GraphQL and XML/SOAP injection surfaces, wider DOM-XSS AST coverage, and a new sub-not-gsub filter bypass detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GraphQL and XML / SOAP request bodies as new injection surfaces for XSS scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Widens DOM-XSS AST coverage to include Promise combinators, optional chaining, and static bracket paths, with more sinks and sources and fewer false positives.
• Detects the sub-not-gsub angle filter bypass: a doubled <<svg ...>> payload opens a real tag where a one-shot str::replace only consumed the first <.

SIEM · 2026-09-16

Databricks ABAC row filters and column masks now extend to views in Unity Catalog (Beta, DBR 19+).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends ABAC row filters and column masks to views (in addition to tables), enabling Unity Catalog policies to control access to sensitive data exposed through views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables the ABAC on Views preview via the account console's Previews page.

SIEM · 2026-09-16

Databricks Data Classification now scans Unity Catalog views (Beta) in addition to tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Data Classification to scan Unity Catalog views in addition to tables, classifying columns for sensitive data using the same detection engine (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-16

Databricks OpenSharing now GA for sharing foreign Delta tables from OneLake, Hive metastore, and AWS Glue without data copying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports sharing foreign Delta tables via OpenSharing from OneLake, Hive metastore, or AWS Glue without copying data into Databricks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-16

READ METADATA privilege becomes available by default for compliance security profile workspaces, exposing grants, row filters, column masks, and ABAC policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables READ METADATA privilege by default for workspaces with the compliance security profile, granting read-only visibility into security-sensitive metadata — including privilege grants, row filters, column masks, and ABAC policies — not exposed by BROWSE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-16

Lakeflow pipelines now support managed tables and append flows with checkpoint migration in Beta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for creating managed tables in Lakeflow pipelines and writing to them via one or more append flows using append_flow (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds import_checkpoint on append_flow to migrate existing Structured Streaming workloads into a Lakeflow pipeline without reprocessing the source.
• Adds create_table and CREATE TABLE ... FLOW (pipelines) syntax for defining managed tables and flows within Lakeflow pipelines.

Vulnerability Management · 2026-09-16

defectdojo: Adds DD_V3_ASSET_ALIASES chart value and compose environment variable to enable per-source asset aliases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes FedRAMP VDR, PAIN, and KEV-cap SLA fields in the Pro UI and REST API.
• Adds Dedupe Pools: group Assets that should deduplicate against each other, choose where originals collect, preview membership-change impact, and re-run deduplication over in-scope Findings with Apply Now.
• Adds new Palo Alto Cortex connector family covering XDR, XSIAM, XSOAR, and Cloud.

Identity & Access Management · 2026-09-16

Didit adds social-footprint add-on for email/phone risk APIs, document-liveness scores, PDF compliance reports, and expanded session event payloads⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds enable_social: true request field to the Email Risk API endpoint to return an email_social block containing online-platform registrations, per-category counts, and profile details for a screened address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds enable_social: true request field to the Phone Risk API endpoint to return a phone_social block containing online-platform registrations, per-category counts, and profile details for a screened number.
• Adds critical_field_occlusion_action parameter to the document-verification endpoint to control session outcome when a critical printed field (identity number, name, date of birth, or expiry date) is physically covered — defaults to Decline; REVIEW returns 400.

Secure Access (VPN / SASE / ZTNA) · 2026-09-16

DNSFilter adds GA Unblock Request Management with CSV export and a redesigned MSP Branding page replacing Whitelabel settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Unblock Requests page to the dashboard, providing a full request queue with Allow or Deny actions, threat-category warnings on risky domains, an Investigate Mode row action for quick Query Log scoping, and CSV export of active and historical requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Redesigns the Whitelabel settings page as a dedicated Branding page, exposing Logo, Favicon, Dashboard Name, and Subdomain URL as individual, first-class branding objects — new MSPs provisioned after September 15 configure a branded subdomain (yourdomain.dnsfilter.com) with current branding defaults.

Secure Access (VPN / SASE / ZTNA) · 2026-09-16

iOS Roaming Client v1.4.5 embeds root certs in the MDM profile and reduces background sync to state-change-only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The .mobileconfig file now includes DNSFilter root certificates alongside the iOS Roaming Client configuration, so a single MDM profile push installs both.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The dns_over_tls_enabled MDM key now accepts false from first registration and persists the setting across DNS extension restarts.
• Changes to dhcp_dns_search_domains now take effect within one configuration refresh with no DNS extension restart required.

Secure Access (VPN / SASE / ZTNA) · 2026-09-16

DNSFilter: Launches the DNSFilter MCP Server (GA) under Integrations → AI Connectors, connecting AI assistants (Claude, ChatGPT, Codex) to DNS activity, threat data, policy management, and allow/block lists via the Model Context Protocol.

• Reinstalling the iOS Roaming Client now reuses the existing device record instead of creating a duplicate registration entry.

AI/LLM Security · 2026-09-16

Docker Sandboxes MCP gateway gains custom request headers with secret-placeholder substitution for remote MCP endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --header 'Name: value' flag to sbx mcp add for sending custom HTTP headers (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Authorization, Accept) to remote MCP endpoints, repeatable per header.
• Adds secret-placeholder syntax ${placeholder} in header values, resolved at sandbox connect time from the host credential store via sbx secret set mcp:<server>:<placeholder>.
• Adds sbx secret rm mcp:<server>:<placeholder> to remove header secrets after a server registration is removed.

AI/LLM Security · 2026-09-16

Docker Sandboxes environment files gain --name flag, ${{ env.fileDir }} reference, and skills access control field⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --name flag to all sbx env subcommands (sbx env create, sbx env run, sbx env rm) to override the sandbox name set in the environment file or auto-generated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ${{ env.fileDir }} variable expression in environment files, expanding to the absolute path of the directory containing the file where the reference is written — useful for locating scripts or assets stored alongside the environment file.
• Adds skills field to environment files, controlling access to the shared agent skills store with values off, readonly, or readwrite; defaults to the daemon default (readonly unless overridden by the organization).

AI/LLM Security · 2026-09-16

Docker Sandboxes adds MCP gateway secret namespacing, scoped custom secrets, GitHub Packages npm credential injection, and --registry-auth-endpoint for self-hosted registries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --sandbox flag to sbx credential commands to scope a custom secret to a specific sandbox instead of the global default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --registry-auth-endpoint flag to trust a separate authentication host when a self-hosted registry (e.g. a self-hosted GitLab instance) uses a split Registry v2 Bearer auth flow.
• Adds --host npm.pkg.github.com --env NODE_AUTH_TOKEN --command 'gh auth token' workflow to inject GitHub Packages credentials into sandboxes for installing private npm packages.

AI/LLM Security · 2026-09-16

Docker Sandboxes adds --skills flag and skills.defaultMode setting to control shared skill store access mode per sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --skills flag to sbx run and sbx create to set the shared skill store mount mode — readonly, readwrite, or off — when creating a sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds skills.defaultMode setting (configurable via sbx settings set) to control the default shared skill store access mode for all future sandboxes, accepting readonly, readwrite, or off.

AI/LLM Security · 2026-09-16

Docker Sandboxes adds until filter for stopped-sandbox queries and auto-stop behavior for local sandboxes after sbx run completes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds until filter to sandbox queries, accepting a duration, RFC 3339 timestamp, or Unix timestamp to scope results by when a sandbox stopped (the existing since=<duration> filter remains supported).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-09-16

Docker Sandboxes v0.43.0 adds tri-state skills sharing, overflow model routing, MCP custom headers, and richer sandbox lifecycle controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --skills=off|readonly|readwrite flag to sbx create/sbx run for tri-state skills sharing (read-only by default); --no-share-skills still works as a deprecated alias for --skills=off.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds skills.defaultMode config key to set the desired default skills-sharing behaviour.
• Adds --overflow-provider/--overflow-model flags to sbx run --model to pair a local model with a hosted fallback for oversized requests.

SIEM · 2026-09-16

Exabeam Threat Detection Management gains automatic activity notifications⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automatic notifications for important Threat Detection Management activity events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-09-16

Fastly adds AI Firewall and AI Runtime Control (ARC) to inspect and govern LLM traffic at the edge.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Fastly AI Firewall, a security module for Fastly AI Runtime Control (ARC) that inspects large language model (LLM) requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Fastly AI Runtime Control (ARC), a control plane that sits between your applications and LLM providers to govern AI traffic.

Firewalls & Network Defense · 2026-09-16

Historical Stats and Real-Time Analytics APIs gain arc_requests metric for AI Runtime Control traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds arc_requests metric to the Historical Stats and Real-Time Analytics APIs to track requests received by AI Runtime Control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-09-16

Finite State adds Phoenix Contact FL SWITCH 2000 unpacking, broader Reachability verdicts, and static-library component detection across more firmware formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Unpacks Phoenix Contact FL SWITCH 2000 firmware updates so the Linux root filesystem and its Components appear in scan results and produce a complete SBOM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Returns a clear error when importing an SPDX 3.x SBOM stating that SPDX 3.x is not yet supported, instead of a generic format-detection failure.
• Records generation context as after-build on binary scan SBOMs, matching the CISA SBOM minimum elements.

Secure Access (VPN / SASE / ZTNA) · 2026-09-16

Firezone macOS/iOS 1.5.20 adds X.509 certificate-backed device trust⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for device trust backed by X.509 certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-09-16

GitGuardian detection engine gains Akamai and Docker Hub analyzers, expanded n8n host detection, and reduced false positives for generic high-entropy secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Updates the GitLab secret analyzer to adapt to changes in GitLab API behavior.
• Updates the Figma Personal Access Token analyzer to reflect changes in the Figma API.
• Updates the OpenAI API Key analyzer's scope checker endpoints following OpenAI API updates.

SAST / SCA / Code Security · 2026-09-16

GitHub Advanced Security configurations can now be enforced at the enterprise level, blocking org and repo admins from overriding policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Enforce for repository and organization owners option to the Enforcement dropdown in security configurations, blocking organization administrators from overriding enterprise-level GitHub Advanced Security settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-16

GitHub Copilot now suggests allowed values when defining custom repository properties, available in public preview for Business and Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Repository custom property suggestions Copilot policy at the enterprise and organization level to control whether Copilot suggests allowed values when creating custom property definitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GitHub Copilot now suggests relevant allowed values when admins create custom property definitions (single-select or multi-select) for repositories, speeding up governance taxonomy setup.

General Utilities & Libraries · 2026-09-16

gh auth login and auth refresh now copy OAuth device codes to the clipboard by default; opt out with gh config set clipboard disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• gh auth login and gh auth refresh now copy OAuth device codes to the clipboard by default, removing a manual copy step during authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-16

Google Unified Security launches with Chrome Enterprise Premium integration, multi-cloud CDIR, and AI Protection for securing AI workloads⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Chrome Enterprise Premium (CEP) integration with Google SecOps, enabling curated detections enriched with Safe Browsing and Google Threat Intelligence (GTI) specifically designed for browser-based threats such as malicious extensions, credential theft, and data exfiltration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds dedicated Google SecOps dashboards for Chrome security events, providing visibility into browser anomalies and facilitating investigation of threats on managed and BYOD devices.
• Enables automated response playbooks for Chrome Enterprise actions — including blocking malicious URLs, blocking extensions, and quarantining devices — directly from the Google SecOps platform.

SIEM · 2026-09-16

Google SecOps parsers gain a match_all option in Grok filters to extract every non-overlapping pattern match from a field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds match_all option to the Grok filter in Google SecOps parser syntax, enabling parsers to extract all non-overlapping pattern occurrences within a field instead of only the first match.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-09-16

NodeZero findings now flow into CrowdStrike Falcon Next-Gen SIEM for correlation with endpoint, identity, and cloud telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates NodeZero validated findings and exposure data into CrowdStrike Falcon Next-Gen SIEM, available via the CrowdStrike Marketplace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables correlation of validated NodeZero exposure data with endpoint, identity, cloud, and other security telemetry during SIEM investigations.
• Incorporates NodeZero validated exposure information into existing security operations workflows within Falcon Next-Gen SIEM.

Secrets Detection & Management · 2026-09-16

Infisical v0.165.11 adds credential-free agents, Snowflake PAM, custom X.509 extensions, self-serve upgrades, and secret-scanning time-unit env vars.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds time-unit support for secret scanning environment variables, enabling human-readable duration configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Snowflake account support to the PAM (Privileged Access Management) module.
• Supports custom X.509 extensions on certificate policies and profiles.

SAST / SCA / Code Security · 2026-09-16

JFrog Boost wraps agent shell commands to compress log noise, index codebases, and export OTLP telemetry to observability backends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces JFrog Boost, a CLI tool that wraps shell commands run by coding agents to compress repetitive log noise before output reaches the agent context window while preserving failures, summaries, and actionable hints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports company-wide Boost deployment via MDM scripts for organization-wide rollout.
• Adds GitHub Actions integration to compress agent shell output in CI workflows.

Identity & Access Management · 2026-09-16

JumpCloud Private Repository now supports in-place app version updates, eliminating the need to recreate applications for each release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Update Version action on an application's Details tab to upload a new binary to the Private Repository without creating a new application, reassigning devices, or rebinding device groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Requires entering an install success exit code before deploying a Windows EXE update so JumpCloud can confirm installation succeeded.
• Refreshes the Organization Profile, Security, and Features tabs in Settings with shorter labels and easier-to-scan helper text.

Identity & Access Management · 2026-09-16

JumpCloud: Adds M365/Azure AD security groups to JumpCloud's Microsoft 365 directory integration.

Identity & Access Management · 2026-09-16

JumpCloud: Replaces deprecated GET api/systemusers/reactivate/{id} with POST https://console.jumpcloud.com/systemusers/reactivate/{id} accepting { activation_email: {email_address} } in the request body.

• Updates Dynamic Groups API memberQuery filters to use $lte and $gte operators, replacing the deprecated $le and $ge syntax, aligning filter syntax across all API list endpoints.
• Removes requirement for JumpCloud Go to be enabled as a feature for discovering unmanaged applications in SaaS Management; the JumpCloud Go browser extension alone is now sufficient.
• Adds multiple IP address support to RADIUS server configurations.

Identity & Access Management · 2026-09-16

JumpCloud: Adds sso_auth event to logs for forced re-authentication events, supporting compliance and security auditing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds asset cloning capability in Asset Management to streamline creation of assets with shared hardware configurations.
• Enforces modern TLS cipher suites for all LDAP connections, limiting to TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, and TLS_RSA_WITH_AES_128_GCM_SHA256, removing CBC-mode and SHA-1/SHA-256 suites.

Identity & Access Management · 2026-09-16

JumpCloud: Adds Update Version on the application's Details tab in the Private Repository to upload a new binary for an existing custom app, deploying it to already-associated devices without re-creating the application, reassigning devices, or rebinding device groups — Windows EXE updates require entering an install success exit code before deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agent Identities (Public Preview) under Identity Management > Agents for non-human identity management of AI agents, with OAuth client credentials generated on the agent's Authentication tab for the JumpCloud AI Gateway, group-based SSO application access via Identity Management > Agent Groups, and MCP server authorization from the agent's Applications tab via Manage connections.
• Expands SCIM group management for prebuilt and custom SCIM apps with a dedicated mapping UI for name overrides, extended schema mapping, and side-by-side object transformation previews; custom activation validation now supports selecting custom group names and representative test users and groups instead of hard-coded defaults, with all sync rules and activities logged to Directory Insights.
• Adds alert trigger conditions based on event frequency to Insights rules, so alerts fire only when defined criteria are met rather than on every single event.

Identity & Access Management · 2026-09-16

JumpCloud: Paginates the items list at 100 items per page for improved navigation of large vaults.

AI/LLM Security · 2026-09-16

Mend AI: Supports abatilo/actions-poetry poetry-version input for automated version tracking in GitHub Actions workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports actions-rust-lang/setup-rust-toolchain toolchain input for automated version tracking in GitHub Actions workflows.
• Supports aquaproj/aqua-installer aqua_version input for automated version tracking in GitHub Actions workflows.
• Supports astral-sh/ruff-action version input for automated version tracking in GitHub Actions workflows.

Data Security & DLP · 2026-09-16

Netskope adds Agent Action Control to intercept and block risky AI agent actions before they execute⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agent Action Control to the Netskope AI Security suite, enabling security teams to inspect and block AI agent actions before they execute.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-09-16

Obsidian 1.14.2 lets you open any file from outside your vault and sets itself as your OS default Markdown viewer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Open file from outside the vault... command to open any file on your computer in the current window (Desktop only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Obsidian now registers in the OS Open with menu and can be set as the default app for Markdown files (requires latest installer).
• Base font size is no longer saved to appearance.json — it moves to device local storage so it no longer syncs across devices via Obsidian Sync.

General Utilities & Libraries · 2026-09-16

Obsidian Mobile 1.14.2 adds extra large Quick Capture and View Note widgets for iOS 27.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Quick Capture's color scheme now matches the active vault's color scheme on iOS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-16

OX Security launches OX Cloud with AI Detection and Response (AIDR) and Agentic Attack Surface Management (AASM) for AI-agent visibility in cloud environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI Detection and Response (AIDR) to detect and govern AI agent activity across cloud and runtime environments in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Agentic Attack Surface Management (AASM) to discover AI agents, models, MCP servers and non-human identities and map what they can reach.
• Introduces OX Cloud as a full CNAPP platform covering Cloud Security Posture Management (CSPM), Kubernetes Security Posture Management (KSPM), Data Security Posture Management (DSPM), runtime vulnerability detection, cloud inventory and graph-based attack path analysis.

SAST / SCA / Code Security · 2026-09-16

OX Cloud launches as a unified CNAPP platform with real-time AI agent detection (AIDR), runtime inspection, and reachability-based prioritization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AIDR (AI Detection and Response) for real-time detection and governance of AI-driven usage, configuration, and threats across cloud and runtime environments, including AI agents calling tools, models accessing data, and MCP servers executing autonomously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Agentic Attack Surface capability, powered by the OX Agent, to uncover hidden backdoors and reachable exposures through agentic-level inspection.
• Adds Runtime Events capability for investigating runtime anomalies with full context to accelerate incident detection and triage.

SAST / SCA / Code Security · 2026-09-16

Phoenix Security adds native integration with Rapid7 InsightVM SaaS platform for vulnerability ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Rapid7 InsightVM (SaaS/cloud) as a new scanner integration, configurable via Integrations > Scanners > Add Scanner Integration with a Server URL in the form https://{region}.api.insight.rapid7.com/, API Username, and Password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-16

PingOne adds custom client IDs/secrets for imported apps, AI agent type detection in Bot Detection, and an updated Audit UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support via the PingOne API for setting a custom client ID and client secret when importing OIDC-based applications and custom resources from PingFederate or third-party solutions into PingOne.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enhances the PingOne Protect Bot Detection predictor with new rules to identify specific computer-using agent (CUA) types for more granular AI-driven activity monitoring, available in Protect (Signals) SDK 5.6.10 and later; workforce flows may also require PingID Device Trust agent version 1.2 or later.
• Updates the Audit UI with a modernized interface and a simplified time zone selector.

Identity & Access Management · 2026-09-16

PingOne DaVinci enforces a baseline content security policy (CSP) for all production flows on PingOne domains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enforces a baseline content security policy (CSP) on all flows running on a PingOne domain in production environments, rolled out in phases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-16

Ping Identity: Releases Protect (Signals) SDK version 5.6.11 for Web.

• Releases PingID Device Trust agent version 1.2 with improved data collection.

Identity & Access Management · 2026-09-16

Ping Identity Advanced Identity Cloud adds OAuth 2.0 CIMD support, Rich Authorization Details, and new LDAP/Identity Store Decision node versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds redirectUrlType and customRedirectUrl parameters to the backchannel transaction initialize endpoint, enabling customization of the redirect URI returned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Store Software Statement setting on the OAuth 2.0 provider to persist the software statement provided during dynamic client registration (DCR) in the client configuration and return it in DCR read responses.
• Adds Allow audience members to introspect tokens setting on the OAuth 2.0 provider, permitting any client whose client_id appears in a token's aud claim to introspect that token without a special scope.

Identity & Access Management · 2026-09-16

Ping Identity: Supports EC key attestation for Android device binding, including compatibility with newer Google hardware attestation root certificates.

• Adds error logging to the reCAPTCHA Enterprise node when its Google project, site key, or API key secret is misconfigured.

CNAPP · 2026-09-16

Plerion Terraform onboarding now supports all three workload scanning modes, including operator-owned service accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Terraform onboarding now supports all three workload scanning deployment models, including a service account you own and Plerion operates, keeping scanning inside your organization without appliances in scanned accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Two Terraform templates provision a service account setup: one grants Plerion the required access, and one deploys per-region resources (appliance network, auto-scaling scan pool, and snapshot encryption key), both registering with Plerion automatically during terraform apply with no manual console steps.

SAST / SCA / Code Security · 2026-09-16

Portkey MCP Gateway gains two-layer authentication with API key, OAuth 2.1, external IdP, and per-model pricing adjustments⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP Gateway authentication via x-portkey-api-key header (API key scoped to workspaces, requires mcp invoke permission, created in Settings > API Keys).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OAuth 2.1 support for MCP Gateway: when no API key is present Portkey acts as the OAuth provider and initiates a browser-based consent flow for interactive tools such as Claude Desktop or Cursor.
• Adds External IdP (Bring Your Own Identity) support for MCP Gateway, enabling JWT validation from Okta, Auth0, Azure AD, and Cognito so users without Portkey accounts can access MCP servers.

Vulnerability Management · 2026-09-16

Qualys TruRisk Eliminate adds AI-powered Patch Reliability Scoring and automated host isolation via Cloud Agent for overdue CISA KEV vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds patch.kb QQL filter in the Patch Management app (Patches > Windows) to surface Patch Reliability assessments for specific KBs, with Patch Reliability: Low drill-down opening an AI Assessment window showing known issues and source links via Detailed Report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI-Powered Patch Reliability Scoring in TruRisk Eliminate that combines LLM-analyzed public sentiment with Qualys telemetry on patch rollback and vulnerability reopen rates to produce a pre-deployment reliability score (Low / High) for each patch.
• Adds automated host isolation in TruRisk Eliminate, triggered natively through the Qualys Cloud Agent when a user-defined QQL policy is met — no EDR integration required — quarantining the host within seconds and writing a timestamped audit record of which rule, host, and deadline triggered the action.

MCP Servers & Tooling · 2026-09-16

Runlayer 1.28.428 adds webhook HMAC signing, scan budgets with fail-open/closed control, Terraform-managed agents, and Windows browser auto-deploy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds runlayer_agent resource and data source to the Terraform provider so agents can be fully managed as infrastructure-as-code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds HMAC signing for agent webhooks — create, rotate, and disable signing secrets from the webhook dialog, with a scheme picker and curl examples.
• Adds scan budgets to ToolGuard: configure latency and payload budgets with fail-open/fail-closed behavior, allow/truncate/block payload actions, and budget-exceeded events written to audit logs.

Attack Surface & Exposure Management · 2026-09-16

runZero API gains endpoints to suppress and unsuppress vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds API endpoints to suppress and unsuppress vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-16

SonarQube: Adds Scoped Organization Tokens (SOTs) for non-user-specific authentication in SonarQube Cloud organizations.

• Adds SonarQube CLI environment-variables configuration for non-interactive use in CI/CD pipelines, container builds, and headless environments.
• Adds SonarQube CLI output-format selection covering human-readable, script-friendly, spreadsheet, and AI-agent formats.
• Adds native support for analyzing YAML files detected as Azure Pipelines in SonarQube Cloud and SonarQube Server (including 2026.3).

Endpoint Security (EDR/XDR) · 2026-09-16

Sophos Protection for Linux 2026.2 adds kernel 6.19/7.0 support and expands account-activity telemetry to the data lake.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands account_activity_linux data lake events to include account creation, deletion, and modifications to group membership.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Improves event processing performance for endpoints with heavy container activity.
• Introduces data-lake batching updates to increase alert fidelity.

Endpoint Security (EDR/XDR) · 2026-09-16

SPL 2026.3 adds tamper resiliency, a diagnostic CLI tool, DNS/SNI data lake events, and Update Cache/Message Relay support for Linux servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Endpoint Self Help command-line tool for administrators to view product health and collect diagnostic information from a Linux server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables Linux servers with SPL Agent to be configured as Update Caches and Message Relays in Sophos Central.
• Adds automatic detection and recovery for unauthorized changes to SPL Agent files (Tamper Resiliency).

Firewalls & Network Defense · 2026-09-16

Sublime Security can now ingest Microsoft 365 Junk reports as user-reported phishing signal without changing end-user workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new opt-in setting under Admin > Account > Abuse Mailbox to ingest Outlook Junk reports as user reports for Microsoft 365 message sources, capturing phishing signal without requiring end-users to use the Report Phishing button.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

IDS / IPS · 2026-09-16

Suricata 8.0.7 adds dataset subdomain matching, a new tcp.session keyword, ARP accept policy option, and SMTP firewall progress states.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds accept-arp option under firewall.policies config to control whether ARP traffic is accepted by the firewall policy engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds default-policy setting to firewall policy config for specifying a fallback action when no explicit policy matches.
• Adds match subdomain option to the dataset keyword, enabling rules to match subdomains of entries in a dataset.

Cloud Security Posture · 2026-09-16

KSPM Analyzer v1.49.5 reduces node IOPS by excluding kubelet pod volume mounts from CIS Linux Benchmark filesystem scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Improves CIS Linux Benchmark filesystem scans in KSPM Analyzer v1.49.5 by excluding kubelet pod volume mounts, reducing IOPS on nodes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-09-16

Sysdig CLI Scanner v1.30.0 adds standalone binary scanning, license reporting, and Hummingbird OS support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds standalone binary scanning via --detect-unknown-executables to identify and report vulnerabilities in applications not installed by a package manager, including executables the scanner does not recognize.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for Binary Allow List and Binary Deny List rules, so vulnerability policies that allow or deny specific binaries are now evaluated by the CLI Scanner.
• Adds per-package license data (including license category) to the JSON scan result under the v1 schema, available via --output json, in Technical Preview.

General Utilities & Libraries · 2026-09-16

SysReptor 2026.75 adds a JSON field type, AI agent on by default, Jira pagination, and retest status color indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds json field type for report fields, enabling structured data entry in findings and templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Plugin jira: follows API pagination to list all available projects, removing the previous cap on visible Jira projects.
• Enables the AI agent by default in settings, so new deployments get AI-assisted reporting without manual activation.

Endpoint Security (EDR/XDR) · 2026-09-16

Trend Vision One adds Outlook Add-in integration so users can report phishing simulation emails directly from their inbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Report Phishing button via the Outlook Add-in so users can report suspicious or simulated phishing emails directly from Microsoft Outlook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Tracks which users reported simulated phishing emails within simulation analytics, adding a new response option to the phishing results filter.
• Adds a new user status in simulation profiles describing the method used to report a phishing email.

Endpoint Security (EDR/XDR) · 2026-09-16

Trend Vision One Security Awareness adds OpenLDAP as an identity data source for user import and sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenLDAP as a supported identity data source in Security Awareness, enabling direct user import and synchronization from LDAP-based directories for phishing simulations and training campaigns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-16

Service Gateway 3.0.34 adds Rocky Linux 9.8, package signature verification, Brazil site support, and new MicroK8s debug CLI commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CLI commands to enable and disable MicroK8s debug logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds package signature verification before firmware upgrade and service installation.
• Adds Brazil (BR) site FQDN support.

Endpoint Security (EDR/XDR) · 2026-09-16

Version Control Policies gains pattern update schedule management for TrendAI Vision One agent 202609+⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pattern update schedule configuration to Version Control Policies, reachable via Endpoint Security → Endpoint Security Configuration → Version Control Policies, for agents on version 202609 and later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Engine updates now follow agent software update settings when managed through Version Control Policies, consolidating previously separate controls.
• Enrollment into Version Control Policies now automatically enrolls all unenrolled Protection Manager instances in a single operation.

Endpoint Security (EDR/XDR) · 2026-09-16

Private Access Connector 3.9.0.2162 adds Proxmox platform support and richer Browser Access diagnostic logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enhances application access visibility with improved telemetry data in Secure Access history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds more detailed diagnostic logging for Browser Access to aid troubleshooting.

CNAPP · 2026-09-16

Upwind Code now supports Azure DevOps and Bitbucket Cloud, completing coverage across all four major version control providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Azure DevOps integration, connecting at the organization level through Microsoft Entra ID to discover repositories and surface findings on pull requests without modifying existing CI/CD pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Bitbucket Cloud integration, connecting at the workspace level to automatically include new repositories and surface findings within pull request review workflows.
• Enables reporting scan results from any version control provider to Upwind through the API, for teams not using GitHub, GitLab, Azure DevOps, or Bitbucket Cloud.

SAST / SCA / Code Security · 2026-09-16

Veracode SAST gains Dart 3.13/Flutter 3.47, PHP 8.4/8.5, Pipeline Scan 200 MB+ artifact support, and an enhanced Python scanner with PySpark/Flask/Django/FastAPI coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds veracode.json support for excluding specific Java .jar files from static analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds veracode.json support for excluding specific Java classes from Static Analysis.
• Expands hardcoded secrets detection to include application configuration files with -local and -prod naming patterns in Java.

AI/LLM Security · 2026-09-16

WitnessAI adds intent-based AI data classification with agentic controls, MCP allow-lists, and data tokenization across the full prompt lifecycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Observe module for network-level discovery of AI tools and MCP connections — including native apps like Windows Copilot and Microsoft 365 — cataloging thousands of AI applications without endpoint clients or browser extensions, and attributing captured agent actions to a human identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Agentic Control to enforce approved-tool and MCP allow-lists, block unauthorized tool calls before execution, perform pre-execution checks on approved tool calls, apply runtime controls to agent activity, and maintain a full audit trail of governed agent and tool-call activity across more than 100 LLM types.
• Adds Protect runtime guardrails to inspect prompts and filter harmful or off-policy responses in AI interactions routed through the platform, covering both inputs and generated outputs for PII and sensitive data per NIST Generative AI Profile guidance.

AI/LLM Security · 2026-09-16

Zenity now publishes an API — 3 endpoints across 3 areas: .well Known, Api, Markdown⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• .well Known (1 endpoint) — read⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Api (1 endpoint) — read
• Markdown (1 endpoint) — read

AI/LLM Security · 2026-09-15

AI SAFE² CLI 0.4.0 introduces a portable agent system identity manifest with new safe2 evidence system and safe2 schema export commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds safe2 evidence system SOURCE --output FILE command to normalize an attributed agent-system identity declaration into a portable manifest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --strict flag to safe2 evidence system and safe2 evidence manifest to exit with status 1 when identity gaps, unknown evidence bases, missing versions, or disconnected components are detected.
• Adds safe2 schema export system-identity-source-v1 command to export the provider-neutral input contract for agent system identity.

AI/LLM Security · 2026-09-15

ai-safe2-framework: Adds safe2 evidence harness SOURCE --output FILE to validate and normalize a provider-neutral harness export into a structured AI SAFE² evidence result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a seven-domain coverage inventory assessing task lifecycle, tool calls, artifacts, tests, usage, environment state, and completion claims.
• Adds SHA-256 source-byte binding that records the digest and size of the exact harness export that was processed.
• Adds evidence attribution that preserves the producer, export identifier, source references, and collection basis across intake.

Web Application Security · 2026-09-15

Arcjet Guard adds Vercel Eve agent integration with guardTool(), guardApproval(), guardInbound(), and arcjetHooks() helpers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guardTool() from @arcjet/guard/vercel-eve/v0 to wrap an authored Eve tool's execute, throwing ArcjetDeniedError on DENY or returning ArcjetDenialResult when onDeny: 'result' is set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds guardApproval() from @arcjet/guard/vercel-eve/v0 to gate OpenAPI connections, MCP connections, and defineDynamic tools before execution, with optional onAllow: 'user-approval' for human-in-the-loop gating and a response field (GuardApprovalResponsePolicy) to authorize the responder.
• Adds guardInbound() from @arcjet/guard/vercel-eve/v0 to screen inbound text on an Eve channel (agent/channels/*.ts) before the agent session starts, requiring a stable correlationId (e.g. conversation ID) so the decision joins the session later.

Web Application Security · 2026-09-15

Arcjet adds a Vercel AI SDK v7 agent guard integration to intercept and policy-gate AI tool calls before execution⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @arcjet/guard/vercel-ai/v7 export with guardTool(), aiToolsContext(), createAgentContext(), guardAction(), captureAction(), and securityMetadata() helpers for securing Vercel AI SDK agent tool calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds guardTool() to wrap AI SDK tool({ execute }) handlers so Arcjet policy runs before execute; on DENY the model receives a structured ArcjetDenialResult ({ arcjetDenied, reason, message, retryable, retryAfterSeconds? }) instead of the tool running.
• Adds guardAction() to gate app-invoked (non-model) functions, throwing ArcjetDeniedError on policy denial and ArcjetGuardUnavailableError when the policy cannot be evaluated.

Web Application Security · 2026-09-15

Arcjet adds a TanStack AI adapter with guardMiddleware() and tanstackAiContext() for securing AI agent tool calls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guardMiddleware() from @arcjet/guard/tanstack-ai/v0 as a chat({ middleware }) gate that intercepts every tool call via onBeforeToolCall, denying by returning { type: 'skip', result } with an ArcjetDenialResult before the tool's execute runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tanstackAiContext() from @arcjet/guard/tanstack-ai/v0 to correlate guard calls to a caller-owned session, reading correlationId, sessionId, or conversationId from chat({ context }) — never minting or reading TanStack-generated IDs like threadId, requestId, streamId, or traceId.
• Adds onDeny: 'abort' option on guardMiddleware() to stop the entire chat run with { type: 'abort', reason } instead of the default skip behavior.

Web Application Security · 2026-09-15

Arcjet: Adds @arcjet/guard/strands-agents/v1 (JavaScript/TypeScript) and arcjet[strands-agents] (Python) adapters that integrate Arcjet policy enforcement into Strands Agents tool handlers via guardTool() / guard_tool and guardHooks() / guard_hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guardTool() helper (JS) and guard_tool helper (Python) to wrap authored @tool / tool({ callback }) handlers so the original callback never runs on DENY.
• Adds guardHooks() plugin (JS) and guard_hooks hook provider (Python) that register on BeforeToolCallEvent to gate unwrapped and MCP tools agent-wide without modifying individual tool handlers.
• Adds strandsAgentContext() (JS) and strands_agent_context (Python) helpers that extract a caller-owned correlationId / correlation_id, sessionId / session_id, or requestId / request_id from invocationState for session correlation in the Arcjet Console.

Web Application Security · 2026-09-15

Arcjet Guard adds OpenAI Agents adapters for JS/TS (@arcjet/guard/openai-agents/v0) and Python (arcjet.guard.openai_agents) to gate function-tool handlers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @arcjet/guard/openai-agents/v0 JavaScript/TypeScript adapter that wraps FunctionTool.invoke via guardTool() to allow or deny authored tool calls before any side effect runs, returning ArcjetDenialResult ({ arcjetDenied, reason, message, retryable, retryAfterSeconds?⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ }) on DENY.
• Adds arcjet.guard.openai_agents Python adapter (installed via arcjet[openai-agents], requires openai-agents>=0.19.0,<1 and CPython 3.10+) with guard_tool() that attaches policy gating on FunctionTool.tool_input_guardrails and calls reject_content(...) on DENY.
• Adds openaiAgentsContext() (JS) and openai_agents_context() (Python) helpers to extract a caller-owned correlation ID from runContext.context — reading correlationId, then sessionId, then conversationId, then groupId — without minting a new ID.

Web Application Security · 2026-09-15

Arcjet: Adds guardProcessor() from @arcjet/guard/mastra/v1 for use in Mastra inputProcessors / outputProcessors, calling abort() (tripwire) on DENY and screening later agentic steps via processInputStep so tool continuations cannot skip the inbound gate.

• Adds guardHooks() from @arcjet/guard/mastra/v1 providing beforeToolCall / afterToolCall for MCP, workspace, or toolset tools not wrapped by guardTool; beforeToolCall returns { proceed: false, output } on DENY, while afterToolCall is observe-only.
• Adds mastraAgentContext() to read correlation IDs from MASTRA_THREAD_ID_KEY, then resource, then workflow.runId on RequestContext without minting a new ID.
• All helpers accept an action string (or a function of { toolName } for hooks), rules, metadata, and onGuardError ('deny' default or 'allow') options.

Web Application Security · 2026-09-15

Arcjet: Adds guardToolNode() from @arcjet/guard/langgraph/v1 to guard a ToolNode in place — including MCP and runtime-discovered tools — defaulting to onGuardError: 'deny' (fail-closed) and skipping already-branded guardTool tools to avoid double-calling.

• Adds langgraphAgentContext() from @arcjet/guard/langgraph/v1 to correlate guard calls using configurable.thread_id, then the run ID, then configurable.checkpoint_ns — without minting an ID or calling createAgentContext.
• Supports inbound prompt-injection screening via a direct client.guard({ label, rules, ...langgraphAgentContext(config) }) call before graph.invoke, with decision.hasFailedOpen() available to fail closed when needed.
• Requires Node.js >=22.21.0 <23 || >=24.5.0 and peers @langchain/langgraph (>=1 <2) and @langchain/core (>=1 <2), installed via npm install @arcjet/guard @langchain/langgraph @langchain/core.

Web Application Security · 2026-09-15

Arcjet: Adds @arcjet/guard/langchain/v1 JavaScript/TypeScript adapter with guardTool(), guardMiddleware(), and langchainContext() helpers to enforce Arcjet policies at LangChain tool call boundaries before side effects run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds arcjet.guard.langchain Python adapter via arcjet[langchain] and arcjet[langchain-agents] extras, exposing guard_tool, ArcjetMiddleware, ToolPolicy, ArcjetCaptureHandler, and ArcjetAsyncCaptureHandler.
• Introduces guardMiddleware() (JavaScript) and ArcjetMiddleware + ToolPolicy (Python) as an invoke-wide gate passed to createAgent({ middleware })/create_agent, with a wrapToolCall hook that denies by returning a real ToolMessage instead of calling the handler.
• Introduces langchainContext() helper to read configurable.thread_id, caller-owned sessionId/conversationId, or init.sessionId/init.correlationId for correlating Guard decisions across interrupted and resumed agent runs.

Web Application Security · 2026-09-15

Arcjet adds a Google ADK (TypeScript) integration with guardPlugin and googleAdkContext from @arcjet/guard/google-adk/v2⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guardPlugin() from @arcjet/guard/google-adk/v2 as a Runner-wide beforeToolCallback gate for Google ADK JS (@google/adk v2), denying tool calls by returning an ArcjetDenialResult dict before FunctionTool.execute runs — supports action, rules, metadata, sessionId, and onGuardError options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds googleAdkContext() from @arcjet/guard/google-adk/v2 to correlate direct guard() inbound calls with a caller-owned ID read from correlationId, then sessionId, then conversationId on the object passed to it.
• Requires Node.js >=22.21.0 <23 || >=24.5.0 and @google/adk >=2 <3 (optional peer) for the new integration; import path is the versioned @arcjet/guard/google-adk/v2 with no unversioned alias.

Web Application Security · 2026-09-15

Arcjet: Adds guardTool() from @arcjet/guard/genkit/v1 to wrap a Genkit ToolAction returned by ai.defineTool(), enforcing remote policy before any side effect runs and returning an ArcjetDenialResult as toolResponse.output on DENY instead of throwing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guardMiddleware() from @arcjet/guard/genkit/v1 as a generateMiddleware tool hook passed via ai.generate({ use }), gating all tool invocations — including MCP and injected tools that cannot be looked up — while skipping already-branded guardTool actions.
• Adds @arcjet/guard/genkit/v1 versioned import path for the Genkit JS adapter (Genkit >=1.0.0 <2), requiring @arcjet/guard 1.11.0 or later and Node.js >=22.21.0 <23 || >=24.5.0; guardMiddleware requires Genkit >= 1.33 for the generateMiddleware tool hook.

Web Application Security · 2026-09-15

Arcjet adds official CrewAI Python integration with register_arcjet_hooks, guard_tool, and free_text_arguments helpers for agent tool gating⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds arcjet.guard.crewai module with register_arcjet_hooks, guard_tool, free_text_arguments, sanitize_tool_name, unregister_arcjet_hooks, ArcjetCrewAIHooks, and ToolPolicy helpers for securing CrewAI agent tool calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds register_arcjet_hooks to register a process-wide PRE_TOOL_CALL hook that enforces Arcjet policy before any crew, LiteAgent, or MCP adapter tool runs; raises HookAborted(reason=..., source='arcjet') on DENY.
• Adds guard_tool to wrap a standalone CrewAI BaseTool you invoke directly via run() or arun(), raising ArcjetDeniedError on DENY and ArcjetUnavailableError when Guard cannot be evaluated.

Web Application Security · 2026-09-15

Arcjet Guard adds agent security helpers for Claude Managed Agents, covering inbound prompt screening and custom-tool gating in JS and Python.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guardEvents / guard_events helper to screen inbound user.message events for prompt injection before sessions.events.send is called, blocking the turn on DENY so the model never sees the prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds guardCustomTool / guard_custom_tool helper to intercept agent.custom_tool_use events and block handler execution on DENY, returning the denial as user.custom_tool_result with is_error set.
• Adds claudeManagedAgentsContext / claude_managed_agents_context helper to attach a caller-owned correlation ID (e.g. a conversation ID) to Guard calls without minting a new ID.

Web Application Security · 2026-09-15

Arcjet: Adds guardTool(client, toolDefinition, policy) (JS) and guard_tool (Python) helpers that wrap an authored tool() / @tool handler and return an ArcjetDenialResult (isError: true / is_error: True) on DENY without running the handler.

• Adds guardHooks() (JS) and guard_hooks() (Python) helpers that register UserPromptSubmit, PreToolUse, and PostToolUse hooks to screen inbound prompts for injection and deny unwrapped built-in and MCP tools.
• Adds guard_hooks options inbound, tools, exclude, actor, inputs, rules, metadata, session_id, correlation_id, and on_guard_error to control which surfaces are gated and how errors are handled.
• Supports the detectPromptInjection() rule inside guardHooks / guard_hooks inbound to block prompt-injection attempts in UserPromptSubmit before the model sees the prompt.

Managed Detection & Response (MDR) · 2026-09-15

Arctic Wolf launches Aurora MDR Connect, a new MDR tier built exclusively for MSPs to deliver modern security operations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Aurora MDR Connect, a new tier of Aurora Managed Detection and Response built exclusively for MSPs, powered by the Aurora Superintelligence Platform and the Aurora Agentic SOC.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-15

Auth0 adds match_all: true to Tenant ACL for a blanket Deny All rule across the full tenant scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds match_all: true attribute to Tenant Access Control List (ACL) rules, enabling a Deny All rule that rejects all incoming traffic across the full tenant scope without requiring specific signal matching (IP, geolocation, etc.).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Password & Credential Cracking · 2026-09-15

bopscrk 2.4.7 adds extensive case transform mode and new basic case operations for wordlist generation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables extensive_case option in bopscrk.cfg to generate ALL possible case transforms of each word, producing larger but more thorough wordlists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new basic case transform operations beyond the previous defaults (lower, upper, each-char-upper, pairs-upper, odds-upper, consonants-upper, vowels-upper).
• Improves case transform logic so transforms now respect the case of the original input word.

Password & Credential Cracking · 2026-09-15

bopscrk: Dramatically increases speed and performance of wordlist generation.

Vulnerability Management · 2026-09-15

Brinqa adds five new connectors: Azure Container Service, Azure Identity, Azure Network, Parquet, and Pentera.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Microsoft Azure Container Service connector for Cloud Resource data ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Microsoft Azure Identity connector for Cloud Resource data ingestion.
• Adds Microsoft Azure Network connector for Cloud Resource data ingestion.

Attack Surface & Exposure Management · 2026-09-15

Censys adds case-insensitive regex to CenQL, 22 new protocol/app scanners, and two new ASM risk fingerprints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the (?i) case-insensitive regex operator to the Censys Query Language (CenQL), enabling case-insensitive value=~ pattern matching in host.services.endpoints.http.headers and other string fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds 22 new protocol, application, and endpoint scanners to the Platform, including UTILINET_LPP, ORENCO_ATRTU, OPW_FSC3000 (Critical Infrastructure module), PIGEONHOLE, SAMSUNG_OFFICESERV, CISCO_SDWAN_VDAEMON, VANTAGE_INFUSION, CNORD_SECURITY_CENTER, VISIONHITECH_IPCAM (Starter/Search/Core), and OTLP_GRPC, NETFLIX_NRDP, HIKVISION_DNVRS, SPOTIFY_CONNECT, MANAGESIEVE, LIBP2P, TAURUS_STB, GEOVISION_AUDIO, BLUEMAX_NUTTCP, WOW_REALMD, THRULAY, STOMP, and CLAMAV (all users).
• Adds two new ASM risk fingerprints queryable via risks.name: Vulnerable GitLab Server (CVE-2026-85706) (unauthenticated arbitrary file read via repository commits API) and Vulnerable GitLab Server (CVE-2026-87719) (authenticated credential leak via GraphQL subscription in GitLab EE).

Container & Image Security · 2026-09-15

New guide: sync Chainguard registry images to Harbor via proxy cache or replication rule⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chainctl auth configure-docker --pull-token as the way to generate pull-token credentials for Harbor to authenticate against cgr.dev.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports configuring a Harbor proxy cache project (e.g. cgr-proxy) backed by the Chainguard registry, enabling docker pull $HARBOR_URL/cgr-proxy/$ORGANIZATION/$IMAGE:$TAG.
• Supports configuring a Harbor pull-based replication rule (e.g. cgr-mirror) to copy images from the Chainguard registry into a local Harbor project, with Flatten All Levels flattening and scheduled or manual trigger modes.

Container & Image Security · 2026-09-15

New guide: set up Google Artifact Registry as a pull-through cache for Chainguard Free and Production containers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds gcloud secrets create and gcloud secrets versions add workflow to store a Chainguard pull token password as a Google Secret Manager secret for authenticated Artifact Registry pull-through.

Container & Image Security · 2026-09-15

Chainguard: Supports configuring a remote Artifactory repository pointed at https://cgr.dev/ with the optional Project ID field to strip the chainguard/ or organization-name prefix from downstream pull paths.

• Enables Artifactory as a pull-through cache for Chainguard Free Containers via a remote repository (example key cgr-public) requiring Enable Token Authentication and Block Mismatching Mime Types settings.
• Enables Artifactory as a pull-through cache for Chainguard Production Containers via a remote repository (example key cgr-private) authenticated with a chainctl-generated <identity-id> and <pull-token>.
• Supports configuring an Artifactory virtual repository to aggregate both free (cgr-public) and production (cgr-private) remote repositories under a single pull endpoint.

Container & Image Security · 2026-09-15

Chainguard containers can now be pulled through Amazon ECR pull-through cache using a stored pull token in AWS Secrets Manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports storing Chainguard credentials in AWS Secrets Manager under the ecr-pullthroughcache/ prefix using the username and accessToken keys, enabling ECR to authenticate to cgr.dev on your behalf.
• Supports creating an ECR pull-through cache rule via aws ecr create-pull-through-cache-rule with --upstream-registry-url cgr.dev, --upstream-repository-prefix, and --credential-arn to cache Chainguard Production Containers in your private ECR registry.
• Adds native Chainguard upstream option in the Amazon ECR console under Private registry > Pull through cache > Add rule, with a dedicated Chainguard upstream selection and namespace scoping controls.

Container & Image Security · 2026-09-15

Chainguard adds chainctl actions entitlements create and chainctl actions entitlements list subcommands for managing action entitlements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chainctl actions entitlements list subcommand to list existing action entitlements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-09-15

Chainguard adds chainctl skills entitlements create command for managing agent skill entitlements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chainctl skills entitlements create subcommand to provision entitlements for agent skills.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-09-15

Chainguard Catalog Starter lets teams trial up to five production-grade container images free via console or chainctl⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chainctl starter init to interactively sign up for a new Catalog Starter account from the command line.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chainctl starter request-access to join an existing Catalog Starter organization from the CLI.
• Adds chainctl starter add-images to select up to five non-FIPS images for a Catalog Starter plan, accepting one to four image names as arguments.

Internet Services · 2026-09-15

Cloudflare AI adds Wan 3.0 Prime text-to-video, Gemini Flash variants, GPT Image 2.5 models, FLUX.2 klein, and OpenAI open-weight reasoning models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds wan-3.0-prime, Alibaba's text-to-video model supporting adaptive aspect ratio and 480P, 720P, or 1080P resolution with configurable duration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds gemini-3.8-flash, engineered for long-horizon software engineering, autonomous agents, and complex enterprise workflows.
• Adds gemini-omni-1.1-flash, a high-performance multimodal video generation and editing model with conversational controls and generated audio.

Internet Services · 2026-09-15

Cloudflare adds SAML force-reauth, Browser Run guardrails with read-only Live View, and Origin Range Requests in Cache Rules⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guardrails parameter to Browser Run sessions (Puppeteer, Playwright, REST API) via allowedDomains to restrict a browser session's HTTP/HTTPS requests to permitted hostnames and subdomains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds { mode: "readonly" } option when generating a Browser Run Live View URL, letting observers watch a session without clicking, typing, navigating, or running JavaScript.
• Adds origin_range_requests.mode field (on, off, default) to Cache Rules in the Rulesets API, controlling whether Cloudflare fetches large files from origin in cache-aligned byte ranges.

Internet Services · 2026-09-15

Cloudflare adds fresh SAML auth enforcement, Browser Run hostname guardrails, and WAF ruleset updates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds configuration to require fresh identity provider authentication for each SAML login in Cloudflare Access.
• Updates Cloudflare WAF managed rulesets with scheduled changes for 2026-09-22.

SAST / SCA / Code Security · 2026-09-15

Cloudsmith adds vulnerability export, per-package audit logs, granular billing/OIDC read-only roles, and richer GitHub secret-scanning alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Lets workspace owners grant members read-only access to billing, usage, and OIDC data individually, without assigning the Manager or Owner role.
• GitHub secret-scanning email notifications now list every location an exposed Cloudsmith API key was found in a GitHub repository, with a direct link to each detection.

Web Application Security · 2026-09-15

CMSeeK 1.1.3 adds 12 new CMS detections, WordPress XML-RPC bruteforce, and new --light-scan and --only-cms flags⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --light-scan argument to limit scan depth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --only-cms (-o) argument to restrict results to CMS detection only.
• Adds WordPress bruteforce capability via XML-RPC.

Identity & Access Management · 2026-09-15

ConductorOne adds an EU data residency instance for organizations requiring data stored and processed in the European Union.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an EU data residency instance where all tenant-specific URLs — login, redirect URIs, API and webhook endpoints, MCP server, and CLI configuration — are region-scoped; hosting region is selected at domain registration time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-15

ConductorOne: Adds an EU data residency instance at yourcompany.c1eu.ai for organizations that need customer data stored and processed in the EU, with dedicated auth, API, webhook, and MCP endpoints under c1eu.ai.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• EU tenants use https://accounts.c1eu.ai/auth/callback as the redirect/callback URI and https://your_domain.c1eu.ai/login as the initiate login URI across SSO and OAuth integrations.
• EU tenants sign up at accounts.c1eu.ai/accounts/signup — hosting region is a one-time choice made at signup and cannot be changed afterward.

Identity & Access Management · 2026-09-15

ConductorOne adds an EU data residency instance with region-specific URLs for login, API, webhooks, MCP, and CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Microsoft Teams as a notification and interaction surface is not yet supported on the EU data residency instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-15

Databricks adds ai_transcribe function to transcribe audio files to text with timestamps and speaker labeling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ai_transcribe SQL/AI function to transcribe audio files to text, with per-segment timestamps and automatic speaker labeling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-15

Databricks adds a Beta snapshots API for Lakebase, enabling programmatic create, get, list, delete, and branch-restore of point-in-time snapshots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Beta Lakebase snapshots API supporting create, get, list, and delete operations on point-in-time snapshots of a project branch, plus restore via creating a new branch from a snapshot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-15

Databricks Genie now renders chart visualizations as images directly in Slack replies (Public Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Genie chart visualizations now appear as inline images in Slack replies when using the Databricks Genie app for Slack.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-15

Databricks adds session restore for serverless jobs, letting you load a failed run's Python variables and Spark session into a notebook for live debugging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds session restore for serverless jobs (Public Preview): automatically captures a snapshot of Python variables and Spark session state from eligible serverless compute job runs so you can restore them into a new interactive notebook to debug failures or explore results without rerunning the entire job.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-15

Databricks lets account admins set system table retention from 30 to 3,650 days (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds account-wide configurable data retention period (30–3,650 days) for supported system tables, settable by account admins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-15

DataDome adds static asset exclusion support to skip processing of common file types like CSS, JS, and images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports excluding static assets (e.g., .css, .js, .jpg, .png, .webp, .pdf, .woff2, and 40+ other extensions) from DataDome processing to reduce unnecessary inspection overhead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-09-15

DefectDojo findings notes now support inline image attachments via paste, drag-and-drop, or toolbar button.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds image support to the Markdown editor used in Finding notes, descriptions, and other markdown fields — paste from clipboard, drag-and-drop, or use the Insert image toolbar button; images appear inline in the notes feed and in generated reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-09-15

DefectDojo Pro v3.3 adds Dedupe Pools, PSIRT 2.0, cross-domain finding correlation, API v3 alpha, FIPS 140-3 support, and major connector/SBOM expansions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api/v3-alpha/ API v3 (alpha) with slim references, expansion, RBAC sub-resources, and the Pro importer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes Custom Fields on the token-authenticated /api/v2 API.
• Adds a CycloneDX/SPDX SBOM and CycloneDX VEX export API, and the Pro UI now accepts .spdx files on import.

Vulnerability Management · 2026-09-15

DefectDojo 3.3.100 adds injectable dedupe candidate scope and winner ordering, plus pooling controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds injectable candidate scope and winner order configuration to the deduplication engine, along with dedupe pools support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-09-15

Detect It Easy adds a PE heuristic engine with --heuristicscan and --verbose flags for deep structural and behavioral static analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --heuristicscan together with --verbose CLI flags to enable the PE heuristic engine and surface its fullest evidence report, with findings separated as [HEUR/Any], [HEUR/.NET], and [HEUR/EMU].⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Generic Heuristic Analysis engine (__GenericHeuristicAnalysis_By_DosX.7.sg) for PE files, going beyond signature matching to report structural and behavioral anomalies with visible evidence.
• Supports operand-aware MSIL bytecode pattern analysis for managed PE files, covering indirect calls, control-flow transformations, arithmetic mutations, and invalid instruction sequences without requiring a CLR emulator.

Identity & Access Management · 2026-09-15

Manual review can now send localized email notifications with direct resume links and per-locale customizable wording.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sends localized email notifications to users when manual review requests additional steps, including a direct link to resume and a per-step reason in the message body.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Detects when all requested steps are due to an expired document and replaces the generic retry prompt with a targeted message asking for a valid document.
• Allows per-locale customization of notification wording via White Label → Texts in the console.

Identity & Access Management · 2026-09-15

Didit workflows gain flexible AML Screening with custom field mapping, rich branch logic for metadata, and a session event audit trail via API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds metadata.<key> as a first-class branch condition, letting workflows compare session-creation metadata against fixed values or other session fields (e.g. metadata.min_age <= Age), with numbers compared numerically so 18 and '18' behave identically.
• Exposes full workflow routing history via GET /v3/session/{id}/decision/?include=events, returning a timeline of every branch decision, matched condition, next node, and outcome node — including fallback edges and the status node that set In Review.

Identity & Access Management · 2026-09-15

Didit adds email/phone risk intelligence endpoints, social footprint add-on, PDF report generation, and expanded session event data⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an email risk endpoint that returns deliverability, disposable-address, breach, cross-session match, and normalized risk-intelligence signals via x-api-key authentication without sending an OTP; responds with email.enrichment (aliased as email.email_intelligence) and a top-level status of Approved, In Review, or Declined.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a phone risk endpoint that returns carrier, line-type, porting, disposable-number, cross-session match, and normalized risk-intelligence signals via x-api-key authentication without sending an OTP; responds with phone.enrichment (aliased as phone.phone_intelligence) and a top-level status of Approved, In Review, or Declined.
• Adds include=events query parameter to the session retrieval endpoint, expanding the response with the event timeline (events), activity log (activity_reviews), blocklist flags (blocklisted), per-session cost_breakdown, workflow metadata (workflow_type, workflow_version, workflow_version_id, workflow_terminal_node_id), and session metadata (api_service, session_type, has_device_nfc_support); limited to KYC sessions only.

Secure Access (VPN / SASE / ZTNA) · 2026-09-15

DNSFilter MCP Server now GA, letting AI assistants query DNS activity, manage policies, and automate reports via natural language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the DNSFilter MCP Server integration (generally available), allowing AI assistants such as Claude, ChatGPT, and Codex to query DNS activity and threat data, manage policies and allow/block lists, and automate reports and investigations via the Model Context Protocol — no dashboard navigation required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes MCP Server setup under Integrations → AI Connectors; admin copies the server URL from the DNSFilter MCP Server card to connect a client, which stays authorized for seven days before requiring reconnection.

Reconnaissance & OSINT · 2026-09-15

DNSRecon adds Shodan netblock expansion via --shodan, --shodan-active, --shodan-key, REST API, and DNSRECON_WORDLIST_DIRS env var⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --shodan, --shodan-active, and --shodan-key CLI flags to expand netblocks discovered via SPF (-s) and WHOIS (-w) data using Shodan during standard enumeration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --shodan-key alternative via the SHODAN_API_KEY environment variable for keyless CLI invocation.
• Adds do_shodan=true and shodan_active=true query parameters to the /general_enum REST API endpoint, and accepts the Shodan key via the X-Shodan-Api-Key request header.

Reconnaissance & OSINT · 2026-09-15

dnsrecon: Adds --shodan-active CLI flag to perform active Shodan scanning during netblock expansion.

• Supports setting the Shodan API key via the SHODAN_API_KEY environment variable instead of --shodan-key.

Firewalls & Network Defense · 2026-09-15

Fastly CLI v16.1.0 adds Log Explorer/Insights commands and AI Runtime Control support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds logging subcommands for Log Explorer and Insights to the Fastly CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-09-15

Fastly JavaScript SDK 3.46.0 adds CoreCache.transactionLookupAsync for async cache transaction lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CoreCache.transactionLookupAsync method for performing asynchronous cache transaction lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-15

Firezone adds a native ARM64 installer for Windows on ARM devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a native ARM64 installer for Windows on ARM devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-15

Firezone Windows client now supports native ARM64 (aarch64) devices alongside x86-64.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds native ARM64 (aarch64) Windows client support, with a dedicated ARM64 installer available alongside the existing x86-64 installer; WinGet automatically selects the correct installer for the detected CPU architecture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-09-15

GitGuardian adds Akamai API Credentials and Docker Hub analyzers, expands n8n host detection, and sharpens entropy secret filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds generic_high_entropy_secret filter that suppresses false positives when the assigned variable name ends with checksum, with no loss of recall.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a secret analyzer for Akamai API Credentials.
• Adds a new analyzer for Docker Hub personal access tokens.

Secrets Detection & Management · 2026-09-15

GitGuardian roadmap adds integrations and protections including ServiceNow VR, Azure DevOps Boards, Linear, Mattermost, Google Chronicle SOAR, Docker Hub presence checks, and GitHub/GitLab issue integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ServiceNow Vulnerability Response (VR/AVR) integration to push GitGuardian secret incidents into ServiceNow with risk scoring, bi-directional status sync, and ServiceNow RBAC/ABAC controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Azure DevOps Boards integration to automatically create and sync Azure DevOps work items from GitGuardian incidents.
• Adds Google Chronicle SOAR integration to send GitGuardian secret incidents natively, enabling playbook triggering and SOC-driven remediation orchestration.

Secrets Detection & Management · 2026-09-15

GitGuardian now links AWS access keys stored in secrets managers, Vault, or Kubernetes to their AWS IAM identity in the identity map.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• AWS access keys stored in a secrets manager, Vault, or Kubernetes are now linked to their AWS IAM identity in the identity map.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-15

GitHub Copilot auto model selection gains efficiency, balance, and intelligence tiers to control cost-quality tradeoffs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds three optimization tiers — efficiency, balance, and intelligence — to Copilot auto model selection, letting users control how auto weighs cost, quality, and response latency per prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Rolls out auto model selection tier configuration in Visual Studio Code, Copilot CLI, and the GitHub Copilot app.

SIEM · 2026-09-15

Google SecOps adds GoogleSQL query support in Search (public preview) for ad hoc investigations alongside YARA-L 2.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GoogleSQL query support in Search (public preview), enabling standard declarative SQL and Piped SQL syntax to query UDM events, entity graphs, detection rules, and case management data — as a flexible alternative to YARA-L 2.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-09-15

gowitness 3.2.0 adds --chrome-user-data-dir for authenticated session reuse and a --no-log-color global flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --chrome-user-data-dir flag to specify an existing Chrome User Directory, enabling reuse of authenticated browser sessions across gowitness runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --no-log-color global flag to disable ANSI color codes in log output.

Post-Exploitation · 2026-09-15

Hekatomb automates DPAPI secret extraction by combining LDAP enumeration, SMB blob download, and DC private key decryption via RPC⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -hashes LMHASH:NTHASH flag for pass-the-hash authentication instead of a plaintext password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -dns DNS flag to specify a DNS server IP for resolving computer hostnames discovered via LDAP.
• Adds -just-user JUST_USER flag to restrict credential decryption attempts to a single username.

Post-Exploitation · 2026-09-15

hekatomb: Adds -port [port] flag to set the SMB server port used during DPAPI blob collection.

• New hekatomb CLI tool connects to LDAP to enumerate domain computers and users, downloads all DPAPI blobs via SMB, extracts the domain controller backup private key via RPC, and decrypts all stored Windows Credential Manager secrets.

Identity & Access Management · 2026-09-15

iDenfy can now auto-import brand colors and logo from your website domain to pre-fill the verification UI theme.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports auto-importing brand colors and logo from a domain URL to pre-fill the verification UI theme, reducing manual palette setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-15

iDenfy: Adds KYB shared identity verification across companies

• Adds PNG logo uploads for branding

Identity & Access Management · 2026-09-15

iDenfy adds auto-branding from your site, native-script CSV columns, a fields param on the KYB endpoint, and extended injection detection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a fields parameter to the KYB company endpoint to return only the requested data fields instead of the full response payload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• KYC CSV reports gain an Original language data section that exports document field values in their native script as separate columns.
• New branding theme pre-fill pulls colors and logo directly from your website, eliminating manual palette configuration.

Digital Forensics & Incident Response · 2026-09-15

iLEAPP v2026.4.1 upgrades the Apple Unified Logs engine to unifiedlog_iterator v0.7.0 and adds iOS/macOS/tvOS/visionOS/watchOS 26–27 version recognition.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Upgrades the Apple Unified Logs parsing engine to unifiedlog_iterator v0.7.0, filling previously empty process paths on Simpledump and Statedump rows and logging the parser version at import time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds recognition for iOS 26.7, iOS 27.0, macOS 15.8, macOS 26.7, macOS 27.0, tvOS 27.0, visionOS 27.0, and watchOS 27.0 in apple_build_id_to_os_version.json.

Data Security & DLP · 2026-09-15

Immuta Request app now supports multi-user access requests in a single submission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds multi-user access requests to the Immuta Request app, letting managers and admins select multiple users in a single request form and submit once instead of once per user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds email address hover-over on user names in the request form to distinguish between users with similar or identical names.

SIEM · 2026-09-15

InsightIDR adds Disable User and Enable User in Active Directory actions via Response & Remediation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Disable User in Active Directory action, accessible from Response & Remediation > SIEM > Investigations > Take action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Enable User in Active Directory action, accessible from Response & Remediation > SIEM > Investigations > Take action.

SIEM · 2026-09-15

Insight Agent can now collect Security Event Logs directly from Domain Controllers as an alternative to per-DC Active Directory event sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the Insight Agent to collect Security Event Logs from Domain Controllers via SIEM > Settings > SIEM Features > Command Platform Features > Rapid7 Agent toggle, as an optional alternative to deploying a separate Active Directory event source on each Domain Controller.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-09-15

Inspektor Gadget adds --oci-store-user flag to ig run, letting non-root users run gadgets from their own OCI store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --oci-store-user flag to ig run to load a gadget from the invoking user's OCI store (~/.ig/oci-store) when running under sudo, avoiding root-owned files in the home directory; --pull is forced to never and signature downloads are disabled, so the gadget must be pulled as the user first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Documents that gadget images are stored per-user: root's store is at /var/lib/ig/oci-store and all other users' stores are at ~/.ig/oci-store, so a gadget built as a non-root user is not visible to sudo ig image list.
• All ig image subcommands (build, list, etc.) can be run without root; only ig run requires root to load eBPF programs.

Container & Image Security · 2026-09-15

Inspektor Gadget auto-detects container runtime socket paths via kubelet /configz on Kubernetes v1.33+, with manual override via daemon config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automatic container runtime socket path detection by querying the kubelet /configz endpoint on each node, enabled by default on Kubernetes v1.33+ clusters where nodes/configz RBAC permission is granted automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports explicit socket path override via a daemon configuration file (daemon-config.yaml) for clusters where auto-detection via /configz is unavailable or returns a 403.

Web Application Security · 2026-09-15

Invicti scan location exports now include HTTP method and status code columns across CSV, JSON, and XML formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds HTTP Methods and Status Codes columns to CSV (Locations) scan location exports, appended at the end of each row.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds HTTP method and HTTP response code fields to JSON and XML scan location export formats.

Malware Analysis · 2026-09-15

Joe Reverser 2.1 Golden Eagle expands agentic malware and phishing analysis with deeper automation workflow integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Releases Joe Reverser 2.1 Golden Eagle, an agentic automated analyst covering malware, phishing campaigns, malicious documents, and web-based threats with enhanced autonomous analysis and reverse engineering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Improves integration into automated analysis workflows for Joe Reverser's agentic capabilities.

Identity & Access Management · 2026-09-15

JumpCloud 2022 adds passwordless RADIUS, TOTP for LDAP, Remote Assist, Password Manager, OIDC SSO, and a raft of new device management capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Command After Agent Install command type so admins can specify enrollment commands to run immediately after the JumpCloud agent is installed on new devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Running column to the commands queue to distinguish commands waiting in the queue from commands actively running.
• Adds certificate (passwordless) based authentication to JumpCloud RADIUS, supporting any X.509 compliant certificate authority — existing certificates can be imported and used for RADIUS auth.

Identity & Access Management · 2026-09-15

JumpCloud 2023 adds passwordless Go SSO, Android zero-touch enrollment, remote Background Tools, dynamic groups, and admin MFA by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JumpCloud Go browser extension enabling hardware-protected, phishing-resistant passwordless login using Apple Touch ID and Windows Hello on managed macOS and Windows devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enforces JumpCloud Go as the default MFA method for conditional access policies on SSO apps, with user and device verification on every application session.
• Adds Android zero-touch enrollment support for fully managed, dedicated, and company-owned Android devices with a work profile.

Identity & Access Management · 2026-09-15

JumpCloud 2024 adds Device Monitoring & Alerting, Windows App Catalog, SaaS Management, BYOD iOS 18 MDM, and a new CSP-based Windows policy framework.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /systemusers?filter=department:$in:... support for escaping the pipe | character with backslash \ inside in and nin API filter operators, enabling pipe characters in search terms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds six new Windows MDM CSP-based policies: Windows Wi-Fi Configuration Policy, Windows VPN Policy, Install Certificate Policy, Bluetooth Configuration Policy, Control Policy Conflict, and Windows Notification Service.
• Adds a new Windows MDM policy to configure Simple Certificate Enrollment Protocol (SCEP) for Windows devices.

Identity & Access Management · 2026-09-15

JumpCloud adds Access Requests, MCP Server, Shadow AI Dashboard, Custom Admin Roles, and SAML/OIDC forced re-auth with AMR claims⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds forced re-authentication support: the IdP now honors ForceAuthn="true" in SAML and prompt=login in OIDC, prompting users for credentials even with an active session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Authentication Methods References (AMR) claims in both SAML assertions and OIDC ID tokens, tagging logins with proof of factors used (e.g., password + OTP).
• Introduces JumpCloud Access Requests, enabling approval flows for access requests submittable from the JumpCloud User Portal and manageable in the admin console.

Identity & Access Management · 2026-09-15

JumpCloud adds Password Vault, Agent Identities, Access Risk Detection GA, MCP discovery, and AI Gateway connection management in 2026-09-14 release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP Discovery and Token & Cost Tracking options under Access > AI & SaaS Management > Settings > Enhanced Discovery Options to discover MCP servers and track token usage and estimated cost from Cursor, Claude Code, OpenCode, Codex, and VS Code Copilot CLI on managed Windows and macOS devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MCP Connection column in Access > AI & SaaS Management > Applications showing Discovered, Connected, or Not Available status for each app, with Add MCP Server and View actions available inline.
• Adds Password Vault to the JumpCloud Protect mobile app, enabling users to view secrets, autofill credentials into mobile apps, and autofill in the mobile browser after authenticating.

Identity & Access Management · 2026-09-15

JumpCloud RBAC preview gains granular CRUD permissions for Identity Management and Application Management scopes, plus scope reorganization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CRUD operations and No Access permission to the Identity Management and Application Management scopes, enabling more granular admin permissions for Users and Applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Splits Identity Management and Directory and Groups Management into separate, independently assignable scopes.
• Moves Directory Management and Group Management scopes under a unified Directory and Groups Management permissions category.

Identity & Access Management · 2026-09-15

JumpCloud adds RSS feed subscriptions for release notes, agent updates, and bug fix announcements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds RSS subscription options for JumpCloud Help Center updates, including separate feeds for product release notes, agent release notes, and bug fix reports via the Release Notes and Bug Fixes page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-15

JumpCloud Password Manager Desktop App adds EU region support, raised storage limits, ARM macOS build, and shared folder admin controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds EU region support — users can now select their region before activating their account, available on the activation page for the desktop app and on the pairing page for the browser extension.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Raises item storage limits to 13,000 items with autofill enabled, 5,000 items per shared folder, and 30,000 items when autofill is not used.
• Introduces a Move All items button in shared folders to move all items from a folder at once.

Container & Image Security · 2026-09-15

Kata Containers 4.2.0 adds TLS to kata-monitor, VFIO/block-device fd passing for QEMU, virtio-rng for dragonball, and early guest console log capture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TLS support to kata-monitor for encrypted metrics exposure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Passes block storage sources by file descriptor in runtime-rs/QEMU, enabling more secure and flexible block device attachment.
• Passes VFIO devices by file descriptor in runtime-rs/QEMU, enabling fd-based VFIO device handoff.

Web Application Security · 2026-09-15

Levo 1.2.135.1 adds per-app test config overrides, bulk scan delete, Service Graph (Beta), form-encoded body testing, and a new synchronous CreateFinding API mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CreateFinding API opt-in synchronous mode that returns event IDs on completion; default asynchronous behavior is unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-application security-test configuration overrides via a new Configuration tab on each application's Security Testing page, with settings marked as inherited from the environment or overridden for that application.
• Adds Active / Stale / Down status filter on the On-Prem Deployments screen for Satellites, Taggers, Sensors, DAST Runners, and AI Gateways alongside the existing lifecycle filter.

Web Application Security · 2026-09-15

Levo adds a new API discovery source, two new integrations, and an overhauled component health monitoring experience.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new API discovery source for broader API inventory coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces two new integrations.

AI/LLM Security · 2026-09-15

Mend Renovate's GitHub Actions manager gains version-input support for 50+ new actions across tools like Terraform, kubectl, Flutter, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds version-input support for hashicorp/setup-terraform's terraform_version in the manager/github-actions manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds version-input support for terraform-linters/setup-tflint's tflint_version in the manager/github-actions manager.
• Adds version-input support for extractions/setup-just's just-version in the manager/github-actions manager.

SAST / SCA / Code Security · 2026-09-15

Mend SCA adds the EU Vulnerability Database (EUVD) from ENISA as a primary security data source with dedicated CVSS scores and exploitability data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates the European Union Vulnerability Database (EUVD), sourced from ENISA, as a primary security data source, adding enriched CVSS scores and exploitability information alongside existing vulnerability feeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-15

Mend Renovate expands GitHub Actions manager with 50+ new action version inputs and adds mise selector lockfile support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds manager/github-actions support for baptiste0928/cargo-install crate and version inputs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds manager/github-actions support for conda-incubator/setup-miniconda version inputs
• Adds manager/github-actions support for crystal-lang/install-crystal version inputs

Network Analysis & Monitoring · 2026-09-15

PolarProxy 2.0.2 adds Tor proxy support, idle timeout controls, SOCKS4/5 relay, license key file, and --helpenv for environment variable discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --connect socks4:HOST:PORT and --connect socks5:HOST:PORT options to relay outgoing sessions through a SOCKS4 or SOCKS5 proxy, enabling traffic forwarding via Tor or other SOCKS intermediaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --keyfile <path> flag to load a license key from a file path, enabling higher data/session limits.
• Adds --helpenv flag to print all environment variables that can substitute command-line arguments.

AI/LLM Security · 2026-09-15

nono tool-sandbox adds webhook and chain approval backends with configurable auth and multi-backend chaining⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds webhook approval backend with url and auth fields; set auth: "platform" to sign requests with the enrollment key and use the submit-and-poll exchange against the enrolled platform's approval route.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chain approval backend with mode (default all) and backends fields to combine multiple approval backends.
• Adds terminal approval backend to prompt the operator directly in the terminal.

Identity & Access Management · 2026-09-15

Nudge Security browser extension now supports Safari, enabling SaaS/AI visibility and enforcement on company Macs via Apple Business Manager and MDM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Safari browser extension support with silent rollout through Apple Business Manager and MDM, expanding SaaS and AI visibility to the default browser on company Macs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Monitors SaaS and AI activity in real time via the Safari extension, including daily AI usage, logins, access patterns, and file uploads.
• Detects identity and access risks through the Safari extension, covering weak or reused passwords, SSO or MFA bypass attempts, shared credentials, and risky password manager use.

SAST / SCA / Code Security · 2026-09-15

Codex Security adds patch-risk assessment, fix verification, failed-scan recovery, and improved SARIF exports across v0.1.21–v0.1.24.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds $codex-security:assess-patch-risk command to review a proposed change against exact revisions and source evidence, returning a recommendation to merge, revise, or make no change.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds $codex-security:verify-fix command to check whether an existing patch resolves a reported security finding without modifying repository files or issue trackers, returning fixed, still_vulnerable, or inconclusive per finding.
• Checks Daybreak access from within the plugin before a scan in desktop and CLI sessions signed in with ChatGPT, showing an enrollment link when access is not granted or a warning when access cannot be verified.

Post-Exploitation · 2026-09-15

phpsploit gains three new plugins: proclist, bannergrab, and cloudcredgrab⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds proclist plugin to enumerate running processes on a compromised host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bannergrab plugin to grab service banners from a target.
• Adds cloudcredgrab plugin to extract cloud provider credentials from a compromised host.

Identity & Access Management · 2026-09-15

Ping Identity adds ESV support for connector server names, inline script error visibility, and streamlined identity/job management UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports using an ESV (environment secret/variable) for the connector server name in connector configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Shows errors in the script editor when scripts use environment ESVs incorrectly.
• Allows creating another identity immediately after creating one, without closing the modal.

CNAPP · 2026-09-15

Plerion adds SCIM 2.0 provisioning, user groups with role inheritance, org-scoped API keys, and break-glass admin accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SCIM 2.0 provisioning support so Okta, Microsoft Entra ID, or any SCIM 2.0 identity provider can create, update, and deactivate Plerion users, with existing users matched by email address and adopted automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds user groups that grant roles to every member, syncable from an identity provider over SCIM or created directly in Plerion.
• Adds organization API keys scoped to the whole organization with read or readWrite access, used by identity providers for SCIM provisioning.

SAST / SCA / Code Security · 2026-09-15

Portkey's Azure Guardrails integration adds PII category filtering to restrict detection to specific entity types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PII category filtering to Azure Guardrails, supporting entity types Person, Email, PhoneNumber, Address, CreditCardNumber, and PassportNumber — leave empty to detect all default categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-09-15

InsightCloudSec 26.9.15 adds 8 new Azure Insights, 5 new Query Filters, and expanded harvesters for Redis, Cosmos DB, and PostgreSQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cache Instance Encryption Type Query Filter to identify Cache Instances by encryption configuration (Customer-Managed Key vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Provider-Managed Key), defaulting to Provider-Managed Key detection.
• Adds Cache Instance Access Key Authentication Enabled Query Filter to identify Azure Cache for Redis instances where disableAccessKeyAuthentication is set to false.
• Adds Distributed Table Public Network Access Query Filter to identify Azure Cosmos DB accounts with public network access enabled.

AI-Powered Offensive Security · 2026-09-15

RAPTOR debuts with 30+ slash commands covering autonomous vuln validation, binary analysis, SCA, fuzzing, and web scanning inside Claude Code sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Launches the raptor binary (from bin/raptor) with flags --project, --continue, and --model to start a session with pre-flight checks, coverage tracking, and environment sanitisation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --max-cost-usd flag to cap per-run LLM API spend (default $10) across the analysis dispatch layer.
• Adds --codeql flag to /scan to include CodeQL deep analysis alongside Semgrep and Coccinelle.

AI-Powered Offensive Security · 2026-09-15

RAPTOR: Adds subprocess sandboxing using Linux namespaces, Landlock, and seccomp for processes handling untrusted content, with the threat model documented in docs/sandbox.md.

• Supports devcontainer deployment with target-folder mounts via the mounts section of .devcontainer/devcontainer.json, and --privileged for rr deterministic debugger access.

AI/LLM Security · 2026-09-15

Reality Defender adds a POST /api/v2/user-feedback endpoint for submitting feedback on detection results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST https://api.prd.realitydefender.xyz/api/v2/user-feedback endpoint (authenticated via x-api-key header) for submitting user feedback on detection results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-09-15

Scrut adds a platform-wide search bar with Cmd+K/Ctrl+K shortcut to find documents and navigate modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Search results are permission-filtered, ensuring users only see documents and modules they are authorized to access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-09-15

Scrut Automation adds a Continuous Compliance tab in Task Center for year-round compliance tracking across all modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Continuous Compliance tab under Task Center in the left navigation panel, providing a single view to track open tasks across compliance modules including Policy Tasks, Evidence Tasks, Failing Tests, Risk Management, Corrective Actions, Audit Center, Vulnerabilities, Vendor Management, and Answer Questionnaires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Show Only Pending toggle to filter the Continuous Compliance tab to open tasks only across all modules.
• Adds an Assignee / Approver filter to surface tasks assigned to or awaiting approval from a specific team member across all compliance modules.

Compliance Automation & Trust Management · 2026-09-15

Scrut adds an Audit Prep tab in Task Center to centralize and track compliance readiness tasks across frameworks (closed beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Audit Prep tab inside Task Center providing a centralized view of audit preparation tasks across policy, evidence, test, and audit-request modules, with per-module progress indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a framework/entity selector at the top of the Audit Prep tab so teams working toward multiple frameworks (SOC 2, ISO 27001, GDPR, etc.) or multiple entities can track separate progress, audit schedules, assessment reports, and timelines for each combination.
• Adds a Progress Bar showing control-completion-based audit readiness percentage, with milestone-gated actions: scheduling an Internal Audit becomes available at 90% and an External Audit becomes available at 100% (after the internal audit is complete).

Compliance Automation & Trust Management · 2026-09-15

Scrut adds a Notification Center with priority-ordered, role-scoped alerts and direct module CTAs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Notification Center accessible via the bell icon in the top-right corner, surfacing billing updates, platform maintenance, integration updates, and product announcements in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Each notification includes a CTA that navigates directly to the relevant module in Scrut.
• Provides a Show Only Unread toggle to filter the notification list to new items only.

Compliance Automation & Trust Management · 2026-09-15

Scrut adds NEN 7510, AI gap analysis on policies and evidence, Aikido Security integration, JSONL exports, and GitHub issue creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JSON Lines (JSONL) export format for Automated Tests, including metadata and authenticity signals so auditors can verify pass/fail outcomes from integration and internal sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds native Aikido Security integration so Aikido findings flow directly into Scrut's vulnerability management workflow.
• Adds NEN 7510 framework to the Frameworks module, fully translated and mapped including healthcare-specific controls for patient data access, logging, and confidentiality.

Compliance Automation & Trust Management · 2026-09-15

Scrut Automation adds ISO/IEC 27701:2025 as a stand-alone privacy management framework for PII controllers and processors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ISO/IEC 27701:2025 to the Frameworks module as a stand-alone privacy management standard covering PII controllers and processors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-09-15

Scrut Automation adds FedRAMP Moderate and ISO/IEC 27018:2025 to the Frameworks module with pre-configured templates and automated evidence mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds FedRAMP Moderate and ISO/IEC 27018:2025 to the Frameworks module, each with pre-configured policy templates and automated evidence mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-09-15

Scrut Automation adds MCP integration and a new Critical risk tier above High.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Scrut MCP to connect live compliance data to MCP-compatible apps including Claude Code, Cursor, and ChatGPT Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-09-15

Scrut adds SOC 2 system description generation, CRA and Indonesia PDPL frameworks, per-framework gap visibility, and MCP workspace switching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds EU Cyber Resilience Act (CRA) as a framework in Scrut, with requirements pre-mapped to Scrut's control library.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Indonesia PDPL as a framework in Scrut, with requirements pre-mapped to the control library.
• Adds AI-generated SOC 2 System Description built from existing framework, control, and organization data in the workspace, with a step-by-step template and direct download for the report package.

Cloud Security Posture · 2026-09-15

ScubaGear consolidates Defender, Exchange Online, and Teams policies into a new securitysuite baseline with migration tooling and validator warnings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Replaces the defender product name with securitysuite in ProductNames config; running with defender triggers a validator warning but still works via automatic substitution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the SecuritySuite: top-level config section to replace the deprecated Defender: section for policy exclusions.
• Migrates MS.DEFENDER.*, MS.EXO.8–MS.EXO.17, and MS.TEAMS.6–MS.TEAMS.8 policies into new MS.SECURITYSUITE.* policy IDs, with the authoritative mapping in PowerShell/ScubaGear/mappings/scuba-baseline-policy-migrations.csv.

Reconnaissance & OSINT · 2026-09-15

sippts v4.2.1 adds CVSS scoring with severity colours to CVE results, ordering findings worst-first in the scan module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a 6th column to data/cve.csv carrying the CVSS score (list version 0.5), readable by sippts 4.2.1 or newer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-09-15

Slim 1.40.11 adds --include-dir-bins and --include-ssh-client flags to build, plus improved xray reports and latest Docker Engine support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --include-dir-bins flag to the build command to include binaries from specified directories in the minified image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --include-ssh-client flag to the build command to include SSH client binaries in the minified image.
• Improves xray command reports with additional detail.

SAST / SCA / Code Security · 2026-09-15

Snyk adds Secrets scanning, a Remediation Agent, custom regex rules, AI/agent access docs, AIBOM API, and a Unified IDE Configuration Dialog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New AIBOM API endpoints let practitioners retrieve AI Bill of Materials data via the Snyk API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New AccessRequests API endpoints expose access-request management programmatically.
• New Export API endpoints enable programmatic export of scan data.

SAST / SCA / Code Security · 2026-09-15

SonarQube adds Hunter Agent for AI-powered vulnerability discovery, SonarScanner for Cargo (Rust), and Scoped Organization Tokens⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Scoped Organization Tokens (SOTs) for non-user-specific authentication in SonarQube Cloud, with an API migration guide for integrations moving away from the deprecated POST /users/roles permission grant in favor of inline role assignments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SonarScanner for Cargo, enabling Rust project analysis in both SonarQube Cloud and SonarQube Community Build.
• Introduces the Hunter Agent, an AI-powered analysis capability that uncovers complex, logic-level vulnerabilities in long-living branches on SonarQube Cloud.

Vulnerability Management · 2026-09-15

SploitScan adds --input-dir for batch directory import, xAI Grok and DeepSeek AI providers, and flexible config.json path resolution via --config or SPLOITSCAN_CONFIG_PATH⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --input-dir INPUT_DIR flag to batch-process an entire directory of vulnerability scanner reports (Nessus, Nexpose, OpenVAS, Docker) in one run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --config / -c flag and SPLOITSCAN_CONFIG_PATH environment variable for specifying a custom config.json path, with a defined fallback search order across ~/.sploitscan/config.json, ~/.config/sploitscan/config.json, ~/Library/Application Support/sploitscan/config.json, %APPDATA%/sploitscan/config.json, and /etc/sploitscan/config.json.
• Adds grok_api_key and deepseek_api_key fields to config.json, enabling xAI Grok and DeepSeek as AI providers selectable via the -a flag (e.g., 'grok' or 'deepseek').

Vulnerability Management · 2026-09-15

SploitScan adds --input-dir for batch directory-based scanner report imports and xAI Grok/DeepSeek AI provider support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-09-15

Surface Command adds an Attack Surface Overview report under Reports & Dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Attack Surface Overview view accessible via Reports & Dashboards > Attack Surface Overview.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-09-15

Tenzir adds parallel data movement, deeper pushdown, on-demand schema loading, and automatic Sigma matching for OCSF⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds parallel data movement and deeper operator pushdown in Tenzir Node v6.17.0 to accelerate pipeline throughput.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds on-demand schema loading in Tenzir Platform v1.39.2, enabling schemas to be fetched as needed rather than preloaded.
• Adds automatic Sigma rule matching for OCSF-formatted events in Tenzir Node v6.16.0, extending detection coverage to OCSF schemas without manual mapping.

Threat Intelligence · 2026-09-15

Threat Command alerts now support document attachments in PDF, CSV, DOC, DOCX, PNG, TXT, JPG, EML, and MSG formats⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports bulk document attachment across multiple alerts via the ellipsis menu in the alert toolbar.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-09-15

Threat Command: Attach files to alert notes via the paperclip icon, supporting CSV, DOC, DOCX, EML, JPEG, JPG, MSG, PDF, PNG, and TXT formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Copy existing alert notes using the copy icon.
• Alert notes (text or file attachments) persist with an alert even after it is closed or remediated, and support threaded replies between internal users.

Threat Intelligence · 2026-09-15

Threat Command DRP Alerts gains Query Mode with the DRP Query Language for complex, field-based alert searches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Query Mode to the DRP Alerts search bar, enabling field-based searches using the DRP Query Language (DRPQL) with autocomplete suggestions — accessible from Alerts > Digital Risk Protection > DRP Alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports complex DRPQL queries combining keyword matching in alert titles/descriptions, status filters (e.g. excluding closed alerts), and date-range filters (e.g. alerts found after a specific date).

Threat Intelligence · 2026-09-15

Threat Command adds IOC enrichment pivot from SIEM & ICON directly into the Threat Intelligence database.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables users to query 'get an indicator by value' from the Threat Intelligence database directly from any page within SIEM or Automation (ICON), pivoting IOCs tied to alerts without leaving the Rapid7 Insight platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-15

Varonis adds sensitivity label filtering for SharePoint Online sites to support security and compliance investigations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables filtering and analysis of SharePoint Online sites by sensitivity label assigned directly to the site, surfacing site-level classification in security and compliance investigations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-15

Varonis Data Lifecycle Automation now supports custom link prefixes for easier auditing and administration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for custom prefixes on links generated by Data Lifecycle Automation policies when content is moved, making automation-generated links distinguishable for auditing and link management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-15

Varonis adds a dedicated Activity tab to the Account Pane for unified account investigation with filtering and drill-down.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a dedicated Activity tab inside the Account Pane that combines activity trends and detailed event logs in a single view, with interactive filtering and drill-down to identify spikes and accelerate investigations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-15

Varonis users and roles can now be created and managed directly from the web interface, replacing the Management Console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the ability to create, view, and manage Varonis users and roles directly from the web interface, consolidating administration into a single experience without the Management Console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-15

Varonis lets you create and update dictionaries directly in the web UI, alongside EDM classifiers and classification policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dictionary creation and editing directly in the Varonis web interface, eliminating the need to switch to the Management Console for dictionary management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-15

Varonis lets you manage permissions, groups, folder protection, and memberships directly from the Analytics page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Manage permissions, groups, folder protection, and memberships directly within the Analytics page without leaving the review workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-15

Varonis adds visibility into service principal and AI agent sign-ins in Entra ID for identity-based attack detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Monitors and surfaces authentication events for service principals and AI agents in Entra ID, enabling investigation of non-human identity sign-ins that were previously invisible.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-15

Varonis adds non-human Entra ID sign-in monitoring, SharePoint sensitivity-label filtering, and unified web-based administration⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables creating and updating dictionaries directly from the Varonis web interface, consolidating dictionaries, EDM classifiers, and classification policies into a single workflow without switching to the Management Console.
• Enables creating, viewing, and managing Varonis users and roles directly from the web interface, removing the need to use the Management Console for user management.

Network Analysis & Monitoring · 2026-09-15

Zeek 9.0 adds UDP packet source for VXLAN/GENEVE mirroring, ZIP analyzer, NTP control/private logs, new TLS events, and LDAP SASL forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds zeek -i udp::0.0.0.0:4789:vxlan UDP packet source (bundled zeek-packet-source-udp plugin) to receive VXLAN or GENEVE mirror traffic over UDP without raw packet capture; uses SO_REUSEPORT for multi-worker kernel load-balancing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds VNI-aware connection tracking via policy/frameworks/conn_key/packet_source/udp/vxlan_vni policy script when using the UDP packet source.
• Adds policy/files/zip/register.zeek to map the bundled Spicy ZIP file analyzer to the application/zip MIME type; recursive ZIP depth is controlled by Spicy::max_file_depth.

SAST / SCA / Code Security · 2026-09-15

ZeroPath MCP server authentication gains service keys for org-wide, user-independent machine integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for service API keys (organization-admin authority, not tied to any individual user) as an alternative to personal API keys — recommended for long-lived machine integrations such as MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-15

ZeroPath adds a 0–100 priority score per finding, blending severity and agent confidence to surface validated results first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a 0–100 finding priority score calculated as severity × confidence for validated findings and a reduced 0–10 scale (severity only) for unvalidated findings, ensuring agent-confirmed results surface first in issue lists and dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Preserves customer-edited application overviews and threat model sections even when the underlying directory is renamed or removed.

SAST / SCA / Code Security · 2026-09-15

ZeroPath adds granular repository permissions and server-side access enforcement for Rules, Custom Sources, and Sinks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a repository-create permission that gates creating repositories, uploading scan targets, and configuring or redrawing monorepo partitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds server-side permission enforcement for configuration pages — Rules, Context, Locations, Custom Sources & Sinks, Members, Notifications, and Tags — returning an Access Denied error with actionable messaging instead of a blank page when access is missing.
• Read access to Custom Rules, Custom Sources, and Custom Sinks is now gated by the same permission that controls sidebar visibility, causing the list and detail API endpoints for those resources to return an authorization error when a user lacks access.

SAST / SCA / Code Security · 2026-09-15

ZeroPath SLA policies gain an enabled/disabled toggle to pause enforcement without losing configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an enabled/disabled toggle to each SLA policy card, letting you suspend breach tracking, SLI snapshots, and compliance reports temporarily without deleting the policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-15

ZeroPath threat models now track edit attribution and dual freshness timestamps so teams can distinguish agent-generated from human-revised content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds edit attribution to threat model sections, recording who last saved each fixed section and when, and marking content as customer-edited vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ agent-generated.
• Adds Agent generated at and Evidence checked at timestamps to each threat model so teams can distinguish when content was last written from when evidence was last checked.
• Customer-edited sections are pinned so that subsequent scan refreshes do not overwrite team-written content.

SAST / SCA / Code Security · 2026-09-15

ZeroPath scan-completion webhook now includes metadata.prUrl to link PR scan results back to the originating pull request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds metadata.prUrl field to scan-completion webhook payloads for PR scans, providing the pull request URL without additional API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-15

ZeroPath adds complete finding exports, CVSS boundary reasoning, and fixes severity handling for unlabelled SCA advisories⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exports now include all matching findings regardless of whether they have a confidence or priority score, with unassessed findings reporting null confidence and score values instead of being silently omitted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• SCA findings from advisories without a severity label now display no severity rather than a fabricated default Low value of 2.5.
• CVSS Subsequent System metrics (SC, SI, SA) are now scored independently from Vulnerable System metrics (VC, VI, VA), each with dedicated written rationale explaining whether an exploit crosses a security boundary.

Identity & Access Management · 2026-09-14

1Password 8.12.37 ships full passkey support in the browser extension, with Watchtower now flagging upgradeable logins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-09-14

ALEAPP v2026.4.0 adds raw/E01 image input via -t raw, F2FS support, and new Android app coverage for Blink, Kwai, Avast Cleanup, YouCam Perfect, and MEGA.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -t raw flag to read raw disk images and E01 acquisitions directly, enabling forensic analysis without prior extraction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds F2FS filesystem support via re-vendored qnxprobe, allowing parsing of Android devices formatted with F2FS.
• Adds full Blink camera/doorbell artifact support for Android, covering Camera Information, Camera Entitlements, Syncmodule Information, Syncmodule Entitlements, and Network Information from the BlinkRoom database.

Secure Access (VPN / SASE / ZTNA) · 2026-09-14

Duo Desktop 7.21 adds opt-out data-collection notification and expands supported security product checks to 13 new vendors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Duo Desktop 7.21 displays a one-time opt-out notification on first launch, letting users turn off data collection and reporting; the prompt never reappears after subsequent upgrades.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds detection support for Check Point Endpoint Security (macOS and Windows), Cynet Endpoint Security (macOS and Windows), ESET Security (Windows), Forcepoint One (macOS and Windows), HarfangLab (macOS), Huntress (macOS and Windows), Nessus (macOS and Windows), Netskope (macOS and Windows), Sophos AV (macOS and Windows), Sophos Home (macOS and Windows), Trend Micro Apex One (macOS and Windows), VMware Carbon Black Cloud, and Xcitium (Windows).
• Adds mkdir -p /Library/Application\ Support/Duo/Duo\ Device\ Health/ prerequisite step for system-wide configuration when the settings directory does not yet exist on macOS.

Secure Access (VPN / SASE / ZTNA) · 2026-09-14

Cisco Duo Desktop: Duo Desktop displays a one-time opt-out notification on first launch after installing version 7.21 or later, letting users turn off data collection and reporting.

• Duo Desktop displays a one-time opt-out notification on first launch after installing version 7.21 or later, letting users turn off data collection and reporting.
• Adds detection support for Check Point Endpoint Security (macOS and Windows), Cynet Endpoint Security (macOS and Windows), ESET Security (Windows), Forcepoint One (macOS and Windows), HarfangLab (macOS), Huntress (macOS and Windows), Nessus (macOS and Windows), Netskope (macOS and Windows), Sophos AV (macOS and Windows), Sophos Home (macOS and Windows), Trend Micro Apex One (macOS and Windows), VMware Carbon Black Cloud, and Xcitium (Windows).

Integrated & IT Risk Management · 2026-09-14

CISO Assistant v4.0.3 lets admins enforce a date format across all users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds admin ability to force a date format for all users across the instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-09-14

Clavister NetWall can now act as a DNS-over-TLS (DoT) gateway using cOS Core TLS in an IP Policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports terminating DNS-over-TLS (DoT) connections by configuring cOS Core TLS functionality within an IP Policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-14

SIEM · 2026-09-14

API surface changed: +5 endpoints, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /v1/organizations/{organizationId}/services/{serviceId}/query-api-endpoints/{endpointId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /v1/organizations/{organizationId}/services/{serviceId}/query-api-endpoints
• New endpoint GET /v1/organizations/{organizationId}/services/{serviceId}/query-api-endpoints/{endpointId}

Internet Services · 2026-09-14

Cloudflare: New endpoint DELETE /accounts/{account_id}/addressing/address_maps/{address_map_id}/accounts/{member_account_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /accounts/{account_id}/browser-extension/config/inventories
• New endpoint GET /accounts/{account_id}/browser-extension/config/inventories/{registration_id}
• New endpoint GET /accounts/{account_id}/email-security/analytics/monthly_report

Internet Services · 2026-09-14

Cloudflare: Adds per_cache_read_token and per_cache_write_token fields to the cf-aig-custom-cost header in AI Gateway, enabling custom cost metrics that reflect negotiated cache-read and cache-write token pricing across providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cloudflare DLP Passive Detection (GA), which discovers sensitive data types in sampled Gateway HTTP request and response bodies and their destinations without requiring an active Gateway DLP policy.
• Adds support for routing non-RFC 1918 local IPv4 networks through the WARP tunnel in Cloudflare One Client for macOS and Windows (v2026.8.1290.1) when unrestricted LAN inclusion is enabled by policy or MDM.
• Adds a service recovery mechanism backed by a Windows scheduler task to start the WARP service on system unlock in Cloudflare One Client for Windows (v2026.8.1290.1).

Internet Services · 2026-09-14

Cloudflare adds DLP Passive Detection, per-turn Voice Agent metrics, extensionless R2 AI Search indexing, and Containers + Codex via OpenAI Agents API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Passive Detection for Data Loss Prevention — analyse Gateway traffic to discover where sensitive data travels before committing to a DLP policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New Workflows on Workers Paid retain instance state for seven days by default.
• Enables running Codex inside Cloudflare Containers via the OpenAI Agents API.

SAST / SCA / Code Security · 2026-09-14

Cloudsmith now lets you export vulnerability and malicious package findings as a JSON file from the web app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables export of vulnerability and malicious package findings as a JSON file directly from the Cloudsmith web app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-14

Cloudsmith adds per-package audit logs showing what changed, who changed it, and when.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a per-package audit trail in the Cloudsmith web app showing what changed, who changed it, and when.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-14

Codacy Skills adds Analysis CLI and Code Review Skills for pre-commit scanning and PR review via Claude Code and other agents⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Analysis CLI Skill, installable via npm i -g @codacy/analysis-cli and claude plugin install codacy-skills@codacy, enabling AI agents (Claude Code, OpenAI Codex, GitHub Copilot) to run Codacy static analysis locally before commit — with no Codacy account required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports scoping analysis to specific files, staged changes, a branch, or an open pull request via the @codacy/analysis-cli.
• Enables local ruleset sync so the @codacy/analysis-cli checks code against the same standards enforced at the merge gate, when connected to a Codacy account.

General Utilities & Libraries · 2026-09-14

VS Code agent now supports user-level instruction files, recursive folder scanning, and a chat customization diagnostics view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds user-level instructions scope so instruction files apply across all workspaces, not just a single workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports recursive scanning of instruction file folders, enabling subdirectory organization by team, language, or module.
• Adds a chat customization diagnostics view — accessible via the Chat view context menu — to inspect all loaded instruction files and surface any errors.

Identity & Access Management · 2026-09-14

ConductorOne: Adds per-section overview dashboards across all major admin nav sections, replacing what previously lived in the single Product digest view.

Vulnerability Management · 2026-09-14

defectdojo: New endpoint documented: PATCH /api/v2/user_contact_infos/{id}/

SAST / SCA / Code Security · 2026-09-14

Dependency-Track 4.14.4 adds CycloneDX 1.7 support as its headline new capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CycloneDX 1.7 support for ingesting and processing SBOMs in the new schema version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-14

Didit: Adds Credential details to session results for digital-ID-wallet verifications: the wallet, its issuing authority, the level of assurance asserted, and whether the signature checked out

• Adds cost preview in the console: each lookup switch displays its billing rate before the configuration is saved

SAST / SCA / Code Security · 2026-09-14

Endor Labs adds Potentially Affected malware exposure classification and a severity threshold policy parameter for unpinned dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Potentially Affected Finding Severity parameter to the Malware finding policy, configurable to Critical, High, Medium, Low, or None, to control whether findings are raised for unpinned dependencies whose declared version range could resolve to a known malicious package version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Exposure parameter to finding policy templates to include or exclude findings based on whether a dependency is Definitely Affected or Potentially Affected.
• Introduces a Potentially Affected malware exposure classification for unpinned dependencies whose resolved version does not currently match a malicious package but whose declared version range could resolve to one across environments or future resolution runs.

SIEM · 2026-09-14

Exploitation & C2 · 2026-09-14

NodeZero external pentests now support multi-Scope testing with per-Scope breakdowns in test reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an External Scope toggle to external pentest configuration, enabling testing of authorized assets across multiple Scopes at once with per-Scope breakdowns in test reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-09-14

NodeZero adds AWS, Azure Cloud, Entra ID Hybrid, and Entra ID Hybrid Pentest as new test types⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AWS test as a new NodeZero test type for attacking and assessing AWS environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Azure Cloud test as a new NodeZero test type for attacking and assessing Azure Cloud environments.
• Adds Entra ID Hybrid test as a new NodeZero test type for assessing Entra ID Hybrid identity environments.

Reconnaissance & OSINT · 2026-09-14

Digital Forensics & Incident Response · 2026-09-14

iLEAPP v2026.4.0 adds -t raw for disk images and E01s, F2FS support, and new artifacts for Garmin Connect, Tutanota, MEGA, and SMS previews.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -t raw input type to parse raw disk images and E01 acquisitions directly from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds F2FS filesystem support via re-vendored qnxprobe 1.28/1.29, enabling raw image parsing of F2FS volumes.
• Adds full artifact coverage for Garmin Connect (including the Move IQ activity series) on iOS.

Attack Surface & Exposure Management · 2026-09-14

Intruder adds Additional Domains configuration for authenticated web app scans, enabling subdomain and cross-domain coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Additional domains field when setting up or editing authentication for a web app target, allowing trusted subdomains (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ api.example.com, auth.example.com) and external services (identity providers, CDNs, third-party APIs) to be included in authenticated scan scope.

Web Application Security · 2026-09-14

Identity & Access Management · 2026-09-14

JumpCloud: Adds MCP Connection Status column (Discovered, Connected, Not Available) in AI & SaaS Management Applications tab, and an Add MCP Server workflow to connect discovered servers to AI Gateway without leaving the applications view.

• Adds mandatory App dropdown association for MCP servers in AI Gateway, scoping MCP server access to specific SSO applications or bookmarks and enabling group-based access control.

Container & Image Security · 2026-09-14

Mend Platform adds in-IDE/AI-agent suppression and a unified vulnerability remediation experience with a Top Fix column.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a suppression tool for IDE and AI agent workflows, supporting single and bulk suppression or unsuppression actions across all scanning engines, including SAST and SCA, with UI updates reflecting within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a unified vulnerability remediation experience with a Top Fix column in the Findings table, an updated Remediation tab, and standardized fix logic and metadata across the Mend Platform.

SAST / SCA / Code Security · 2026-09-14

Mend SCA adds IDE/AI-agent suppression triage and a unified vulnerability remediation experience with a Top Fix column⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a suppression tool in the IDE and AI agent workflow supporting single and bulk suppression or unsuppression across all scanning engines, including SAST and SCA, with UI updates reflecting within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a unified vulnerability remediation experience with standardized fix logic, a new Top Fix column in the Findings table, and an updated Remediation tab for consistent vulnerability fix metadata.

SAST / SCA / Code Security · 2026-09-14

Mend SCA adds the EU Vulnerability Database (EUVD) from ENISA as a primary security data source with dedicated CVSS scores and exploitability data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates the European Union Vulnerability Database (EUVD), sourced directly from ENISA, as a primary security data source, adding dedicated CVSS scores and exploitability information to vulnerability findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-09-14

MVT gains --timezone/-t for bugreport timestamp accuracy and defers IOC loading until first use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --timezone/-t option to mvt-android check-bugreport, accepting an IANA timezone name (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Europe/Paris), so bugreport file timestamps are interpreted in the device's wall-clock zone rather than the analysing machine's timezone; falls back to reading persist.sys.timezone from the bugreport's SYSTEM PROPERTIES section automatically.
• Defers STIX indicator loading until first use, so mvt-android and mvt-ios subcommands that list modules or reject invalid paths no longer parse IOC files unnecessarily.
• Reports unreadable or truncated sysdiagnose archives (catching tarfile.ReadError, EOFError, zlib.error, and OSError) with a critical-level log message and a clean exit code 1 instead of a silent Aborted!.

Threat Intelligence · 2026-09-14

OpenCTI now supports custom PMTiles map files uploaded by admins and stored in S3-compatible storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports uploading a custom PMTiles file as the map source, stored in the S3 bucket (Silo or any S3-compatible storage), replacing the previous file on upload — active immediately with no extra steps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-09-14

OpenCTI 7.260914.0 adds configurable keep-alive/headers timeout to prevent intermittent 502s behind ALB/ECS load balancers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds configurable keep-alive and headers timeout settings for deployments behind a load balancer (ALB/ECS) to prevent intermittent 502 errors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-14

Openlayer adds audit-ready evidence export from compliance framework pages, with SHA-256 checksums and scoped project exports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Export report action (via the ⋯ options menu) on workspace and project framework pages to download a zip containing uploaded evidence files, a markdown progress/control-status report, and CSV manifests with SHA-256 checksums — requires the Export framework evidence permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports scoping the export to a single project by triggering Export report from the project's framework page instead of the workspace framework page.

Vulnerability Management · 2026-09-14

OSV-Scanner v2.6.0 adds multi-arch container images, --experimental-plugins for new extractors, and pkg:git PURL typing for Git-pinned dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables additional file-type extractors (not on by default) via the --experimental-plugins flag — see the Supported Inventory Types doc for extractor names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extracts Git repository URLs and supports local OSV tag matching for Git-based dependencies in JavaScript lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock).
• Publishes a multi-arch (linux/arm64) container image for osv-scanner-action.

Continuous Control Monitoring (CCM) · 2026-09-14

RegScale: Adds archer subcommand for RSA Archer bidirectional integration (login and sync commands)

• Adds ibm subcommand for IBM AppScan file processing
• Adds veracode subcommand to process Veracode export files

Continuous Control Monitoring (CCM) · 2026-09-14

RegScale CLI 6.46.0 adds empty-role detection in jcam check_config and service account management from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection in jcam check_config that names any role declared in jcamSystemRoles that matches no point-of-contact position in any JCAM system in scope, surfacing roles that would be created empty before they are built.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ability to create and manage RegScale service accounts from the CLI.

Identity & Access Management · 2026-09-14

SailPoint adds Work Reassignment to automatically redirect access request reviews, manual tasks, and certifications to other users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Work Reassignment, reachable via User icon > Preferences > Work Reassignment, to automatically redirect access request reviews, manual tasks, and certifications to another identity for a configured time window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables managers to configure Work Reassignment for direct reports via the My Team widget > select identity > Work Reassignment tab, covering the same work item types.
• Adds a Reassignment History page under Preferences > Work Reassignment showing reassignment details — assignee and date — for the past 90 days.

SAST / SCA / Code Security · 2026-09-14

SAST / SCA / Code Security · 2026-09-14

Semgrep: Autofix is now generally available for all customers, running on demand per finding via the finding page or API.

SAST / SCA / Code Security · 2026-09-14

Socket reachability engine adds PHP support, --reach-version override, dynamic JS dispatch, Go/Rust analysis improvements, and smarter socket fix for Go modules⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The --entry-points flag now applies only to the scanned project's own root instead of leaking into every discovered subproject.
• Performance improvements for Python reachability analysis on projects using 3rd-party serializers like Pydantic.

SAST / SCA / Code Security · 2026-09-14

API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GET /api/v2/org/{orgId}/envs: param unassignedApps (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SOAR · 2026-09-14

API surface changed: +2 endpoints, −18 endpoints, 16 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /api/v1/responder-execution/{scope}/{rootId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /api/v1/responder-execution/{scope}/{rootId}/count

SOAR · 2026-09-14

SOAR · 2026-09-14

Tines: Adds optional automatic syncing for skills imported from git.

• Adds Hold Shift shortcut to open connector details from connector pick list.
• Adds branch rename capability.

Endpoint Security (EDR/XDR) · 2026-09-14

Zero Trust Secure Access Module for Windows 2.38.1040 cuts device posture reporting interval from 5 minutes to 2 minutes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Reduces the device posture reporting interval from 5 minutes to 2 minutes, enabling faster detection of posture changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-14

Zero Trust Secure Access On-Premises Gateway 1.0.93 adds ChatGPT unauthenticated traffic inspection and an updated Prompt Scan engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for ChatGPT unauthenticated traffic inspection, enabling coverage of sessions where users have not signed into ChatGPT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adopts the latest Prompt Scan engine to improve detection accuracy for prompt injection and harmful prompts.

Data Security & DLP · 2026-09-14

Ubiq Security adds Microsoft Entra ID (Azure AD) IDP integration with SCIM provisioning and JWT-based dataset authorization for enterprise users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JWT/token-based authorization support via Entra App Registrations, requiring configuration of Access Tokens, a Client Secret, group Token Claims, an API Scope named Custom.Read, and Microsoft Graph delegated permissions (offline_access, openid, profile).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds IDP Integration setup UI on the Integrations page for all enterprise plan users, enabling configuration of the OpenID Connect Discovery URL, IDP Token Issuer (https://sts.windows.net/TENANT_ID/), and IDP Token Audience fields.

Data Security & DLP · 2026-09-14

Ubiq adds Okta IDP integration via SCIM 2.0 and OIDC, enabling enterprise SSO and auto-provisioned identities in Ubiq SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds idp block to the Ubiq configuration file with keys type, customer_id, token_endpoint_url, tenant_id, and client_secret to configure Okta OIDC authentication for Ubiq client libraries/SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds [idp] credential section with SERVER, IDP_USERNAME, and IDP_PASSWORD fields so Ubiq libraries authenticate end-users via their Okta username and password.
• New IDP Integration setup UI on the Integrations page (enterprise plan) exposes the Ubiq SCIM URL and SCIM Secret Token needed to configure SCIM 2.0 push from Okta to Ubiq.

Compliance Automation & Trust Management · 2026-09-14

Vanta: New endpoint GET /personnel-notification-settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint PATCH /personnel-notification-settings

SAST / SCA / Code Security · 2026-09-14

SAST / SCA / Code Security · 2026-09-14

ZeroPath: Adds access sync and repository permissions import from GitHub (five roles, including direct collaborators) and Bitbucket (Cloud workspace groups and Server project groups), mapping provider roles onto 39 permissions across 10 groups.

Secure Access (VPN / SASE / ZTNA) · 2026-09-14

Zscaler launches Zero Trust Exchange Agentic Operations with a hosted MCP server and ZAgent for AI-driven administrative workflows⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Zero Trust Exchange Agentic Operations, a new hosted operational layer exposing intent-based tools and skills to first-party and third-party AI agents via a hosted Model Context Protocol (MCP) server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces ZAgent, Zscaler's native agentic experience within the Experience Center, allowing administrators to describe objectives in natural language and receive coordinated responses from specialized Zscaler agents and skills.
• Supports connecting approved commercial AI clients (Claude, ChatGPT) and custom customer-built agents through an OAuth 2.1 authorization flow, with per-user role-scoped consent and revocation.

Identity & Access Management · 2026-09-13

1Password adds full passkey support — create, save, sign in, and share passkeys across browsers and platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds full passkey support to the 1Password browser extension, enabling users to create, save, and authenticate with passkeys on sites that support passkey login — across Chrome, Firefox, Edge, Brave, and Safari.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables viewing, editing, moving, deleting, and sharing saved passkeys from 1Password on Mac, iOS, Windows, Android, and Linux.
• Watchtower now flags existing logins that are eligible to be upgraded to a passkey.

Post-Exploitation · 2026-09-13

API surface changed: +30 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v2/alert-webhooks/{alert_webhook_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /api/v2/alerts/{alert_id}
• New endpoint DELETE /api/v2/clients/{client_id}/artifacts/{artifact_id}

AI/LLM Security · 2026-09-13

API surface changed: +5 endpoints, 126 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /backend/v1/agent-sessions/{agentSessionId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /backend/v1/campaign-runs/{campaignRunId}/access
• New endpoint GET /backend/v1/license

Container & Image Security · 2026-09-13

API surface changed: +3 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /argos/v1/vex/documents/{ecosystem}/{package}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /registry/v2/repos/{repoUid}/digests/{digest}/stig:download
• GET /policies/v1/decisions: param artifactId (query) added

Container & Image Security · 2026-09-13

Chainguard adds Go 1.27 images including a new go-openssl-fips container and JFrog Catalog integration for Chainguard Libraries⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds go-openssl-fips container image that selects its FIPS-validated cryptographic module at deployment time rather than at compile time, enabling a single artifact to satisfy both OpenSSL FIPS and Go Cryptographic Module requirements without recompilation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ships Go 1.27 across three Chainguard container images: go, go-fips, and go-openssl-fips.
• Integrates Chainguard Libraries with JFrog Catalog, allowing joint customers to pull Chainguard-built packages through JFrog and enabling JFrog Zero-Touch Remediation to substitute patched Chainguard packages without changing developer workflows; Java support ships now, with JavaScript and Python to follow by end of September 2026.

Integrated & IT Risk Management · 2026-09-13

CISO Assistant v4.0.2 adds AI-powered workflows, TPRM domain export/import, date filters, quick-form requests, and German NIS2 translations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI call support to workflows, enabling automated AI-driven steps within CISO Assistant workflow definitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Carries the full TPRM ecosystem (third-party risk management data) through domain export/import operations.
• Adds date filters across the platform for narrowing object lists by date ranges.

Identity & Access Management · 2026-09-13

API surface changed: +2 endpoints, 9 modified, 2 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /users/{user_id}/biometric_credentials/{biometric_credential_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /users/{user_id}/biometric_credentials

Identity & Access Management · 2026-09-13

Clerk: Adds OAuth 2.0 Device Authorization Grant (beta, RFC 8628) for applications that cannot open a browser or accept text input — CLIs, TVs, game consoles — letting users approve access from a separate browser-capable device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports both public clients (Client ID only) and confidential clients (Client ID + Client Secret) for device authorization flows.
• Automatically advertises device_authorization_endpoint and urn:ietf:params:oauth:grant-type:device_code in OAuth 2.0 and OpenID Connect metadata when Device Authorization Grant is available and the verification page is reachable.

Internet Services · 2026-09-13

Cloudflare: New endpoint DELETE /accounts/{account_id}/field_extractors/{extractor}

• New endpoint GET /accounts/{account_id}/field_extractors/{extractor}
• New endpoint GET /accounts/{account_id}/workers/observability/zones/{zone_id}/observability/tracing/rules
• New endpoint GET /accounts/{account_id}/workers/observability/zones/{zone_id}/observability/tracing/settings

Identity & Access Management · 2026-09-13

ConductorOne adds agent classifiers, four session-policy API endpoints, MCP resource governance, and new system log event classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds agent classifiers that evaluate private-data sensitivity, untrusted-content exposure, and exfiltration capability at call time, routing matches to a hook, human approval, or outright block — with an Observe mode that logs what a rule would catch before it can deny anything.
• Adds bulk and individual reprocessing of findings against current transformation and routing rules, with the option to keep or reset manual changes.
• Adds a configurable bulk request limit (1–100, default 10) for the maximum number of entitlements a user can request at once, set from Governance > Forms.

Vulnerability Management · 2026-09-13

defectdojo: Adds token_expiry field to PATCH /api/v2/user_contact_infos/{id}/ (superuser only) to set or clear a per-user token expiry datetime; after the datetime passes, the user's token receives 403 Forbidden with {"detail": "API token has expired."} until a new token is generated; set to null to clear the override.

• Adds DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable to enforce an instance-wide maximum token lifetime (in days, measured from each token's creation time); applies retroactively to all existing tokens including those issued via POST /api/v2/api-token-auth/; defaults to no expiry when unset.
• New endpoint documented: POST /api/v2/api-tokens/revoke/

Identity & Access Management · 2026-09-13

Didit adds per-user PDF history export via UI button and GET /v3/users/{vendor_data}/generate-pdf/ API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v3/users/{vendor_data}/generate-pdf/ API endpoint to pull a complete PDF history for a single user, authenticated with an API key, enabling scheduled compliance exports or back-office ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Download user history PDF button on the user detail page to download the same bundled PDF report from the console UI.
• The exported PDF bundles a cover page (profile summary, feature status, session index) with the full standard report of every completed session for that user.

Identity & Access Management · 2026-09-13

Didit adds email/phone social-footprint lookups, PDF compliance report generation, and async KYB registry search with webhooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds enable_social: true request field to email risk lookups to return an email_social block listing online platforms the address is registered on, with per-category counts and profile details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds compatibility aliases email.enrichment and phone.enrichment as normalized intelligence objects alongside the existing email.email_intelligence and phone.phone_intelligence fields — values are identical.
• Adds GET /v3/session/{sessionId}/generate-pdf/ endpoint to render and download a compliance-ready PDF report for finished KYC or KYB verification sessions (eligible statuses: Approved, Declined, In Review, Kyc Expired).

Identity & Access Management · 2026-09-13

Didit AML Screening node gains flexible Screened entity field mapping for flows without ID Verification or KYB Registry steps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Screened entity tab to the AML Screening node so practitioners can map screening inputs (name, date of birth, country, document number) directly from Document AI fields, questionnaire answers, expected_details, or metadata — enabling AML screening on flows that use non-standardised documents such as tax certificates or notarised incorporation deeds instead of an ID Verification or KYB Registry step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Entity type selector on the AML Screening node to screen either a person or a company named in an uploaded document, routing company searches against company records rather than people records.
• Adds an Incomplete screening data control on the AML Screening node to configure behaviour when less than a full identity is available — defaulting to Review, with a No action option for flows that knowingly hold only a name.

Identity & Access Management · 2026-09-13

Mobile SDKs 4.8.0 bring national ID-number lookup and digital ID wallet sign-in to iOS, Android, React Native, and Flutter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Improves questionnaire error messaging in mobile SDKs so users see the server-returned rejection reason instead of a generic failure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-13

Didit adds non-document national ID lookup and digital ID wallet support to ID Verification, with per-country method controls and new assurance-tier fields on sessions, webhooks, and the decision API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds status.updated webhook and decision API fields carrying the verification method (Documentary, Data match, Cryptographic) and assurance tier for every ID Verification session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-country method controls via the Countries tab on the ID Verification step and through the API, letting you enable or disable document capture, national ID lookup, and digital ID wallets country by country.
• Adds non-document national ID-number lookup: the user submits their national ID number and personal details, checked against an authoritative source (government register, credit bureau, or similar) with no photograph or upload required.

Post-Exploitation · 2026-09-13

evil-winrm-py v1.7.0 adds an MCP server mode for AI agent access and JEA endpoint support via new CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --mcp flag to start evil-winrm-py as an MCP server in streamable HTTP mode, with --mcp-host (default 127.0.0.1) and --mcp-port (default 8000) to configure the listener address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes four MCP tools over the server: winrm_login, winrm_execute, winrm_logout, and list_sessions, supporting multiple concurrent WinRM sessions each tracked by a session_id.
• Adds -c/--configuration-name CLI flag to connect to a constrained JEA endpoint instead of the default Microsoft.PowerShell full PowerShell session, available in both interactive shell and MCP server modes.

Secrets Detection & Management · 2026-09-13

GitGuardian API adds external_provider_type field with Okta support for team management endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds external_provider_type field (supporting "okta" as a valid value) to team-related API responses and requests, enabling identity-provider-aware team management via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-09-13

Hayabusa v4.1.0 adds sort-csv for post-scan deduplication and GeoIP enrichment for logon-summary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sort-csv command that sorts a Hayabusa CSV by Timestamp, deduplicates detections by comparing every column except EvtxFile, and accepts a single file via -f, --file, a directory of CSVs via -d, --directory, an output path via -o, --output, and -C, --clobber to overwrite.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -G, --geo-ip option to the logon-summary command, appending Source ASN, Source Country, and Source City columns for the source IP of each summarized logon.
• Adds First Logon/Last Logon columns to the logon-summary successful logon table and First Attempt/Last Attempt columns to the failed logon table.

Reconnaissance & OSINT · 2026-09-13

Threat Intelligence · 2026-09-13

API surface changed: +1 endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint POST /monitoring/claim-pending⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-13

juice-shop adds a NextGen B2B REST API at /b2b/v2 replacing XML-based endpoints, with JWT bearer auth and JSON order management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /b2b/v2/orders endpoint (operationId: createCustomerOrder) to create customer orders, accepting an Order body with cid, orderLines, and orderLinesData fields and returning an OrderConfirmation with orderNo and paymentDue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds JWT bearer authentication (bearerAuth, scheme: bearer, format: JWT) as the security scheme for all /b2b/v2 endpoints.
• Introduces the NextGen B2B JSON API (/b2b/v2, version 2.0.0), replacing the previously offered XML-based B2B endpoints.

Identity & Access Management · 2026-09-13

JumpCloud: Adds MCP Discovery and Token & Cost Tracking toggles under Enhanced Discovery Options in device settings, supporting Cursor, Claude Code, OpenCode, Codex, VS Code, and Copilot CLI on managed Windows and macOS devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Insights > Reports Custom Query Builder with Manual Report Builder and natural-language query modes, supporting CSV and JSON export and scheduled reports.
• Introduces Agent Identities (Public Preview) under Identity Management > Agents for non-human identity management of AI agents, with OAuth-based authentication via the JumpCloud AI Gateway and group-based access control through Identity Management > Agent Groups.
• Introduces Password Vault across Admin Portal, User Portal, JumpCloud Protect mobile app, and JumpCloud Go browser extension, enabling credential sharing, autofill, and bulk CSV/Excel import.

Network Analysis & Monitoring · 2026-09-13

NETRESEC: Adds outbound SOCKS proxy client via --connect socks5:<host>:<port> (or socks4:), supporting both SOCKS4 and SOCKS5, enabling use cases such as routing inspected TLS traffic through Tor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle dead connections on the client and server sides respectively.
• Adds --tlstimeout <seconds> flag to enforce a timeout on the TLS handshake stage (default 30 seconds).
• Adds --timeout <seconds> flag to enforce a timeout on the TCP handshake stage (default 30 seconds).

General Utilities & Libraries · 2026-09-13

Obsidian 1.14.1 adds Quick Capture widget locations, OpenStreetMap templates, MathJax 4.1.3, and RTL Bases table support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• iOS Lock Screen and Control Center Quick Capture widgets can now be configured to open a specific Location.

Threat Intelligence · 2026-09-13

New POST /dark-web-brand-playbook-alert/{id} endpoint retrieves full intelligence for a single Dark Web Brand Playbook Alert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /dark-web-brand-playbook-alert/{id} endpoint to retrieve the full intelligence picture for a single Dark Web Brand Playbook Alert, including workflow state, priority, assignee, matched assets, screenshot references, source-specific evidence for forum, market, Telegram, and ransomware mentions, the analysis report, cached source content, and the alert's full change log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Continuous Control Monitoring (CCM) · 2026-09-13

RegScale CLI gains OCSF ingestion, QRadar SIEM sync, Jira Data Center, JCAM, Databricks, DuroSuite, Sicura, SentinelOne, Axonius V2, and more new integrations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ocsf command for OCSF (Open Cybersecurity Schema Framework) integration to standardize security event ingestion into RegScale⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds qradar command for IBM QRadar SIEM integration to sync security events, findings, and assets from QRadar into RegScale
• Adds jira_dc command for Jira Data Center (on-prem) integration to sync issues, tasks, and attachments between Jira Data Center and RegScale

Continuous Control Monitoring (CCM) · 2026-09-13

RegScale CLI gains 60+ integrations and commands spanning SIEMs, CNAPPs, GRC tools, SBOM, OSCAL, SARIF, and CI/CD pipeline compliance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds regscale wiz command to integrate continuous monitoring data from Wiz.io.
• Adds regscale crowdstrike command (Beta) to load CrowdStrike threat intelligence into RegScale.
• Adds regscale cisa command to ingest CISA threat intelligence including KEV (Known Exploited Vulnerabilities) and security alerts.

Attack Surface & Exposure Management · 2026-09-13

runZero adds custom roles for API keys and MCP connections, sub-asset visibility, and direct task reprocessing from the UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables account-level API clients to use granular authentication scopes in addition to roles, capped by the creator's own access rights.
• Supports reprocessing tasks directly from the user interface.

SAST / SCA / Code Security · 2026-09-13

API surface changed: +11 endpoints, 46 modified, 191 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v1/advisories/{advisory_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /api/v1/advisories/
• New endpoint GET /api/v1/advisories/public/{workspace_key}

SAST / SCA / Code Security · 2026-09-13

Semgrep adds webhook actions on Supply Chain incident policies, expands Issues API fields, and makes Autofix available to all customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Autofix for all customers; it remains opt-in per finding and runs only when requested from the finding page or through the API.
• Makes Supply Chain Autofix independent of Upgrade Guidance, allowing Autofix pull requests to be opened even when Upgrade Guidance is disabled or has not yet run.
• Adds the ability to record an ignore reason and a comment when triaging an Agentic Workflows issue.

SAST / SCA / Code Security · 2026-09-13

Socket's Coana reachability engine gains PHP support, workspace grouping, dynamic JS dispatch, and smarter fix attribution via --dry-run --output-file⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --reach-version flag to socket scan reach to run a specific Coana engine version instead of the bundled pinned one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds withheldFixes field to the --dry-run --output-file JSON output, naming versions and flags that blocked an automatic fix.
• Enables reachability analysis for PHP/Composer projects when running via the Socket CLI, with subdirectory Composer projects analyzed in their own directory.

SAST / SCA / Code Security · 2026-09-13

New GET /v0/orgs/{org_slug}/alert-policies/migration/status endpoint reveals your org's Policies migration state in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v0/orgs/{org_slug}/alert-policies/migration/status to report where an organization stands in the alert-policy migration, returning state (null, pending, previewing, accepted, or auto_finalized), the booleans alert_policies_enabled and legacy_evaluation_enabled, and timestamps (finalized_at, deadline_at, window_end_at, deadline_admin_paused_at) — all as ISO-8601 strings or null.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Requires the alert-policy:list scope and organization-wide repository access on the API token; a repository-restricted token returns an error, and each call consumes 1 unit of quota.

Firewalls & Network Defense · 2026-09-13

API surface changed: 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GET /v0/message-groups: param verdict__is_not (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SOAR · 2026-09-13

API surface changed: −1 endpoint, 16 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SOAR · 2026-09-13

Tines 43.2.0 adds case API field updates, MCP tools, formula-driven AI provider URLs, audit log retention config, and dashboard draft mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Update case fields via the API capability, enabling programmatic updates to case fields through the Tines API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Audit log retention period configuration, allowing teams to set how long audit log data is retained.
• Adds Cases tools in the Tines MCP (Model Context Protocol), exposing case management surfaces to AI-driven workflows.

Compliance Automation & Trust Management · 2026-09-13

API surface changed: +3 endpoints, 14 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint PATCH /groups/{groupId}

SAST / SCA / Code Security · 2026-09-13

Veracode adds veracode fix sca CLI command, IDE/CLI Usage Analytics dashboard, Dart 3.13, Flutter 3.47, PHP 8.4/8.5 support, and GitHub Workflow SCA fix generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for Dart 3.13 and Flutter 3.47 in Static Analysis.
• Adds support for PHP 8.4 and PHP 8.5 in Static Analysis.
• Improves detection of CWE-80 flaws involving React useState in Static Analysis.

SAST / SCA / Code Security · 2026-09-13

ZeroPath: Adds a remote MCP server at https://zeropath.com/mcp supporting Streamable HTTP clients (Claude, Cursor, Codex); connections are read-only until approved, and administrators can view and revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Microsoft Teams channel notifications via Adaptive Cards; a channel owner pastes an incoming webhook URL into ZeroPath — no Azure AD app registration required — and notification rules control which events reach which channels.
• Adds Continuous Scanning mode: triggers a full scan on every meaningful commit to a repository's default branch (including merged pull requests), re-examines what changed on follow-up scans, and closes findings fixed by those commits; available on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server, configurable per organization, tag, or repository.
• Adds Assistant skills: administrators author reusable methodology (triage approach, patch-review criteria, report structure, codebase conventions) from the Skills tab; four built-in skills ship for triage, dependency reachability, report writing, and patch review, each forkable into an editable copy.

AI/LLM Security · 2026-09-12

SAFE2 CLI 0.3.0 adds eight new subcommands for capturing, verifying, and signing task evidence from AI agent runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds safe2 feedback receipt to produce JSON or Markdown evidence receipts for AI agent task claims, with --artifact-root, --format, and --output options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds safe2 feedback capture-pytest to run selected tests and capture fresh evidence, recording the observed exit code and test results separately from process success.
• Adds safe2 feedback verify-pytest to recheck a saved pytest capture offline, recomputing hashes and test assessments without re-executing tests.

Cloud Security Posture · 2026-09-12

AppOmni extends SSPM into AI-SPM with Agent Inventory, Marlin AI correlation, and AskOmni conversational security queries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces AI Security Posture Management (AI-SPM), extending SSPM coverage to discover, control, and defend AI agents and copilots running inside SaaS environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Agent Inventory to automatically map which AI agents exist across your SaaS stack, what they are connected to, and who is using them — covering platforms including Claude, Microsoft 365 Copilot, Salesforce Agentforce, and ServiceNow Now Assist.
• Introduces Marlin AI for autonomous investigation and correlation, connecting security signals across SaaS and AI ecosystems into a single prioritized view, including prompt injection attempts, high-risk misconfigurations, and ACL role changes, with built-in IP and user behavior analytics.

Digital Forensics & Incident Response · 2026-09-12

Belkasoft X v2.12 adds offline evidence translation, AI SQLite classification, custom SQLite artifacts, and RSMF 2.0 support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds offline evidence translation so case files can be translated without an internet connection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI-powered SQLite classification to automatically categorize SQLite databases found in evidence.
• Adds custom SQLite artifacts, enabling practitioners to define their own artifact types for SQLite data.

SAST / SCA / Code Security · 2026-09-12

Black Duck Signal gains BYO-LLM support, letting regulated orgs route each of its seven AppSec agents through their own LLM infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --llm-mode CLI flag and mode field in the [LLM] config-file section to switch Black Duck Signal between Black Duck-managed and BYO-LLM endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds [LLM] global config section with uri, key, timeout, gcp_service_account_key, and gcp_project fields that set defaults for all seven agents.
• Adds per-agent config sections — [LLM_SINGLEFILESCAN_AGENT], [LLM_DATAFLOW_AGENT], [LLM_OVERSIGHT_AGENT], [LLM_EXPLOITATION_AGENT], [LLM_SCA_AGENT], [LLM_MERGEKEY_EMBED_AGENT], [LLM_OVERSIGHT_EMBED_AGENT] — each accepting model, uri, key, timeout, and api_version overrides.

Container & Image Security · 2026-09-12

Chainguard: Adds go-openssl-fips container image for Go 1.27 that selects its FIPS-validated cryptographic module at deployment time rather than at compile time, enabling a single build artifact to run across environments without recompilation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Ships 39 new container images this week, including 10 kubeflow-pipelines-* FIPS variants and new images for dbmate, hadolint, jruby, kserve-huggingfaceserver, gubernator, packer, security-profiles-operator, aws-lambda-dotnet, opentelemetry-go-instrumentation, presidio-anonymizer, redpanda-console-fips, and others.

Identity & Access Management · 2026-09-12

Identity & Access Management · 2026-09-12

Clerk adds OAuth 2.0 Device Authorization Grant (beta) for CLIs, TVs, and input-constrained devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for device_authorization_endpoint and grant type urn:ietf:params:oauth:grant-type:device_code advertised automatically via OAuth 2.0 and OpenID Connect metadata when Device Authorization Grant is enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Clerk's Account Portal hosts user verification for device flows, displaying the OAuth application, requested scopes, optional Organization selection, and approve/deny actions.

Internet Services · 2026-09-12

API surface changed: +20 endpoints, −3 endpoints, 162 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /accounts/{account_id}/artifacts/namespaces/{namespace}
• New endpoint POST /accounts/{account_id}/artifacts/namespaces
• New endpoint POST /accounts/{account_id}/infrastructure/targets/batch_tags

Internet Services · 2026-09-12

Voice Agent turn metrics, AI Gateway cache token costs, Containers + OpenAI Agents API, and a new Zoom CASB integration⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds turnmetrics event on VoiceClient in @cloudflare/voice v0.4.0, emitting a typed VoiceTurnMetrics summary with turnId, terminal outcomes (completed, no_output, output_limit, content_filtered, model_error, tts_error, aborted), and per-stage timings (speech-to-final-transcript, model-to-first-text, TTS-to-first-audio, total turn duration).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds diagnostics: { browserConsole: true } option to withVoice() in @cloudflare/voice v0.4.0, forwarding server lifecycle events to the browser console for local debugging.
• Adds support for indexing R2 objects without filename extensions in AI Search when the objects include a supported Content-Type metadata value.

Internet Services · 2026-09-12

Cloudflare API v7.10.0 adds billing management, BGP filter profiles, data-security posture policies, field extractors, and abuse-report endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /accounts/{account_id}/subscriptions/cancel-downgrade to cancel a delayed subscription downgrade.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST /accounts/{account_id}/subscriptions/{subscription_identifier}/cancel-reason and GET /accounts/{account_id}/subscriptions/{subscription_identifier}/cancel-reason to create and retrieve cancellation reasons.
• Adds POST /accounts/{account_id}/subscriptions/{subscription_identifier}/action/append to append a subscription action.

Internet Services · 2026-09-12

Cloudflare adds Voice Agent turn metrics, AI Gateway custom cache token costs, Container+Codex support, and R2 extensionless object indexing⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per-turn latency metrics and browser diagnostics for Voice Agents via @cloudflare/voice v0.4.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports indexing extensionless R2 objects in AI Search by setting supported Content-Type metadata.

SAST / SCA / Code Security · 2026-09-12

GitHub secret scanning email alerts now include direct links to every location a leaked Cloudsmith API key was detected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GitHub secret scanning email notifications now list every detection location for an exposed Cloudsmith API key, with a direct link to each occurrence in the GitHub repository.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-12

ConductorOne: Adds four new read-only API endpoints to preview which session policy applies to a given user (by direct assignment, group membership, or tenant default) and list every user a policy applies to — direct and group-conferred, with the conferring group named.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds groups[] field and correlation_uid to system log events, plus four new Identity & Access event classes: Account Change, Entity Management, User Access Management, and Group Management; machine identities now reported as Service account type.
• Adds Agent Classifiers to evaluate AI agent risk at call time — writing rules over private-data sensitivity, untrusted-content exposure, and exfiltration capability, then routing matches to a hook, human approval, or block; includes Observe mode to log what a rule would catch before enforcement.
• Admins can now set a custom bulk request entitlement limit (1–100, default 10) from Governance > Forms.

SIEM · 2026-09-12

DeepSeek V4.1 Flash now available on Databricks Unity Gateway with text and image input support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DeepSeek V4.1 Flash model to Unity Gateway, accessible via Foundation Model APIs, with support for text and image inputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-12

Databricks OpenSharing now GA for foreign Iceberg tables federated via Lakehouse Federation, readable by external Iceberg clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports sharing foreign Iceberg tables federated from external Iceberg catalogs via Lakehouse Federation to Delta Sharing recipients, including those using non-Databricks Iceberg clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-12

Databricks OpenSharing now supports sharing foreign schemas and tables federated via Lakehouse Federation without copying data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables recipients to read data in shared foreign tables and foreign schemas via OpenSharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-12

Jobs API gains performance_target: STANDARD for one-time runs, also supported in Airflow's DatabricksSubmitRunOperator.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds performance_target field set to STANDARD in the Jobs API for one-time runs, enabling standard performance mode alongside the existing options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports performance_target: STANDARD in Apache Airflow's DatabricksSubmitRunOperator for one-time Databricks job submissions.

SIEM · 2026-09-12

Databricks Genie gains MCP connectors for Google Drive, Gmail, Google Calendar, Microsoft 365, Atlassian, Slack, and GitHub — governed through Unity Catalog and Unity Gateway⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Databricks-provided MCP connectors for Google Drive, Gmail, Google Calendar, Microsoft 365, Atlassian, Slack, and GitHub, enabling Genie One and Genie Code to search and act on external company tools while answering questions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Authenticates each user individually via OAuth so tokens are never shared across users.

Web Application Security · 2026-09-12

DataDome adds static asset exclusion to skip processing of CSS, JS, images, media, and other non-dynamic file types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports excluding static assets (e.g., avi, css, js, jpg, png, svg, mp4, woff2, zip, and dozens more) from DataDome processing via an exclusion list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-09-12

DefectDojo gains programmatic API token revocation, per-user expiry, and an instance-wide default token lifetime setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /api/v2/api-tokens/revoke/ endpoint allowing a superuser or Global Owner to revoke a token by its key value, without knowing the owning user; returns 204 on success, 404 if the key is not found, 400 if the key field is missing, or 403 for non-superusers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds token_expiry field on PATCH /api/v2/user_contact_infos/{id}/ (superuser only) to set a per-user token expiry datetime; expired tokens receive 403 Forbidden with {"detail": "API token has expired."} and setting the field to null clears the override and falls back to the instance default.
• Adds DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable to enforce a maximum token lifetime across all users; tokens expire that many days after creation and the setting is evaluated at request time, making it retroactive to existing tokens.

Identity & Access Management · 2026-09-12

API surface changed: +3 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /v3/aml-monitoring/jobs/{job_id}/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint POST /v3/businesses/aml-monitoring/
• New endpoint POST /v3/users/aml-monitoring/

Identity & Access Management · 2026-09-12

Didit adds social-footprint add-on for email/phone risk APIs, enable_social flag, and documents two-step KYB registry search-then-select flow with async webhook support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds enable_social: true request field to the Email Risk API endpoint to append an email_social block containing online platform registrations, per-category counts, and profile details for an email address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds enable_social: true request field to the Phone Risk API endpoint to append a phone_social block containing online platform registrations, per-category counts, and profile details for a phone number.
• Exposes email.enrichment as a compatibility alias for email.email_intelligence on live Email Risk API responses so new integrations have a stable normalized field name.

Identity & Access Management · 2026-09-12

Didit adds digital identity wallet support and a KYB Registry API with company search and profile endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for 22 digital identity wallets across multiple countries, including assurance levels, prerequisites, and attributes — distinct from crypto wallet screening.

Identity & Access Management · 2026-09-12

Didit adds non-document identity lookup and per-country method controls, with verification method and assurance tier now returned on every session result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Data match (non-document lookup) as a new ID Verification method: users enter a national ID number and personal details, checked against government registers, credit bureaus, or utility/residential records — no photograph or upload required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Sessions, the decision API, and the status.updated webhook now carry the method that produced each ID Verification (document, Data match, or wallet) and its assurance tier (Documentary, Data match, or Cryptographic).
• Adds Registry comparison result fields showing every compared field, the value the user provided, the value the source held, and whether it matched.

SIEM · 2026-09-12

Elastic Security Labs adds a layered Linux LPE detection framework covering SUID/SGID abuse, page-cache exploits, and COW-class kernel bugs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Suspicious SUID/SGID Utility Execution detection rule combining euid-0 / non-root-real-user shape, low process.args_count, and interpreter or writable-path parent to catch abuse of su, sudo, pkexec, and passwd with near-zero false positives.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Potential Privilege Escalation via a SUID/SGID Binary detection rule using an EQL stringcontains(process.executable, process.command_line) trick to catch abuse of uncommon or long-tail SUID binaries without maintaining a hard-coded name list.
• Adds a SUID helper proxy-execution detection rule that inspects process.args (rather than process.name) for known setuid binary paths — including /usr/bin/pkexec, /usr/lib/snapd/snap-confine, /usr/bin/newuidmap, and /usr/libexec/openssh/ssh-keysign — combined with process.args_count <= 2 to catch cases where the helper is passed as an argument to another privileged binary.

SAST / SCA / Code Security · 2026-09-12

Endor Labs adds base image remediation with upgrade comparison, Poetry private registry auth, and async SBOM/VEX export via AsyncJob API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds endorctl container scan --base-image-check-updates to attribute container findings to base vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ application layers and compare remediation options across a refreshed build, next version, and latest version.
• Adds endorctl container remediation list-base-image-updates to list base image upgrade options with per-option counts of findings fixed and introduced.
• Adds AsyncJob REST API resource for submitting and polling SBOM and VEX export jobs as background tasks, enabling large-project exports without request timeouts.

Firewalls & Network Defense · 2026-09-12

Fastly stats APIs now expose imgopto_input_image_bytes and imgopto_output_image_bytes for Image Optimizer traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds imgopto_input_image_bytes and imgopto_output_image_bytes metrics to real-time analytics and historical stats API responses, enabling visibility into Image Optimizer input and output data volumes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-12

Copilot usage metrics API gains VS Code Agents fields: daily_active_vscode_agent_users, used_vscode_agent, and totals_by_vscode_agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds daily_active_vscode_agent_users to aggregate enterprise and organization Copilot usage reports (1-day and 28-day periods) to count unique users active in the VS Code Agents window each day.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds totals_by_vscode_agent to aggregate enterprise and organization reports, exposing optional session_count and total_user_messages rollups for the VS Code Agents window.
• Adds used_vscode_agent to per-user enterprise and organization Copilot usage reports (1-day and 28-day periods) as an optional indicator of whether the user used the VS Code Agents window.

SAST / SCA / Code Security · 2026-09-12

Copilot code review auto-resolves addressed comments, writes smart commit messages, and uses shell tools plus an agent ensemble for deeper analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Generates smart commit messages when you apply a Copilot code review autofix suggestion, replacing the generic auto-filled message with one describing the specific change.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands Copilot code review analysis to use the full set of shell tools from the Copilot SDK — including running build commands, tests, and targeted scripts — behind the Copilot agent firewall.

SAST / SCA / Code Security · 2026-09-12

GitHub Copilot adds Jira integration, HydraFusion adaptive model routing, VS Code agent automations, and JetBrains enterprise sandbox controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Project HydraFusion to /experimental in Copilot CLI, enabling automated semantic routing between local, cloud, and compound models — select it like any other model and it balances performance, cost, and latency per task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Jira integration in the Copilot app, letting you bring Jira issues into a shared canvas and carry context through investigation, implementation, and pull request preparation.
• Adds agent automations (public preview) in VS Code 1.137, enabling recurring agent tasks scheduled hourly, daily, or weekly, or triggered on demand.

SIEM · 2026-09-12

Google SecOps adds case playbooks, reaction triggers, and self-service Bindplane Enterprise license download in preview⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables self-service download of the Bindplane Enterprise (Google Edition) license key from SIEM Settings > Collection Agents > Bindplane Enterprise (Google Edition) in the platform console, available to Enterprise Plus and Google Unified Security customers in US and EU regions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces case playbooks (preview), allowing playbooks and manual actions to run across an entire case container rather than individual alerts, consolidating response tasks during investigations.
• Introduces reaction triggers (preview), enabling playbooks to fire automatically in response to real-time case or alert updates — such as changes to case assignee, case tags, alert priority, or newly added entities.

Reconnaissance & OSINT · 2026-09-12

API surface changed: −2 endpoints, 1 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-09-12

API surface changed: +16 endpoints, 11 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v1/secret-validation-rules/dynamic-secrets/{ruleId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /api/v1/secret-validation-rules/secret-rotations/{ruleId}
• New endpoint DELETE /api/v1/secret-validation-rules/static-secrets/{ruleId}

Attack Surface & Exposure Management · 2026-09-12

Intruder: Adds an Additional domains field for web app authentication, allowing subdomains and external services to be included in authenticated scan scope.

Endpoint Security (EDR/XDR) · 2026-09-12

Iru adds Auto Apps for Windows/Mac, enrollment retry for Return to Service, and Cyber Essentials alignment in Compliance Automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Auto Apps support for Windows and Mac devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables devices to automatically retry enrollment when using Return to Service.

General Utilities & Libraries · 2026-09-12

Joplin v3.7.18 adds double-click-to-add-note on whiteboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables double-clicking an empty whiteboard canvas to add a note directly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-12

juice-shop adds a NextGen B2B JSON API at /b2b/v2 with a POST /orders endpoint secured by JWT bearer auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the OrderLinesData schema for passing order lines in customer-specific JSON format as a raw string, enabling flexible enterprise order integrations alongside the structured OrderLines array format.

Identity & Access Management · 2026-09-12

JumpCloud adds Password Vault, Agent Identities, Access Risk Detection, Custom Query Builder, and MCP/AI Gateway management in its 2026 releases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP Discovery and Token & Cost Tracking options under Enhanced Discovery Options in device settings, surfacing MCP servers and token/cost data from Cursor, Claude Code, OpenCode, Codex, VS Code, and Copilot CLI on managed Windows and macOS devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds + New App button in the Add MCP Server dialog to launch the standard Add New SSO Application wizard during server setup.
• Adds Identity Management > Agents section (Public Preview) for registering and governing non-human AI agent identities with OAuth client credentials, group-based SSO application access via Agent Groups, and lifecycle management independent of human user accounts.

SAST / SCA / Code Security · 2026-09-12

Lakera Red adds tool-call tracing via interceptTool/intercept_tool so red-team scans capture what agents actually did, not just their final replies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds LAKERA_RED_TOOL_INTERCEPT, LAKERA_RED_API_KEY, and LAKERA_RED_URL environment variables to enable and configure tool tracing in the lakera-red-sdk.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds interceptTool (TypeScript) / intercept_tool (Python) module-level functions to the lakera-red-sdk to report tool name, arguments, and result to the Red API over TLS and return the result unchanged.
• Supports tracing any JsonValue result type — string, number, boolean, null, array, or object — through interceptTool/intercept_tool.

Network Analysis & Monitoring · 2026-09-12

PolarProxy 2.0.2 adds outgoing SOCKS4/5 tunneling, environment-variable config, idle-connection timeouts, and an SBOM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --connect socks5:<host>:<port> (and socks4) to route PolarProxy's outgoing connections through an upstream SOCKS4 or SOCKS5 proxy, enabling use cases such as inspecting HTTPS traffic before forwarding it through Tor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --idletimeoutclient <seconds> and --idletimeoutserver <seconds> flags to close idle (dead) connections after a configurable period; complements the existing --timeout <seconds> (TCP handshake) and new --tlstimeout <seconds> (TLS handshake) flags.
• Adds --tlstimeout <seconds> for a dedicated TLS-handshake timeout, separate from the existing TCP-handshake --timeout; default is 30 seconds.

AI/LLM Security · 2026-09-12

nono gains nono session cleanup command to remove sessions from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds nono session cleanup subcommand to remove sessions from the CLI runtime.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-09-12

nono adds live sandbox session management with ps, attach, detach, stop, inspect, and cleanup commands⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds session lifecycle management for live sandbox sessions via ps, attach, detach, stop, inspect, and session cleanup subcommands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-09-12

nono v0.77.0 removes all legacy profile aliases and shims, and switches network-notification sessions to CLONE_FILES bootstrap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Removes all legacy profile-key aliases, CLI flag aliases (including --allow-net, --net-allow, and env vars NONO_NET_BLOCK, NONO_NET_ALLOW, NONO_PROXY_CREDENTIAL, etc.), and the nono policy subcommand — these now fail to parse instead of warning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Switches network-notification session bootstrap to use CLONE_FILES, improving session startup for that session type.

General Utilities & Libraries · 2026-09-12

Obsidian mobile gains configurable Quick Capture widgets with location targeting and OpenStreetMap support; math rendering upgrades to MathJax 4.1.3.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --font-preferred-size CSS variable for text that should respect the system preferred text size, combining --font-text-size with the --preferred-text-scale multiplier on mobile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds {{openStreetMapLink}} template variable to iOS Quick Capture templates to insert an OpenStreetMap link to the user's current position.
• Adds a configurable Quick Capture Home Screen widget on iOS 26 with shortcuts to capture directly to different Locations.

Identity & Access Management · 2026-09-12

SAP Connector migrated to SCIM 2.0 API; Marker.io (SCIM) and Square OIDC IdP-initiated SSO added.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• SAP integration has been migrated to use the SCIM 2.0 API, with the connector's internal HTTP helper updated to support this standard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Marker.io by Redblock (SCIM) integration is now available.
• Square (OIDC) now supports IdP-initiated SSO flow.

Identity & Access Management · 2026-09-12

OIG adds cancel-request APIs (Beta), higher Access Request limits, and GA certifications for campaign decisions and AI agent resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds three new cancel-request API endpoints (Update a request for Access Request V1, Update a request for Requests V2, and Update my request for My Requests) in Beta, enabling programmatic cancellation of active and pending access requests from custom portals, ITSM tools, CLIs, or chatbots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Increases Access Request limits: users per task or question raised to 25 (from 10), entitlement bundles in an access level condition to 1,000 (from 100), groups in an access level condition to 1,000 (from 500), request type configuration lists per org to 250 (from 100), and request types per org to 750 (from 500).
• API support for Access Certification campaign decisions is now GA in Production.

Identity & Access Management · 2026-09-12

Okta adds malware proxy detection, PowerShell AD script execution, and richer telephony hook payloads in September 2026⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds data.context.app.clientId and data.messageProfile.isResend fields to the telephony inline hook request payload, identifying the signing-in app and whether an OTP is a resend within the same session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MALWARE_PROXIES IP service category to enhanced dynamic network zones, powered by Okta CyberDefense and covering proxy services linked to malware and botnet activity (including 911 S5, NSOCKS, iProxy, and BHProxies).
• Enables admins to execute custom PowerShell scripts in on-premises Active Directory environments via the Active Directory agent, invokable through Okta Workflows and the Okta public API (Invoke a remote script on the AD agent).

Identity & Access Management · 2026-09-12

Okta Identity Engine: Adds GET /api/v1/proximity-providers and GET /api/v1/proximity-providers/{proximityProviderType} endpoints via the Proximity Providers API to list NFC authenticator types and retrieve available NFC tags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds registrationEndpoint property to the MCP Server Registrations API, exposing the URL of the OAuth 2.0 Dynamic Client Registration endpoint.
• Adds registrationMethod property to the Client Authentication Settings API to define how OAuth client credentials for a resource connection are registered.
• Adds registrationType property to the Okta Integration Network to register an MCP server from an OIN catalog entry.

Identity & Access Management · 2026-09-12

Okta 2026.09.0 adds NFC authenticator, MCP server registration, malware proxy IP service, and PowerShell scripts for AD⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds NFC authenticator support (self-service Early Access in Preview), enabling NFC-based hardware tokens as an authentication factor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds additional telephony inline hook payload fields (self-service Early Access in Preview), giving hook handlers richer context for SMS/voice flows.
• Adds API support for Dynamic Client Registration (Beta), allowing OAuth clients to register programmatically without manual admin configuration.

Secure Access (VPN / SASE / ZTNA) · 2026-09-12

OpenVPN launches Access Server Link: browser-based, self-hosted ZTNA deployment on AWS, Azure, and GCP with automatic DNS and SSL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Access Server Link, a new guided browser-based setup for self-hosted ZTNA that requires only three inputs — hostname, cloud provider/region, and admin password — to deploy Access Server on AWS, Azure, or GCP without SSH, manual DNS configuration, or certificate management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds automatic SSL certificate provisioning and renewal via Access Server Link, replacing self-signed certificates and eliminating certificate-expiry outages.
• Adds automatic IP-change detection and domain record updates through Access Server Link, keeping deployments reachable without manual DNS intervention after cloud IP changes.

Identity & Access Management · 2026-09-12

Passbolt API gains four Action Log endpoints for querying folder, resource, user, and raw log activity⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /actionlog/folder/{folderId}.json to retrieve interpreted activity for a folder (requires the Folders plugin; Pro, Enterprise, or Cloud plan).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET /actionlog/resource/{resourceId}.json to retrieve interpreted activity for a resource, with limit and page pagination parameters.
• Adds GET /actionlog/user/{userId}.json to retrieve interpreted activity for a user account, with limit and page pagination parameters.

Identity & Access Management · 2026-09-12

Passbolt audit log docs detail four /actionlog API endpoints, SIEM forwarding, and the action_logs_purge retention command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes four read-only audit log API endpoints: GET /actionlog/resource/{resourceId}.json, GET /actionlog/folder/{folderId}.json, GET /actionlog/user/{userId}.json, and GET /actionlog/logs.json (admins only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GET /actionlog/logs.json accepts filters has-users, is-success, created-after, and created-before, plus a contain parameter on user and user.profile, and sorting on created, enabling periodic extractions.
• Supports GET /actionlog/user/{userId}.json as the only way to read a user account's activity trail, with no equivalent Activity tab in the UI.

Identity & Access Management · 2026-09-12

Passbolt API docs add action log endpoints for folders, resources, and users, plus share and share-simulate endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /actionlog/folder/{folderId}.json endpoint to return interpreted activity for a folder, with limit and page query parameters (Pro, Enterprise, or Cloud plans; requires the folders plugin).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PUT /share/resource/{foreignId}.json endpoint to share a resource, accepting v5 encrypted metadata payloads with object_type PASSBOLT_RESOURCE_METADATA and per-recipient secrets.
• Adds PUT /share/folder/{foreignId}.json endpoint to share a folder (also accepts POST; requires the Folders plugin).

Integrated & IT Risk Management · 2026-09-12

Rapid7 Cyber GRC adds Workday integration, guided task workflow, and automatic SSO URI validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Automates evidence collection across the employee lifecycle via a new Workday integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Creates tasks faster with a guided, step-by-step workflow.
• Validates SSO configurations automatically with Authentication Provider URI checks.

Attack Surface & Exposure Management · 2026-09-12

Exposure Command adds AI-summarized remediation reports and CrowdStrike findings in Remediation Hub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Top Remediations Report with AI Summary in Risk > Remediation Hub, exporting in HTML or CSV format, so stakeholders receive the same AI-generated remediation context (impact, next steps) shown in-product without manual explanation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces CrowdStrike remediation recommendations directly in Risk > Remediation Hub alongside other sources via the CrowdStrike connector for Rapid7 Attack Surface Management, enabling unified prioritization without switching tools.

SIEM · 2026-09-12

Rapid7 Incident Command adds an Environment Health Dashboard consolidating agent, collector, and sensor health metrics in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Environment Health Dashboard at Data Connectors > Environment Health, consolidating health metrics for agents, collectors, event sources, network sensors, orchestrators, honeypots, scan engines, and data exporters into a single page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides a KPI bar and state bar chart showing counts per data source type by state (online, offline, stale).
• Surfaces an issue feed sorted by severity with direct links to relevant documentation for known problems across data sources.

SIEM · 2026-09-12

InsightIDR process start events now automatically include LDAP/AD user identity context, eliminating manual correlation during triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Endpoint process start events now include a top-level user field and associated user RRN, automatically attributing LDAP/AD identity to process activity in alerts and investigations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-09-12

Remediation Hub gains AI-summarized reports (HTML/CSV) and unified CrowdStrike remediation recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI-generated summaries to the Top Remediations Report in Risk > Remediation Hub, exportable in HTML or CSV format, so stakeholders receive the same remediation context (impact, next steps) that teams see in-product.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces CrowdStrike remediation recommendations directly in Risk > Remediation Hub alongside other sources via the CrowdStrike connector for Rapid7 Attack Surface Management, enabling unified prioritization without tool-switching.

Continuous Control Monitoring (CCM) · 2026-09-12

RegScale CLI 6.45.10 adds @drop support to JCAM config fields for explicit import suppression.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @drop as an accepted value for jcamPositionRoleNames and jcamAgencyDefinedDataItems in JCAM profile config, allowing tenants to explicitly record that a point of contact or agency-defined attribute is intentionally excluded from import rather than silently omitting it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-09-12

runZero adds custom roles for API keys and MCP connections, reprocessing tasks from the UI, and SAML certificate expiry warnings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Allows custom roles to be assigned to API keys, default user roles, group permissions, SSO defaults, and MCP connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables creation of API clients with custom permissions capped by the creator's own access rights, with support for granular authentication scopes on account-level API clients.
• Tasks can now be reprocessed directly from the user interface.

SAST / SCA / Code Security · 2026-09-12

Network Analysis & Monitoring · 2026-09-12

Security Onion 3.3.0-20260911 adds an x86-64-v3 CPU compatibility pre-flight check to the soup updater.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an x86-64-v3 CPU pre-flight check to soup to catch incompatible hardware before an upgrade proceeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-12

Semgrep adds webhook support for Supply Chain incident policies, Autofix GA, and richer Issues API fields⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The Issues API now includes descriptions for the status, triageState, and aggregateState values, and designates aggregateState as the recommended field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds webhook as a supported action on the Early notification for Supply Chain incidents policy, alongside Slack.
• Supports reauthorizing or reconnecting OAuth ticketing integrations without creating a new connection.

SAST / SCA / Code Security · 2026-09-12

Socket: Adds --reach-version flag to socket scan reach to run a different pinned Coana engine version than the one bundled with the Socket CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables reachability analysis for PHP/Composer projects when running through the Socket CLI; a Composer project in a subdirectory is now analyzed in its own directory rather than at the repository root.
• Adds withheldFixes field to --dry-run --output-file JSON output, naming the version and responsible flag when compute-fixes-and-upgrade-purls cannot apply a fix due to a policy constraint such as --disable-major-updates.
• npm, pnpm, and yarn workspace packages are now grouped and analyzed together under their workspace root when running reachability analysis via the Socket CLI.

Firewalls & Network Defense · 2026-09-12

Sophos Central Firewall raises maximum Firewall Reporting storage entitlement for term-licensed firewall models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Increases the maximum Central Firewall Reporting storage entitlement for firewall models on term licences, retaining more reporting data before the storage limit is reached.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SOAR · 2026-09-12

SOAR · 2026-09-12

Tines: Enables updating case fields via the API, expanding programmatic case management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds configurable audit log retention period, giving teams control over how long audit records are kept.
• Adds dashboard draft and edit mode, allowing dashboards to be staged before publishing.
• Allows renaming new stories under change control without requiring approval.

SOAR · 2026-09-12

Tines 3B ships MCP settings, Git sync, workflow monitoring tools, new OAuth connectors, and a ZIP download API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds API endpoint to download workflow as ZIP for programmatic workflow export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new MCP settings page for configuring Model Context Protocol integrations.
• Adds Security settings page with public access and session controls.

SOAR · 2026-09-12

Tines adds Amazon Bedrock Mantle as a custom OpenAI-compatible provider, enabling OpenAI models via AWS infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for OpenAI models served via Amazon Bedrock Mantle by configuring https://bedrock-mantle.<region>.api.aws/openai/v1 as a custom OpenAI provider endpoint with API type OpenAI Responses and manually added model IDs (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ openai.gpt-5.6-luna).

SOAR · 2026-09-12

Tines adds live background-tab refresh for Cases/dashboards, a dockable events panel, and pinnable/hideable case table columns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Cases, Records, and dashboards now stay up to date automatically when open in background browser tabs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Dock the events panel to keep it persistently visible within the Cases interface.
• Pin and hide any column in the cases table to customize the view.

AI/LLM Security · 2026-09-12

ToolHive v0.49.0 ships a dependency-light generated Go client for the management API and per-backend dial-control policy via session.WithDialControlResolver.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds session.WithDialControlResolver to pkg/vmcp/session, replacing WithDialControl with a per-backend dial-policy resolver so different network controls can be applied per workload ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tokenEndpointAuthMethod / token_endpoint_auth_method field to oauth2 upstream provider config, enabling explicit selection of client_secret_basic or POST-body credential delivery per upstream.

Secrets Detection & Management · 2026-09-12

TruffleHog adds S3-compatible storage scanning, SARIF output for GitHub Code Scanning, and scan history APIs alongside new secret detectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --sarif flag emitting SARIF 2.1.0 output, mapping verified findings to errors and unverified findings to warnings with stable fingerprints for GitHub Code Scanning upload tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Atlassian API token as an explicit credential type on Bitbucket sources, paired with account email, separate from the git-clone username.
• Neon Postgres credentials are now verified using a driver that accepts Neon's SCRAM iteration count, producing definite live/not-live results.

Secrets Detection & Management · 2026-09-12

TruffleHog adds customVerifiers config and --verifier CLI flag for self-hosted/enterprise secret verification endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds customVerifiers field to the TruffleHog config YAML, supporting self-hosted endpoints for GitHub Enterprise, GitLab, Jira Data Center, Confluence Data Center, Bitbucket Data Center, JFrog Artifactory (access token and reference token variants), and HashiCorp Vault AppRole auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --verifier CLI flag to the open-source trufflehog binary, enabling custom verifier endpoints to be passed at scan time without a config file (e.g. --verifier github=example1.github.com,example2.github.com).

Compliance Automation & Trust Management · 2026-09-12

Vanta: Adds framework associations and deactivation reasons for deactivated controls through the REST API.

• Adds a Custom Agent trigger for when a risk scenario is created or updated.
• Adds a Custom Agent event trigger for vendor residual risk score changes.
• Supports multi-framework audits within a single engagement, with shared evidence reuse and framework-specific assessment preservation.

Compliance Automation & Trust Management · 2026-09-12

Vanta: Adds a Custom Agent event trigger for vendor residual risk score changes, improving responsiveness to shifts in vendor risk posture

• Adds Inherent Risk Scoring by Factor, letting users break Impact and Likelihood into configurable factors, score each independently, and view breakdowns in risk details, auditor views, and CSV exports (Professional)
• Adds Personnel Agent Tools so users can create personnel groups, manage membership, import identity provider groups, and view or update reminder settings through the Vanta Agent (Enterprise)
• Adds Knowledge Base management tools in the Vanta Agent and via MCP, including bulk updates, semantic searches, Answer Library content management, and tagging workflows (Essentials, Plus, Professional, Enterprise)

Digital Forensics & Incident Response · 2026-09-12

Hayabusa updated to v4.0.0 with the new dfir-timeline subcommand for Windows event log analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Updates the bundled Hayabusa binary to v4.0.0 (hayabusa-4.0.0-win-x64-live-response.zip), replacing the previous version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Invokes the new dfir-timeline subcommand in Hayabusa 4.0.0, with --output-type controlling the output format.

Digital Forensics & Incident Response · 2026-09-12

Velociraptor exchange gains a forensic ADCS ESE database artifact and bumps its Hayabusa integration to v4.0.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Windows.ADCS.CertificateAuthority.EDB artifact that parses the Active Directory Certificate Services ESE database directly from disk at C:\Windows\System32\CertLog\*.edb via the ntfs accessor, returning all certificate requests with disposition, requester/caller identity, subject DN, template, timestamps, and serial number.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports EDBGlob parameter (default C:/Windows/System32/CertLog/*.edb) to locate the CA database file.
• Supports DispositionFilter parameter to filter results by disposition value (9=Issued, 11=Pending, 15=Revoked, 16=Error, 20=Failed, 21=Denied).

SAST / SCA / Code Security · 2026-09-12

Veracode training adds LLM security labs, OWASP Top 10:2025 courses, Get Lesson Progress API enhancements, and Veracode Platform SSO integration for Security Labs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds updatedAfter parameter to the Get Lesson Progress API to support incremental loads of lesson progress data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds excludeNotStarted=true parameter to the Get Lesson Progress API to filter out lessons that have not been started.
• Adds stack field and updated_on field to the Get Lesson Progress API response.

SAST / SCA / Code Security · 2026-09-12

Veracode adds Fix for SCA via veracode fix sca CLI command, IDE/CLI Usage Analytics, and Dart/Flutter/PHP static analysis support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds veracode fix sca CLI command to analyze vulnerable dependencies from SCA findings, generate remediation patches, and identify safe upgrade paths (Limited Availability).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds IDE and CLI Usage Explore and Dashboard in Veracode Analytics to visualize and explore organization-wide IDE and CLI usage.

SAST / SCA / Code Security · 2026-09-12

ZeroPath adds a remote MCP server, Microsoft Teams alerts, Gerrit/CVS support, Continuous Scanning, and Assistant skills in this release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a remote MCP server at https://zeropath.com/mcp — connect Claude, Cursor, Codex, or any Streamable HTTP client to your findings with no install and no API key; connections are read-only until you approve changes, and an administrator can view and revoke all connections organization-wide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds lastScanFailure field on repository objects, replacing lastScanError, carrying both the error message and the outcome.
• Adds Continuous Scanning mode — triggers a full scan on every meaningful commit to a default branch (including merged pull requests), with follow-up scans closing findings fixed by those commits; configurable per organization, tag, or repository on GitHub, GitLab, Bitbucket Cloud, and Bitbucket Server.

Identity & Access Management · 2026-09-11

Aembit adds Content Security Providers for MCP traffic, with CrowdStrike AIDR as the first supported provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds application.mcp.contentSecurity field to MCP workload events, recording each Content Security Provider decision per message.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Content Security Provider support to Access Policies, inserting an inspection step on tools/list and tools/call MCP methods before forwarding to MCP servers.
• Integrates CrowdStrike AIDR as the first Content Security Provider, enabling verdict-enforced inspection of MCP tool discovery and invocation traffic through the MCP Identity Gateway.

Identity & Access Management · 2026-09-11

Aembit: Adds Content Security Providers to govern Model Context Protocol (MCP) tool traffic flowing through Aembit's MCP Identity Gateway, attached to an Access Policy via its optional Content Security component.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates CrowdStrike AI Detection and Response (AIDR) as a Content Security Provider to inspect MCP tool messages in real time and return verdicts that Aembit enforces before messages continue.

Identity & Access Management · 2026-09-11

Aembit adds a CLI for terminal-based credential retrieval, an MCP Identity Gateway for AI agent/MCP server policy enforcement, and updated edge components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Aembit CLI, a command-line tool for fetching credentials to access Server Workloads directly from a terminal, available for Linux amd64 (musl and glibc), Linux arm64, and Windows amd64.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the MCP Identity Gateway, a data-plane gateway between AI agents and MCP servers that enforces Access Policies on every connection, available for Linux amd64 and Linux arm64.
• Adds the Agent Controller edge component, which brokers registration between Agent Proxies and Aembit Cloud, available for Linux amd64 and Windows amd64.

Identity & Access Management · 2026-09-11

authentik now supports fully air-gapped deployments with offline Enterprise license installation and local validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports air-gapped deployments where license installation and validation are performed locally with no internet connection required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports installing Enterprise licenses offline: navigate to Enterprise > Licenses, copy Your Install ID, obtain a key on a connected system, transfer it, and paste it into the License key field.
• Supports internal Helm chart registry workflows: download the chart archive on a connected system with helm repo add authentik https://charts.goauthentik.io, transfer the archive, and install with helm install from the local file.

Identity & Access Management · 2026-09-11

authentik Enterprise adds agent accounts, scheduled user offboarding, and privileged access management (preview features).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds agent accounts that act on behalf of a parent user when accessing the authentik API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds scheduled user offboarding to deactivate or delete users at a scheduled time, with optional session and token revocation (preview).
• Adds privileged access management letting users request access to applications and entitlements, with approval rules and time-limited grants (preview).

Endpoint Security (EDR/XDR) · 2026-09-11

Automox Exclusion Windows now independently block Device Scans or Policy Execution, with API support and new UI indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds API endpoint support for blocked activities / scope configuration payload parameters on Exclusion Windows, enabling programmatic control over whether Policy Execution, Device Scans, or both are suppressed per window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a Blocked Activities section to the Exclusion Window configuration page, letting administrators independently select Policy Execution, Device Scans, or both as the operational scope of a window.
• New Device Scans blocking scope for Exclusion Windows suppresses intensive scan routines during critical business windows without halting scheduled policy executions.

Firewalls & Network Defense · 2026-09-11

CoPilot 4.37.0 adds Transit Gateway horizontal scaling, DCF IPS rule feeds, Kubernetes onboarding GA, CSR generation, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Transit Gateway Horizontal Scaling for scaling out transit gateway capacity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Distributed Cloud Firewall IPS Rule Feeds for managing intrusion prevention rule feeds in DCF.
• Adds a Distributed Cloud Firewall Value Dashboard for visualizing DCF security value and coverage.

Wireless & RF · 2026-09-11

Bastille adds smart glasses detection and location to its wireless intrusion detection platform, pinpointing devices within 1–3 meters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds smart glasses detection to the existing platform, identifying unique wireless signatures of smart glasses within seconds of entry into a monitored facility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Locates detected smart glasses to within one to three meters in real time across Wi-Fi, Bluetooth, and cellular frequencies.
• Automatically alerts security teams when smart glasses are detected and feeds those alerts into existing security systems with no new infrastructure required.

Container & Image Security · 2026-09-11

Chainguard Libraries now work in JFrog Catalog with Xray and Curation policy support. Java is available now; JavaScript and Python support is planned for September 2026.

Container & Image Security · 2026-09-11

Chainguard: New endpoint GET /argos/v1/vex/documents/{ecosystem}/{package}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /argos/v1/vex/dump

SAST / SCA / Code Security · 2026-09-11

Checkmarx 3.66 adds native SCA reachability, UV package manager support, MCP risk triage, DAST AI permissions, and expanded OSS-Realtime scanner coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds two new DAST AI permissions, Dast-to-code-initiator and Dast-AI-attack-initiator, to the dast-admin role for granular access control over DAST AI features.
• New native reachability analysis engine in SCA performs exploitable path analysis without requiring a separate SAST scan, adding a Reachability column with statuses: Exp.Path Found, Not Detected, Not Supported, Pending Analysis, or Calculation Failed; supports Python, Java, JavaScript, and C#.
• Adds support for the UV Python package manager in SCA, selectable via a new Python Package Manager configuration setting at tenant and project level (pip remains the default).

Identity & Access Management · 2026-09-11

Identity & Access Management · 2026-09-11

Clerk adds device authorization metadata so OAuth clients can discover the enabled grant automatically.

• Adds OAuth 2.0 Device Authorization Grant (RFC 8628) beta support, letting CLIs, TVs, game consoles, and other browserless devices obtain tokens by having a user approve access on a separate browser-capable device.
• Device Authorization Grant shares Clerk OAuth scopes, tokens, consent context, and Organization claims with the Authorization Code Flow; PKCE and redirect URIs are not used.

SIEM · 2026-09-11

API surface changed: +5 endpoints, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /v1/organizations/{organizationId}/services/{serviceId}/query-api-endpoints/{endpointId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /v1/organizations/{organizationId}/services/{serviceId}/query-api-endpoints
• New endpoint GET /v1/organizations/{organizationId}/services/{serviceId}/query-api-endpoints/{endpointId}

Internet Services · 2026-09-11

Cloudflare: New endpoint DELETE /accounts/{account_id}/addressing/address_maps/{address_map_id}/accounts/{member_account_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /accounts/{account_id}/browser-extension/config/inventories
• New endpoint GET /accounts/{account_id}/browser-extension/config/inventories/{registration_id}
• New endpoint GET /accounts/{account_id}/email-security/analytics/monthly_report

Internet Services · 2026-09-11

Cloudflare adds Zoom CASB integration, Containers + OpenAI Agents API support, AI Gateway cache-token custom costs, and Workflows retention controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds successRetention and errorRetention fields to WorkflowInstanceCreateOptions to set per-instance or per-Workflow retention periods (e.g., '2 days', '30 days') on Workers Paid; maximum remains 30 days.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cloudflare Containers now supports self-hosted execution environments for the OpenAI Agents API via Codex, with a reference implementation available as the open-source OpenAI Agents API Workers template.
• Adds a new Cloudflare CASB integration for Zoom, scanning account settings, user accounts, meetings, recordings, and content (via DLP Profile matching) for security findings; enable under Cloud & SaaS findings > Integrations in the Cloudflare One dashboard.

Internet Services · 2026-09-11

Cloudflare: Adds POST /accounts/{account_id}/payment-methods/{payment_method_id}/set-as-default to designate a default payment method.

• Adds GET /user/spectrum_analytics/zones/report for Spectrum Analytics zone bandwidth reports.
• Adds Workers build pipeline endpoints: start, list, cancel, get builds; stream logs; manage triggers, variables, deploy hooks, tokens, repo connections.

Internet Services · 2026-09-11

Cloudflare: Adds cache-read and cache-write custom token rate configuration for requests routed through AI Gateway, enabling cost tracking for cached responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new CASB integration for Zoom, scanning account settings, users, meetings, and recordings for security misconfigurations and data risks.
• Supports running Codex with Cloudflare Containers via the OpenAI Agents API.
• Sets default instance retention for new Workflows on Workers Paid to seven days.

Identity & Access Management · 2026-09-11

ConductorOne adds agent classifiers, four session-policy API endpoints, system log event classes, and bulk request limits in this release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds four read-only API endpoints to preview which session policy applies to a given user and why (direct assignment, group membership, or tenant default), and to list every user a policy covers — direct and group-conferred, with the conferring group named.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Admins can now set a max number of entitlements a user can request at once in bulk (1–100, default 10) from Governance > Forms.
• Adds a Resources tab in MCP server management where admins can approve static resources and URI templates discovered on a server; each approved resource gets its own read entitlement governed separately from tool and toolset access.

Runtime Security · 2026-09-11

CubeSandbox v0.7.1 adds HA control-plane, S3-backed templates, K8s S3 volumes, external PostgreSQL, and virtiofsd hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables CUBE_DATABASE_DRIVER to select MySQL or PostgreSQL and connect one-click deployments to a self-managed database instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds [cow.s3] enable = true config key (or ONE_CLICK_ENABLE_S3LVOL=1 env var) to opt in to the CubeS3lvol S3 backend for cross-node pause/resume and snapshots; disabled by default.
• Adds new top-level redis.db Helm config key applied to CubeMaster, CubeProxy, and CLM so multiple clusters sharing one Redis instance can isolate logical databases per cluster.

Vulnerability Management · 2026-09-11

CVE MCP Server debuts 28 tools + a triage_cve orchestrator spanning 24 APIs for one-call CVE triage via Claude⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds triage_cve one-call orchestrator that fans out to NVD, EPSS, CISA KEV, and public PoC sources concurrently, computes a composite 0–100 risk score with a KEV hard override, falls back to VulnCheck NVD++ when NIST NVD is throttled, and emits an SSVC v2 gated decision at depth='deep'⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes MCP resources kev://catalog, epss://scores/{cve_id}, and manifest://tool-hash (SHA-256 over the registered tool surface for tamper detection), plus MCP prompts patch_decision, compare_and_prioritize, and dependency_triage
• Adds bulk_cve_lookup to batch-fetch details for up to 20 CVEs in a single call with parallel enrichment

Vulnerability Management · 2026-09-11

CVE MCP Server: Exposes MCP prompts patch_decision, compare_and_prioritize, and dependency_triage.

• Adds lookup_cve to fetch CVE records from NVD including CVSS scores, CWEs, affected products, references, and timeline.
• Adds search_cves to search NVD by keyword, product name, severity, or date range.
• Adds get_epss_score to retrieve EPSS exploitation probability (0–1) and percentile for one or more CVEs.

Data Security & DLP · 2026-09-11

Cyera Agent Guardian now integrates with Claude's inference hooks to inspect and block sensitive prompts before they reach the model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates Cyera Agent Guardian with Anthropic's new Claude inference hooks to intercept every prompt sent to Claude Chat, Claude Cowork, Claude Code, and Claude Design — allowing or denying before the model runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports shadow mode (verdicts logged without blocking), percentage-based rollout (inspecting a slice of requests during policy tuning), and role-based exclusions within the inference hook rollout controls.
• Configurable failure handling lets you set whether a timeout blocks by default or allows through, per part of your environment.

Data Security & DLP · 2026-09-11

Cyera acquires Oasis Security, adding non-human identity (NHI) management as a new Cyera Identity pillar within its platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds non-human identity (NHI) management to the Cyera platform via the acquisition of Oasis Security, enabling continuous, policy-driven control over which workloads and AI agents can access which systems, in what context, and for how long.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Cyera Identity as a dedicated identity pillar within Cyera's platform, connecting NHI governance directly to Cyera's data intelligence layer to govern data access and identity together in a single platform.

SIEM · 2026-09-11

Databricks dashboards gain relationship-scoped filters, theme import/export, path maps, LOD expressions, and richer Ask Genie context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Include-style level of detail (LOD) expressions in YAML to the metric view editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Line shape control to line and area charts, connecting data points with linear, smooth, or stepped lines.
• Adds Apply to setting on the pivot table color scale, letting you paint the color gradient on cell text as well as the background.

SIEM · 2026-09-11

Genie One adds GA Databricks-managed MCP connectors for Google Drive, Gmail, Microsoft 365, Atlassian, and Slack via Unity Catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Governs all MCP connector tool calls through Unity Catalog and Unity Gateway, enforcing built-in policies, approval requirements, and logging usage and audit activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Requires per-user individual authentication with OAuth tokens that are never shared across users.

SIEM · 2026-09-11

Databricks Genie Agents now support up to 50 data sources and 200,000 stored conversations per agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the per-agent data source limit to 50 tables, views, or metric views, up from 30.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Raises the per-agent conversation storage limit to 200,000 conversations, up from 10,000.

SIEM · 2026-09-11

Genie One gains code skills on by default, backend steering, PowerPoint uploads, and memory confirmation prompts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Genie Code skills in Genie One by default, with per-skill toggle controls on the customization page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds backend steering to Genie One, letting you send steering messages while a response is in progress to guide the output without waiting for it to finish.
• Supports uploading .pptx (PowerPoint) files directly into a Genie One conversation.

SIEM · 2026-09-11

Lakeflow continuous pipelines gain maintenance windows to control when platform restarts occur.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds maintenance window scheduling for continuous Lakeflow pipelines, letting you specify a day of the week, start hour, and time zone so Databricks applies runtime upgrades and serverless infrastructure restarts only within that one-hour window — configurable via the Jobs UI, the Pipelines UI, or the Jobs REST API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-11

Databricks Excel Add-in is now GA, letting users query, import, and write back Unity Catalog data directly from Excel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Databricks Excel Add-in (GA) to connect Microsoft Excel to a Databricks workspace for browsing and importing Unity Catalog tables and views, running SQL queries, building pivot tables, using custom functions, and writing data back to Unity Catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Live query mode when building pivot tables in the Excel Add-in, refreshing results in real time as fields are updated.

SIEM · 2026-09-11

Databricks Lakeflow Connect gains a new Anaplan connector (Beta) for ingesting audit trail events and user account records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Workspace admins can enable or disable the Anaplan connector through the Previews page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-11

Lakeflow Connect adds Anysphere (Cursor) Organization connector in Beta to ingest members and groups as daily snapshots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-11

Unity Catalog now surfaces AWS Secrets Manager secrets as read-only, governable objects via External Secrets (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds External Secrets in Unity Catalog (Beta), linking a Unity Catalog schema to AWS Secrets Manager so secrets appear as read-only securable objects governed by Unity Catalog privileges, with values read from AWS Secrets Manager on demand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-09-11

defectdojo: Adds POST /api/v2/api-tokens/revoke/ endpoint allowing a superuser or Global Owner to revoke a compromised token by its key value, returning 204 on success and notifying the token owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DD_API_TOKEN_DEFAULT_EXPIRY_DAYS environment variable to enforce a maximum token lifetime (in days) across all users instance-wide, evaluated at token-use time and applied retroactively to existing tokens.

Endpoint Security (EDR/XDR) · 2026-09-11

Devicie expands automated Intune app management to 1,500+ Windows and macOS apps, with rollback and line-of-business support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Automatically manages more than 1,500 Windows and macOS applications inside an organization's existing Microsoft Intune tenant, with new versions typically ready within hours of publisher release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Includes line-of-business, internally developed, and complex-installer vendor applications in the same automated pipeline at no additional charge.
• Retains the current application version plus the two preceding versions in the tenant, enabling rollback to an earlier release if an update causes problems.

Identity & Access Management · 2026-09-11

Didit: Adds per-country method control via the Countries tab on the ID Verification step and through the API, letting operators toggle document capture, non-document lookup, and (future) digital ID wallets country by country.

• Adds non-document lookup as a live verification method — the user submits a national ID number and personal details, which are checked against the authoritative source (government register, credit bureau, or utility/residential records) for that country with no photograph or upload required.
• Adds Registry comparison result block to sessions, exposing each compared field with the user-provided value, the source-held value, and match status, plus an error row when a source did not respond.
• Adds Credential details result block to sessions for wallet verifications, showing the wallet, issuing authority, asserted level of assurance, and signature verification outcome.

Container & Image Security · 2026-09-11

AI-Powered Offensive Security · 2026-09-11

Dreadnode adds traditional ML attack targets, light TUI theme, /reload and /transcript chat commands, and bulk workspace membership across all orgs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Set DREADNODE_TUI_THEME=light to switch the TUI from its default dark palette to a light theme.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds /reload slash command in chat sessions to reload the current agent without leaving the session.
• Adds /transcript command in the TUI to toggle between compact and full agent transcript views.

AI-Powered Offensive Security · 2026-09-11

Dreadnode adds offline SDK/CLI bundles, a Global Tool Registry API, multi-agent red-teaming tasks, and Cloudflare Workers OAST support for air-gapped deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api/v1/tools and GET /api/v1/tools/{tool_id} endpoints to query the new Global Tool Registry, giving published capability Python tools and command wrappers stable, organization-scoped identities with immutable revision history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds caBundle config key for self-hosted deployments to inject a custom CA bundle into the Node frontend, completing CA trust support across all workloads (API, LiteLLM, and frontend).
• Surfaces full cold-start timing breakdown (total, platform overhead, provider provisioning, boot, installs, slowest step) via dn runtime start and GET /runtimes/{id}.

AI-Powered Offensive Security · 2026-09-11

Dreadnode opens Web Chat to all users, adds air-gap deployment, HTTP desync detection, IP rotation, geo-DNS, and LSB steganography in web-security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds replicated.isAirgap=true Helm CLI setting to prevent the Replicated SDK pod from attempting outbound connections to replicated.app in air-gapped installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --mine flag to dn runtime ls to filter runtimes to only those you own; also marks runtimes you do not own in the default listing.
• Adds /status slash command to the TUI, displaying current session, model, user, org, workspace, and project at a glance.

Secure Access (VPN / SASE / ZTNA) · 2026-09-11

Firezone adds Device Trust setup: X.509-based device attestation with MDM, SCEP, ACME, PKI, and PKCS#11/TPM support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Settings → Trust Anchors in the admin portal to upload CA certificates (PEM or DER) that Firezone uses to validate client device identity certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Require attestation condition to Policies, letting admins enforce that only clients presenting a valid, chained device certificate can access a protected Resource.
• Adds Settings → Device Trust in the Firezone Client for verifying that a device certificate is selected, the chain is valid, and the private key is accessible.

Secure Access (VPN / SASE / ZTNA) · 2026-09-11

Firezone adds cryptographic device trust via mTLS client certificates, supporting CRL/OCSP revocation and PKCS#11 on Linux⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds firezone://serial/<value>, firezone://udid/<value>, firezone://smbios-uuid/<value>, firezone://intune-id/<value>, firezone://ws1-uuid/<value>, firezone://jamf-id/<value>, and firezone://kandji-id/<value> typed URI SAN formats for embedding per-device identity claims in client certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports device trust via mutual TLS (mTLS): at connection time the Firezone Client presents an X.509 certificate issued by your MDM or enterprise PKI and proves possession of the private key before access is granted.
• Adds a Require attestation policy condition that grants access only while a Client connection remains attested by a valid, trusted device certificate.

Secure Access (VPN / SASE / ZTNA) · 2026-09-11

Firezone Android 1.5.14 adds device trust via X.509 certificates and a refreshed app icon.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for device trust backed by X.509 certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates the app icon and other in-app logos to the new F mark.

Wireless & RF · 2026-09-11

Fluxion v6.32 replaces isc-dhcp-server with kea-dhcp4 as the Captive Portal DHCP backend⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Switches the Captive Portal attack's DHCP backend from isc-dhcp-server (dhcpd) to kea-dhcp4, with JSON-based config generation and AppArmor local override handling for the kea-dhcp4 profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Relocates the DHCP lease file to /var/lib/kea/kea-leases4.csv and reworks client IP/MAC/hostname lookup against kea's CSV lease format.

SAST / SCA / Code Security · 2026-09-11

GitHub's refreshed pull request listing page enters public preview with advanced filtering, compact mode, and richer PR context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠