The week in full · Sep 18–24

Identity & Access Management · 2026-09-24

Aembit: Aembit now reads given_name, family_name, and name OIDC profile claims when provisioning users through single sign-on, populating first and last names automatically.

Identity & Access Management · 2026-09-24

Aembit adds SAML-bound dynamic claims, X.509-SVID delivery, multi-cluster Kubernetes attestation, MCP Tool Access Control, and AWS STS provider selection in GitHub Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds aws-access-key-id input to the Aembit GitHub Action (minimum version 1.3.0) so a workflow on a GitHub-hosted runner can select among multiple AWS STS Federation Credential Providers in a single Access Policy by Access Key ID selector.
• Extends the Edge API credentials endpoint and Edge SDKs for TypeScript and Python (minimum Edge SDK 1.34.0) to pass an AWS STS Credential Provider selector as connection metadata alongside existing JWT Credential Provider selectors.
• Adds MCP Tool Access Control enforcement to the MCP Identity Gateway (version 1.34.5794): Tool Visibility controls which MCP tools an AI agent discovers, Tool Invocation controls which it can call, and both accept exact tool names or case-sensitive glob patterns.

AI/LLM Security · 2026-09-24

DeepTeam now flushes finished test cases to disk mid-run; API Checker gets more reliable model fingerprinting via sample refilling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds mid-run disk persistence for DeepTeam: finished test cases are written to disk during a run rather than held only in memory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Improves API Checker model identification by refilling failed fingerprint samples for more reliable detection.

AI/LLM Security · 2026-09-24

NEXUS v0.4 adds eight named payment authority adapter profiles for AI agents, covering x402, AP2, Visa TAP, Mastercard AP4M, and KYA-OS delegation evidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SafePay Exact reference profile for structural x402 v2 exact EVM/USDC evaluation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SafePay Verified reference profile for authenticated x402 facilitator or chain evidence with an explicit verifier boundary.
• Adds SafePay Variable reference profile for maximum-versus-actual charge enforcement and reservation release.

SAST / SCA / Code Security · 2026-09-24

Aikido adds Code Coverage: line-level test coverage for every repo, paired with code quality findings, accepting LCOV and Cobertura reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Code Quality > Code Coverage section to the Aikido dashboard, showing per-repository, per-file, and per-line test coverage alongside existing code quality findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Accepts LCOV and Cobertura coverage report formats, with native support for outputs from Jest and pytest-cov.
• Provides a GitHub Action and a GitLab CI component for uploading coverage reports to Aikido from CI pipelines, requiring no extra token or self-hosted component.

SAST / SCA / Code Security · 2026-09-24

Aikido launches Deep Review, an agentic PR reviewer that traces logic across repos and posts findings with suggested fixes directly on pull requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Deep Review, an agentic pull request reviewer that reasons across your full codebase — including middleware, global config, and linked repositories — not just the diff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Flags bugs and unintended side effects in addition to security findings on every pull request.
• Saves accepted-risk and false-positive decisions to memory so future reviews reflect prior feedback.

Wireless & RF · 2026-09-24

airgeddon v12.02 adds 5GHz DoS pursuit, nftables NAT support, and replaces ISC DHCP with Kea DHCP server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds 5GHz band hopping support to DoS pursuit mode, enabling pursuit of targets across both 2.4GHz and 5GHz bands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds iptables/nftables NAT support validation, extending compatibility to systems using the modern nftables firewall framework.
• Adds dynamic xterm sizing and positioning based on actual desktop and window metrics.

Identity & Access Management · 2026-09-24

Auth0 adds Action Modules, B2B Member Management API, custom user IDs at signup, and real-time enterprise connection events⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds api.user.setUserId() method in onExecutePreUserRegistration Actions to assign custom user IDs (UUIDs, domain-specific, or legacy-compatible formats) to new database-connection users at signup, replacing the need for self-hosted signup pages or bulk import.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds connection.created, connection.updated, and connection.deleted events for enterprise connections (Azure AD, ADFS, Google Workspace, Active Directory, LDAP, Ping), deliverable to a webhook or Amazon EventBridge as CloudEvents-formatted JSON.
• Adds Action Modules, enabling reuse of custom functions across multiple Actions and Triggers, with independent secrets and dependencies per module.

Firewalls & Network Defense · 2026-09-24

Aviatrix CoPilot gains Cloud Routes: a unified multicloud routing visibility and diagnostics hub under Diagnostics > Cloud Routes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cloud Routes under CoPilot > Diagnostics > Cloud Routes to view all routing information for managed resources across multicloud and on-prem (Site2Cloud) connections in a single place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Gateway Routes tab showing tunnel information, route state (up/down), and per-gateway routing tables for all Aviatrix gateways managed by the Controller, with filtering by gateway name, subnet, or IP address.
• Adds VPC/VNet Routes tab showing routing tables for all VPC/VNet/VCNs across any cloud provider, filterable by route table name, subnet, or IP address.

Firewalls & Network Defense · 2026-09-24

Aviatrix VPN Client 3.0.2 adds a Universal binary for macOS (Intel + Apple Silicon) and extends Ubuntu support to 26.04.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Universal binary macOS installer that runs natively on both Intel and Apple Silicon (ARM64) Macs, eliminating the Rosetta 2 requirement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends Ubuntu support to include Ubuntu 26.04 (alongside 22.04 and 24.04).

Firewalls & Network Defense · 2026-09-24

Aviatrix CoPilot adds a Security > Egress > Overview tab with Egress Security Score and VPC/VNet protection status (requires Controller 8.0 + DCF).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Security > Egress > Overview tab (requires Controller 8.0 and DCF enabled) showing an Egress Security Score card, a score-calculation explanation dialog, and a Protected VPC/VNets breakdown (Unprotected, Monitored, Partially Protected, Protected, No Egress, Unknown).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Egress Security Score Explained dialog, accessible via Learn More on the Overview tab, detailing how scores are assigned to VPC/VNets based on their protection status.
• Adds a Manage VPC/VNets shortcut on the Egress Security Score card that navigates directly to the Egress VPC/VNets tab for managing protection.

SAST / SCA / Code Security · 2026-09-24

Polaris gains BYO LLM for Signal AI analysis, central scan rule profiles, on-prem SCM support, async SCA alerts, and a dynamic sitemap view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SARIF-format upload of Signal AI code analysis results into Polaris, where they are classified under the new AI tool type and managed alongside deterministic findings through unified policies, triage, audit trails, and governance workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports per-agent LLM configuration across each of Signal AI's six agents, with provider, model, and endpoint independently selectable — supporting OpenAI, Azure OpenAI, AWS Bedrock, GCP Vertex AI, or any OpenAI-compatible proxy with automatic provider detection.
• Introduces central rule configuration in Polaris, letting security teams define rule profiles once and apply them at the organization, application, or project level via hierarchical inheritance, automatically enforced across CI pipelines, CLI scans, and integrations.

Vulnerability Management · 2026-09-24

Brinqa adds a Pending Changes review step when upgrading connector versions in data integrations to surface schema differences before they take effect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Pending Changes wizard step when upgrading a connector version in an existing data integration, surfacing added, removed, renamed, and changed attributes before the update is saved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces a Used in Consolidation column in the Pending Changes table so practitioners can immediately see which schema changes affect active consolidation identifiers or attribute mappings.
• Adds per-attribute detail panels showing a field-by-field comparison of old and new values, with an Enable this attribute in Sync configuration toggle for new or renamed attributes that auto-checks the attribute in the sync configuration step.

Vulnerability Management · 2026-09-24

Brinqa Platform gains a unified left sidebar with keyboard shortcuts, AI Chat, and per-browser appearance preferences.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cmd+B / Ctrl+B keyboard shortcut to toggle the sidebar between collapsed and expanded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Cmd+Shift+F / Ctrl+Shift+F keyboard shortcut to focus the sidebar search input, expanding the sidebar first if collapsed.
• Introduces Account > Preferences > Palette to choose an accent color — Navy (default), Black, or Green — applied across both light and dark themes.

Vulnerability Management · 2026-09-24

Brinqa adds BrinqaIQ Assistant: a self-hosted AI chatbot for BQL query generation, CVE exploration, and automation lifecycle management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds BrinqaIQ Assistant, a self-hosted RAG-powered chatbot that translates plain-language descriptions into valid Brinqa Query Language (BQL) queries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds BQL execution capability within the BrinqaIQ chat interface, allowing queries to run directly against Brinqa data and display results inline.
• Adds a CVE Explorer capability to look up CVE details, severity ratings, affected products, and remediation context from within BrinqaIQ.

Vulnerability Management · 2026-09-24

Brinqa's ServiceNow connector now ingests Problem and ProblemPtask records via the ServiceNow API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends the ServiceNow API connector to support Problem and ProblemPtask record types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-24

Cato AI Security for Agents adds read-only discovery and inline inspection of Amazon Bedrock AgentCore agents across prompt, tool call, tool response, and output stages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds read-only discovery of every agent running on Amazon Bedrock AgentCore, surfacing each agent's instructions, model, and connected tools without installing anything.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds inline inspection of agent-model exchanges at four observable stages — prompt, tool call, tool response, and output — to detect prompt injection and other unwanted activity before the model acts.
• Extends Cato AI Security for Agents coverage to Amazon Bedrock (Agents Classic and AgentCore), Microsoft Foundry, Microsoft Copilot Studio, ChatGPT (GPTs and Agents), Amazon Quick, and developer-hosted agent endpoints.

Container & Image Security · 2026-09-24

Chainguard: Publishes tutorial for pulling packages from Chainguard package repositories through Sonatype Nexus raw repositories as pull-through caches for apk packages.

SAST / SCA / Code Security · 2026-09-24

Checkmarx adds AI Auto Remediation, bulk triage, MCP API Security support, async CSV export, and broader Exemption Rules coverage⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automated AI Remediation configured in Account Settings under AI Assist, with controls for projects, branches, scanners (SAST and SCA), severity thresholds, and project-level override permissions; for supported GitHub Code Repository Integration projects, opens a pull request with the suggested fix automatically after a scan completes.
• Expands MCP Server triage tools support to IaC Security and Secrets scanners, bringing them to parity with existing SCA and SAST triage support.
• Adds an Internet-Facing badge in the Risk Orchestration unified project table for projects identified as publicly accessible, sourced from Cloud Insights integration data.

SAST / SCA / Code Security · 2026-09-24

Checkmarx 3.66 adds Global Inventory API, native SCA reachability, MCP Server triage, manual test result import, and UV package manager support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a public Global Inventory API that retrieves packages, risks, and license data aggregated across an account, filtered by project, application, severity, or exploitability, with pagination; authenticated via platform API token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --skip-default-filter CLI flag to bypass default file-inclusion filters and include all files in the scanned .zip archive.
• Adds *.tfvars and *.tfbacken file extensions to the list of supported files included in scanned .zip archives.

Identity & Access Management · 2026-09-24

Clerk: Enables Publish CIMD support in OAuth application settings so MCP and other public OAuth clients can identify themselves via an HTTPS URL as their client_id, without a pre-issued client secret or Dynamic Client Registration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an SMS logs view in Application Logs with five delivery event types — sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed — for phone verification codes, OTPs, and password reset codes.
• Groups all events for a single SMS message under a shared trace, enabling end-to-end timeline reconstruction for a single recipient.

Internet Services · 2026-09-24

Cloudflare adds Traffic Destination selector, Worker Previews, private MCP support, browser binding session APIs, and more⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds net.offramp.type API field as the Traffic Destination selector in Gateway HTTP and Network policies, with values internet, cloudflare_wan, cloudflare_tunnel, device_client, and mesh to target specific off-ramp methods.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds acquire() and launch() methods to browser bindings with an outboundByHost option to route per-hostname requests through another Worker, plus connectSession(sessionId) and a nested devtools binding for typed DevTools and session-management operations.
• Adds guided onboarding for Cloudflare Mesh participants from the dashboard, with deployment options for Linux, Kubernetes, Docker Compose, and Docker CLI, plus a unified node-and-device management table.

Internet Services · 2026-09-24

Cloudflare: Introduces Worker Previews, letting each pull request run in an isolated environment with its own code, URL, bindings, logs, metrics, and traces, configured via the previews block in the Wrangler configuration file and deployed with npx wrangler preview (requires Wrangler 4.135.0 or later).

• Introduces account-level transformation analytics in Images, showing request traffic split by URL-based vs. Images binding transformations, top zones, configurations, origin hosts, and Worker scripts.

General Utilities & Libraries · 2026-09-24

VS Code Agents window gains per-diff-editor word wrap control and GitHub PR review comment support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables adding GitHub pull request review comments directly from the Agents window view via the chat.experimental.agentsWindowPRComments setting and the Add PR Comment action.

General Utilities & Libraries · 2026-09-24

VS Code Agents adds automatic session cleanup settings and an application-icon badge for unread session alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.agentSessions.autoMarkAsDoneMergedSessionsAfterDays config setting to automatically mark inactive Agent Host sessions as done after a configured number of days when their pull requests have merged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.agentSessions.autoDeleteArchivedMergedSessionsAfterDays config setting to permanently delete sessions that were automatically marked as done after a separate grace period (in days).
• Adds sessions.showApplicationBadge setting (defaults to true in Insiders, disabled in Stable) to show a badge on the OS application icon — macOS dock, Linux launcher, or Windows taskbar — counting Agent sessions with unread results, pending input, or failing CI checks on open non-draft pull requests.

General Utilities & Libraries · 2026-09-24

VS Code Agents gains sessions.useWorktree, chat.editor.preferCopilotHarness, and ChatEditorPreferCopilotHarness policy for harness and isolation control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables ~/.bashrc (macOS/Linux) or PowerShell profiles (Windows) before each command in local Copilot Agent Host sessions that use the SDK built-in shell tool.

General Utilities & Libraries · 2026-09-24

code-oss: Enables chat.agentHost.devContainer.enabled to run Agent Host sessions inside a Dev Container, supporting local folders and — from VS Code 1.139 — folders on SSH, Tunnel, or WSL remote hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Use Dev Container and Use Local / Use Remote Host workspace-picker options so you can toggle Dev Container mode per folder before starting a session; the workspace label gains a - Dev Container suffix when active.
• Requires a .devcontainer/devcontainer.json Dev Container configuration at the project root and Docker installed and on PATH on the machine (or remote host) that contains the folder.
• Adds Remove Pull Request Artifact from Session via right-click on the pull request pill (single PR) or via the pull requests dropdown (multiple PRs), disassociating the artifact without closing the PR on GitHub.

General Utilities & Libraries · 2026-09-24

code-oss: Enables chat.agentHost.devContainer.enabled to run Agent Host sessions inside a Dev Container so the agent builds and tests with the project's own tools and dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Create PR form for Agent Host sessions, with fields for repository, source branch, base branch, title, and description, and a Create as Draft toggle.
• Adds After creation options to the Create PR form — Merge Manually, Auto-Merge (with Squash, Merge Commit, or Rebase methods), and Agent Merge — as mutually exclusive post-creation behaviours.

Compliance Automation & Trust Management · 2026-09-24

Compyl adds Box integration and expands GitHub, Okta, and MongoDB Atlas coverage; custom fields now searchable in grid views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Box as a new integration, collecting users, groups, files, folders, collaborations, shared links, legal holds, retention policies, classifications, and enterprise events for continuous compliance evidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands the GitHub integration to cover Dependabot alerts, secret scanning alerts, code scanning alerts, organization security settings (including 2FA status), outside collaborators, and rulesets.
• Expands the Okta integration to cover application entitlements, MFA enrollment status, group rules, admin role assignments, and user lifecycle events.

Identity & Access Management · 2026-09-24

ConductorOne: Adds a single guided setup flow for creating apps and adding connectors.

• Adds searchable step and trigger-type search by name or description in the automation builder.
• Adds faceted, searchable resource-type pickers with real counts to Grant Found, Grant Deleted, and revoke criteria.

Third-Party & Vendor Risk (TPRM) · 2026-09-24

Conveyor now translates non-English Word questionnaires to English for review, then exports in the original language or English.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds end-to-end translation workflow for non-English Word questionnaires: import, work in English, then export in the original language or English via the Questionnaires module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-24

Corridor adds a beta GET /teams/:id/findings/sarif endpoint that exports findings as SARIF 2.1.0 for ingestion by tools like Wiz.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /teams/:id/findings/sarif endpoint (beta) that returns findings as a SARIF 2.1.0 document (application/sarif+json), consumable by any SARIF-compatible tool such as Wiz.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Maps finding severity to SARIF level (error for critical/high, warning for medium, note for low) and properties.security-severity (9.0, 7.0, 5.0, or 3.0) for downstream SAST tooling compatibility.
• Encodes Corridor finding IDs in partialFingerprints.corridorFindingId/v1 and deep-links to findings via hostedViewerUri inside each SARIF result.

SAST / SCA / Code Security · 2026-09-24

Corridor adds a Devin cloud-agent integration that installs a git pre-commit hook to block commits with security findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a CORRIDOR_API_KEY organization secret in Devin that the Corridor CLI uses to authenticate during environment setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Governance > Long-Running Agents configuration page in the Corridor dashboard with a Configuration tab for selecting Devin as an agent and generating API keys.
• Adds a curl -fsSL https://app.corridor.dev/cli/devin-setup.sh | sh setup snippet for the Devin initialize environment block that installs the Corridor CLI and a git pre-commit hook.

SAST / SCA / Code Security · 2026-09-24

Corridor: Adds CORRIDOR_API_KEY secret support in Codex cloud environments to authenticate the Corridor CLI during cloud sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Codex integration option under Governance > Long-Running Agents > Configuration in the Corridor dashboard, enabling per-session pre-commit scanning of staged changes.
• Supports API key management (view, revoke, rotate) under Team-Owned API Keys in the Configuration tab.

SAST / SCA / Code Security · 2026-09-24

Corridor: Runs corridor scan --staged as a git pre-commit hook in Claude Code cloud sessions, blocking commits that contain security findings before code is committed.

• Integrates with Claude Tag (Anthropic's @Claude in Slack) cloud environments in addition to Claude Code web sessions, configurable via claude.ai/admin-settings/claude-tag under Slack > Advanced > default environment.

SAST / SCA / Code Security · 2026-09-24

Corridor: Exposes a one-time API key from the Long-Running Agents modal to authenticate agent sessions with Corridor.

SAST / SCA / Code Security · 2026-09-24

Corridor adds integrations for Claude Code/Claude Tag, Codex, and Devin cloud agents to scan code before every commit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds integration with Claude Code and Claude Tag cloud environments to scan code for security vulnerabilities before every commit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds integration with Codex cloud to scan code for security vulnerabilities before every commit.
• Adds integration with Devin to scan code for security vulnerabilities before every commit.

IDS / IPS · 2026-09-24

CrowdSec: Adds BOUNCER_KEY_traefik environment variable wired via secretKeyRef in crowdsec-values.yaml (lapi.env) so the LAPI bouncer key is never committed in plaintext.

• Adds cscli metrics show appsec command to view processed vs. blocked requests and individual AppSec rule triggers after enabling the AppSec Component.
• Supports deploying the CrowdSec Traefik bouncer plugin (github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin v1.4.5) on Kubernetes via the experimental.plugins.bouncer key in traefik-values.yaml.

IDS / IPS · 2026-09-24

CrowdSec: Adds CAPTCHA_PROVIDER config key in /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf to select among three captcha providers: recaptcha, hcaptcha, or turnstile.

• Adds REDIRECT_LOCATION and RET_CODE config keys alongside BAN_TEMPLATE_PATH in /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf to control ban remediation response (redirect, custom HTTP code, or custom HTML page).
• Supports both live mode (per-request Local API query) and stream mode (periodic pull every UPDATE_FREQUENCY seconds) via the MODE config key, with CACHE_EXPIRATION tuning for live mode.
• Supports IPv4/IPv6 and IP range-based remediation decisions.

IDS / IPS · 2026-09-24

CrowdSec: Adds crowdsecurity/crs AppSec config key to /etc/crowdsec/acquis.d/appsec.yaml appsec_configs list to load CRS rules in out-of-band mode alongside crowdsecurity/appsec-default virtual patching.

• Adds crowdsecurity/crs-inband AppSec config key to /etc/crowdsec/acquis.d/appsec.yaml appsec_configs list to load CRS rules in blocking (in-band) mode.
• Documents a three-tier WAF security enhancement path: basic virtual patching, enhanced out-of-band CRS detection, and maximum in-band CRS blocking.

IDS / IPS · 2026-09-24

CrowdSec: Adds SendChallenge() helper in on_challenge to force re-challenge even when the client already holds a valid cookie.

• Adds SetRemediation(action) and SetReturnCode(code) helpers in on_challenge to override the remediation action and HTTP status code returned to the bouncer.
• Adds DropRequest(reason) helper in on_challenge to immediately block a request based on fingerprint signals.
• Adds MatchKnownBot(ip, ua, path, ...files) helper (available in pre_eval, post_eval, on_match) to verify legitimate crawlers against bot definition files in <datadir>/legit_bots/*.json using IP-range and FCrDNS checks; ships via crowdsecurity/appsec-bot-challenge-exclude-* appsec-configs.

IDS / IPS · 2026-09-24

CrowdSec: Adds key_rotation_interval config key to control how often signing keys rotate without invalidating already-issued cookies.

• Adds master_secret config key to share a root key across instances in an HA deployment.
• Adds MatchKnownBot() and ExemptFromChallenge(reason) hook functions to classify and exempt known-good bots per-request.
• Introduces a bot-detection challenge flow: visitors without a valid __crowdsec_challenge cookie are intercepted by SendChallenge, served a JS proof-of-work + fpscanner device-fingerprint page, and issued a sealed success cookie on passing.

IDS / IPS · 2026-09-24

CrowdSec: Adds crowdsecurity/appsec-bot-challenge-scoring appsec-config that serves the challenge and computes a per-request bot score via AddRequestScore() and SendChallenge() hooks, with per-signal weights (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ cdp=100, utc_timezone=15).

• Adds crowdsecurity/appsec-bot-challenge-good-bots and crowdsecurity/appsec-bot-challenge-exclude-paths reusable collections for composing custom bundles without the default threshold.
• Adds MatchKnownBot() function that checks client IPs against vendor-published ranges and forward-confirmed reverse-DNS; bot definition files are downloaded into <datadir>/legit_bots/.
• Adds crowdsecurity/rejected-browser-submission per-submission alert (kind bot-detection, alert-only) and crowdsecurity/appsec-bot-challenge-too-many-* behavioral alerts (kind crowdsec, creates block decisions), queryable with cscli alerts list --kind bot-detection.

IDS / IPS · 2026-09-24

CrowdSec AppSec Component adds native YAML rule syntax with in-band/out-of-band evaluation modes and ModSecurity seclang import support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces native CrowdSec AppSec YAML rule format with name, description, rules, and labels directives for writing WAF-style detection rules without ModSecurity.
• Supports in-band and out-of-band rule evaluation modes: in-band rules block requests synchronously and generate alerts; out-of-band rules run asynchronously, emit events into the parsers/scenarios pipeline, and do not generate alerts on their own.
• Adds match field supporting match types regex, equals, startsWith, endsWith, contains, libinjectionSQL, libinjectionXSS, gt, lt, gte, and lte.

IDS / IPS · 2026-09-24

CrowdSec: Surfaces Malicious Intents breakdowns — categorizing blocked IPs by inferred attack type (spam, scanning, brute-force) derived from community network observations.

• Surfaces Malicious Traffic Dropped/Discarded metrics, reporting both raw (actual packets/requests/bytes dropped by bouncers) and estimated traffic volume, with L4/L7-aware coefficients applied.
• Adds a per-blocklist breakdown within both the Malicious Traffic Discarded and Projected Resources Saved sections, ordered by each list's contribution to blocked traffic.

IDS / IPS · 2026-09-24

CrowdSec introduces the Service API (SAPI), a premium SaaS API with API-key auth and OpenAPI specs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Service API (SAPI), a premium endpoint layer exposing CrowdSec SaaS features — new SaaS capabilities will appear on SAPI before their UI counterparts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Generates Service API keys via the CrowdSec Console under Settings > Service API Keys, with per-key permission scoping.
• Publishes full API specifications in Redoc and OpenAPI formats.

Runtime Security · 2026-09-24

CubeSandbox v0.7.2 adds JuiceFS volume plugin, idle guest memory reclaim, cross-node S3 restore cache, and sandbox.connect timeout parameter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds timeout parameter to sandbox.connect to control connection deadlines (#1352).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds cubeNode.network.mtu config key to pin guest MTU when node uplink NIC MTU cannot be auto-detected (#1674).
• Adds hostNetworkChangeAck confirmation flag required when switching an existing cluster to host-network mode for cube-node Pods (#1815).

Web Application Security · 2026-09-24

Dalfox adds an out-of-scope host file option that aborts scanning if the file is unreadable⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for a file listing out-of-scope hosts, where an unreadable path aborts the scan to enforce validation; coverage includes the scan target, any OAST server named with --blind-oob=, and the public interactsh mesh.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-09-24

Dalfox gains a full MCP server integration with async scanning, structured output, resources, prompts, and progress streaming.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes six tools over MCP, with scans async by default — submit via the tool, poll for results, or pass wait: true to block and stream progress.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Streams notifications/progress against _meta.progressToken on wait=true calls or tools/call, reporting cumulative requests sent, phase, parameters tested, and findings so far.
• Publishes outputSchema in tools/list and returns a structuredContent object on tools/call so clients can validate and destructure responses without parsing strings.

Web Application Security · 2026-09-24

Dalfox adds resume-capable scanning with completed-target tracking and an out-of-scope domain exclusion file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Records completed scan targets to a file and skips them on re-run, with raw HTTP/HAR request data fingerprinted so changed captures are re-scanned; run-wide credential values are excluded from the fingerprint so a refreshed session resumes cleanly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports a file listing out-of-scope domains to exclude from scanning; an unreadable file is a fatal FILE_READ_ERROR to prevent accidentally attacking every host in the exclusion list.

SIEM · 2026-09-24

Genie One MCP server hits GA as system.ai.genie_one_mcp in Unity Gateway, exposing Genie to any MCP client with Unity Catalog permissions enforced.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Promotes system.ai.genie_one_mcp MCP Service in Unity Gateway to general availability, exposing Genie as a conversational tool over the Model Context Protocol so any MCP client or agent (Claude, ChatGPT, Cursor) can query Databricks data with Unity Catalog permissions enforced on every request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-24

Databricks AI Functions gains ai_predict_class and ai_predict_value for in-SQL classification and regression prediction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ai_predict_class SQL function to train a classification model and predict class labels for rows where the target column is NULL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ai_predict_value SQL function to train a regression model and predict numeric values for rows where the target column is NULL.

SIEM · 2026-09-24

Databricks adds no-code governed AI app building via Genie App Builder, App Spaces, and Serverless Micro Apps (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Genie App Builder to author governed data and AI apps in natural language without writing code (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds App Spaces to enforce governance policies across apps built with Genie App Builder (Beta).
• Adds Serverless Micro Apps that scale to zero when idle (Beta).

SIEM · 2026-09-24

Scala UDFs can now read Unity Catalog secrets via a SECRETS clause, with caller or owner permissions depending on UDF scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Unity Catalog Scala UDFs declare required secrets in a SECRETS clause and run under the function owner's permissions, so callers need no direct secret access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Requires environment_version set to 6 or above for Unity Catalog Scala UDFs (and session-scoped UDFs on serverless compute) to access secrets; on classic compute, requires Databricks Runtime 19 or above with standard access mode.
• Limits secret-accessing Unity Catalog Scala UDFs to serverless SQL warehouses only among SQL warehouse types; dedicated access mode compute does not support direct invocation.

SIEM · 2026-09-24

Unity Catalog Python UDFs reach GA with named handlers, dependency installs, and credential access — five-UDF-per-query limit removed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports named handlers for row-at-a-time scalar UDFs in Unity Catalog Python UDFs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Removes the five-UDF-call-per-query limit for Unity Catalog Python UDFs.
• Enables installing custom dependencies in Unity Catalog Python UDFs.

SIEM · 2026-09-24

Databricks adds central configuration for coding agents, covering models, MCP servers, skills, routing, and MDM rollout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables central configuration of coding agents — including models, MCP servers, skills, a default harness, and Smart Routing — with settings applied at agent launch or rolled out via mobile device management (MDM).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-24

New ug CLI connects coding agents (Claude Code, Codex, Pi) to Unity Gateway with one command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the ug CLI to connect coding agents — including Claude Code, Codex, and Pi — to Unity Gateway, handling authentication, configuration, MCP server registration, and spend visibility in the terminal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-24

Unity Gateway unified tracing now captures coding-agent tool and skill activity alongside model requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds coding-agent activity (tools and skills used) to Unity Gateway unified tracing, viewable in Govern > Traces or via Genie.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-09-24

Identity & Access Management · 2026-09-24

Didit adds Smart-ID and Mobile-ID as wallet-based identity verification methods for supported countries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Smart-ID and Mobile-ID as wallet sign-in verification methods, selectable per workflow node in the console, with configurable fallback to document capture when wallet sign-in fails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-09-24

CertCentral adds Persistent DNS TXT automatic domain revalidation and shifts TLS issuance to G5 RSA/ECC roots by default⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Shifts default TLS certificate issuance (new orders, renewals, reissues, and duplicates) to DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 hierarchies for all DV, OV, and EV certificates across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.
• Enforces six remote MPIC network perspectives across at least two RIR regions for domain control verification and CAA checks, requiring four corroborations per domain query, in compliance with the CA/Browser Forum MPIC requirements effective December 15, 2026.

Secure Access (VPN / SASE / ZTNA) · 2026-09-24

macOS Roaming Client v2.4.6 adds IPv6 support, DoH VPN fallback, and a new configuration.json architecture⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ENABLE_DOH_FALLBACK=true install-time flag to keep DNSFilter filtering active over DNS-over-HTTPS when a corporate VPN blocks the DNS-over-TLS port.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Switches agent configuration from legacy daemon.conf to a new configuration.json format; existing installations migrate automatically on upgrade.
• Travel Wi-Fi settings in dns_agent.conf now apply at CLI install time, and install-time configuration keys use the same Travel Wi-Fi names as the dashboard and documentation.

Secure Access (VPN / SASE / ZTNA) · 2026-09-24

AI/LLM Security · 2026-09-24

Docker Sandboxes gains sbx settings for configuring clipboard access, kit sources, SSH agent forwarding, registry mirrors, and more via CLI or env vars.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sbx settings list to view all settings with their effective value, type, source, and description; use --no-trunc for full text or --json for complete records including defaults and environment variable names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sbx settings get <key> to inspect a single setting's effective value, or pass --json to include source and default.
• Adds sbx settings set <key> <value> to write a persistent override for any setting, including JSON values like kit.allowedSources.

SIEM · 2026-09-24

Elastic Security Serverless gains Cross-Project Search, letting one origin project run ~2,100 detection rules across up to 100 linked projects with a single alert queue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports FROM logs-* METADATA _index in ES|QL from the origin for broad threat-hunting sweeps across every linked project simultaneously, with _index prefix providing per-tenant attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports targeted single-project ES|QL queries from the origin using the cloud-team:logs-* qualified index pattern syntax to scope a hunt to one linked project.
• Adds per-project alert rollup via ES|QL FROM .alerts-security.alerts-* METADATA _index with EVAL project = CASE(LOCATE(_index, ':') > 0, MV_FIRST(SPLIT(_index, ':')), 'origin') to surface a 'which tenant is on fire' situational-awareness view.

Digital Forensics & Incident Response · 2026-09-24

ElcomSoft: Adds bootloader-level low-level extraction support for Apple TV 4K 2nd Generation using the usbliter8 SecureROM exploit (requires a custom adapter with a microcontroller board running ElcomSoft custom firmware).

• Extends low-level extraction coverage beyond checkm8-compatible devices to newer SoCs via the usbliter8 exploit.

Secure Access (VPN / SASE / ZTNA) · 2026-09-24

Firezone Terraform Provider lets you manage Sites, Resources, Policies, Groups, Actors, and Gateways as code via firezone/firezone.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the firezone/firezone Terraform provider, sourced via the firezone/firezone registry path, enabling infrastructure-as-code management of Firezone Portal objects alongside Gateway infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports FIREZONE_TOKEN and FIREZONE_ENDPOINT environment variables for provider authentication and endpoint configuration without hardcoding secrets.
• Provides firezone_site, firezone_resource, firezone_policy, firezone_gateway, and group/actor/membership resources for declarative access configuration.

Secure Access (VPN / SASE / ZTNA) · 2026-09-24

Firezone Gateway 1.6.2 moves authenticate, enable-service, and disable-service commands into firezone-gateway itself.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Moves the authenticate, enable-service, and disable-service subcommands from the separate firezone CLI into firezone-gateway itself, consolidating gateway management into a single binary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-24

Firezone: Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

Endpoint Security (EDR/XDR) · 2026-09-24

Fleet: Adds microsoft_graph_credentials.tenant_id, microsoft_graph_credentials.client_id, and microsoft_graph_credentials.client_secret fields to the PUT /api/v1/fleet/microsoft_graph_credentials request body.

• Supports uploading a replacement profile file on existing Android and Windows configuration profiles where the new file's settings can differ completely from the ones it replaces.
• Adds alternative_browser_host field to global and team settings for Fleet Desktop browser-host overrides.

Secrets Detection & Management · 2026-09-24

GitGuardian adds GET /v1/detector-custom-hosts to list workspace-level custom hosts grouped by secret detector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v1/detector-custom-hosts endpoint to list all custom hosts configured on the workspace, grouped by secret detector, including each detector's checker_default_base_url and custom_hosts[].base_url values — only detectors that support custom hosts are returned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-09-24

GitGuardian adds permissions sync from Bitbucket, Azure DevOps, Jira, Confluence, and JFrog Artifactory, plus Platform API notifier management⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Platform API support to create, update, and delete Slack, Microsoft Teams, webhook, and email notifiers, enabling scripted and version-controlled notification setup for large workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds team and permissions sync from Bitbucket, automatically mirroring Bitbucket groups, projects, and repository access into GitGuardian teams and perimeters.
• Adds team and permissions sync from Azure DevOps, automatically mirroring Azure DevOps projects, teams, and repository access into GitGuardian teams and perimeters.

Secrets Detection & Management · 2026-09-24

GitGuardian adds 10 new detectors, 8 secret analyzers, and new validators for Splunk, Artifactory, Salesforce, and Databricks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new detector for Brightcove OAuth credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new detector for Infor ION API Gateway OAuth client credentials, capturing the authorization host and token endpoint when present.
• Adds a new detector for generic Sanctum tokens.

SAST / SCA / Code Security · 2026-09-24

GitHub Copilot code review adds per-user effort controls on all plans and an enterprise-wide default effort setting for org repos.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a dedicated code review page under profile → Copilot settings, available on every Copilot plan (including Business and Enterprise), with separate toggles for automatic reviews on PR creation, new pushes, and draft PRs you create or coauthor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a personal default review effort setting (Lite or Balanced) on the Copilot code review settings page, applying to all reviews you request — including automatic ones — while still allowing per-request overrides from the Reviewers panel.
• Adds an enterprise-wide default review effort setting (Lite, Balanced, or GitHub default) for organization-owned repositories, configurable by enterprise administrators, with organization- and repository-level overrides still permitted.

SAST / SCA / Code Security · 2026-09-24

GitHub Copilot app gains per-project local sandboxing to restrict file, network, and credential access during agent sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /sandbox on command to enable sandboxing for an already-running local session without changing the project default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-project sandbox settings in the GitHub Copilot app covering filesystem (additional read/write, read-only, and denied folder lists), outbound internet and local network controls, and Git/GitHub CLI credential access for local repository and working tree sessions.
• Enforces hard failure — the sandboxed shell errors out rather than silently running without a sandbox — when the OS cannot enforce the requested policy.

SIEM · 2026-09-24

Google SecOps adds remediation plans, Wiz integration, bulk data-table ops, and search-session result retrieval via new REST APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v1beta/{parent}:search to initiate search sessions, plus GET /v1beta/{parent}/searchedResults under the new v1beta.projects.locations.instances.searchSessions.searchedResults resource to page through results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST /v1beta/{parent}/dataTableRows:bulkDelete and POST /v1beta/{parent}/dataTableRows:bulkDeleteAsync for synchronous and asynchronous bulk deletion of data table rows.
• Adds GET /v1alpha/{name}:queryCaseViews to query available views for a case.

SIEM · 2026-09-24

Google SecOps: Adds metadata.base_labels.ingestion_kv_labels field (key: gcp_organization_id) to UDM events from Google Cloud direct ingestion, enabling multi-org log source identification without extra sink configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-24

Google SecOps enriches directly ingested logs with gcp_organization_id to simplify multi-org filtering and RBAC scoping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds gcp_organization_id under metadata.base_labels.ingestion_kv_labels in UDM events for logs ingested via Google Cloud direct ingestion, enabling multi-organization filtering, detection rule scoping, and Data RBAC without additional sink or feed configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-24

Headscale v0.29.4 adds mapper and node-store metrics and reduces peer-map rebuild churn via node-ID keying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds headscale_mapper_changes_dropped_total and headscale_ha_health_updates_total Prometheus metrics to track suppressed no-op map updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds headscale_nodestore_snapshot_builds_total Prometheus metric to track peer-map snapshot rebuilds.
• Peers the peer map by node ID and reuses it for writes that cannot change peer visibility, so routine map requests no longer trigger a full rebuild.

Identity & Access Management · 2026-09-24

iDenfy: Adds landscape mode support on Android SDK 9.2.0.

• Adds blur and glare detection for older devices on Android SDK 9.2.0.
• Adds color scheme customization with XML fallbacks on Android SDK 9.2.0.
• Adds Smart-ID refresh state on Android SDK 9.2.0 and iOS SDK 9.2.3.

Secrets Detection & Management · 2026-09-24

Infisical v0.165.16 adds GCP gateway enrollment, ClickHouse PAM support, secret scanning batching, and certificate deletion blocking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GCP enrollment support for the Infisical Gateway, enabling GCP-based infrastructure to join the gateway network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ClickHouse as a supported target for Privileged Access Management (PAM), enabling dynamic credential management for ClickHouse databases.
• Blocks certificate deletion until the certificate has expired, preventing premature removal of active certificates.

Web Application Security · 2026-09-24

Invicti adds REST API access for Website Discovery and surfaces API spec source locations in API Discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes Website Discovery via the Invicti Platform REST API, enabling retrieval of discovered websites and integration of discovery results into external workflows and cyber tooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds API specification source location display in API Discovery, showing where each specification was found and which endpoints were auto-detected during a scan.
• Adds discovery date filtering, exact-match and exclusion text filters, and multi-select risk score filtering to the Website Discovery list.

Identity & Access Management · 2026-09-24

JumpCloud ADI gains Windows Server 2022 support, HA sync agents, new Directory Insights events, and flexible agent installation across 2023 releases⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new JSON configuration file for the AD sync agent with settings for domain controller address and a flag for allowing insecure connections (use of LDAP).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports high availability configurations for AD sync agents — multiple agents can be installed, with one designated primary by the ADI service; if the primary becomes unavailable, another active agent is automatically promoted.
• Adds new user_update_password_provision Directory Insights event, logged by the AD sync agent when password attribute changes are made or attempted in AD.

Identity & Access Management · 2026-09-24

JumpCloud adds direct SSH access to Privileged Access Management resources⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds 'Connect to a Resource with Direct Access using SSH' capability to Privileged Access Management, enabling SSH connections directly to managed resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-24

JumpCloud 2022 adds passwordless RADIUS auth, TOTP for LDAP, Remote Assist, Password Manager, and new MSP command templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Command After Agent Install command type so admins can specify enrollment commands to run immediately after the JumpCloud agent is installed on new devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds certificate (passwordless) based authentication to JumpCloud RADIUS, supporting certificates from any X.509 compliant certificate authority.
• Adds TOTP as a supported MFA factor for LDAP applications, alongside JumpCloud Protect push notifications.

Identity & Access Management · 2026-09-24

JumpCloud 2023 adds passwordless Go auth, Android zero-touch enrollment, Remote Assist background tools, dynamic groups, and Push Bombing mitigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JumpCloud Go browser extension enabling hardware-protected, phishing-resistant passwordless login to JumpCloud-protected web resources on managed macOS and Windows devices via Apple Touch ID and Windows Hello.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds JumpCloud Go as the default MFA method for conditional access policies on SSO apps, with user and device verification on every application session.
• Adds Android zero-touch enrollment support for fully managed, dedicated, and company-owned Android devices with a work profile.

Identity & Access Management · 2026-09-24

JumpCloud 2024 adds Device Monitoring & Alerting, Windows App Catalog, SaaS Management, CSP-based MDM policies, and multi-tenant MFA enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /systemusers?filter=department:$in:Finance | Accounting|IT support: the pipe | character can now be escaped with \ inside in and nin API filter operator search terms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds six new Windows MDM policies via Configuration Service Provider (CSP) framework: Windows Wi-Fi Configuration Policy, Windows VPN Policy, Install Certificate Policy, Bluetooth Configuration Policy, Control Policy Conflict, and Windows Notification Service.
• Adds a new Windows MDM policy to configure Simple Certificate Enrollment Protocol (SCEP) for Windows devices.

Identity & Access Management · 2026-09-24

JumpCloud ships Access Requests with webhook/JIRA integration, MCP Server GA, Shadow AI Dashboard, forced re-auth SAML/OIDC, and a wave of new management features.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sso_auth event to logs to capture forced re-authentication events for compliance and security auditing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ForceAuthn='true' (SAML) and prompt=login (OIDC) support so that service providers can trigger step-up authentication without ending the user's existing session.
• Includes Authentication Methods References (AMR) claims in both SAML assertions and OIDC ID tokens to surface proof of MFA factors used at the point of access.

Identity & Access Management · 2026-09-24

JumpCloud adds Password Vault (admin, user, mobile, browser), Agent Identities, MCP visibility, and expanded Android/Windows policies in 2026-09.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Access > AI & SaaS Management > Applications view with an MCP Connection column showing Discovered, Connected, or Not Available status for each app, plus an Add MCP Server action to connect discovered MCP servers to AI Gateway without switching tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Identity Management > Agents section (Public Preview) to register and govern non-human AI agent identities with OAuth-based credentials, group-based application access, and lifecycle management independent of human accounts.
• Adds Password Vault to the JumpCloud Admin Portal, enabling admins to enable the vault, assign access to users and user groups, create and share credentials and websites with Connect, View, Edit, and Manage permissions, and view audit logs in Directory Insights.

Identity & Access Management · 2026-09-24

JumpCloud adds RSS feed subscriptions for release notes, agent updates, and bug fix announcements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds RSS feed subscriptions for JumpCloud Help Center updates, product release notes, agent release notes, and bug fix reports via the Release Notes and Bug Fixes page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-24

JumpCloud Password Manager Desktop App adds EU region support, ARM builds for Apple Silicon, auto-lock, and raises item storage to 30,000.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports EU region selection before account activation — choose your region on the activation page (desktop app) or pairing page (browser extension).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces auto-lock schedule with a default of 15 minutes of inactivity and a configurable maximum of 1,440 minutes (24 hours).
• Raises item storage capacity to 13,000 items with autofill enabled, or up to 30,000 items without autofill; a single shared folder can hold up to 5,000 items.

Identity & Access Management · 2026-09-24

JumpCloud: Adds a unified Patch Management dashboard in the Admin Portal with Overview, Windows, and Apple tabs for cross-platform patch compliance, severity filtering, and bulk remediation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Windows-specific patch dashboard with KB-centric controls: search/filter KBs, review CVE details, approve awaiting updates, retry failed installations, and export the KB list as CSV or JSON.
• Adds Apple Compliance Dashboard tracking macOS, iOS, and iPadOS OS rollout progress against active update policies, with filtering by platform, release date, severity, and device status.
• Adds Update Version action on an existing application's Details tab in the Private Repository, enabling binary updates without re-creating the application or reassigning devices.

AI/LLM Security · 2026-09-24

Manifold Security adds an Ask policy response that pauses agent actions for developer consent across all supported coding agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Ask policy response that halts a coding agent's action mid-task and waits for the developer to approve or reject it before proceeding — silence is treated as a rejection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends Ask, Alert, Allow, and Deny policy enforcement to all supported agents: Claude Code, Cursor, Gemini CLI, GitHub Copilot, and Antigravity (via each agent's own permission prompt), plus Codex, Devin, and Kimi (via a native OS consent dialog).
• Introduces a two-path delivery model: agents with their own approval system surface the Manifold prompt inline in the session; agents without one receive a native OS dialog on the developer's machine.

SAST / SCA / Code Security · 2026-09-24

Mend Renovate adds GraalVM version datasource, supportsNpmrc flag, and postUpgradeTasks in branch commit fingerprint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds supportsNpmrc flag to control npm rc support in package managers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Includes postUpgradeTasks in the branch commit fingerprint via the cache subsystem, ensuring post-upgrade task changes are reflected in branch identity.
• Adds a GraalVM version datasource so Renovate can track and update GraalVM versions.

Network Analysis & Monitoring · 2026-09-24

NETRESEC: Adds --input, --output, and --model flags to the flowcarp CLI for building statistical protocol models from PCAP files and classifying traffic against them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds flowcarp --output model:<label>:<tag>:<file>.fcp syntax to train and save a custom protocol model from example capture files, enabling detection of proprietary or novel C2 protocols without hand-written signatures.
• Exposes a free demo web service at https://demo.flowcarp.com accepting raw PCAP uploads via curl --data-binary and returning a JSON response with detected flows, protocols, and alerts.
• Introduces FlowCarp statistical protocol classification as a malware-family identification layer, distinguishing C2 traffic by packet sizes, timing, message-length distributions, request/response behavior, and protocol structure — covering 600+ protocols on the commercial license.

Network Analysis & Monitoring · 2026-09-24

NETRESEC: Adds --model <file>.fcp flag to flowcarp to apply a custom protocol model against a new PCAP for classification.

Network Analysis & Monitoring · 2026-09-24

NETRESEC: Assigns a single protocol or malware family label per flow, reducing the multi-alert overlap common in traditional IDS-based C2 classification workflows.

Identity & Access Management · 2026-09-24

Nudge Security: Adds a Use approved password manager bulk nudge: filter accounts inventory by password manager (including unapproved ones), multi-select, and send one batched nudge per employee listing all affected accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-09-24

Identity & Access Management · 2026-09-24

Omada Identity Cloud adds Context Hierarchies dashboard, provisioning task history, SoD mail notifications, Graph API 3.8, and new-UI access review surveys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds assignmentKey filter to the calculatedAssignments GraphQL query to filter calculated assignments by assignment key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds soDProgress and soDProgressText fields to the calculatedAssignments GraphQL query to expose Segregation of Duties progress per calculated assignment.
• Adds EnableUseNewUISurvey customer setting (default false) to enable the new UI for access review survey questions.

Secrets Detection & Management · 2026-09-24

OpenBao Proxy gains dedicated environment variables for idle connections, keep-alives, and full TLS control in v2.7.x⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds BAO_PROXY_DISABLE_IDLE_CONNECTIONS environment variable to control idle connection behaviour in OpenBao Proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds BAO_PROXY_DISABLE_KEEP_ALIVES environment variable to disable HTTP keep-alives in OpenBao Proxy.
• Adds BAO_ADDR environment variable support in OpenBao Proxy for specifying the upstream BAO server address.

Secrets Detection & Management · 2026-09-24

OpenBao v2.7.0 adds External KMS key support, ML-DSA post-quantum crypto, PQC TLS, PostgreSQL read scaling, Control Groups, and PebbleDB storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tls_key_exchange_preferences to server, agent, and proxy listener config to enforce pure post-quantum TLS key exchange algorithms (SecP256r1MLKEM768, SecP384r1MLKEM1024, X25519MLKEM768, MLKEM1024).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds consistency_fallback_behavior, consistency_missing_header_forward, and consistency_max_index_wait listener configuration parameters for strong consistency control.
• Supports X-Vault-Index and X-Vault-Inconsistent request headers (values: fail, forward-active-node, await-state) to enforce client/server read consistency.

Secrets Detection & Management · 2026-09-24

OpenBao v2.6.3 adds ResolvePathOperation to the SDK and exposes three new fields in sanitized server config output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds disable_standby_reads, allow_unauthenticated_workflows, and unsafe_relative_paths fields to the command/server sanitized config output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces ResolvePathOperation in sdk/logical to report canonical URLs for resources prior to ACL evaluation.

General Utilities & Libraries · 2026-09-24

OpenSSL adds new PKCS12 parsing context API with granular control over certs, keys, and secret bags⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PKCS12_PARSE_CTX_new and PKCS12_PARSE_CTX_free for lifecycle management of a new PKCS12 parsing context object.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PKCS12_parse_ex for parsing PKCS12 structures using the new context-based API.
• Adds PKCS12_decrypt_secretbag for decrypting PKCS12 secret bag contents.

Identity & Access Management · 2026-09-24

Ping Identity adds Friendly Captcha support, JavaScript-free QR codes, dynamic radio-button choices, and a configurable userAgent for external REST calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds userAgent property to external REST service configuration, defaulting to PingIdentity for outbound requests, overridable per-request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Friendly Captcha support to the v2.0 CAPTCHA node as a privacy-focused CAPTCHA provider alternative.
• Adds an option to the Combined MFA Registration, OATH Registration, and Push Registration nodes to render QR codes without using JavaScript.

CNAPP · 2026-09-24

Plerion: Introduces role-based API key permissions: Tenant admin keys can call every operation, while Tenant read-only and custom roles restrict which operations and integrations a key may access, with unauthorized requests refused as 403 Forbidden.

SAST / SCA / Code Security · 2026-09-24

Portkey adds native ElevenLabs TTS and STT routing via unified /v1/audio/speech and /v1/audio/transcriptions endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Routes ElevenLabs text-to-speech through the unified /v1/audio/speech endpoint using x-portkey-provider: @YOUR_ELEVENLABS_PROVIDER_SLUG, accepting any ElevenLabs voice ID (premade, cloned, or custom) via the voice field — forwarded as-is rather than remapped from OpenAI built-in voice names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Routes ElevenLabs speech-to-text through the unified /v1/audio/transcriptions endpoint using the scribe_v1 model, with no custom host configuration required.
• Adds providerSlug as an opt-in Prometheus extra label (disabled by default; enable by adding providerSlug to PROMETHEUS_EXTRA_LABELS) to distinguish the Model Catalog provider or virtual key that served a request from the upstream provider name.

Vulnerability Management · 2026-09-24

CNAPP · 2026-09-24

Rapid7 InsightCloudSec: Adds harvesting of public_network_access property for Azure Cosmos DB accounts.

• Adds harvesting of diagnostic settings for Azure Cosmos DB accounts (Microsoft.DocumentDb/databaseAccounts).
• New Cache Instance Not Using Customer Managed Key Insight: identifies Azure Cache for Redis instances not using CMK for encryption at rest.
• New Cache Instance With Access Key Authentication Enabled Insight: identifies Azure Cache for Redis instances with access key authentication enabled, aligned with CIS Azure Database Services Benchmark v2.0.0 Control 2.9.

CNAPP · 2026-09-24

Rapid7 InsightCloudSec: Adds Database Instance Without Secure Transport Enabled (MySQL) insight: flags MySQL Flexible Servers without require_secure_transport enabled, mapped to NIST SP 800-53 Rev. 5, NIST SP 800-171, NIST CSF v2.0, CMMC Level 2, and Microsoft Cloud Security Benchmark v1.

• Adds harvesting of CMK encryption properties from Azure Cache for Redis Enterprise resources.

SOAR · 2026-09-24

InsightConnect gains a DNS Made Easy connector and new BitSight include/exclude organization settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds include and exclude organizations settings to the BitSight connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New DNS Made Easy connector imports managed domain details into the Rapid7 Platform.
• The Connector detail panel now hides the Workflows and Functions tabs for users without the required permissions.

Vulnerability Management · 2026-09-24

InsightVM 8.60.0 adds TLS 1.3 console support, CIS Apache Tomcat 11 policy, and updated CIS Kubernetes v2.0.1 benchmark.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TLS 1.3 as the preferred protocol for Security Console connections, with automatic fallback to TLS 1.2 for compatibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates built-in CIS Kubernetes (K8s) Benchmark support from v1.6.1 to v2.0.1.

AI-Powered Offensive Security · 2026-09-24

RAPTOR adds /openant LLM source-code scan command and fully standalone (no Claude Code) execution path⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /openant slash command for OpenAnt LLM source-code scanning: AST analysis plus per-function LLM reasoning (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a fully standalone execution path via python3 raptor.py with no Claude Code dependency, supporting doctor, agentic --repo, and scan --repo subcommands.
• Adds _RAPTOR_TRUSTED=1 environment variable to allow libexec/raptor-* scripts (including raptor-project-manager) to run outside a Claude Code session.

AI-Powered Offensive Security · 2026-09-24

RAPTOR: Adds docs/troubleshooting.md covering self-test, sandbox setup errors on Ubuntu 24.04+, and EDR interaction.

• Adds docs/agent-security.md covering agent capabilities, tool boundaries, network controls, and human approval workflows.

MCP Servers & Tooling · 2026-09-24

Runlayer adds Claude Opus 5.5, GPT-6 models, DPoP-bound agent tokens, calendar budget windows, MCP trigger management, and a Gmail label trigger across this release cycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DPoP-bound agent tokens: agent-account tokens can be bound to DPoP keys at issuance and enforced at the MCP proxy, with a per-agent require DPoP flag and admin UI.
• Adds calendar-based budget windows to LLM gateway usage rules, enabling monthly or other calendar-period caps.
• Adds max_completion_tokens in place of the legacy max_tokens parameter for Azure Foundry agents on gpt-5-family deployments.

Attack Surface & Exposure Management · 2026-09-24

runZero: Custom integration script library now covers more than 100 products, available in the console with individual scripts modifiable or usable as templates.

• Custom roles granting Saved queries read can now view the Queries page and table without inventory access; roles granting write or manage can create, edit, copy, import, and delete saved queries.
• Scripts are now available to all administrators, even those with narrow access scopes.

Identity & Access Management · 2026-09-24

SailPoint: Adds connector for Anvil.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds connector for Checkmk.
• Adds connector for Cloudiway.
• Adds connector for Condens.

Identity & Access Management · 2026-09-24

SailPoint Identity Graph rolls out to all Business+ customers, enabling interactive visualization of identity relationships and blast radius analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Accesses Identity Graph directly from the MySailPoint homepage and from context menus across the product by clicking the graph icon on any identity, entitlement, or access item.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Visualizes the full identity estate — humans, non-human identities, and agents — in a single interactive graph to surface overpermissioned identities and complex access pathways.
• Identifies the blast radius of a compromised identity immediately, leveraging context across SailPoint's portfolio.

Identity & Access Management · 2026-09-24

NERM Classic workflows gain a History tab for paginated, searchable version and change event review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a History tab to NERM Classic workflow configuration, showing a paginated newest-first table of version-lifecycle and step/configuration-change events — including when, who, event type, step label, and version identifier — without requiring Admin Activity or the audit API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports search by step labels, step IDs, and version IDs within the History tab, with quick filters to narrow the event list.
• Enables version comparison from within the History tab, letting admins follow changes that spawned a version and open a diff, including after a fork.

Compliance Automation & Trust Management · 2026-09-24

Scrut Automation adds a Compliance Overview tab to the Control Details page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Compliance Overview tab to the Control Details page for at-a-glance compliance status per control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-24

Semgrep Supply Chain adds zero-day malware detection with automated org-wide response policies and a malware firewall (private beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds org-wide Supply Chain policies that trigger automated responses — open a Jira ticket, send a Slack alert, or call a webhook — the moment a malware finding is generated, with no human in the loop.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds zero-day incident detection that rescans all customer repositories with AI-assisted, expert-verified advisory rules within minutes of a supply chain incident and posts findings to the Semgrep dashboard organized by advisories rolled up into incidents.
• Adds early-notification opt-in that proactively informs customers via Slack or webhooks of their blast radius — affected repos, projects, findings, and scan progress — when a new supply chain incident is detected.

Endpoint Security (EDR/XDR) · 2026-09-24

Wayfinder Threat Hunting expands to AWS, Azure, and GCP cloud control planes with IAM, S3, and cross-tenant hunt coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Wayfinder Threat Hunting for Cloud with continuous, expert-led hunting across AWS, Azure, and GCP control-plane activity, enabled via existing Singularity Marketplace plugins for each cloud provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Covers cloud control-plane abuse, IAM privilege escalation, unauthorized access, and data exfiltration — including hunts for IAM user enumeration, S3 bucket reconnaissance, root account logins, AKS cluster-admin credential access, suspicious IAM policy changes, AMI deregistration, telemetry destruction, and cross-tenant delegation changes.
• Maps curated indicators and behavioral rules to MITRE ATT&CK techniques and surfaces findings with enriched Purple AI summaries for triage.

AI/LLM Security · 2026-09-24

SkillSpector v2.12.0 adds --fail-on-findings, SC10 supply-chain detection, opencode_cli provider, TP4 Markdown fences, and GitHub tree scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds skillspector scan --fail-on-findings flag that exits with code 1 when any active finding is present, including findings below the default risk-score threshold, across single-skill, recursive, and MCP registry scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SKILLSPECTOR_MAX_STATIC_ANALYSIS_SECONDS_PER_ARTIFACT environment variable to configure static-pattern and YARA time allowance per artifact; default raised from 30 to 300 seconds.
• Adds SKILLSPECTOR_COMPACT_PROMPTS=1 (also true / yes) to enable shorter unpadded LLM prompt line labels such as L1: instead of L01:.

SAST / SCA / Code Security · 2026-09-24

New snyk studio install --experimental command integrates Snyk scanning directly into AI coding tools like Cursor, Copilot, and Claude Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds snyk studio install --experimental command to configure Snyk Studio in AI coding tools (Cursor, Claude Code, Codex, Copilot, Gemini, Kiro, and Windsurf), scanning generated code in the background as it is written.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-24

snyk fix --agentic gains severity, breakability, and exclusion filters plus opt-in revert control⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --severity-filter flag to snyk fix --agentic to limit automated fixes to only the chosen severity levels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --breakability-filter flag to snyk fix --agentic to restrict Open Source upgrades to those matching the chosen breakability level.
• Adds --exclude-ids flag to snyk fix --agentic to skip specific issue IDs while fixing everything else.

SAST / SCA / Code Security · 2026-09-24

Socket reachability analysis adds Go 1.27 support, Python pickle hook modeling, and lower peak memory for large repos.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports Go 1.27 projects in the Go reachability analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Models calls to pickle.{Pickler,Unpickler} hooks through load and dump in the Python reachability analysis.
• Lowers peak memory use when scanning large repositories.

SAST / SCA / Code Security · 2026-09-24

SonarQube Cloud adds secret masking in source-code views and Web API responses for organization admins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables organization administrators to mask detected secret values in source-code views and Web API responses via a new Masking detected secrets in source code security setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a dedicated Security settings section for SonarQube Cloud organization administrators to configure organization-level security controls.

Endpoint Security (EDR/XDR) · 2026-09-24

Sophos Mobile adds Accessibility Appearance, Safety & Handling, and Liquid Glass settings to Apple Business profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Accessibility Appearance, Safety & Handling, and Liquid Glass settings to Apple Business profiles, enabling admins to skip those setup assistant steps during enrollment (note: Accessibility Appearance and Safety & Handling apply to iPhones and iPads only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-09-24

Splunk Security Content v6.7.0 adds 7 new macOS and Windows analytics covering osascript, ClickFix chains, and LOLBin abuse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cisco NVM - Osascript Network Connection for a Long Duration detection to identify long-lived network connections initiated via osascript on macOS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MacOS Osascript Executing Interactive Shell detection to catch osascript spawning interactive shells on macOS endpoints.
• Adds MacOS Osascript Executing JavaScript Code With ObjC detection to identify JavaScript for Automation code using the Objective-C bridge via osascript.

Secure Access (VPN / SASE / ZTNA) · 2026-09-24

Tailscale adds posture-assertion detail views, webhook event subscriptions, and per-device ping from the mobile app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables pinging devices in your tailnet directly from the mobile app.
• Shows a helpful banner when there are no other devices in the tailnet.

Detection Engineering · 2026-09-24

Tenzir Platform v1.40.0 adds Azure managed identity auth for Key Vault secret stores and JSON output to the workspace creation CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a JSON output flag to the workspace creation CLI command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Azure managed identity authentication for Key Vault secret stores, eliminating the need for long-lived client secrets in workspace configuration.
• Enables force stopping of Explorer pipelines.

SOAR · 2026-09-24

Tines 43.4.0–43.3.0: AI usage API gains new dimensions, markdown conversion functions, and storyboard case management with formula support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new dimensions to the AI usage API, expanding what usage data can be queried.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-24

Helm Chart 3.5.4 adds per-component toleration config keys, ArgoCD SCC normalization, and excluded-nodes billing support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tolerations.<component> per-component keys and tolerations.defaults fallback in Helm values to configure tainted-node tolerations (control-plane, GPU, spot/preemptible) for individual components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports excluded-nodes billing and protection.

Endpoint Security (EDR/XDR) · 2026-09-24

Helm Chart 3.5.3 adds resource limits for admission-controller and policy-operator and restricts audit-log-collector webhook ingress via NetworkPolicy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Updates Helm installation to use oci://public.ecr.aws/trendmicro/container-security/trendmicro-container-security as the primary installation source, with the GitHub container registry as the alternative.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-09-24

TruffleHog v3.97.8 adds Okta OAuth 2.0 client credential detection and per-detector verification timing metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection and verification for Okta OAuth 2.0 client credentials (client_id + client_secret) in the Okta detector, complementing the existing SSWS API token detection; verifies via the client_credentials grant against https://{domain}/oauth2/default/v1/token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-detector verification wall-time tracking to the verification cache via an optional DetectorMetricsReporter interface, enabling metrics backends to record remote verification latency broken down by detector type.
• Ensures 45 secret detectors now report findings even when live verification fails for operational reasons (request build errors, transport errors, body read errors) rather than silently discarding them, using SetVerificationError to record the failure.

Secrets Detection & Management · 2026-09-24

TruffleHog v3.97.9 adds version and comment_number fields to SharePoint source metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Err() method to JobProgress and JobProgressRef, mirroring context.Err so callers can programmatically read why a scan job ended.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-09-24

TrustCloud adds Application Launchpad with per-app IRA workflow, dynamic control scoping, AI Impact Reports, and consistent CSV export across all views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Application Launchpad — a single landing page per application under TrustOps > Applications — consolidating findings, controls, tests, risks, exceptions, and tech stack into one context-scoped view instead of global filtered views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a dedicated Inherent Risk Assessment (IRA) page per application, where answers stored as key-value custom attributes drive dynamic control and test scoping without a support ticket.
• Adds dynamic scoping: saving IRA answers triggers an immediate foreground recompute of control test scope and risk score, with a progress dialog reporting saving responses, recalculating risk scores, and refreshing the assessment.

Data Security & DLP · 2026-09-24

Data Security & DLP · 2026-09-24

Ubiq Security: Adds proxy support for API calls via an optional proxy section in the configuration file, with instructions for running mitmproxy via Docker (docker run mitmproxy/mitmproxy) or directly (mitmproxy --mode regular --listen-port 8080).

Data Security & DLP · 2026-09-24

Ubiq Security: Adds CipherInt32, CipherInt64, CipherInt32ForSearch, and CipherInt64ForSearch methods on StructuredEncryption — and matching DecipherInt32/DecipherInt64 on StructuredDecryption — to encrypt and decrypt native Go integer types against datasets configured with data_type: integer (size: 32 or size: 64).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GetKeyNumber, GetKeyNumberInt32, GetKeyNumberInt64, GetKeyNumberDate, and GetKeyNumberDateTime on StructuredDecryption to inspect which key version a ciphertext was encrypted with, without decrypting it or logging a usage event.
• Adds LoadCache() on both StructuredEncryption and StructuredDecryption objects to pre-populate (or refresh the TTL of) specific datasets by name — pass an empty slice to load all datasets.
• Migrates the canonical Go library import path to gitlab.com/ubiqsecurity/ubiq-go/v2; the /v2 suffix is required to access Structured Encryption — importing without it selects the v1 library.

Data Security & DLP · 2026-09-24

Ubiq Security: Operators accept a credentials parameter (Ubiq credentials object), a data_task parameter (task ID of the upstream data task), and a dataset_names list mapping columns to Ubiq dataset names, enabling column-level encryption on tabular data such as BigQuery results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Install via pip install ubiq_security; operators are loaded automatically when placed under plugins/operators/ in the Airflow home directory.

Data Security & DLP · 2026-09-24

Ubiq Security: Adds IDP_CUSTOMER_ID and IDP_PRIVATE_KEY_PATH environment variables to configure SSO customer identity and the path to a Secret Manager-mounted private key for the Cloud Function.

Data Security & DLP · 2026-09-24

Ubiq Security: date and datetime datasets now work with input character sets other than 0-9.

Data Security & DLP · 2026-09-24

Varonis adds Data Lifecycle Management, Terraform-based collector deployment, Confluence history scanning, Jira permissions analysis, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Data Lifecycle Management (DLM) to automatically identify, prioritize, and quarantine redundant, obsolete, and trivial (ROT) data across connected data sources using classification, permissions mapping, and activity analysis.

SAST / SCA / Code Security · 2026-09-24

Veracode Static Analysis adds iOS 27, Go 1.27, DryRun Security integration, and Pipeline Scan support for artifacts larger than 200 MB⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for excluding Java .jar files from static analysis using veracode.json.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for excluding specific Java classes from Static Analysis through the veracode.json configuration file.
• Pipeline Scan now supports scanning packaged artifacts larger than 200 MB with no changes to existing integrations required.

SAST / SCA / Code Security · 2026-09-24

Veracode: Adds support for iOS 27 in the Static Analysis Engine v2026.09.

• Adds support for Go 1.27 in the Static Analysis Engine v2026.09.
• Redesigns the EASM interface with improved navigation and usability, with a legacy UI fallback option.
• Improves detection of CWE-259 and CWE-798 flaws in the Static Analysis Engine v2026.09, reducing false positives.

Network Analysis & Monitoring · 2026-09-24

Wireshark docs add process-level packet attribution via --process-info and frame.process filter field in pcapng captures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds frame.process filter field to query packets by the process (ID, name, executable path, command line, parent process, or user) that sent or received them, recorded in pcapng files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes --process-info option in dumpcap to control what process metadata is captured: nothing, IDs and names, or full detail (executable path, command line, parent process, user).
• Surfaces process metadata under Process information in the frame details panel and in the Output tab of the Capture Options dialog.

SAST / SCA / Code Security · 2026-09-24

ZeroPath adds bulk action permission checks, scheduled run safeguards, and per-setting permission controls for repository management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bulk action permission checking across multiple repositories — actions like scanning, scheduling, toggling PR settings, or deleting are disabled with an explanatory message when you lack permission on the full selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a two-hour runtime cap on scheduled assistant runs, automatically stopping and marking exceeded runs as failed with a timeout message.
• Adds completion verification for scheduled runs, marking runs that exit without reporting a status and summary as failed rather than silently completed.

SAST / SCA / Code Security · 2026-09-24

ZeroPath adds saveable Dashboard Profiles with per-user layouts, filter presets, and org-wide shared templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Dashboard Profiles — saved arrangements of dashboard widgets on a 12-column grid, bundled with active filters (date range, period, severity, vulnerability class, application) — so any profile restores both layout and filters in one click.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a profile switcher beside the page title that lists personal profiles and org templates shared across the organization, automatically opening the last-used (starred) profile on every device.
• Adds Save profile and Save as new actions inside the layout editor to persist the current widget arrangement and filters back to an existing profile or create a new one.

SAST / SCA / Code Security · 2026-09-24

ZeroPath adds asynchronous SBOM export jobs supporting CycloneDX JSON, SPDX JSON, standalone VEX, and ML-BOM formats via UI and API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds 412 PRECONDITION_FAILED response (with message 'SCA inventory for scan … was retired on …; export the latest scan') when a CycloneDX, SPDX, or VEX export is requested against a scan whose inventory has been retired.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds scaScan.inventoryRetiredAt field returned by scans.getScan so integrations can detect whether a scan's inventory is still available before requesting an export.
• Adds inventoryRetiredAt field to manifests returned by sca.listManifestsForRepository so integrations can select an exportable scan without inferring retirement from an empty package list.

SAST / SCA / Code Security · 2026-09-24

ZeroPath SCA adds AI bill of materials, per-repo Inventory tab, SBOM export (CycloneDX/SPDX/VEX/ML-BOM), and SPDX license grouping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ?tab=inventory&view=<view>&branch=<name> URL parameters to per-repository Inventory tab pages, making branch-specific inventory views directly shareable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exports CycloneDX, SPDX, VEX, and ML-BOM artifacts via an Export SBOM action on the per-repository Inventory tab, generated from the same inventory the UI shows.
• Adds a per-repository Inventory tab with Supply Chain sub-views — Overview (posture and KEV exposure), Risk, Dependencies, Licenses, and AI components — scoped to a single repository and selectable by branch.

SAST / SCA / Code Security · 2026-09-24

ZeroPath self-hosted gains Dynamic Testing / Runtime Validation starting in onprem-2026.09.07-beta, enabled via a Helm value.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Runtime Validation (Dynamic Testing / DAST) on self-hosted deployments via the Helm value runtimeValidation.enabled: true, available from release onprem-2026.09.07-beta onward.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Runs sandboxes as short-lived pods under a RuntimeClass (gVisor by default) on designated nodes, with each run getting its own isolated pod.
• Routes OOB callbacks to a private collector on a team-delegated DNS zone (e.g. oob.security.internal) instead of the cloud callback domain, requiring resolvers to forward that zone and reachability on ports 53, 80, and 443.

SAST / SCA / Code Security · 2026-09-24

ZeroPath adds automatic Jira & Linear ticket sync on finding status changes, plus smarter PR false-positive filtering⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Filters out pre-existing vulnerabilities that appear newly introduced due to file moves or refactors defeating diff rename detection, so only vulnerabilities genuinely introduced by the PR are reported.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Omits individual findings that cannot receive a clear verdict during deep confirmation (due to ambiguous evidence or missing context) rather than failing the entire confirmation phase, so more PR scans complete successfully.

SAST / SCA / Code Security · 2026-09-24

ZeroPath adds automatic fix verification, Verified Fixed state, and cross-tracker sync for Jira and Linear on investigation completion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Automatically updates connected Jira or Linear tickets with the investigation outcome and verdict reason when an investigation completes, keeping external trackers in sync without manual intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Investigation results now refresh the finding's confidence value and recompute its priority score from current severity and new confidence for SAST findings; manually overridden severity is preserved.
• Findings where automated review could not complete surface as a standardized unverified assessment in the default issue queue, signaling that they require manual triage.

SAST / SCA / Code Security · 2026-09-24

ZeroPath adds Bitbucket Cloud and Bitbucket Data Center as supported repository integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Bitbucket Cloud support via workspace access tokens, connecting all repositories in a workspace to ZeroPath.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Bitbucket Data Center support via user HTTP access tokens (all projects visible to that user) or project-scoped tokens, with the instance domain required at connection time.
• Supports Project administration / Webhooks permission on Bitbucket tokens to enable automatic pull-request webhooks.

SAST / SCA / Code Security · 2026-09-24

ZeroPath self-hosted deployments gain direct webhook delivery with custom headers, internal address support, and encrypted credential storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Self-hosted (on-prem) deployments now accept a webhook endpoint URL and optional custom authorization header directly in the integration form, delivering events straight from the ZeroPath instance without any Svix dependency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Self-hosted webhook receivers support internal addresses including internal DNS names, private IP ranges, non-standard ports, and plain http, since the receiver sits inside the operator's own network.
• Setting CREDENTIAL_ENCRYPTION_KEY on the frontend causes custom authorization headers to be stored encrypted at rest; without the key, headers are stored as plaintext.

SAST / SCA / Code Security · 2026-09-24

ZeroPath API gains member-action permission fields on team responses and cron schedule listing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Team API responses now include memberActions: { add: boolean, remove: boolean } to indicate whether the calling user can add or remove members, based on team-level and organization-level permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds endpoint to list all cron schedules, each including its cronExpression.

SAST / SCA / Code Security · 2026-09-24

ZeroPath adds Bitbucket Data Center integration and self-hosted OIDC SSO support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports connecting a self-hosted Bitbucket Server or Data Center instance to ZeroPath via HTTP access token, enabling full scans, pull request scans, build statuses, and inline comments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OIDC single sign-on configuration for self-hosted ZeroPath deployments, with a Keycloak walkthrough included.

Identity & Access Management · 2026-09-23

1Password for Mac now supports saving one-time passwords via macOS Autofill, plus GitHub Actions setup instructions in Developer Environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for saving one-time passwords in 1Password through macOS Autofill — configure via System Settings > General > AutoFill & Passwords > Set Up Codes In, selecting 1Password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a button in Developer > Environments > GitHub Actions destination to view setup instructions.
• Promotes API Credential to near the top of the New Item screen for faster access.

Identity & Access Management · 2026-09-23

Aembit adds Okta Cross App Access support via a new Enterprise-Managed Authorization Credential Provider for AI agent identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Enterprise-Managed Authorization Credential Provider that implements the Model Context Protocol Working Group's Enterprise-Managed Authorization extension, enabling Okta Cross App Access (XAA) for AI agents without per-service consent steps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends policy-based access enforcement and auditability to Okta XAA-driven agent connections, letting security teams centrally control which agents act on whose behalf and under what policy.
• Supports XAA alongside existing OAuth authorization capabilities, allowing organizations to adopt Cross App Access incrementally as ecosystem support expands rather than requiring an all-or-nothing migration.

Identity & Access Management · 2026-09-23

Aembit adds SAML dynamic claims, multi-cluster OIDC trust, MCP Enterprise tokens, and X.509-SVID delivery via Secrets Operator⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds credentialType: X509Svid to AembitSecretRefreshSchedule so Secrets Operator generates a private key inside the cluster, obtains a signed certificate from Aembit, and writes both to a kubernetes.io/tls Secret (fields tls.crt and tls.key) for mutual TLS — private key never leaves the cluster, and the certificate is renewed automatically before expiry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds three SAML 2.0 dynamic-claim expressions — ${saml.response.subject.nameId}, ${saml.response.issuer}, and ${saml.response.attributes['<name>']} — to the OAuth 2.0 Authorization Code Credential Provider, binding issued credentials to the individual SAML user's identity.
• Adds support for multiple OIDC Endpoints in a single Kubernetes Service Account Trust Provider, enabling attestation of a client workload running active-active across two or more clusters, each with its own signing key.

Identity & Access Management · 2026-09-23

Aembit launches Enterprise-Managed Authorization Credential Provider to broker XAA/EMA for AI agents against SaaS MCP servers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Enterprise-Managed Authorization (EMA) Credential Provider that captures a user's SSO ID token and refresh token (requiring the offline_access scope) at login, refreshes them in the background, and performs a dual token exchange at request time so AI agents can access downstream MCP servers without per-app OAuth consent screens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Aembit's Edge Controller brokers XAA between identity providers and upstream MCP servers that don't yet support XAA natively — generating and signing assertions using the tenant's own keys when the IdP cannot perform the exchange directly.
• Automatically falls back to the standard OAuth Authorization Code flow for any upstream MCP server or identity provider that doesn't support XAA, requiring no separate configuration.

SAST / SCA / Code Security · 2026-09-23

Aikido adds Cloud Asset Map, fix PRs from Deep Review comments, GitLab code coverage, on-prem pentest model, and new APIs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET List user logins history API endpoint for auditing authentication activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Broker management API for programmatic control of broker configuration.
• Adds webhook event for when a new issue ignore/snooze request is accepted or denied.

SAST / SCA / Code Security · 2026-09-23

Arnica: Adds Microsoft Teams integration: install the Arnica bot into a team or channel so findings are posted there and practitioners can interact with findings directly from Teams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds commands and finding actions available in the Arnica Microsoft Teams bot for day-to-day triage without leaving Teams.
• Adds Arnica Slackbot commands to quickly access risks from Slack.

Web Application Security · 2026-09-23

Bright adds fuzzing mode to STAR Harness, three new security tests, 2,000+ entry point scanning, and a new Optimizer dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Deprecates the entrypointsStatuses property in the Scan Configuration API; use the entryPointFilter property instead, which accepts securityStatus and connectivityStatus arrays for more flexible entry point selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds entryPointFilter to the Scan Configuration API, supporting fields securityStatus (e.g. 'new') and connectivityStatus (e.g. 'ok') to replace entrypointsStatuses.
• Adds a new Email Spoofing security test that checks a domain's public DNS records for missing or weak DMARC, SPF, DKIM, and BIMI configuration.

Exploitation & C2 · 2026-09-23

Bugcrowd adds Submission Collaborator, enabling researchers to collaborate on bug submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Submission Collaborator, a new capability allowing researchers to collaborate on submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-09-23

Bugcrowd raises the submission collaborator limit from 8 to 20, with full platform-native reward allocation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the maximum number of collaborators per submission from 8 to 20, with reward allocation for all collaborators handled directly on the platform without manual processing delays.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-09-23

Bugcrowd Researcher Platform adds Submission Collaborator, enabling researchers to collaborate on submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Submission Collaborator, allowing researchers to collaborate with others on a submission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-23

bytebase now publishes an API — 278 endpoints across 33 areas: Databaseservice, Instanceservice, Userservice, …⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Databaseservice (31 endpoints) — DatabaseService manages databases and their schemas.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Instanceservice (27 endpoints) — InstanceService manages database instances and their connections.
• Userservice (16 endpoints) — UserService manages user accounts and authentication.

Data Security & DLP · 2026-09-23

Bytebase 3.22.1 adds GPT-5 model support and improves service account search in Grant Access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports GPT-5 models for AI features alongside existing GPT-4o support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-23

Bytebase 3.22.0 adds project-scoped instances, Data Explorer, login lockout, new bytebase recovery CLI, and per-object saved-query sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bytebase recovery CLI command as a break-glass path to re-enable password sign-in or reset a user's password directly against the metadata database, bypassing the UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Restricts /metrics to loopback-only by default; adds --metrics-remote-access startup flag to restore remote scraper access when the endpoint is protected by a gateway, firewall, or NetworkPolicy.
• Requires authentication on /v1/actuator/info; monitoring scripts that poll this endpoint must now include a credential.

Container & Image Security · 2026-09-23

Chainguard launches Sovereign Artifacts beta for EU data residency, storing container and library artifacts in-region for ~30% faster pulls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openjdk:26 and ceph:19 container images.
• Adds 26 new container images this week, including clamav-prometheus-exporter, crossplane-azure-marketplaceordering, kserve-sklearnserver, commercial-spilo-fips, graphql-hive-gateway, jupyterhub-k8s-singleuser-sample, nuxeo-2025, chainguard-server-hypervisor-aws, mongodb-kubernetes, opentelemetry-python-instrumentation-fips, strimzi-kafka-fips, crossplane-aws-emrcontainers, kro, pyrra, starboard-exporter, krakend, mongodb-search, and FIPS variants.
• Adds cursor-agent, chainguard-desktop-workstation-pc, commercial-avocado, rustfs, cloudzero-agent, trivy-k8s-wrapper, access-log-exporter, datahub-gms, kates-connect, kubeflow-trainer-controller-manager, and tracee container images.

SAST / SCA / Code Security · 2026-09-23

Checkmarx One adds MCP Server risk triage, UV Python resolver, and SAST engine 9.7.7 rollout⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds UV Resolution setting at the tenant or project level to use UV for resolving Python projects, with pip remaining the default; results including vulnerabilities, license findings, and SBOM exports display consistently with other supported Python package managers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables changing a risk's state and severity directly through the MCP Server — marking findings such as Not Exploitable or Confirmed from an AI assistant using natural language, spanning all major scan engines.
• Upgrades the SAST engine to version 9.7.7, rolling out gradually.

SAST / SCA / Code Security · 2026-09-23

Checkmarx One adds bulk triage, automated AI remediation, API Security in MCP Server, and Codex/Gemini CLI dependency scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds projects.delete event logging to the Audit Trail API, tracking project deletion actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends Exemption Rules support to CLI-triggered scans in Azure DevOps pipelines, so break-build policy evaluation honors exempt-state configuration from Policy Management for CLI workflows.
• Extends break-build Exemption Rules to CLI scans across all SCM platforms, ensuring exempted findings are excluded from break-build results regardless of SCM platform or evaluation flow.

SAST / SCA / Code Security · 2026-09-23

Checkmarx: Adds a public Global Inventory API that programmatically retrieves packages, risks, and license data aggregated across an account, filtered by project, application, severity, or exploitability, with pagination; authenticated via platform API token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Dast-to-code-initiator and Dast-AI-attack-initiator permissions to the dast-admin role for controlling access to each DAST AI feature independently.
• Adds UV Resolution setting at the tenant or project level so SCA uses the UV Python package manager for dependency resolution instead of pip.
• Adds support for importing manual testing results via CLI or a JSON file, unifying manual and automated (ZAP) findings in a single scan view with UI filtering, report inclusion, and CLI-based overrides.

AI/LLM Security · 2026-09-23

clawscan v0.2.0 adds --platform for single-OS npm tarballs and Docker container labeling for worker-owned cleanup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --platform flag to build smaller npm tarballs targeting one supported operating system and architecture, while retaining the default universal package.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Labels worker-owned Docker containers with optional run and command IDs so supervisors can identify and clean up containers after cancellation.
• Preserves every scanner report when sanitized target, profile, or custom scanner names collide with each other or generated numeric suffixes.

AI/LLM Security · 2026-09-23

clawscan v0.1.7 adds BYOS support, declarative JSON gate policy, OpenClaw install policy adapter, and requires explicit config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports user-defined scanners (BYOS) declared in profile config, with {{target}} templating, secretEnv redaction, and isolated working directories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds declarative JSON gate policy for controlling artifact verdicts based on scan results.
• Adds OpenClaw install policy adapter for evaluating install-gate policies.

Identity & Access Management · 2026-09-23

Clerk: Adds SMS delivery event logging with five typed events — sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed — available in the SMS logs view under Application Logs on all plans.

Internet Services · 2026-09-23

Cloudflare adds Worker Previews, private MCP servers, Rulesets dry-run validation, DDoS log filtering, and browser binding DevTools methods⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dry_run=true query parameter to Rulesets API mutation endpoints to validate ruleset changes — expressions, action parameters, permissions, and quota limits — without persisting or publishing them; successful no-op operations return result: null.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds filter_attack_traffic field to Logpush job API requests to exclude identified DDoS attack traffic from delivered logs, supporting http_requests, firewall_events, and network_analytics_logs datasets; also available in the dashboard under Exclude DDoS attack traffic in Advanced Options.
• Adds acquire() and launch() browser binding methods that accept outboundByHost to route requests for selected hostnames through another Worker, enabling access to private services or adding authentication without constructing raw HTTP requests.

Internet Services · 2026-09-23

Cloudflare API adds zone tracing, posture rules, SFU/TURN management, Address Map account membership, and Hyperdrive restart endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET/PUT/DELETE /zones/{zone_id}/observability/tracing/settings endpoints to view, update, and reset per-zone tracing settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET/PUT/DELETE /zones/{zone_id}/observability/tracing/rules endpoints to view, replace, and delete zone trace rules.
• Adds PUT /accounts/{account_id}/addressing/address_maps/{address_map_id}/accounts/{member_account_id} and DELETE on the same path to add or remove an account membership from an Address Map.

Internet Services · 2026-09-23

Cloudflare adds inactive token lifecycle management, private MCP server support, 32-arg concat(), Cursor Origin builds, and per-PR Worker Previews.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds concat() support for up to 32 arguments in Rules expressions, enabling richer dynamic value construction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds private network MCP server support for MCP server portals, allowing portals to connect to MCP servers available only on a private network.
• Adds Cursor Origin repository support in Workers Builds for automatic deployments, branch previews, and build status reporting.

Internet Services · 2026-09-23

Cloudflare WAF adds four new managed rules blocking SSRF non-standard IP notations, jar loopback payloads, and Jinja SSTI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds managed rule ...5f21b651 to block SSRF attempts using cloud and link-local non-standard IP notation (action changed from Log to Block).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds managed rule ...0f0313d6 to block SSRF attempts using jar HTTP loopback payloads (action changed from Log to Block).
• Adds managed rule ...75cd912a to block SSRF attempts using local non-standard IP notation (action changed from Log to Block).

General Utilities & Libraries · 2026-09-23

code-oss: Adds chat.agent.sandbox.allowNetwork to toggle outbound network access for sandboxed terminal commands; defaults to true (unrestricted).

• Adds chat.agent.allowedNetworkDomains and chat.agent.deniedNetworkDomains for domain-level network filtering in Local sessions and Agent Host custom terminal tool on macOS, Linux, and WSL2.
• Adds chat.agentHost.sdkSandbox.enabled (macOS, Linux, WSL2) and chat.agentHost.sdkSandbox.enabledWindows (Windows) to enable Experimental sandboxing for the Copilot SDK built-in shell used in Agent Host sessions.
• Adds chat.agentHost.customTerminalTool.enabled to switch Agent Host sessions from the Copilot SDK built-in shell to the custom terminal tool (which uses the chat.agent.sandbox.* settings); defaults to false.

General Utilities & Libraries · 2026-09-23

VS Code 1.139 adds remote Dev Container support for agent sessions over SSH, Tunnel, and WSL hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports running agent sessions inside a remote project's Dev Container for SSH, Tunnel, and WSL hosts via the desktop Agents window, starting in VS Code 1.139 — using the container's configured tools and dependencies without installing them on the host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-09-23

VS Code Copilot gains a dedicated /plan workflow with Plan mode, review cards, and Local session Plan agent controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /plan slash command in Copilot chat to switch the session into Plan mode and submit a planning request in one step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds github.copilot.chat.switchAgent.enabled setting to let the Agent automatically switch to Plan mode for research or complex tasks.
• Introduces a dedicated Plan mode selectable from the agent mode picker, enabling the agent to research the project, ask clarifying questions, and produce a reviewable plan without editing files.

General Utilities & Libraries · 2026-09-23

VS Code chat gains terminal command execution, request queuing/steering, OS notifications, find-in-chat, and a customizable Agents window background.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.requestQueuing.defaultAction setting to control whether queued messages default to steer or queue when a request is already in progress.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.notifyWindowOnResponseReceived setting (values: off, windowNotFocused, always) to send OS notifications when a chat response is received, with a preview of the response.
• Adds chat.notifyWindowOnConfirmation setting (values: off, windowNotFocused, always) to send OS notifications when the agent needs user input or confirmation to continue.

General Utilities & Libraries · 2026-09-23

VS Code Insiders adds sessions.useWorktree setting and chat.editor.preferCopilotHarness to control agent harness selection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sessions.useWorktree setting in VS Code Insiders to control whether the isolated Git worktree harness is selected when creating a first workspace session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.editor.preferCopilotHarness setting to prefer the Copilot SDK harness over Local for new editor-chat sessions.
• Adds ChatEditorPreferCopilotHarness device policy (available from version 1.134) for enterprise admins to enforce the Copilot harness preference.

General Utilities & Libraries · 2026-09-23

code-oss: Enables chat.agentHost.devContainer.enabled to run Agent Host sessions inside a Dev Container, letting the agent build and test with the project's own tools and dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports Dev Container sessions on remote folders over SSH, Tunnel, or WSL hosts (requires VS Code 1.139), with Docker running on the remote host and a .devcontainer/devcontainer.json present.
• Adds GitHub Issues and Pull Requests as first-class context attachments via 'Add Context > Issue...' or 'Pull Request...', with direct URL paste support.

Identity & Access Management · 2026-09-23

SAST / SCA / Code Security · 2026-09-23

Corridor adds Context: attach named notes or documents to projects so guardrails analyze code against your own internal standards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Context, a named note or uploaded document attached to a project that supplies guardrails with organization-specific background — internal libraries, approved patterns, coding standards, and policy excerpts — to make PR review analysis more relevant and reduce false positives.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Context applies to PR Reviews (used when Corridor reviews pull requests) and MCP Plan (supplied to AI coding agents so generated code fits your standards).

SAST / SCA / Code Security · 2026-09-23

cve-lite-cli v1.37.0 adds --output <dir> to control where JSON, SARIF, and SBOM files land, with a matching GitHub Action input.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --output <dir> flag to direct --json, --sarif, and --sbom output files into a specified directory (created when missing); passing --output without one of those three flags is an error rather than a silent no-op.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a matching output input to the GitHub Action for the same directory-routing behaviour.

SAST / SCA / Code Security · 2026-09-23

Cycode Workstation Protection adds real-time package install enforcement with cooldown policies and malicious package threat intelligence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Workstation Protection, a new capability that intercepts package install commands in real time to enforce cooldown (release-age gating) policies and block known malicious packages before they install on developer workstations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Deploys Workstation Protection via Mobile Device Management (MDM) with no new console, no new infrastructure, and no change to developer install workflows.
• Checks every package install against a continuously updated threat intelligence feed to catch malicious packages that have aged past cooldown windows, including typosquatting, slopsquatting, and persistent compromised maintainer releases.

SIEM · 2026-09-23

Databricks OpenSharing now supports inviting recipients by email with a secure activation link (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds email-based invitation for OpenSharing recipients, sending a secure activation link instead of requiring manual exchange of a sharing identifier or credential file (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-23

Databricks adds a Beta API to programmatically manage Lakebase backup schedules with configurable cadence and retention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Beta snapshot schedule API for Lakebase that lets you read and set a root branch's automated snapshot cadences (daily, weekly, or monthly) and per-cadence retention periods.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-23

OpenAI GPT-6 Luna is now accessible via Databricks Unity Gateway through Foundation Model APIs pay-per-token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenAI GPT-6 Luna model access through Unity Gateway via Foundation Model APIs on a pay-per-token basis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-23

Databricks Lakeflow Connect adds a Shopify connector (Beta) for ingesting e-commerce data via OAuth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Shopify connector in Lakeflow Connect (Beta) that ingests products, orders, customers, inventory, fulfillments, and discounts from Shopify into Databricks using the Shopify OAuth client credentials grant; workspace admins enable it via the Previews page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-23

Databricks lets you back model provider API keys with customer-owned Unity Catalog secrets, enabling zero-downtime key rotation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Backs a model provider service credential with a customer-owned Unity Catalog secret so that rotating the secret takes effect at query time with no service change.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-23

Unity Gateway lets you configure a price multiplier on model provider services to reflect negotiated rates for external model spend.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a price multiplier setting on model provider services in Unity Gateway so that external model spend estimates reflect negotiated rates instead of published list prices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-23

Didit: Adds liveness_camera and liveness_camera_switch (and equivalent document) query parameters for direct verification URLs, enabling the same camera control without going through the SDK.

Public Key Infrastructure (PKI) · 2026-09-23

CertCentral now auto-revalidates domains via Persistent DNS TXT Record DCV every five days, preventing expired validations from blocking certificate issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automatic domain revalidation using the Persistent DNS TXT Record DCV method, where DigiCert checks and revalidates domains every five days as long as the Persistent DNS TXT record with the correct persistent URI value (Account or Unique) remains in place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports automatic revalidation for OV and EV TLS, Qualified Website Authentication Certificates (QWAC), QWAC PSD2, PKIo Private Services Server, and X9 PKI for TLS certificate types — with validated domains added to the Domains page where revalidation runs.
• Persistent DNS TXT domain validation is reusable for nine days before revalidation is required, with the automatic process eliminating the need to manually resubmit domains before expiry.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

DNSFilter adds Blocked By column to Unblock Requests grids, type-to-confirm for Roaming Client deletion, and Last Logged In User in CyberSight Top Clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Blocked By column to the Active Requests and Request History grids showing the reason each domain was blocked, consistent with the Query Log's Method column, and also visible in the approval drawer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Last Logged In User as a default column and Friendly Name as an optional column in the CyberSight Top Clients View All grids on Activity Overview and AI Usage.
• Introduces type-to-confirm requirement for deleting Roaming Clients and running cleanup deletions, preventing accidental mass deletions.

AI/LLM Security · 2026-09-23

Docker Sandboxes gains --model and --provider flags plus llmman to run local, Ollama, or hosted AI models inside sandboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sbx run --model <model> flag to select the model that answers an agent's requests, supporting local GGUF models, Ollama, and hosted providers like openai or anthropic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sbx run --provider <provider> flag to route model requests to llmman (default), an existing Ollama install at localhost:11434, a hosted provider, or a custom endpoint defined in model.providers.
• Adds sbx run --overflow-provider <provider> and --overflow-model <model> flags to pair a local model with a fallback hosted provider for requests that exceed local context capacity.

AI/LLM Security · 2026-09-23

Docker Sandboxes adds sandbox-scoped secrets with precedence over global secrets and live hot-reload in existing sandboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sandbox-scoped secrets that take precedence over global secrets, configurable with sbx secret rm <service> --sandbox <sandbox-name>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Secret changes (add, update, remove) take effect in existing local sandboxes without a restart.

AI/LLM Security · 2026-09-23

Docker Sandboxes adds GitHub Copilot provider support and --model flag for local/hosted model selection in OpenCode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

UNCATEGORIZED · 2026-09-23

DockSec v2026.9.21 adds --fix, AI exploit-chain correlation, EPSS prioritization, Markdown CI reports, and PR comment mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --fix flag that emits remediation commands alongside each finding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --format markdown report output, sized for CI/CD pipeline logs and pull-request summaries.
• Adds EPSS-based priority scoring to structured findings output, surfacing exploitability likelihood alongside severity.

UNCATEGORIZED · 2026-09-23

DockSec: Adds AI-powered vulnerability correlation that identifies exploit chains across findings.

• Replaces string-substitution HTML templates with Jinja2 for report rendering.
• Adds signed releases and self-scanning CI with integration guides.

UNCATEGORIZED · 2026-09-23

DockSec: Introduces EPSS-based priority scoring so findings are ranked by real-world exploit probability rather than raw severity volume.

Firewalls & Network Defense · 2026-09-23

Fastly Historical Stats API now exposes bot time series metrics served by ContentGuard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bot time series metrics (served by ContentGuard) to the Historical Stats API, enabling per-service bot-protection data retrieval.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-09-23

Fastly launches a Bot Management API to configure ContentGuard actions per bot category, individual bot, and workspace protection mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Bot Management API to configure ContentGuard, separate from the Next-Gen WAF API, enabling programmatic control over how Fastly responds to bot traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports setting an action for a bot category (such as AI crawlers, search engines, or headless browsers) so that any bot Fastly later adds to that category inherits the action automatically.
• Supports overriding the action for an individual bot within a category, with the ability to set the action back to inherit to return it to the category default.

Reverse Engineering · 2026-09-23

Finite State adds a Scans page with live queue visibility and two new API endpoints for scan queue health and snapshots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /public/v0/scans/analysis endpoint returning Scan queue totals, success rate, and duration metrics for a selected period.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET /public/v0/scans/ops-snapshot endpoint returning the current live running and queued Scan snapshot.
• Extends GET /public/v0/scans to include processing time, Finding count, start time, and filter/sort by who initiated the Scan.

Endpoint Security (EDR/XDR) · 2026-09-23

Fleet adds CVSS-range vulnerability filtering, APNs ping, MDM command cancellation, and Microsoft Graph credential management APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /api/v1/fleet/hosts/:id/apns_ping endpoint to send an APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or configuration profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PUT /api/v1/fleet/microsoft_graph_credentials endpoint to declaratively replace stored Microsoft Graph credentials; accepts microsoft_graph_credentials[].tenant_id, .client_id, and .client_secret, validates each new or changed credential against Microsoft Graph before saving.
• Supports replacing an existing MDM configuration profile file via upload, with type-specific identifier matching rules for Apple (mobileconfig/DDM), Windows, and Android profiles.

SAST / SCA / Code Security · 2026-09-23

FOSSA adds scheduled and webhook-triggered project re-analysis, configurable under Settings → Projects → Hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a POST https://app.fossa.com/hooks/webhook/{project-locator} endpoint to let external systems (CI pipelines, package registries) trigger on-demand FOSSA project re-analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds scheduled hooks to automatically re-analyze all organization projects on a recurring hour, day, or week interval at a configured time, enabled under Settings → Projects → Hooks.
• Adds per-project webhook hooks configurable under Project Settings → Settings → Hooks, with automatic hook disabling and error recording when a project is ineligible for re-analysis.

SAST / SCA / Code Security · 2026-09-23

FOSSA exposes a public CPE Lookup API at analysis.fossa.com for querying CVEs and vulnerability metadata without a project scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET https://analysis.fossa.com/api/v1/cpe/match/{search} to return full security metadata — CVE IDs, CVSS v2/v3/v4 vectors, EPSS scores, CWEs, affected packages, exploitability, and known ransomware campaign use — for any CPE v2.3 string, with no FOSSA account required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET https://analysis.fossa.com/api/v1/cpe/match/{search}/id to return only a lightweight list of vulnerability IDs (e.g. CVE identifiers) matching a CPE, avoiding the overhead of the full metadata response.
• Adds GET https://analysis.fossa.com/api/v1/cpe/match/{search}/compat as a compatibility endpoint for clients previously using vulns.fossa.com/api/vulns/cpes/search, returning a simplified response with nvdId, cpe, affectedVersionRanges, and affectedPackageRanges.

SAST / SCA / Code Security · 2026-09-23

GitHub Copilot app gains OpenTelemetry support via enterprise managed-settings.json, enabling centralized agent observability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a telemetry property to managed-settings.json for enterprise-managed Copilot settings to enable OTel export and specify the receiving endpoint, with prompt/response content excluded by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports sending Copilot agent activity data — including AI model requests, tool calls, and step-by-step execution traces — to any OpenTelemetry-compatible monitoring backend.

SAST / SCA / Code Security · 2026-09-23

GitHub Copilot for JetBrains 1.18.0 adds AI-assisted tool approvals, re-editable agent messages, org-shared skills, and Codex plan mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a setting to toggle the built-in GitHub MCP Server on or off independently of manually configured MCP servers, which remains enabled by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds persistent per-tool controls for MCP servers in Copilot agent sessions, letting you enable or disable individual tools without affecting others.
• Introduces AI-assisted tool approvals (assisted approvals) in public preview for Copilot agent sessions, automatically approving low-risk tool calls while still prompting for higher-risk actions.

SAST / SCA / Code Security · 2026-09-23

GitHub Copilot CLI gains whole codebase indexing for C++, building a persistent symbol index across all project files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the /lsp logs command to check C++ whole codebase indexing progress at any time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-23

Claude Opus 5.5 is now available in GitHub Copilot for agentic coding and long-running tasks across all major IDEs and clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Claude Opus 5.5 to the Copilot model picker in Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-23

GitHub Copilot adds GPT-6 Sol and GPT-6 Luna as selectable models across VS Code, CLI, mobile, and IDEs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GPT-6 Sol to GitHub Copilot as a balanced model for interactive and agentic coding with multistep validation, available on Copilot Pro+, Max, Business, and Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GPT-6 Luna to GitHub Copilot as a lightweight, cost-efficient model for smaller and faster tasks — the lowest-cost option in the GPT-6 family — available on Copilot Pro, Pro+, Max, Business, and Enterprise plans.

SAST / SCA / Code Security · 2026-09-23

GitHub SSH gains post-quantum mlkem768x25519-sha256 key exchange and enforces 3072-bit minimum RSA key sizes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds mlkem768x25519-sha256 post-quantum key exchange for SSH sessions on github.com and GitHub Enterprise Cloud with Data Residency (excluding the U.S.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ region), with GitHub Enterprise Server support in version 3.24.
• Enforces a minimum RSA SSH key size of 3072 bits for all new keys uploaded after October 14, 2026, for both signing and authentication.

SIEM · 2026-09-23

Google SecOps: Adds POST /v1alpha/{parent}/remediationPlans:generate to trigger the Remediation agent and save its output as a Remediation Plan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v1alpha/{name}:execute to execute a suggested Remediation Plan.
• Adds GET /v1alpha/{parent}/remediationPlans to list Remediation Plans with optional filtering.
• Adds PATCH /v1alpha/{remediationPlan.name} to update a Remediation Plan.

SIEM · 2026-09-23

Google SecOps: Gemini in SecOps uses Google Search grounding to pull up-to-date internet context into responses, surfacing the exact search queries used and citations to source data.

SIEM · 2026-09-23

Google SecOps: Enables rollback of a Response Integration to a previous version from the Response Integrations page if an update causes issues or requires reverting custom code changes.

• Provides curated detection transparency by allowing users to inspect individual rule logic and code directly in the Content Hub Curated Detections page.
• Supports installing and running Power Ups from the Content Hub Power Ups page to extend playbook capabilities.

SIEM · 2026-09-23

Google SecOps: Adds the Triage and Investigation Agent (TIN) integration, which autonomously gathers evidence, performs first-party enrichment, and returns a True Positive or False Positive verdict plus a confidence_level output usable in downstream logic.

• Adds an AI Agents category in the Step Selection panel of the playbook canvas, from which agents can be dragged onto workflows and configured with Automatic or Manual action types, Retry on failure toggle, and Error Handling (stop or skip) options.
• Exposes structured TIN result fields — verdict and confidence_level — in the Expression Builder for conditional branching via Flow block (Conditional) steps, enabling verdicts to drive remediation, alert closure, or analyst assignment paths.
• Supports asynchronous agent execution: the playbook pauses without occupying the execution queue while the agent runs, surfacing three states — Not Run, Running, and Completed.

SIEM · 2026-09-23

Google SecOps: Adds Model Armor, a model-agnostic prompt and response screening layer that protects against data loss and offensive content across multiple clouds and model providers.

• Adds Agentic AI triage and investigation capability for automatic triage and investigation of security alerts via Gemini AI.

SIEM · 2026-09-23

Google SecOps: Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:archive (ArchiveRule) to archive a specified rule.

• Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:enableLiveRule (EnableLiveRule) to set the latest version of a rule to live.
• Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:disableLiveRule (DisableLiveRule) to disable the latest version of a live rule.
• Adds POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:enableAlerting (EnableAlerting) and POST https://backstory.googleapis.com/v2/detect/rules/{ruleId}:disableAlerting (DisableAlerting) to control alerting on a per-rule basis.

SIEM · 2026-09-23

Google SecOps: Supports 19 regional Backstory API endpoints including https://europe-backstory.googleapis.com, https://northamerica-northeast2-backstory.googleapis.com, https://me-central2-backstory.googleapis.com, and https://africa-south1-backstory.googleapis.com, allowing data-residency-aware API calls.

• UDM search queries sent via API time out after 10 minutes, versus 1 hour for UI-initiated queries.

SIEM · 2026-09-23

Google SecOps: Adds chronicle.rules.modifyRules and chronicle.ruleDeployments.update IAM permissions required for custom roles to manage customizable schedules for multi-event rules, now in General Availability⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-23

Huntress: Adds three macOS detections for quarantine-attribute removal (xattr strip via system call): script/shell strip in common malware staging folders, strip on a mounted disk image, and a combined fake-installer-plus-strip-within-five-minutes correlation — covering AMOS, Poseidon, Odyssey, and MacSync infostealers; requires Agent v0.14.196.

• Adds Screen Sharing session telemetry on macOS — reports source address, session user, and authentication type for each session start, with per-host field suppression; requires Agent v0.14.196.

Reverse Engineering · 2026-09-23

HyperDbg v0.24 adds new memory-read commands, user-mode I/O port access, script engine arrays, and Linux kernel module support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dw and !dw commands to read word (2-byte) values from virtual and physical memory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds da and !da commands to read printable ASCII (null-terminated) strings from virtual and physical memory.
• Adds dds, dqs, and dps commands (plus physical memory counterparts) to read double-word, quad-word, and pointer-sized values resolved to symbol names in module!symbol+offset format.

Identity & Access Management · 2026-09-23

Reverse Engineering · 2026-09-23

ILSpy v11.1 adds C# 14 decompilation, mass-testing tools, and ilspycmd bundle support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds nugetfuzz test tool that downloads NuGet packages and runs them through a debug build of ilspycmd, recording crashes, assertion failures, decompiler warnings, and leaked compiler-generated identifiers in C# output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds decompdiff test tool that runs an assembly through two different versions of the decompiler via ilspycmd and produces a diff of the generated source code; supports --no-build and can run against git refs.
• Accepts single-file bundles as ilspycmd input (previously unsupported).

Secrets Detection & Management · 2026-09-23

Infisical v0.165.15 adds built-in PAM masking, a navbar theme toggle, and a stuck-timeout env var removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds built-in PAM masking to protect privileged access credentials from being exposed in the UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a navbar theme toggle so users can switch themes directly from the navigation bar.
• Removes the stuck timeout environment variable, eliminating a previously required workaround.

Identity & Access Management · 2026-09-23

JumpCloud: Adds Client secret basic and Client secret post client authentication type options on the agent's Authentication tab, letting agents match the exact OAuth credential-delivery method required by external platforms such as Amazon Bedrock AgentCore.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Requires an install success exit code when deploying Windows EXE updates via the Private Repository so JumpCloud can confirm installation succeeded.

Identity & Access Management · 2026-09-23

JumpCloud: Adds new Android Display Settings policy to control screen brightness and screen timeout, with options to allow user configuration or enforce fixed values.

• Adds new Android Autofill policy to allow users to choose an autofill service or disable and lock autofill system-wide on Android 8.0 and later.
• Adds new Android Work Account policy to require a Google authenticated enterprise account for device management and optionally enforce a specific Google Account email during setup.
• Adds new Android Default App and Intent Handling policy to set a managed app as the default handler for selected Android activities such as opening web links or dialing phone numbers.

Identity & Access Management · 2026-09-23

JumpCloud: Launches JumpCloud Case Portal for centralized view of support cases and ideas submitted by any admin in the organization, with filtered search and clickable case detail.

• Integrates SentinelOne agent deployment via JumpCloud Commands for macOS, Windows, and Linux endpoint protection.
• Extends the Microsoft 365 integration to include M365/Azure AD security groups.

Identity & Access Management · 2026-09-23

JumpCloud: Releases SaaS Management — discover, categorize, warn, and block shadow IT SaaS apps on user devices via the JumpCloud Go browser extension, with manual app addition and licensing tracking.

Identity & Access Management · 2026-09-23

JumpCloud: Introduces JumpCloud Access Requests, enabling approval flows for access requests submitted from the JumpCloud User Portal and managed in the admin console.

• Supports webhook configuration in Access Requests to integrate with ticketing systems such as JIRA, automatically creating tickets and sending real-time notifications on new requests.
• Tracks Access Request events in Directory Insights.
• Releases SaaS License Management (GA) to automate license tracking for supported SaaS applications and optimize license cost management.

Identity & Access Management · 2026-09-23

JumpCloud: Adds new Android policies for Display Settings (screen brightness and timeout), Autofill (system autofill control on Android 8.0+), Work Account (Google enterprise account requirement), Default App and Intent Handling (managed app as default handler for activities), and enhanced Bluetooth restrictions including outbound Bluetooth file sharing and personal-profile Bluetooth sharing controls via the Work & Personal Usage policy.

Network Analysis & Monitoring · 2026-09-23

NETRESEC: Adds a free demo API endpoint at https://demo.flowcarp.com (via curl --data-binary @<file>.pcap) that accepts a raw PCAP and returns a JSON response containing detected flows, protocols, and alerts, backed by a commercial license covering 600+ protocols.

Network Analysis & Monitoring · 2026-09-23

NETRESEC: FlowCarp assigns a single protocol or malware family label per flow using statistical classification (packet sizes, timing, message length distributions, request/response behavior, protocol structure), reducing the multi-alert overlap common with IDS signature matching.

Identity & Access Management · 2026-09-23

Nudge Security adds an in-browser warning on OAuth device code pages to block device code phishing attacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new in-browser nudge that fires on every visit to an OAuth device code authorization page for Microsoft, Google, GitHub, GitLab, Salesforce, AWS, Docker, Zoom, Vercel, and OpenAI, warning employees never to enter a code provided by someone else.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Records every employee acknowledgment of the device code phishing nudge as a nudge response for audit and tracking.
• Configure detection and enable the device code phishing nudge in Browser Extension Settings.

General Utilities & Libraries · 2026-09-23

Obsidian 1.14.2 adds open-from-outside-vault, OS Open with integration, and iOS 27 extra-large widgets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-23

SAST / SCA / Code Security · 2026-09-23

Openlayer adds a Lifecycle page with stage advancement, intake overview, risk scorecard, and lifecycle history for governance-mode projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Lifecycle page (reachable from the project sidebar or command menu) that consolidates lifecycle stage, intake information, and risk scorecard for governance-mode projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Lifecycle stage section with a segmented progress bar, a stage counter (e.g. Stage 2 of 5), per-stage criteria with Expand/Collapse controls, and progress reporting such as 2/4 criteria met.
• Adds Send back for re-review control on the Lifecycle page to return a project for another review, restricted to workspace admins and project access-group admins.

SAST / SCA / Code Security · 2026-09-23

Openlayer adds workspace-level governance with intake forms and risk templates for AI project registration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Settings › Governance area with Intake and Risk tabs where workspace admins can define intake forms (organized into sections) and risk templates (categories and dimensions) used across all projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Intake forms and risk assessments are answered per-project from the project's Lifecycle page during registration or afterward.
• Workspace admins can start from the Openlayer template or from scratch when building intake forms and risk dimensions; workspace members can view but not edit these definitions.

SAST / SCA / Code Security · 2026-09-23

Openlayer: New Export a framework endpoint (/api-reference/rest/governance/export-framework) generates an audit-ready zip archive of a framework's evidence and progress.

• New Attach evidence to a rule result endpoint (/api-reference/rest/governance/create-rule-result-evidence) lets you satisfy evidence rules programmatically.
• New List a framework's per-project compliance endpoint (/api-reference/rest/governance/list-project-rule-stats) surfaces a compliance roll-up per project for a given framework.
• Adds EU data region support — choose United States or European Union when signing up or logging in to Openlayer.

Endpoint Security (EDR/XDR) · 2026-09-23

Cortex XDR gains XQL support for Device Security via a new integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds integration between Device Security and Cortex XDR to enable XQL (Extended Query Language) support for IoT device data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-09-23

DNS Security Operator Dashboard in Strata Cloud Manager surfaces C2 traffic, malicious domains, and at-risk users/devices in one view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-23

Passbolt 5.16.0 adds Offline Mode (Beta) for secure read-only access and autofill when the server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Offline Mode (Beta) in the browser extension, giving users secure read-only access and autofill for selected credentials when the Passbolt server cannot be reached.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-09-23

PhoneSploit-Pro v2.3 adds screen/display controls and a hub-based menu to the ADB exploitation toolkit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds screen and display control options, expanding the set of device interactions available during an ADB session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a hub-based menu structure, reorganizing available exploits and actions into grouped navigation hubs.

Identity & Access Management · 2026-09-23

Ping Identity: Adds Sync Updates Only field to the provisioning sync status UI, showing changes since the last successful sync for inbound rules when the source is a directory service (Active Directory, PingDirectory, or OpenLDAP).

• Adds signed-and-then-encrypted ID token and user information support for external OIDC identity providers, strengthening privacy and compliance when connecting to external OpenID providers.
• Releases improved PingOne Authentication Dashboard to general availability, now including PingOne DaVinci-triggered authentication activity for a unified view of sign-on activity from PingOne and DaVinci flows.

Identity & Access Management · 2026-09-23

Ping Identity: Adds support for signed-and-then-encrypted ID tokens and user information returned by external OIDC identity providers in PingOne.

• Adds a Sync Updates Only field to the provisioning sync status UI, showing changes since the last successful sync for inbound rules where the source is a directory service (Active Directory, PingDirectory, or OpenLDAP).

CNAPP · 2026-09-23

Plerion API keys gain role-based access control and a new GET /v1/tenant/openapi endpoint that returns a role-scoped OpenAPI 3.1 spec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v1/tenant/openapi endpoint that returns the full API reference as an OpenAPI 3.1 document scoped to the calling key's permissions — operations the role cannot call are omitted; send Accept: application/yaml to receive YAML instead of the default JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-09-23

Plerion adds per-integration tags (API-accessible), two new S3 checks, and standalone SCIM provisioning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Tags section to each integration's settings page where you can define key-value tags that override AWS account tags with the same key — tag groups update within seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes integration tags through the API: every integration returned by the API now carries its tags along with the source of each tag.
• Adds new S3 check PLERION-AWS-1182: S3 bucket default encryption does not use a customer-managed KMS key — passes buckets encrypted with aws:kms or aws:kms:dsse under an owned key; fails buckets on AES256, no encryption, or an AWS-managed SSE-KMS key (including the console's AWS managed key (aws/s3)); Medium severity.

MCP Servers & Tooling · 2026-09-23

Runlayer Terraform module gains private CA trust bundles and Microsoft Teams integration for ECS self-hosted deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds trusted_ca_pem Terraform module variable to inject a PEM certificate bundle (single or concatenated) into ECS deployments, enabling backend, shared worker, and MCP execution worker tasks to trust private CA-signed MCP servers and HTTPS proxies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Microsoft Teams integration via five module variables — ms_teams_app_client_secret (Terraform variable, recommended via TF_VAR_*) plus MS_TEAMS_APP_CLIENT_ID, MS_TEAMS_RUNLAYER_TENANT_ID, MS_TEAMS_AZURE_SUBSCRIPTION_ID, MS_TEAMS_AZURE_RESOURCE_GROUP, and MS_TEAMS_APP_URL — which together provision a per-agent Entra app registration and Azure Bot Service resource; the integration is off unless all five values are set.
• Adds rds_writer_cpu_utilization_threshold, rds_reader_cpu_utilization_threshold, and rds_writer_acu_utilization_threshold Terraform variables to control RDS autoscaling targets for ECS deployments.

MCP Servers & Tooling · 2026-09-23

Runlayer Operator adds Microsoft Teams integration, MCP Catalog API, AI Watch binary distribution, and OTLP observability support on Kubernetes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP_CATALOG_API_KEY secret (set on the platform namespace) to enable MCP Catalog onboarding; without it, GET /api/v1/catalog/ fails and setup shows Couldn't load setup status.
• Adds AI Watch binary distribution support, requiring a Runlayer download token and a customer-owned object-storage cache with workload identity permissions; missing inputs surface as 'No AI Watch installer is currently resolved' in the UI.
• Adds OTLP observability support for Kubernetes deployments (requires Kubernetes ≥ 1.29 and reachable OTLP endpoints; hostname endpoints may need extra NetworkPolicy CIDRs).

MCP Servers & Tooling · 2026-09-23

Runlayer adds workload identity support for EKS (IRSA) and GKE, eliminating long-lived cloud keys from deployments⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds spec.serviceAccount field in the RunlayerInstance CR to annotate per-component Kubernetes ServiceAccounts with IRSA role ARNs (eks.amazonaws.com/role-arn) on EKS or GSA emails (iam.gke.io/gcp-service-account) on GKE — no long-lived cloud keys embedded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds spec.deploy.platformNamespace to the RunlayerInstance CR to override the default runlayer-<customerId> namespace where workload-identity ServiceAccounts are created.
• Provisions dedicated Kubernetes ServiceAccounts per component — {instance}-backend, {instance}-worker, {instance}-audit-consumer, {instance}-siem-export, {instance}-session-materializer, {instance}-toolguard — each independently annotatable with cloud IAM roles.

MCP Servers & Tooling · 2026-09-23

Runlayer documents external dependency wiring for PostgreSQL, Redis, audit streams, SIEM export, AI Watch packages, and session materializer on AWS and GCP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Maps PostgreSQL (Aurora/RDS or Cloud SQL) into RunlayerInstance via spec.database.* and Secrets runlayer-db / runlayer-redis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Maps Redis (ElastiCache or Memorystore) into RunlayerInstance via spec.redis.*, with spec.redis.tls: true when TLS/auth is enabled.
• Enables optional AI Watch binary package caching via a private S3 bucket configured with BINARY_PACKAGES_S3_BUCKET on runlayer-app, requiring s3:ListBucket, s3:GetObject, and s3:PutObject on the {instance}-backend and -worker IRSA roles.

MCP Servers & Tooling · 2026-09-23

Runlayer adds self-hosted Kubernetes deployment support on EKS and GKE alongside existing ECS/AWS path⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Kubernetes self-hosting support on EKS (AWS) and GKE (GCP), requiring Kubernetes 1.29+ and Helm 3.8+, as an alternative to the ECS deployment path.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Runlayer Operator for EKS/GKE, enabling one or many isolated tenants via MCPServer on the same cluster.
• Supports per-workload ServiceAccounts with IRSA (EKS) or GKE Workload Identity for cloud API access.

MCP Servers & Tooling · 2026-09-23

Runlayer adds Agent Accounts with per-agent policies and audit trails, plus Kubernetes self-hosting docs for EKS and GKE, and Figma MCP integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agent Accounts — give each agent its own identity in Runlayer with independent policies, delegations, tokens, and audit trail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Kubernetes self-hosting support: cluster prerequisites for EKS and GKE, external dependency guidance (Postgres, Redis, buckets, streams) with sample Terraform for EKS (AWS) and GKE (GCP).
• Adds Workload Identity mapping for the Runlayer Operator: map operator ServiceAccounts to IRSA (EKS) or Workload Identity (GKE) via a per-feature permission matrix.

MCP Servers & Tooling · 2026-09-23

Runlayer Operator now supports customer-managed Kubernetes clusters on EKS and GKE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports deploying the Runlayer Operator on customer-managed Kubernetes clusters running on EKS or GKE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MCP Servers & Tooling · 2026-09-23

Runlayer 1.28.687 adds Figma MCP connector, client-provenance policy conditions, and queued agent messages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds meta.client.kind (values: dcr, cimd, pre_registered, manual, ema, agent) and meta.plugin.id as policy condition keys so access policies can gate connectors by how an MCP client obtained its credentials and whether it reaches a connector directly or through a plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Figma remote MCP connector to the catalog — register a Figma OAuth app, have Figma approve its client ID, paste credentials into the connector, and users connect with their own Figma account.
• Adds a recommended security settings dialog on the connector page so admins with the Manage security policies capability can review and apply per-tool scanner settings after deploying a connector, instead of during the deploy wizard.

MCP Servers & Tooling · 2026-09-23

MCP Servers & Tooling · 2026-09-23

Runlayer agents can now reject Slack DMs and restrict interaction to channel mentions only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Direct messages to the agent / Inbound messaging toggle in an agent's Slack settings to block inbound DMs — when disabled, the agent replies that it does not accept direct messages and redirects users to mention it in a channel instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MCP Servers & Tooling · 2026-09-23

Runlayer 1.28.731 adds Claude Opus 5.5, GPT-6 Sol/Luna, channel-only Slack agents, and Shadow AI access controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Restricts saved Shadow AI skill and plugin files to resource managers and security or analytics reviewers; organization-wide Shadow AI REST APIs and MCP tools now require organization-wide audit log access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for channel-only Slack agents: admins can turn off direct messages to an agent in its Slack settings, redirecting DMs to channel mentions instead.
• Adds Claude Opus 5.5 as an agent model, available via the Anthropic API or AWS Bedrock, with adaptive thinking effort settings.

Attack Surface & Exposure Management · 2026-09-23

runZero: Custom roles granting Saved queries read can now view the Queries page and table without inventory access; write or manage roles can create, edit, copy, import, and delete saved queries.

• Software and Vulnerabilities collected from integrations are now retired when that integration data expires.
• runZero now populates MAC vendor information for legacy MAC prefixes.
• AWS, Azure, and GCP imports now include additional asset types.

Identity & Access Management · 2026-09-23

SailPoint Next Generation Certifications reaches GA, bringing multi-million-item campaign scale, a new reviewer UI, and a Generate and Start option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a new certification engine that scales campaign generation to multi-million items, reducing large campaign generation time from days to minutes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Generate and Start option so small campaigns kick off immediately after generation without requiring a manual start step.
• Adds Generate and Start availability for campaigns launched from workflows, replacing the legacy manual-start pattern for targeted certifications.

Identity & Access Management · 2026-09-23

SailPoint adds 21 new connectors including Infisical, StackHawk, FOSSA, and Redpanda Cloud Control Plane⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds connector support for Infisical, enabling identity governance over secrets management platform access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds connector support for StackHawk, extending compliance coverage to application security testing workflows.
• Adds connector support for FOSSA, bringing license compliance and dependency data under identity governance.

SAST / SCA / Code Security · 2026-09-23

sbomify v26.9.0 adds a security advisories API, SPDX 3 VEX/scanning support, a Kubernetes Helm chart, CSAF discovery via security.txt, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a security advisories API, including creation and deletion of advisories through the same endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables and disables a workspace's plugins over the API.
• Exposes public CSAF discovery through security.txt.

SAST / SCA / Code Security · 2026-09-23

Semgrep adds CSV export for Agentic Workflows issues via the Issues page and public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports exporting Agentic Workflows issues as CSV from the Issues page and through the public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-23

Semgrep: Semgrep Guardian now reports status inside AI coding agents, including setup confirmation, per-turn scan summaries, sign-in requirements, and server errors.

• Adds a banner when viewing older Agentic Workflows runs that links to the newest run of the same workflow on that branch.

SOAR · 2026-09-23

Shuffle v2.3.0-rc2 adds graceful worker stop for AI Agent actions in hybrid deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds graceful stop handling for AI Agent actions during hybrid worker execution, preventing runaway processes when an agent-driven workflow terminates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-23

Snyk's Evo gains an MCP server so Claude, Codex, or Cursor can query your AI asset estate and manage policies in-agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Evo MCP Server (GA), letting any MCP client — Claude, Codex, Cursor — query discovered AI assets across code, developer machines, and pentest targets, inspect asset relationships (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ which MCP servers an agent uses), and read or write policies without leaving the agent.
• Adds snyk fix --agentic CLI command, which applies and verifies vulnerability fixes.
• Adds DNS TXT record verification as a method to confirm domain ownership for Snyk API & Web targets.

SAST / SCA / Code Security · 2026-09-23

Snyk: Introduces Evo by Snyk with an MCP Server surface for agentic security use cases.

• Migrates Snyk for Jira from Atlassian Connect to Forge, Atlassian's current cloud app platform, ahead of Atlassian's December 2026 end-of-support deadline.

SAST / SCA / Code Security · 2026-09-23

SonarQube Cloud adds first-class Rust support: 122 Clippy rules, complexity metrics, coverage import, and quality gates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sonar.rust.cargo.manifestPaths config property to point the Rust analyzer at non-default Cargo.toml locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sonar.rust.clippy.enabled config property (set to false to import an external Clippy JSON report instead of running cargo clippy automatically).
• Supports Rust as a first-class language in SonarQube Cloud, with 122 curated Clippy rules enforced through quality profiles across all projects.

Firewalls & Network Defense · 2026-09-23

Sophos Fusion 2026.41 adds wired network settings (STP, IGMP, LLDP-MED, port trunking) for AP6 profiles and advanced diagnostic logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Network settings tab to access point profiles for configuring wired Ethernet port settings on AP6 access points, including Spanning Tree Protocol, IGMP snooping, LLDP-MED, and (on AP6 840E models) port trunking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds advanced diagnostic logging via Diagnostics > System logs in Sophos Fusion to capture optional logs for wireless network troubleshooting.

Firewalls & Network Defense · 2026-09-23

Sophos Email 2026.38 adds custom policies for distribution lists and shared mailboxes plus automated Microsoft 365 journal onboarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables custom protection policies to be applied directly to distribution lists and shared mailboxes, independently of individual member policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Automates Microsoft 365 journal rule creation and related settings during Sophos EMS onboarding, eliminating manual journal configuration after M365 permissions are authorized.

SAST / SCA / Code Security · 2026-09-23

StackHawk docs clarify session-verification config, add basePath and disableServerBasePath OpenAPI options⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds basePath under app.openApiConf to prepend a base path to every operation discovered in an OpenAPI specification, taking precedence over both a path on app.host and servers[].url in the spec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds disableServerBasePath under app.openApiConf to suppress the base path declared in the specification's servers[].url when the API is served at the root of app.host.
• Adds maxConsecutiveUnauthenticatedChecks to the session-verification block to flag suspect authenticated coverage when a burst of consecutive failed session checks occurs, catching gaps that a scan-wide average would miss.

SAST / SCA / Code Security · 2026-09-23

StackHawk: Supports ${VARIABLE} references in scan configuration resolving against organization-wide secrets, so a team shares one credential copy instead of one per engineer; personal secrets take precedence and HawkScan warns on collision or unresolvable names.

• Entity and transport headers (Content-Type, Content-Length, Accept, Accept-Encoding, Host, User-Agent, Referer) are no longer stripped from replayed spider requests during rescans, even when listed in authentication.testPath.requestHeaders or app.redact.headers.

SAST / SCA / Code Security · 2026-09-23

StackHawk: Adds support for installing the hawk CLI via curl -sSf https://download.stackhawk.com/hawk/install.sh | sh, with SHA-256 verification against the published manifest; supports HAWK_INSTALL_VERSION to pin a release and HAWK_INSTALL_DIR to control the install destination (default ~/.hawk/bin).

• Adds resolution of ${VARIABLE} references in scan configuration against organization-wide secrets, so a team can share one copy of a scan credential; personal secrets take precedence and HawkScan warns when both exist, and names any unresolvable variable explicitly.

SAST / SCA / Code Security · 2026-09-23

StackHawk: Fixes hawk op app tech-flags set so naming one technology flag no longer silently re-enables all other 34 flags; the command now reads current flags, merges the change, and writes only the result.

• Emits the platform's own message — including minimum supported version and upgrade location — and exits non-zero when a scan is declined because the CLI is out of support; logs deprecation advisories once per scan rather than on every platform call.

SAST / SCA / Code Security · 2026-09-23

ARC Harden Runner v2.20.0 adds keyless AWS Secrets Manager API key fetch via IRSA, custom agent env vars, and configurable Tetragon security context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds keyless.enabled, keyless.region, keyless.secretName, and keyless.refreshIntervalHours Helm values to let the Harden Runner daemonset fetch its StepSecurity API key from AWS Secrets Manager via IRSA (pod IAM role) instead of a static Helm value, refreshing on a configurable schedule (default 3 hours); the secret must be a JSON object with an api_key field and the IAM role requires secretsmanager:GetSecretValue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds env.customEnvVars Helm value to inject arbitrary environment variables (e.g. HTTP_PROXY, HTTPS_PROXY, NO_PROXY) into the harden-runner container for proxied cluster deployments.
• Adds tetragon.containerSecurityContext Helm value to configure the Tetragon sidecar's security context.

Detection Engineering · 2026-09-23

Stratus Red Team v2.36.1 adds concurrent detonation support across all providers, KUBECONFIG multi-path handling, and Azure correlation ID propagation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Propagates Azure correlation IDs via clientRequestID (migrated from user-agent) so detonation activity is traceable across Azure API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables concurrent detonation across all providers (AWS, Azure, GCP, Entra ID, Kubernetes, EKS) by embedding a short correlation ID (var.correlation.short) in Terraform-managed resource names, preventing resource collisions when multiple users share an environment.
• Removes dependency on the az CLI by bumping the Azure (azurerm) Terraform provider to 4.81.0.

SIEM · 2026-09-23

Search Job Management API goes OpenAPI-compliant, stateless, and adds parent-child org support for MSSP automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Search Job Management API is now fully OpenAPI-compliant, enabling auto-generated SDKs in any language and native integration with Postman and CI/CD pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Long-running search jobs can now be polled via the Search Job Management API without session cookies, making them compatible with AI agents and Model Context Protocol (MCP) frameworks.
• MSSPs and enterprise admins can now automate parent-child and cross-org searches via the Search Job Management API, a capability previously limited to the UI.

General Utilities & Libraries · 2026-09-23

SysReptor 2026.82 adds AI agent skills, AGENTS.md project instructions, and an Audit Trail for sensitive actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AGENTS.md support in projects so per-project AI agent instructions can be defined alongside report content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds skills support to the AI agent for extended, composable automation capabilities.
• Adds an Audit Trail for sensitive actions to track privileged operations across the platform.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale Aperture gains LLM client integration guides for Claude Code, Claude Desktop, Codex, OpenCode, and more⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Aperture chat UI so users can talk to LLMs directly through their browser without a separate client.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports routing Claude Code requests through the Aperture proxy, authenticating via Tailscale identity.
• Supports routing Claude Code GitHub Action requests through Aperture so CI runners authenticate with Tailscale identity instead of individual API keys.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Aperture gains two methods for connecting non-tailnet devices: an Aperture CLI bridge and the standalone ts-unplug proxy⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ts-unplug (from the ts-plug repository), a standalone proxy built with make ts-unplug that accepts -dir and -port flags and forwards local traffic to an Aperture gateway for devices that cannot join the tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Aperture CLI bridge feature — activated via the Bridges settings menu — that embeds a Tailscale node inside the CLI and auto-configures launched coding agents to use a local proxy endpoint.
• Supports auth key authentication for both the CLI bridge and ts-unplug, enabling non-interactive approval for ephemeral environments such as CI/CD runners.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale launches Aperture, an LLM gateway that routes AI traffic over your tailnet to providers like OpenAI, Anthropic, and Gemini⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds providers.<name>.baseurl, providers.<name>.apikey, providers.<name>.models, providers.<name>.authorization, and providers.<name>.compatibility configuration keys in the Aperture JSON Configuration editor to register LLM providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes POST /v1/messages (Anthropic API format), POST /v1/chat/completions (OpenAI Chat API format), and POST /v1/responses (OpenAI Responses API format) endpoints on the Aperture gateway at http://<aperture-hostname>.
• Supports OpenAI, Anthropic, Google Gemini, OpenRouter, Amazon Bedrock, the Gemini Enterprise Agent Platform, and any OpenAI-compatible provider as routable LLM backends.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Aperture by Tailscale is a new centralized AI gateway that secures, monitors, and routes LLM requests across your organization via your tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openai_chat compatibility flag and baseurl/apikey config fields so any provider exposing a /v1/chat/completions endpoint (Groq, Together AI, Fireworks, Mistral, DeepSeek, Perplexity, and others) works with Aperture without code changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds custom:createdByAperture and custom:createdByAI node attributes that Tailscale binds to devices provisioned through the built-in tailnet connector via approved single-use auth keys.
• New Aperture gateway centrally manages LLM provider API keys in server configuration, injecting them per-request so no provider credentials ever reach developer devices or CI/CD systems.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

tailscale: Introduces Aperture, a centralized AI gateway that routes LLM requests to upstream providers (OpenAI, Anthropic, Google) using Tailscale identity for authentication — no API key distribution required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports MCP server proxying to aggregate tools and resources from remote MCP servers with identity-based access control.
• Provides an Aperture CLI for discovering, configuring, and running coding agents through the Aperture proxy.
• Supports spending controls including per-user quotas, budgets, and token purchasing to manage LLM costs across an organization.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM adds external secret references (from:) for env vars, files, AWS SSM, AWS Secrets Manager, and Keeper Secrets Manager⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports from:env:<VARIABLE> secret references in Tailscale PAM service configuration fields to pull credentials from environment variables at connector runtime.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports from:file:<PATH> secret references to read credentials from files on the connector host.
• Supports from:aws:ssm:<PATH> secret references to retrieve credentials from AWS Systems Manager Parameter Store, requiring connector IAM read permissions.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM (beta) adds grant-based access control for databases, SSH, Kubernetes, and Amazon S3 with per-protocol permissions in the tailnet policy file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tailscale.com/cap/pam application capability to tailnet policy file grants, enabling PAM access control with src, dst (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ svc:production-database), and app fields for deny-by-default service access.
• Adds database permission block under tailscale.com/cap/pam with allowed_databases, database, and allowed_query_types fields supporting values like ReadOnly, ReadWrite, SELECT, INSERT, UPDATE, DELETE — enforced for MySQL and PostgreSQL.
• Adds ssh permission block with exec.commands (regex allowlist), allowed_usernames, sftp, and tcp_forwarding.allowed_connections fields to control SSH exec, SFTP, interactive shell, and TCP forwarding independently.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM (beta) adds service accounts for programmatic API access and clientless HTTP service access via Border0 API tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Border0-Token request header support for clientless access to Tailscale PAM HTTP services without installing the Tailscale client.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes the Tailscale PAM API at https://api.border0.com for programmatic management of services, connectors, policies, and session data using service account tokens.
• Introduces Tailscale PAM service accounts with four roles — Administrator, Member, Service Manager, and Read Only — enabling least-privilege automation access to PAM resources.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM now supports storing session recordings in your own Amazon S3 bucket via cross-account IAM role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds IAM policy with s3:PutObject, s3:GetObject, s3:ListBucket, and s3:GetBucketLocation on arn:aws:s3:::${BUCKET_NAME} and arn:aws:s3:::${BUCKET_NAME}/* to grant Tailscale PAM access to a customer-owned S3 bucket.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds IAM role trust policy allowing Tailscale PAM's AWS account (arn:aws:iam::235487987553:root) to assume the role via sts:AssumeRole, with optional sts:ExternalId condition for extra security.
• Adds Recording storage section in the PAM page of the Tailscale admin console to configure a custom S3 bucket, IAM role ARN, optional external ID, and optional AWS region.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM resources can now be managed as Infrastructure as Code via the Border0 Terraform provider⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Terraform IaC support for Tailscale PAM using the borderzero/border0 provider, with the BORDER0_TOKEN environment variable for authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds border0_connector Terraform resource to create and manage Tailscale PAM connectors.
• Adds border0_socket Terraform resource to create and manage Tailscale PAM services, with socket_type, connector_ids, and http_configuration.upstream_url fields.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM now supports custom DNS domains for HTTP services, with wildcard CNAME routing and automatic TLS provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Make this the default domain option when registering multiple custom domains under Tailscale PAM, letting you designate which domain is primary for PAM HTTP services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM (beta) introduces managed privileged access to SSH, RDP, databases, Kubernetes, and more via the admin console⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Tailscale PAM (beta), a Privileged Access Management platform for controlling access to services on your tailnet through the Tailscale admin console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports SSH, HTTP/HTTPS, RDP, VNC, Kubernetes, and any TCP port as PAM-managed service types.
• Supports database service types including Amazon RDS, Elasticsearch, Google Cloud SQL, Microsoft SQL Server, MongoDB, MySQL, and PostgreSQL as PAM-managed resources.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM connectors (beta) add identity-aware privileged access with session recording, policy validation, and secrets management to tailnets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Tailscale PAM (beta), an identity-aware privileged access management layer integrated with Tailscale VPN for securing access to private tailnet resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PAM connector as an application-aware identity proxy supporting SSH, database, and Kubernetes sessions between tailnet clients and services.
• Supports session recording, policy validation, and secrets management via protocol-aware PAM connectors.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM (beta) adds privileged access management for SSH, databases, Kubernetes, RDP, and HTTP services on your tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Tailscale PAM from the PAM page in the Tailscale admin console, automatically creating the tag:border0-managed tag, an autoApprovers rule, an initial PAM application grant for autogroup:admin, and an OIDC trust credential.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PAM connector support on Linux, AWS EC2, Docker, and Kubernetes to securely proxy sessions to PAM services.
• Supports browser-based PAM service access at my.tailscale.com without requiring a Tailscale client installation.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale PAM (beta) adds identity-aware proxying, session recording/playback, credential injection, and a WebAssembly browser client for agentless access⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Manages PAM access policies through the tailnet policy file, editable in the Access controls page of the Tailscale admin console, with support for granular conditions: user identity, specific PAM services, device posture/MDM, time (always or by request), and IP/country.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Tailscale PAM, a new Privileged Access Management platform that securely proxies user sessions to services including SSH, HTTP/HTTPS, databases (Amazon RDS, Elasticsearch, Google Cloud SQL, Microsoft SQL Server, MongoDB, MySQL, PostgreSQL, Snowflake), Kubernetes, RDP, VNC, and arbitrary TCP ports.
• Adds a PAM connector — an identity-aware application proxy deployed inside your infrastructure — that handles session termination, real-time policy enforcement, session recording, and secrets/credential injection.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale launches PAM (beta): privileged access management with session auditing and recording for Linux servers, databases, and Kubernetes clusters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Tailscale PAM (beta), a Privileged Access Management solution providing application-aware, auditable access to Linux servers, databases, and Kubernetes clusters within a tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides complete session auditing and session recording for privileged access sessions governed through Tailscale PAM.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailnet Lock lets trusted nodes cryptographically sign new peers so no node joins your tailnet without your approval, even if Tailscale infrastructure is compromised.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces tailscale lock init command to enable Tailnet Lock, generating ten disablement secrets and distributing trusted Tailnet Lock keys across the tailnet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tailscale lock sign command to sign a new node's key from a trusted signing node using its nodekey: and tlpub: identifiers.
• Adds tailscale lock status command to verify the provisioned state of Tailnet Lock and confirm all nodes report the same set of trusted signing keys.

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale GitHub Action v4.2.0 adds log-mode parameter to control grouped, ungrouped, or quiet log output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds log-mode parameter to the Tailscale GitHub Action to control whether log output is grouped, ungrouped, or quiet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-09-23

Tailscale admin console now shows per-machine posture assertion details and policy rule counts on the Machines page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• In the admin console, the Machines page now displays each posture assertion required by a device posture check, the machine's current value for that assertion, whether it is passing, and a count of policy file rules that affect the machine and require that posture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SOAR · 2026-09-23

Tines: Adds new dimensions to the AI usage API, expanding what usage data can be queried and reported on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new built-in functions for converting content to markdown format.
• Cases and dashboards now stay up to date when viewed in background browser tabs.

SAST / SCA / Code Security · 2026-09-23

Tirith 0.4.0 adds a Python package firewall, Web3 command gating, browser extension auditing, threat intelligence v2, and 9 new AI-agent host integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tirith package inspect to analyze wheel files, sets of wheels, or installed environments without downloading them, using a bounded streaming wheel reader that rejects traversal, collisions, encrypted entries, conflicting metadata, CRC failures, decompression abuse, and ambiguous identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tirith pkg approve and tirith pkg install to bind resolution, exact artifact hashes, inspection results, approval state, contained execution, environment verification, and a tamper-evident receipt.
• Adds tirith pkg graph, diff, attest, attest-npm, verify-env, and receipt subcommands exposing ownership, execution, release-delta, provenance, integrity, and evidence workflows.

Endpoint Security (EDR/XDR) · 2026-09-23

Mobile Security for Business 2.0.1651 adds MDM-provided phone number fallback and improved ZTNA/SWG routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for the latest Android platform requirements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-09-23

TruffleHog gains S3-compatible storage scanning, SARIF output, scan history API, and 9+ new secret detectors⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a --sarif flag that emits a SARIF 2.1.0 log compatible with GitHub Code Scanning upload, mapping verified findings to errors and unverified findings to warnings, each with a stable fingerprint for tracking across scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a scan run history read API covering the global run list, per-source run lists, and individual run detail, with cursor pagination, documented filters, and stable error codes; accepts administrator or editor API keys.
• Adds a scans tab to integration detail showing retained scan history — start time, active duration, resources reached, and change in live secrets — with filtering by status and start time.

Secrets Detection & Management · 2026-09-23

TruffleHog can now run as a server-side pre-receive hook on GitHub Enterprise Server, GitLab Self-Managed, and Bitbucket Data Center.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --no-update and --only-verified and --fail flags for use in pre-receive hook scripts to control update checks, filter to verified secrets, and fail the push on findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-09-23

TruffleHog Enterprise adds webhook notifiers that POST secret-found payloads to any HTTP endpoint with HMAC-SHA256 signature verification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds notifiers.webhook configuration block to config.yml supporting url, token, notifyOnRotation, signatureMethod (sha256 or hmac-sha256, default sha256), base64EncodedToken, and heartbeatInterval (0, 1, 2, 6, 12, or 24 hours) options for webhook notifiers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sourcesToNotify config key to filter which scanner sources trigger webhook notifications, or set to all to receive notifications from every source.
• Sends webhook signatures via the X-Hub-Signature header using a SHA256 hash of the payload body prefixed with the token string, allowing receivers to verify payload authenticity.

Secrets Detection & Management · 2026-09-23

TruffleHog Enterprise adds email notifications via AWS SES, configurable through the web UI or a local YAML config file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds email notification support via AWS SES, configurable in config.yaml under notifiers with connection '@type': type.googleapis.com/notifiers.email, ses.creds.key, ses.creds.secret, ses.region, recipients, and sender fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ccleaker option to email notifications to automatically CC the person who leaked the credential when their email address is available.
• Supports configuring the email notifier through the Integrations tab in the TruffleHog Enterprise web UI as an alternative to local config.yaml configuration.

Secrets Detection & Management · 2026-09-23

TruffleHog Enterprise adds AWS Analyze: enriches detected AWS secrets with IAM identity, permissions, and revocation metadata⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds analyze.aws.using_default_credentials: true config key in the scanner config.yaml to enable AWS Analyze on self-hosted scanners using the instance's default credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds aws_access_key_id and aws_secret_access_key environment variables on the scanner process as the access-key authentication path for self-hosted AWS Analyze.
• Adds aws_auth_cert config key in the scanner config.yaml to point to a complete cert+key file for IAM Roles Anywhere authentication on self-hosted scanners.

Secrets Detection & Management · 2026-09-23

TruffleHog Enterprise gains Topology, an interactive graph tracing how leaked credentials propagate across scanned and unscanned services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Topology, an interactive graph view in TruffleHog Enterprise that maps verified live secrets from the source service where they were found to the target services they grant access to, letting practitioners trace credential blast radius and prioritize high-risk exposures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Topology categorizes every service node into one of three states — Scanned, Not Monitored, or Non-Scannable — so teams can immediately identify services that should be configured for scanning but aren't yet.
• Selecting an edge in the Topology graph surfaces the source service, destination service, secret count, secret types, and a direct link to the related findings.

Secrets Detection & Management · 2026-09-23

TruffleHog adds per-detector config options for AWS account ID filtering and JDBC result suppression via detectors.config in the config YAML.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detectors.config.aws.allowedAccountIds and detectors.config.aws.deniedAccountIds list fields to the config YAML to restrict or block AWS credential verification by account ID (denied IDs always take precedence over allowed IDs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds detectors.config.jdbc.ignorePattern list field to the config YAML to suppress unwanted JDBC detector results via regular expressions.

Secrets Detection & Management · 2026-09-23

TruffleHog adds custom regex detectors with webhook verification, entropy filtering, and configurable HTTP status ranges for secret liveness⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detectors field to the TruffleHog config YAML to define custom regex detectors, each with name, keywords, regex, and optional verify sections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds verify.endpoint, verify.unsafe, and verify.headers config keys to validate detected secrets via a webhook POST request to a user-supplied HTTP/HTTPS server.
• Adds verify.successranges config key accepting a list of HTTP status codes or inclusive ranges (e.g. '200', '200-202') to mark secrets as live/verified.

Secrets Detection & Management · 2026-09-23

TruffleHog Enterprise gains an Activity Log that records scan lifecycle events with a read API for programmatic access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a read API for the Activity Log with endpoints, filters, and response fields for programmatic access to scan history (see API reference for full details).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Activity Log feature to TruffleHog Enterprise, recording scan lifecycle events (scan started, scan completed, scan failed, scan scheduled, scan anomaly detected) across every source with 90-day retention.
• Surfaces a partial scan status when some parts of a scan fail and others succeed, distinguishing incomplete coverage from outright failure.

Secrets Detection & Management · 2026-09-23

TruffleHog Enterprise adds Scan Details UI and read API for per-integration scan run visibility, error drill-down, and live secret delta tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Scans tab on each integration in the TruffleHog Enterprise UI to list per-run status, duration, item coverage (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 95 of 98), error counts, and live-secret delta since the previous run — no additional configuration required.
• Surfaces a per-run errors count that opens a searchable drawer listing each failed item with its individual error message, updating live while a run is in progress.
• Tracks live-secrets change as a run-over-run delta (e.g. +5 means five more live secrets than after the last run), with the end-of-run total available on hover; a source's first run reports its full count as new.

Secrets Detection & Management · 2026-09-23

TruffleHog Enterprise adds source archiving to retire integrations while preserving findings, with a verification-frozen state and activity log tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds source archiving (Enterprise only) to stop scanning an integration while retaining all findings it has already reported — archived sources show a gray archived badge and are hidden from the integrations list by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a verification frozen badge on findings when every source that surfaced a secret is archived, freezing the last known verification status without re-verifying; frozen findings are excluded from MTTR calculations.
• Adds a Show archived filter in the integrations filter bar to surface archived sources, which appear dimmed alongside active ones.

Secrets Detection & Management · 2026-09-23

TruffleHog adds customVerifiers config and --verifier CLI flag for self-hosted secret verification against private enterprise endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds customVerifiers field to the root-level config YAML to point TruffleHog's secret verification at self-hosted or enterprise endpoints for GitHub Enterprise Server, GitLab, Jira Data Center, Confluence Data Center, Bitbucket Data Center, JFrog Artifactory (access token and reference token variants), and HashiCorp Vault.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --verifier CLI flag to the open-source trufflehog binary, allowing custom verifier endpoints to be passed at scan time (e.g. --verifier github=example1.github.com,example2.github.com) without a config file.

Secrets Detection & Management · 2026-09-23

TruffleHog Enterprise adds Shared Secrets: scoped, expiring, SSO-gated links to share findings with non-platform users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Share Secrets feature that turns a detected finding into a secure, access-controlled link — recipients authenticate via Google SSO or SAML SSO against trusted domains and see a read-only view of the finding without needing a TruffleHog Enterprise login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports four expiration window options per link at creation time: on read, 1 hour, 1 day, 7 days, or 1 month, where on read links expire after the first successful read.
• Adds a Shared Secrets management page with two tabs — Active Shared Secrets (lists every unexpired link with revocation controls) and Sharing Settings (holds trusted domains and default authentication method).

Secrets Detection & Management · 2026-09-23

TruffleHog adds locally configurable notifiers via notifiers field in config YAML, supporting stdout, email, Jira, Slack, Splunk, and webhook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds notifiers field to TruffleHog's config YAML to configure secret-discovery alerts locally, with options including name, sendunverified, sourcestonotify, customtext, includesecretlink, type, numworkers, trufflehogaddress, trufflehogscannergroup, and trufflehogscannertoken.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports sourcestonotify field accepting all, sources in this config, or a comma-separated list of sources to control which scan sources trigger notifications.
• Supports stdout notifier type in open-source and on-premise deployments (GA), enabling local terminal alerting when secrets are found.

Secrets Detection & Management · 2026-09-23

TruffleHog gains analyze subcommand to evaluate live secrets' permissions, metadata, and IAM posture⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds trufflehog analyze subcommand with self-discovery analyzers that perform non-state-changing API calls to determine a secret's resources and permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds cloud analyze (enterprise-only) to examine cloud secrets against live cloud environments to determine a secret's IAM posture, with GCP analyze currently supported.

Secrets Detection & Management · 2026-09-23

TruffleHog v3.97.6 adds fine-grained token metadata to GitHub analyzer and makes gist enumeration non-fatal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds is_fine_grained metadata field to GitHub analyzer output, surfacing whether a scanned token is a fine-grained personal access token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-23

Ubiq Security: Adds \Ubiq\encryptDate() / \Ubiq\decryptDate() and \Ubiq\encryptDateTime() / \Ubiq\decryptDateTime() for data_type = 'date' and data_type = 'datetime' datasets, with UTC enforcement and data_type_config min/max range validation before the cipher call.

Data Security & DLP · 2026-09-23

Ubiq Security: Adds encryptNumberForSearchAsync for searchable encryption over integer datasets (32-bit and 64-bit).

• Adds buildStructuredAsync() on CryptographyBuilder to construct a structured encryption/decryption object supporting all structured dataset types.
• Documents multithreaded-environment behavior: Ubiq objects must be created and destroyed per worker thread because NodeJS workers serialize/copy objects rather than sharing them.

Data Security & DLP · 2026-09-23

Ubiq Security: Adds initSession() on UbiqEncrypt and UbiqDecrypt returning UbiqUnstructuredEncryptSession / UbiqUnstructuredDecryptSession to provide thread-safe stateful unstructured encrypt/decrypt sessions reusable across multiple objects.

Data Security & DLP · 2026-09-23

Ubiq Security: Go library v2 is now importable via gitlab.com/ubiqsecurity/ubiq-go/v2 with Structured Encryption support; the v1 path (gitlab.com/ubiqsecurity/ubiq-go) does not support Structured Encryption.

Data Security & DLP · 2026-09-23

Ubiq Security: Adds UbiqEncryptOperator and UbiqDecryptOperator Airflow Operators (importable from plugins/operators/) for performing structured encrypt and decrypt operations inside DAGs, accepting tabular data as a list of lists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports per-column dataset mapping via the dataset_names parameter, allowing selective encryption of specific columns while leaving others untouched within the same Airflow task.
• Integrates with Ubiq credentials via ubiq.configCredentials(config_file=..., profile=...), scoping each DAG to specific datasets and permissions.

Data Security & DLP · 2026-09-23

Ubiq Security: Adds IDP (Identity Provider) authentication for BigQuery encryption/decryption, allowing enterprise customers to authenticate via SSO instead of API keys using IDP_CUSTOMER_ID and IDP_PRIVATE_KEY_PATH environment variables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Includes idp_setup.sh shell script to automate setup of SQL and Broker functions for IDP-based BigQuery integration.
• Supports mounting the IDP private key as a Google Cloud Secret Manager volume in the ubiq-idp-auth Cloud Run function, using IDP_PRIVATE_KEY_PATH to reference the mounted path (e.g. /idp/idp_private_key).

Data Security & DLP · 2026-09-23

Ubiq adds Integer, Date, and Date & Time structured dataset types so encrypted values stay in their original column type⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Integer structured dataset type supporting 32-bit (-99,999,999 to 99,999,999) and 64-bit (-9,999,999,999,999,999 to 9,999,999,999,999,999) whole numbers, with encrypted output staying within integer ranges compatible with existing column types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Date structured dataset type for calendar dates (01/01/0001 to 11/28/2738) with no time component, requiring no custom conversion code in your application.
• Adds Date & Time structured dataset type for timestamps to the second (1653-02-10 06:13:21 to 2286-11-20 17:46:39 UTC), with encrypted values falling between 0018-01-16 11:01:21 and 3921-12-16 12:58:39 UTC.

Data Security & DLP · 2026-09-23

Ubiq Security: date and datetime datasets now work with input character sets other than 0-9.

SAST / SCA / Code Security · 2026-09-23

Veracode adds DryRun Security integration, IaC policy parameter, Jira 11 support, and a redesigned EASM UI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the policy parameter to GitHub Workflow Integration v2.1.7 for infrastructure-as-code (IaC) scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Integrates Veracode Static Analysis with DryRun Security, surfacing Veracode findings and remediation guidance inside pull request and code review workflows.

SAST / SCA / Code Security · 2026-09-23

Veracode DAST gains multi-team targets, custom host-to-IP mappings, directory restrictions, open-port scanning, and EASM integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports assigning multiple teams to a single DAST target when creating a web application or API specification, enabling shared security ownership.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the ability to select a business unit when creating a web application or API specification target, or on the DAST configuration page.
• Adds Directory Restrictions to DAST target configuration to control scan scope.

UNCATEGORIZED · 2026-09-23

vigolium v0.5.0 adds scratch cleanup, hygiene module controls, and scope-origin tracking across JSONL, export, and REST⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds vigolium kit tmp-clean subcommand to collect abandoned vigolium scratch from the system temp directory left by interrupted runs, with --max-age (default 6h) controlling what counts as abandoned.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --module-tag hygiene and --module-id <id> selectors to target the new hygiene module tag.
• Adds dynamic-assessment.hygiene_modules config key to force hardening advisories on at any intensity or off even at deep.

UNCATEGORIZED · 2026-09-23

vigolium v0.4.9 adds source-map ingestion, SSO-wall redirect halting, new HTTP record fields, and major kit js-beautify flag expansion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sourcemap-ingest active module that fetches exposed source maps, secret-scans the recovered originals, and ingests their routes into the scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds http_records.target, root_uuid, and chain_truncated fields — exposing the submitted target, O(1) chain-root lookup, and whether a redirect chain stopped short.
• Adds -o, --modules, --profile, --unpack-modules, --max-ast-nodes, --max-input-mb, and --deadline flags to kit js-beautify; -j output gains status, diagnostics, and per-endpoint provenance.

UNCATEGORIZED · 2026-09-23

vigolium v0.4.7 adds targeted traffic body/header extraction, per-command file output, and exact URL filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds vigolium traffic body and vigolium traffic headers subcommands to extract one side of a stored exchange to stdout or a file without re-sending the request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -o/--output flag to traffic -j, finding -j, and db ls -j to write the result document to a file and print a receipt to stdout.
• Adds --url flag to traffic and db ls for exact URL selection, repeatable and OR-ed, applied before pagination.

UNCATEGORIZED · 2026-09-23

vigolium v0.4.6 adds run probe host sweeps, TLS fingerprinting, redirect-chain tracking, and a deterministic surface_score on every record.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds vigolium run probe (aliases: probing, httpx, alive, sweep) for passive-only host sweeps — one request per target, no fuzzing, enabling -T hosts.txt -c 20 to reach thousands of hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --tls-probe to complete a TLS handshake per HTTPS endpoint and report negotiated version/cipher plus leaf certificate details (subject/CN, SANs, issuer, validity window, serial, MD5/SHA-1/SHA-256 fingerprints) under a tls key.
• Adds --redirect-mode off|same-host|same-apex|any (default any) to control redirect-following scope, replacing the former FollowRedirects/FollowHostRedirects bool pair.

UNCATEGORIZED · 2026-09-23

vigolium v0.4.5 adds NDJSON event streams, tool shims, batch ingest, and a stable machine-output envelope across all commands⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --events ndjson to scan/run/scan-url/scan-request for a live NDJSON event stream on stdout emitting scan.started, phase.started|progress|finished, waf.block, waf.pacing, finding.new, error, and scan.finished events while the human console remains on stderr.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a repeatable phase qualifier to the pace dials — e.g. --rate-limit known-issue-scan=20 — so individual phases can be capped independently without affecting other modules.
• Adds vigolium ffuf|nuclei|katana|gau|arjun tool shims that accept each tool's own argv, print the translation, and run the native phase into the pinned database.

Container & Image Security · 2026-09-22

Anchore Enterprise v6.2 adds AI/ML model SBOM detection, MCP Server for agent integration, VEX-aware policies, and local SBOM generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Natively inspects container images for AI/ML model artifacts, including GGUF files and Docker Model structures, indexing them as packages in the central SBOM catalog alongside traditional software components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Anchore Enterprise MCP Server, a lightweight container image that gives AI agents and tools direct, structured access to vulnerability findings, policy evaluation results, and SBOM catalog data without custom API integration scripts.
• Adds policy support for VEX annotations, allowing policies to automatically factor in VEX status values such as not_affected or fixed to suppress false positives and prevent unnecessary build breaks.

SAST / SCA / Code Security · 2026-09-22

Arnica adds manual severity overrides for findings and a targeted PR status check rerun without re-triggering CI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds manual severity adjustment for code risk findings and individual SCA CVEs, with a required reason, optional review workflow, and full change history on the finding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the ability to post a rerun on a pull request to trigger a fresh Arnica status check without re-triggering other CI pipelines.

Firewalls & Network Defense · 2026-09-22

Aviatrix launches Harvest and Decrypt Protection: post-quantum ML-KEM encryption plus Communication Governance in one software policy, free for first five policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds post-quantum key exchange using the ML-KEM standard on the control plane across Aviatrix-encrypted paths, making intercepted traffic unreadable to future quantum computers without a hardware refresh or network redesign.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Communication Governance on the same gateways that handle encryption, enforcing explicit workload-to-workload reachability policy at the granularity of workload identity and protocol on every available path.
• Provides crypto agility as a configuration setting — the post-quantum algorithm can be swapped with a configuration push rather than a hardware refresh cycle.

Data Security & DLP · 2026-09-22

Bold Security integrates with Wiz to bring cloud resource exposure context into endpoint data-movement enforcement decisions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates with Wiz to sync cloud resource inventory — including repository, bucket, and database sensitivity and exposure levels — directly to the Bold endpoint agent, so enforcement decisions reflect current cloud posture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds exposure-aware enforcement that evaluates both the origin cloud resource and the destination of a data transfer, distinguishing a move from an internal repo to an access-controlled bucket from the same move to a public S3 bucket.
• Adds enriched data lineage so a file's source cloud resource (private repo, internal bucket, production database) is carried as context to the endpoint from the moment data moves.

Runtime Security · 2026-09-22

Bubblewrap v0.13.0 adds mount_setattr() for mount flag remounting, rejects empty path args, and introduces -Ddebug_logging=true with DEBUG_INVOCATION⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -Ddebug_logging=true build option to enable verbose debug logging, gated at runtime by the DEBUG_INVOCATION environment variable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Path arguments such as --bind and --overlay-src now reject empty strings instead of silently treating them as the root directory.

Reverse Engineering · 2026-09-22

Capstone 6.0.0-Alpha11 adds CS_MODE_X86_AMD/INTEL x86 vendor modes, CS_MODE_XTENSA_ESP32S3 gating, and PowerPC mcrxr instruction support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CS_MODE_X86_AMD and CS_MODE_X86_INTEL mode flags for x86 to enable vendor-specific disassembly behavior (currently affecting JO/JNO operand size in 64-bit mode).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Gates Xtensa ESP32-S3 and HIFI3 instructions behind the new CS_MODE_XTENSA_ESP32S3 mode flag to avoid unintended decode on other Xtensa targets.

Reverse Engineering · 2026-09-22

Capstone: Adds CS_MODE_X86_AMD and CS_MODE_X86_INTEL mode flags to select alternative x86 disassembly for JO/JNO operands in 64-bit mode; default x86 behavior is unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for the mcrxr instruction in the PowerPC disassembly module.

Attack Surface & Exposure Management · 2026-09-22

Censys adds ServiceNow TISC integration, 16 new platform fingerprints, and two new ASM risk fingerprints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a ServiceNow TISC integration to automatically or manually enrich IPs, web properties, and certificates in ServiceNow TISC with Censys Platform data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the ability to initiate a Censys rescan of a host or web property directly from ServiceNow TISC.
• Adds the ability to retrieve scan history for an IP address from within ServiceNow TISC.

Container & Image Security · 2026-09-22

Chainguard adds EU Sovereign Artifacts beta for data residency and ships 18 new container images including FIPS variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Launches Sovereign Artifacts beta, storing and serving Chainguard Containers and Chainguard Libraries artifact bytes in an EU region for enrolled customers, with automatic backfill of existing artifacts and approximately 30% faster pulls from Europe.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new cursor-agent (application tier) container image.
• Adds new chainguard-desktop-workstation-pc (base tier) container image.

Identity & Access Management · 2026-09-22

Clerk CLI gains init, enable orgs, config patch, and apps list commands for agent-driven, zero-account Next.js setup⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds npx -y clerk@latest init to provision a claimable Clerk application, write NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY to .env.local, and configure the SDK, <ClerkProvider>, middleware, and auth routes — no Clerk account required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds npx -y clerk@latest init --app <application_id> to wire an existing Clerk application into the project instead of provisioning a new one.
• Adds npx -y clerk@latest apps list --json to enumerate existing Clerk applications by name and ID.

Identity & Access Management · 2026-09-22

Client ID Metadata Documents (CIMD) are now generally available for all Clerk applications, enabling URL-based OAuth client identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Makes Client ID Metadata Documents (CIMD) generally available for every Clerk application, allowing MCP and other public OAuth clients to connect with a URL-based identity without requiring a support request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-22

Clerk adds Client ID Metadata Documents (GA) and SMS delivery event logs with per-event failure reasons⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sms.accepted, sms.delivered, sms.failed, sms.undeliverable, and sms.unconfirmed SMS delivery events to Application Logs, with a normalized reason field (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ invalid_phone_number, destination_unreachable, rate_limited) on failure events.
• Adds a dedicated SMS logs view that lets you filter SMS delivery events by event type (e.g. sms.failed) or destination phone number, with full per-message trace timelines.
• Adds Client admission control to CIMD settings, allowing operators to restrict OAuth flows to pre-reviewed clients by setting Client admission to Pre-registered clients only.

General Utilities & Libraries · 2026-09-22

Custom instructions now support ~ home-folder paths and Unix-style / separators for cross-OS portability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports ~ and ~/ prefix in custom instructions file paths to reference the user home folder, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [personal coding standards](~/copilot/coding-standards.md).
• Supports #file: syntax and Markdown links in custom instructions to reference specific files or URLs as context, with relative paths resolving from the instructions file.

General Utilities & Libraries · 2026-09-22

code-oss adds sessions.diffEditor.wordWrap to control line wrapping in diff editors within the Agents window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sessions.diffEditor.wordWrap setting to control line wrapping in diff editors in the Agents window, with values inherit (default, follows editor.wordWrap), on (wrap at viewport width), and off (never wrap).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-09-22

VS Code agent terminal sandboxing adds OS-level file system and network isolation for agent commands on macOS, Linux, WSL2, and Windows (Experimental).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables agent terminal sandboxing via chat.agent.sandbox.enabled (macOS, Linux, WSL2) or chat.agent.sandbox.enabledWindows (Windows, Experimental), defaulting to off.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.agent.sandbox.fileSystem.mac, chat.agent.sandbox.fileSystem.linux, and chat.agent.sandbox.fileSystem.windows settings to configure per-platform file system access rules (allowRead, allowWrite, denyRead, denyWrite) using literal paths or Git-style globs (macOS only).
• Adds chat.agent.sandbox.allowNetwork (default true) to toggle network isolation independently of file system restrictions.

General Utilities & Libraries · 2026-09-22

VS Code agent sandboxing (Preview on macOS/Linux/WSL2, Experimental on Windows) restricts file system and network access for terminal commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Provides a sandboxing toggle in the permissions picker to enable or disable sandboxing per session for Copilot Agent Host sessions, with new sessions inheriting the effective User or Workspace setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-09-22

VS Code Agents window gains Dev Container sessions, GitHub issue/PR context, and experimental Agent Merge for automated PR unblocking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables chat.agentHost.devContainer.enabled (off by default) to run an Agent Host session inside a Dev Container, giving the agent access to the project's tools, dependencies, and environment defined in .devcontainer/devcontainer.json.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Use Dev Container workspace option in the Agents window sidebar; the workspace label gains a - Dev Container suffix, and Use Local reverts the selection before the session starts.
• Supports adding GitHub issues and pull requests as context via 'Add Context > Issue...' or 'Pull Request...' in the prompt, or by pasting a GitHub issue or pull request URL directly into the prompt.

Identity & Access Management · 2026-09-22

ConductorOne adds EU data residency, saveable AI reports, REST API for AI governance, MCP Terraform support, and a POST /api/v1/app-secrets-admin/revoke credential-revoke endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /api/v1/app-secrets-admin/revoke endpoint to queue credential revokes separately from secret deletion, replacing the previous combined behavior of DELETE /api/v1/secrets/{vault_id}.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes classifiers, tool gates, classifier bindings, templates, and the agent classifier policy through the public REST API for AI governance management.
• Introduces TYPE_SPEND_REMEDY = 7 as a new task action type; JS/TS clients must handle spend-control revision values as strings.

Identity & Access Management · 2026-09-22

ConductorOne AI assistant gains persistent saved reports and read-only stuck-task diagnosis for Super Admins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Save report action in the AI assistant conversation to name, persist, and later refresh or edit reports without losing them between sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Platform > Reporting page listing all saved reports, with rename and delete controls, so reports are discoverable outside conversation history.
• Adds a Function tab on each saved report's page to inspect the underlying logic and data sources behind every result.

Identity & Access Management · 2026-09-22

ConductorOne: Adds a Change history icon to connector, policy, entitlement routing rule, SSO, branding, and AI Gateway spend-control detail pages, with optional justification requirement for connector config changes.

• Adds a member-count display at the top of the group detail page.
• Accounts with outstanding pending invitations can now be included in campaign scope instead of being silently dropped.

IDS / IPS · 2026-09-22

CrowdSec adds an Envoy Gateway bouncer for Kubernetes with external authorization and WAF support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds BOUNCER_KEY_envoy environment variable in lapi.env (via valueFrom.secretKeyRef) to register the Envoy bouncer key with CrowdSec LAPI in-cluster.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds securityPolicy.create, securityPolicy.gatewayName, and securityPolicy.gatewayNamespace Helm values in envoy-bouncer-values.yaml to auto-create gateway.envoyproxy.io/v1alpha1 SecurityPolicy resources for HTTPRoutes.
• Adds config.bouncer.lapiURL and config.bouncer.apiKeySecretRef Helm values to connect the Envoy bouncer to CrowdSec LAPI via envoy-bouncer-values.yaml.

IDS / IPS · 2026-09-22

CrowdSec adds Traefik Kubernetes bouncer docs with AppSec/WAF, stream mode, and secret-backed LAPI key mounting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds crowdsecAppsecEnabled: true to the bouncer middleware spec to enable real-time WAF protection (virtual patching, SQLi, XSS) via the CrowdSec AppSec Component.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds crowdsecLapiKeyFile field to the Traefik Middleware CRD spec, allowing the LAPI bouncer key to be mounted from a Kubernetes Secret rather than stored in plaintext in the manifest.
• Adds crowdsecAppsecHost, crowdsecAppsecPath, crowdsecAppsecFailureBlock, crowdsecAppsecUnreachableBlock, and crowdsecAppsecBodyLimit fields to the bouncer middleware spec for fine-grained AppSec routing and failure policy.

IDS / IPS · 2026-09-22

CrowdSec adds a Go-based HAProxy SPOA bouncer with WAF/AppSec support, CAPTCHA, GeoIP headers, and mTLS — the only HAProxy integration with AppSec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cs-haproxy-spoa-bouncer configured via /etc/crowdsec/bouncers/crowdsec-spoa-bouncer.yaml, integrating CrowdSec with HAProxy over the SPOE protocol to enforce ban, CAPTCHA, and allow decisions natively — replacing the old Lua-based bouncer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SPOE agent configuration at /etc/haproxy/crowdsec.cfg with spoe-message definitions (crowdsec-tcp, crowdsec-http-body, crowdsec-http-no-body) and spoe-group entries to split TCP-level and HTTP-level checks.
• Adds WAF / AppSec evaluation support — the only HAProxy bouncer to pass request body, headers, method, path, query, and URL to CrowdSec AppSec via the crowdsec-http-body SPOE group.

IDS / IPS · 2026-09-22

CrowdSec OpenResty bouncer adds Lua-based WAF/AppSec, mTLS, captcha (reCAPTCHA/hCaptcha/Turnstile), live/stream remediation, and full config reference⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds APPSEC_URL, APPSEC_FAILURE_ACTION, APPSEC_CONNECT_TIMEOUT, APPSEC_SEND_TIMEOUT, APPSEC_PROCESS_TIMEOUT, ALWAYS_SEND_TO_APPSEC, and APPSEC_DROP_UNREADABLE_BODY keys to /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf to enable and tune the Application Security (WAF) Component for virtual patching, SQLi, and XSS defense.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds USE_TLS_AUTH, TLS_CLIENT_CERT, and TLS_CLIENT_KEY configuration keys to /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf to enable mutual TLS (mTLS) authentication with the CrowdSec Local API in place of API keys.
• Adds CAPTCHA_PROVIDER to /etc/crowdsec/bouncers/crowdsec-openresty-bouncer.conf supporting recaptcha, hcaptcha, and turnstile providers alongside SECRET_KEY, SITE_KEY, CAPTCHA_TEMPLATE_PATH, and CAPTCHA_EXPIRATION for captcha remediation.

IDS / IPS · 2026-09-22

CrowdSec WAF gains documented progressive deployment paths: out-of-band CRS detection and in-band CRS blocking alongside virtual patching⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds crowdsecurity/appsec-crs collection for out-of-band OWASP CRS detection layered alongside existing virtual patching, installed via cscli collections install crowdsecurity/appsec-crs, configured in /etc/crowdsec/acquis.d/appsec.yaml.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds crowdsecurity/appsec-crs-inband collection for immediate in-band blocking using OWASP CRS rules alongside virtual patching, installed via cscli collections install crowdsecurity/appsec-crs-inband.
• Adds crowdsecurity/crowdsec-appsec-outofband scenario (bundled with crowdsecurity/appsec-crs) that automatically bans IPs triggering 5 or more distinct out-of-band CRS violations in a short period.

IDS / IPS · 2026-09-22

CrowdSec AppSec gains bot-detection hooks with fingerprint helpers, request scoring, known-bot exemptions, and challenge difficulty controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds on_challenge_submit hook that fires after cryptographic validation of a challenge response but before the success cookie is issued, enabling automation-based rejections via RejectSubmission(reason, verbosity?) and inline cookie grants via GrantChallengeCookie(reason, ttl?).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds RejectSubmission(reason, verbosity?) helper to refuse cookie issuance despite a valid crypto submission; verbosity accepts 'minimal', 'info' (default), or 'verbose' to control fingerprint detail in logs.
• Adds GrantChallengeCookie(reason, ttl?) helper to issue the challenge cookie inline in the submit response (skipping the 307 redirect); ttl is a Go duration string like '24h' and overrides the configured cookie_ttl.

IDS / IPS · 2026-09-22

CrowdSec AppSec gains configurable bot-detection settings: signing keys, rotation, cookie lifetime, and JS obfuscation pooling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds master_secret under challenge: in an appsec-config YAML file to set a shared long-lived secret for multi-instance AppSec deployments, required when running more than one AppSec instance so cookies issued by one node are accepted by another.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds key_rotation_interval (default 5m, minimum 30s) under challenge: to control how frequently the per-epoch signing key advances across all AppSec instances.
• Adds max_live_epochs under challenge: to control how many past epochs remain accepted, tunable for slow mobile networks or long round-trips.

IDS / IPS · 2026-09-22

CrowdSec AppSec bot detection gains overlay config recipes for per-path/per-host challenge scoping, difficulty tuning, probe allowlisting, and custom known-bot files⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ExemptFromChallenge(reason) helper callable in pre_eval hooks to flag a request as exempt so SendChallenge() becomes a no-op for it, enabling per-path or per-host challenge scoping.
• Adds GrantChallengeCookie(label, duration) helper to mint a session cookie (e.g. GrantChallengeCookie("internal-probe", "24h")) so cookie-capable clients are waved through for an entire session window without re-checking the exemption condition on every request.
• Adds SetChallengeDifficulty(level) helper available in pre_eval, post_eval, and on_challenge hooks to set proof-of-work difficulty ("low", "medium", "high") per route before the challenge is issued.

IDS / IPS · 2026-09-22

CrowdSec AppSec adds bot detection via browser proof-of-work, device fingerprinting, and sealed challenge cookies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SendChallenge(), GrantChallengeCookie(), RejectSubmission(), and HasValidChallengeCookie() hook functions that activate the bot-detection challenge runtime when referenced by a loaded hook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces SetChallengeDifficulty to tune the cost of the proof-of-work puzzle served to browser clients.
• Adds key_rotation_interval config key to control how frequently signing keys rotate, with a separate long-lived master_secret that must be shared across instances in an HA deployment.

IDS / IPS · 2026-09-22

CrowdSec adds crowdsecurity/appsec-bot-challenge collection with scored bot detection, verified-bot exclusions, and behavioral block scenarios.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds crowdsecurity/appsec-bot-challenge-scoring-balanced appsec-config that rejects any submission scoring >= 75 via RejectSubmission(), separating threshold policy from scoring logic so either can be swapped independently.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds three ready-made threshold collections — crowdsecurity/appsec-bot-challenge (>= 75, default), crowdsecurity/appsec-bot-challenge-strict (>= 45), and crowdsecurity/appsec-bot-challenge-permissive (>= 100) — to tune false-positive tolerance without rebuilding the scoring engine.
• Adds --kind bot-detection flag to cscli alerts list to filter bot-challenge rejections away from WAF and log-based alerts.

IDS / IPS · 2026-09-22

CrowdSec adds AppSec bot detection via proof-of-work challenges, CDP fingerprinting, and per-engine Prometheus metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Installs bot detection via cscli collections install crowdsecurity/appsec-bot-challenge, which bundles appsec-configs, scenarios, and parsers into a single collection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds crowdsecurity/appsec-bot-challenge-strict (rejects at >= 45) and crowdsecurity/appsec-bot-challenge-permissive (rejects at >= 100) as alternative threshold bundles alongside the default crowdsecurity/appsec-bot-challenge (rejects at >= 75).
• Loads bot detection into the AppSec acquisition by adding crowdsecurity/appsec-bot-* (or a wildcard) to the appsec_configs: list in /etc/crowdsec/acquis.d/appsec.yaml.

IDS / IPS · 2026-09-22

CrowdSec AppSec rules syntax documented: in-band/out-of-band detection, 15+ request zones, transforms, and ModSecurity seclang import⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds seclang_rules parameter in AppSec rule files to embed ModSecurity/seclang rules inline without a separate file⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds seclang_rules_file parameter in AppSec rule files to load ModSecurity rules from a file in the CrowdSec data directory (/var/lib/crowdsec/data on Linux, /var/db/crowdsec/data on FreeBSD, C:\programdata\crowdsec\data on Windows)
• Adds variables field to rule conditions, restricting match to specific keys within ARGS, BODY_ARGS, HEADERS, and COOKIES zones — supports literal keys or RE2 regex patterns wrapped in slashes (e.g. /pattern_.*/)

IDS / IPS · 2026-09-22

CrowdSec AppSec configuration files documented: rule loading, hooks, HTTP codes, and per-band performance tuning via YAML⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds inband_rules and outofband_rules array keys to AppSec config files (stored in /etc/crowdsec/appsec-configs/) for loading rule patterns into in-band vs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ out-of-band processing pipelines.
• Adds default_remediation key (values: ban, captcha, allow) and default_pass_action key to control blocking and pass behavior per AppSec config.
• Adds blocked_http_code, passed_http_code, user_blocked_http_code, and user_passed_http_code integer keys to configure HTTP status codes returned to the remediation component and to the end user independently.

IDS / IPS · 2026-09-22

CrowdSec AppSec Component (WAF) general setup guide documents acquisition config, virtual patching, and detection testing⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds appsec_configs, listen_addr, source, and name keys to /etc/crowdsec/acquis.d/appsec.yaml to expose the AppSec Component as a new acquisition datasource listening on 127.0.0.1:7422 by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports loading multiple AppSec configurations in a single acquisition file — for example combining crowdsecurity/appsec-default (virtual patching, in-band) and crowdsecurity/crs (OWASP CRS, out-of-band).
• Enables detection testing via the crowdsecurity/appsec-generic-test dummy scenario, triggerable by requesting the probe path /crowdsec-test-NtktlJHV4TfBSK3wvlhiOBnl and confirmed with sudo cscli alerts list.

IDS / IPS · 2026-09-22

CrowdSec Console gains Stack Health dashboard for severity-based monitoring of Security Engines, Log Processors, and blocklist integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Stack Health dashboard in the CrowdSec Console, accessible from the Security Stack left bar menu, surfacing configuration issues, connectivity problems, and misconfigurations across Security Engines, Log Processors, and blocklist integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Categorizes detected issues into four severity levels — Critical, Important, Recommended, and Bonus — so practitioners can triage and prioritize remediation.
• Surfaces per-engine issue counts via a badge on each Security Engine card and a dedicated issues section in the Security Engine details view.

IDS / IPS · 2026-09-22

CrowdSec Console gains a Remediation Metrics page showing blocked attacks, discarded traffic, and projected resources saved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Remediation Metrics page to the CrowdSec Console, providing a unified view of malicious activity detected and remediated across your infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a Malicious Intents section showing the total prevented attacks and a breakdown of attack types (spam, scanning, brute-force) inferred from community data for the selected time period.
• Introduces a Malicious Traffic Discarded section with raw and estimated data on dropped requests, packets, and bytes, plus a blocklist breakdown ordered by traffic blocked — supporting Firewall, Nginx, OpenResty, Ingress Nginx, Cloudflare Workers, HAProxy SPOA, and WordPress Plugin remediation components.

IDS / IPS · 2026-09-22

CrowdSec CTI now offers three programmatic access paths: Enrichment API, Offline Replicas, and a TAXII 2.1/STIX 2.1 feed⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds x-api-key header-authenticated Enrichment API for on-demand per-IP JSON lookups, suited for SIEM, SOAR, and TIP real-time enrichment pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Offline Replicas: a periodically refreshed full snapshot of the CrowdSec CTI database available for bulk download in mmdb, parquet, and json formats — no per-request rate limits, supports air-gapped environments.
• Adds a TAXII 2.1 / STIX 2.1 feed for incremental, poll-based synchronization with TAXII-native platforms such as OpenCTI, MISP, and Anomali.

IDS / IPS · 2026-09-22

CrowdSec adds an Application Security Component (AppSec) that turns the Security Engine into a full WAF with virtual patching, ModSecurity rule support, and bot detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds listen_addr configuration in the AppSec acquisition datasource to receive forwarded HTTP requests from remediation components (Nginx, Traefik, HAProxy, Envoy Gateway, OpenResty, WordPress).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the AppSec Component — a WAF capability built into the CrowdSec Security Engine supporting in-band (blocking) and out-of-band (async, non-blocking) rule evaluation against HTTP requests.
• Supports virtual patching with low-effort rule deployment via collections from the CrowdSec Hub.

IDS / IPS · 2026-09-22

CrowdSec adds alpha bot detection to its WAF, blocking headless browsers and automation frameworks before they reach your app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds alpha bot detection to the AppSec component, using browser-side proof-of-work and device fingerprinting to distinguish real browsers from automated clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Detections from bot detection surface in cscli alerts list and as alerts in the CrowdSec console, and the fingerprint verdict is available to custom scenarios and appsec-configs.
• Verified search-engine crawlers, uptime probes, and similar good bots are recognised and passed through without a challenge.

SIEM · 2026-09-22

Databricks Runtime 19 adds truncate, trim_array functions and session-scoped Python UDF worker env vars via spark.pythonWorkerEnv.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds spark.pythonWorkerEnv.<variable-name> configuration prefix to set session-scoped environment variables for Python UDF scalar worker processes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds truncate function to SQL, Scala DataFrame, and Python DataFrame APIs to truncate a number to a specified scale without rounding.
• Adds trim_array function to SQL, Scala DataFrame, and Python DataFrame APIs to remove elements from the end of an array (positive count) or the beginning (negative count).

SIEM · 2026-09-22

The system.query.history system table is now generally available for account-wide query telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds system.query.history system table (GA) for querying account-wide records of SQL warehouse and serverless compute executions, including execution status, duration metrics, and query source.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-22

VARIANT column masks in ABAC now cover ARRAY and MAP types alongside STRUCT, requiring Databricks Runtime 19+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends VARIANT cast support in ABAC column masks to cover ARRAY and MAP column types, in addition to STRUCT and other previously supported types (requires Databricks Runtime 19 or above).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-22

Databricks adds automatic sensitive data classification and tagging in Unity Catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Automatically classify and tag sensitive data in Unity Catalog via the new Data Classification feature.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-22

Datadog Cloud SIEM adds Dynamic Severity rules, Env Remapping, Code Channels in Slack, and Data Access Control for signals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Dynamic Severity rules to adjust the severity of security signals based on the assets they affect, with customizable severity levels, custom tags, and rule-scoped isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds role-, team-, and user-level access controls for Dynamic Severity rules, requiring at least one editor role the current user belongs to before saving.
• Adds Object Storage Request Estimation capability.

Vulnerability Management · 2026-09-22

DefectDojo Pro syncs Feature Flag toggles to start-time surfaces on restart; add DD_FEATURE_FLAGS_BOOT_SYNC=False to opt out.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DD_FEATURE_FLAGS_BOOT_SYNC=False environment variable to keep a process pinned to its environment variables instead of syncing stored Feature Flag toggles at start-up (default is on).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• DefectDojo Pro now reads stored Feature Flag toggles (Locations, Organization / Asset Relabeling) at start-up and applies them to the deployment settings, so Settings > Feature Flags changes take effect after a restart without manually updating DD_V3_FEATURE_LOCATIONS or DD_ENABLE_V3_ORGANIZATION_ASSET_RELABEL.
• With the Locations Feature Flag enabled and a restart, /api/v2/location/, /api/v2/url/, and /api/v3/ API routes are mounted and appear in the API documentation, and /api/v2/endpoints/ is served read-compatibly from Locations.

Vulnerability Management · 2026-09-22

DefectDojo now surfaces suggested deploy-to edges from container image evidence on the asset hierarchy page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds suggested edges on the asset hierarchy page when Container Image Locations are enabled: DefectDojo detects undrawn deploys to relationships by matching image repositories across assets and presents each pair as a reviewable suggestion with container-image evidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Accepting a suggested edge draws a deploys to relationship from the image-building asset to the running asset, causing the deployed asset to inherit its host's exposure; accepted edges carry an origin of container evidence distinguishing them from manually drawn or connector-declared edges.
• Dismissing a suggestion suppresses that asset pair; further images for the same pair are counted but do not reopen it, and dismissed suggestions can be reopened from the same dialog.

Vulnerability Management · 2026-09-22

DefectDojo v3.3.200 adds regulatory compliance packs, DAST, AI red-teaming, CSAF 2.0/VEX export, and a Command Center dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DD_V3_ASSET_VERSIONS chart value and compose environment variable to enable per-source asset versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds CSAF 2.0 / VEX advisory export, backported to the 3.3.x line.
• Adds a vulnerability response evidence API and export, backed by versioned vulnerability response policies with response-clock evaluation and incident escalation.

Vulnerability Management · 2026-09-22

DefectDojo 3.3.200 adds container image location emission from container scanners and debounced product grade recalculation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Container scanners now emit the scanned image as an Image location, linking container images to their repository in the Locations model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Debounces product grade recalculation per product to improve performance on large imports.

Identity & Access Management · 2026-09-22

Didit Web SDK 0.4.0 brings native camera-control options to the browser, including rear-camera and switcher-hide flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds defaultDocumentCamera and defaultLivenessCamera SDK options to the Web SDK, allowing the document and face-capture steps to open on the rear camera by default (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ for kiosk or operator-assisted flows).
• Adds showDocumentCameraSwitchButton and showLivenessCameraSwitchButton SDK options to the Web SDK to hide the in-capture camera switcher and lock users to the chosen lens.

Exploitation & C2 · 2026-09-22

Dradis: Warns a user if another user is currently editing the same Issue record.

Exploitation & C2 · 2026-09-22

Dradis Pro v5.4 adds QA states to Evidence, Roslin AI drafting for Content Blocks, List fields as dropdowns, and Webhook CRUD events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Evidence, Node, and Note CRUD events to Webhooks, enabling external systems to react to evidence lifecycle changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds QA states to Evidence so teams can track review status and gate client-facing deliverables — Excel and Word exports now only include published Evidence.
• Adds a Roslin agent tab to Content Blocks to draft report sections (executive summaries, methodology, scope notes) from the full project content including Issues and Evidence.

Digital Forensics & Incident Response · 2026-09-22

iOS Forensic Toolkit 10.11 brings bootloader-level full file system and keychain extraction to Apple Watch Series 4/5 and Apple TV 4K 2nd Gen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bootloader-level extraction for Apple Watch Series 4 and Series 5, producing a full file system image and decrypted keychain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bootloader-level extraction for Apple TV 4K 2nd Gen, producing a full file system image and decrypted keychain.
• Extends low-level extraction support past the A11 generation of Apple silicon for the first time.

Digital Forensics & Incident Response · 2026-09-22

ElcomSoft: Adds bootloader-level keychain and full file system extraction for Apple TV 4K 2nd Gen (A12 Bionic) via the usbliter8 SecureROM exploit, recovering accounts, authentication tokens, paired device records, network history, and Siri-related artifacts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for tvOS 26.5 and 26.6.
• Adds support for audioOS 26.5 and 26.6.

Reverse Engineering · 2026-09-22

EMBA v2.0.4 migrates to binwalk-ng, makes the local connector endpoint configurable, and expands CSV logging across all modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Makes the local connector endpoint configurable via the change introduced in PR #2069.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Moves MIN_TCP_SERV to defaults and allows it to be adjusted via scanning profiles.
• Migrates firmware extraction from binwalk to the actively maintained binwalk-ng fork.

Runtime Security · 2026-09-22

Falco 0.45.0 adds raw byte matching in rules, reload control endpoints, and GPU detection rules⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /reload webserver endpoint reporting process identity, reload generations, and readiness so integrations can verify a completed reload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds reload_control configuration key that opens a Unix socket accepting POST /reload for local reload requests (disabled by default).
• Adds \xHH byte escape syntax in rule conditions for matching filenames or process arguments containing arbitrary bytes not representable as valid UTF-8.

Secure Access (VPN / SASE / ZTNA) · 2026-09-22

API surface changed: 27 modified, 3 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-22

Fleet: Adds POST /api/v1/fleet/hosts/:id/apns_ping to send an APNs push notification to a macOS, iOS, or iPadOS host, prompting it to check in and pick up pending MDM commands or profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api/v1/fleet/microsoft_graph_credentials to list Microsoft Graph credentials and per-tenant Autopilot sync status, including credential_invalid and last_synced_at fields.
• Adds PUT /api/v1/fleet/microsoft_graph_credentials to declaratively replace stored Microsoft Graph credentials; credentials whose tenant_id is absent from the payload are deleted, and an empty array removes all credentials.
• Adds severity_min and severity_max parameters (CVSS 3.x base score) to the vulnerability hosts-over-time chart endpoint to filter results to a specific CVSS score range.

Endpoint Security (EDR/XDR) · 2026-09-22

Fleet adds a Reports feature with scheduling, label-based targeting, live queries, CSV export, and configurable result caps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds server_settings.report_cap to control the maximum number of stored results per report (default 1,000).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds server_settings.discard_reports_data API field to globally disable stored report results.
• Adds the discard_data field on the create/update report API to disable stored results per individual report.

Endpoint Security (EDR/XDR) · 2026-09-22

Fleet 4.92.0 adds Android MDM commands, per-platform disk encryption, cancelable Apple MDM commands, and new osquery bandwidth-saving config options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds osquery.config_in_memory_cache server configuration option to control the in-memory cache of the osquery config's scheduled-report section (set to true to re-enable; disabled by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds osquery.config_etags server option (FLEET_OSQUERY_CONFIG_ETAGS, default off) to enable conditional request (etag) support on /api/osquery/config, sending a minimal {"etag":"ok"} response to agents whose configuration is unchanged.
• Adds osquery.redis_config_etags server option (FLEET_OSQUERY_REDIS_CONFIG_ETAGS, default off, requires osquery.config_etags) to answer matching etag check-ins directly from a Redis-backed ETag store, skipping the config build and database reads entirely.

Secrets Detection & Management · 2026-09-22

GitGuardian Detection Engine 2.172 adds 10 new detectors, 8 new secret analyzers, and expanded recall for Scaleway, Salesforce, Splunk, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new detector for Brightcove OAuth credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new detector for Infor ION API Gateway OAuth client credentials, capturing the authorization host and token endpoint when present.
• Adds a new detector for generic Sanctum tokens.

SAST / SCA / Code Security · 2026-09-22

GitHub's refreshed pull requests page is now GA, with AND/OR advanced search, bulk actions, and a collapsible sidebar.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Advanced search on the pull requests page now supports AND and OR keywords as well as nested searches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Bulk actions let you close, label, or change milestones on one or more pull requests at once.
• Collapsible sidebar provides quick access to common filters such as Authored by me and Involves me, and can be collapsed to expand the list view.

SAST / SCA / Code Security · 2026-09-22

GitHub Enterprise gains a full credential inventory export — CSV from the UI or via new paginated REST API endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new View enterprise credentials fine-grained permission that grants members access to the enterprise credential inventory alongside enterprise owners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new paginated REST API endpoints to programmatically retrieve the complete enterprise credential inventory for reporting and automation.
• Adds an Export CSV option in enterprise Settings -> Authentication Security -> Credentials to download the full credential inventory.

SAST / SCA / Code Security · 2026-09-22

Grok 4.7 reasoning model now available in GitHub Copilot across VS Code, JetBrains, Xcode, Eclipse, CLI, and cloud agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Copilot Enterprise and Business administrators can manage access to Grok 4.7 via the model policy in Copilot settings, with new models auto-enabled under the global default unless explicitly disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-09-22

Google SecOps: Adds GET /v1alpha/{name}:suggestQueryFields to retrieve query field autosuggestions based on user and tenant-level usage.

• Introduces the v1alpha.projects.locations.instances.remediationPlans resource with POST /v1alpha/{parent}/remediationPlans:generate to trigger the Remediation agent and save its output, POST /v1alpha/{name}:execute to execute a suggested plan, GET /v1alpha/{parent}/remediationPlans to list plans with optional filtering, and PATCH /v1alpha/{remediationPlan.name} to update a plan.
• Introduces v1alpha.projects.locations.instances.remediationPlans.remediationActions with POST /v1alpha/{parent}/remediationActions to create a manual remediation action and GET /v1alpha/{parent}/remediationActions to list actions under a plan.
• Introduces v1alpha.projects.locations.instances.remediationPlans.remediationActions.remediationActionExecutions with GET /v1alpha/{parent}/remediationActionExecutions to list execution records under a remediation action.

SIEM · 2026-09-22

Google SecOps adds in-product Gemini help pane with Google Search grounding, citations, and chat session management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Gemini pane inside Google SecOps for answering natural-language questions about the product using documentation summaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Gemini responses are grounded with Google Search, surfacing the exact search queries used, a Google G icon indicating internet connectivity, and search query chips alongside citations for transparency.
• Supports deleting individual or all chat sessions from the Gemini pane via Delete chat and Delete all chat sessions options.

SIEM · 2026-09-22

Google SecOps Content Hub centralizes discovery and deployment of content packs, detections, dashboards, playbooks, and SOAR integrations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chronicle.googleapis.com/featuredContentSearchQueries.get, .list, and .install IAM permissions to control access to search query content in Content Hub⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chronicle.googleapis.com/featuredContentRules.list IAM permission to control access to featured detection rules in Content Hub
• Adds chronicle.googleapis.com/featuredContentNativeDashboards.get, .list, and .install IAM permissions to control access to dashboard content in Content Hub

SIEM · 2026-09-22

Google SecOps adds Agentic Automation to embed AI agents directly into playbooks for adaptive, AI-driven triage and investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agentic Automation to Google SecOps playbooks, enabling AI agents to be embedded as steps alongside deterministic automation, with asynchronous execution that pauses the playbook without occupying the execution queue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Integrates the Triage and Investigation Agent (TIN) as the first supported agent, delivering autonomous alert analysis with a True Positive / False Positive verdict, a confidence_level score, and structured JSON outputs for downstream branching.
• Exposes AI Agent step results in the Expression Builder so playbook conditions can branch on verdict or confidence_level rather than static inputs.

SIEM · 2026-09-22

Google Unified Security launches converged platform integrating SecOps, Chrome Enterprise, SCC, and AI Protection for multi-cloud threat detection and response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Chrome Enterprise Premium (CEP) integration with Google SecOps, enabling curated detections enriched with Safe Browsing and Google Threat Intelligence (GTI) for browser-based threats such as malicious extensions, credential theft, and data exfiltration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds dedicated Google SecOps dashboards for Chrome security events and anomalies to surface browser-based threat visibility for SOC analysts.
• Adds native playbook orchestration for automated Chrome Enterprise response actions — including blocking malicious URLs, blocking extensions, and quarantining devices — directly from the Google SecOps platform.

SIEM · 2026-09-22

Google SecOps Ingestion API supports UDM events, unstructured logs, batch deduplication, and 19 regional endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST https://malachiteingestion-pa.googleapis.com/v2/udmevents:batchCreate endpoint to ingest pre-parsed UDM events in batches, bypassing the CBN parsing layer for lower end-to-end latency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST https://malachiteingestion-pa.googleapis.com/v2/unstructuredlogentries:batchCreate endpoint to forward raw logs in batches up to 1 MB (uncompressed), with per-entry timestamps via ts_epoch_microseconds or ts_rfc3339 fields.
• Adds batch-level deduplication: Google SecOps hashes customer_id plus log entry content to generate a batch ID, rejecting duplicate batches per customer per log type while allowing identical content under different log types.

SIEM · 2026-09-22

Google SecOps Detection Engine API adds full CRUD and lifecycle endpoints for YARA-L 2.0 rules plus 19 regional endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v2/detect/rules (CreateRule) to create a YARA-L 2.0 detection rule without activating it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST /v2/detect/rules/{ruleId}:createVersion (CreateRuleVersion) to create a new version of an existing rule, including from a non-latest version.
• Adds DELETE /v2/detect/rules/{ruleId} (DeleteRule) to permanently delete a rule by ruleId.

SIEM · 2026-09-22

Google SecOps Backstory Search API reference published, covering endpoints for events, assets, IOCs, and alerts across 19 regional endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET https://backstory.googleapis.com/v1/events/log:get/?name={UID} endpoint (GetLog) to retrieve a single raw log by its metadata.id.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET https://backstory.googleapis.com/v1/event:get?name={UID} endpoint (GetEvent) to retrieve a single parsed UDM event by its metadata.id.
• Adds GET https://backstory.googleapis.com/v1/artifact/listassets endpoint (ListAssets) to list assets that accessed a given artifact (domain, IP, MD5/SHA1/SHA256 hash) within a time window, returning up to 100 results per request via page_size.

SIEM · 2026-09-22

Google SecOps adds GoogleSQL search, case playbooks, reaction triggers, event simulation, and GA customizable multi-event rule schedules⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chronicle.rules.modifyRules and chronicle.ruleDeployments.update IAM permissions requirement for managing customizable rule schedules with custom IAM roles in the Rules Dashboard⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds match_all option to the Grok filter in Google SecOps parser syntax, enabling extraction of all non-overlapping pattern occurrences within a field rather than only the first match
• Adds Unroll processor to data processing pipelines, splitting log entries containing arrays or slices of events into multiple individual log events prior to parsing and ingestion; requires structured input, with raw payloads first processed via a Transform processor (e.g., set(body, ParseJSON(body)))

Exploitation & C2 · 2026-09-22

NodeZero gains Expanded Scope (Network Pivoting) — tunnel, Azure VM, and RFC 1918 pivot techniques with scoped include/exclude controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Expanded Scope (Network Pivoting) toggle to external pentest configuration, enabling NodeZero's attack engine to follow discovered footholds beyond the originally configured scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Tunnel Pivoting technique, which creates L3 tunnels through compromised hosts and deploys attack assets on internal networks outside the configured scope.
• Adds Azure VM Run Command Pivot technique, allowing NodeZero to use Azure Run Command to pivot to VMs with IPs outside the configured scope.

Exploitation & C2 · 2026-09-22

NodeZero OVA deployment now supported on Nutanix AHV/AOS (Prism Central)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Nutanix AHV/AOS as a supported hypervisor platform for deploying the NodeZero OVA host, with step-by-step instructions for uploading and launching the VM via Prism Central.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-09-22

NodeZero OVA now supports Nutanix AHV, enabling quick VM deployments on Nutanix hypervisors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Nutanix AHV as a supported hypervisor for the preconfigured OVA image, alongside VMware and VirtualBox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-22

Huntress Managed ISPM adds two new M365 security controls targeting Shadow Workflows in Exchange Online and Defender for Office 365.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Ensure Direct Send is disabled control for Microsoft Exchange Online, available to schedule for deployment in Managed ISPM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds 'Tenant Allow/Block list should contain zero entries in the allow list' control for Microsoft Defender for Office 365, available to schedule for deployment in Managed ISPM.

Endpoint Security (EDR/XDR) · 2026-09-22

Huntress adds macOS Screen Sharing visibility, quarantine-strip detections, and Defender scan toggle controls for M365 and endpoint hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Network File Scanning and Archive File Scanning toggles for Microsoft Defender in Managed Antivirus, found under EDR > Managed Antivirus > Defender Configuration > Scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends the agent overview page to show the last logged-in user for macOS endpoints (previously Windows-only), requiring Agent v0.14.196 or later.
• Adds a detection that fires when a Screen Sharing session attaches to a root user via a legacy authentication handshake, covering an unauthenticated file-read flaw in Apple's Screen Sharing service disclosed July 2026.

Reverse Engineering · 2026-09-22

HyperDbg adds I/O port execution commands and full virtual/physical memory read command families⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds uin command to execute an I/O IN instruction directly in the debuggee.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds uout command to execute an I/O OUT instruction directly in the debuggee.
• Adds db, dc, dd, dq, dw, da, dds, dps, dqs commands for reading virtual memory in the debuggee.

Identity & Access Management · 2026-09-22

iDenfy adds Bank Card Verification, Blocklist API, KYB fields filtering, CSV native-script export, and branding auto-import in Sprint 135⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a fields parameter to the KYB company endpoint to return only the data fields you need.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Blocklist API endpoint.
• Adds Bank Card Verification capability.

Endpoint Security (EDR/XDR) · 2026-09-22

Iru's Privacy Library Item gains a Recommended privacy permissions area for iPhone and iPad, letting admins batch-prompt users for app and Safari permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Recommended privacy permissions area inside the Privacy Library Item for iPhone and iPad, enabling admins to specify app permissions and Safari website permissions that managed apps and sites require — end users see a single consent prompt with Allow all or Not Now options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-22

JFrog Artifactory adds native LuaRocks repository support for hosting, proxying, and caching Lua rocks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds LuaRocks as a native repository type in JFrog Artifactory, supporting local, remote, and virtual repository configurations for Lua packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports proxying and caching the public luarocks.org registry through a remote repository, serving cached rocks on subsequent requests.
• Enables hosting private rocks and Kong plugins in a local LuaRocks repository, allowing CI jobs to publish .rock files and Kong nodes to install versioned plugins from a single internal endpoint.

General Utilities & Libraries · 2026-09-22

Joplin adds OCR for images and PDFs with offline processing, accessible PDF export, and configurable language data sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OCR: Language data URL or path setting (under Settings > General > Advanced) to point Joplin at a local directory of .traineddata.gz files, enabling OCR on air-gapped machines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OCR: PDF processing mode setting (under General > Advanced), with an Accessible option that overlays an invisible text layer on scanned PDFs to enable text selection, copying, and screen-reader support — at a cost of approximately 10–50 KB per page in database size.
• Adds a Clear cache and re-download language data files action to force refresh of cached Tesseract language data.

Identity & Access Management · 2026-09-22

JumpCloud adds a Device Patch Report for Windows with per-device KB patch status, preview, and CSV export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Device Patch Report (Windows) in the JumpCloud Admin Portal, showing Installed, Pending, and Failed status for each Windows Knowledge Base (KB) patch on each managed device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-22

JumpCloud: Introduces a Linux Forbidden Services policy to remove unsupported service types and reduce security risk on Linux fleets.

• Adds Premium Support Live Chat directly in the Admin Portal, automatically recognizing Premium Support status without requiring a PIN.

Identity & Access Management · 2026-09-22

JumpCloud: Enables admins to manage shared folder assignments and permissions from the Admin Portal in JumpCloud Password Manager, and lets users manually sync individual folders from the desktop app.

• Adds billing visibility for MSP customers showing available and consumed user licenses and the ability to download their JumpCloud contract from the Multi-Tenant Portal.

Identity & Access Management · 2026-09-22

JumpCloud: Adds manual application entry to SaaS Management so admins can track, warn, and block access to apps before automatic discovery runs.

• Launches SaaS Management, providing discovery and tracking of SaaS app use via the JumpCloud Go browser extension, shadow-IT categorization, customizable warning/blocking messaging, and licensing information tracking.
• Enables JumpCloud Go sessions to automatically refresh on device login or unlock, removing additional verification prompts for JumpCloud-protected browser resources.
• Adds inactivity timer to Remote Assist app.

Identity & Access Management · 2026-09-22

JumpCloud: Adds MTP support in the Customer Portal — MTP Admins can access, view, and create support cases across all managed tenant organizations.

• Supports Forced Re-authentication via ForceAuthn='true' in SAML and prompt=login in OIDC, prompting fresh credential entry even when an active session exists.
• Adds macOS Dock Settings and Items policy updates and Lock Screen (Screen Saver) policy enhancements for managed macOS devices.

Identity & Access Management · 2026-09-22

JumpCloud: Adds Client secret basic and Client secret post client authentication type options on an agent's Authentication tab, controlling how OAuth client credentials are sent when requesting tokens from JumpCloud.

• Introduces the Device Patch Report (Windows) in JumpCloud Reports, providing per-device visibility into KB patch installation status (Installed, Pending, Failed) with preview of up to 500 rows and full CSV export.
• Adds in-place version updating for custom applications in the Private Repository via Update Version on the application's Details tab, including EXE install success exit code configuration for Windows.

Identity & Access Management · 2026-09-22

Identity & Access Management · 2026-09-22

JumpCloud: Adds a required install success exit code field when deploying Windows EXE updates via the Private Repository, so JumpCloud can confirm installation succeeded.

• Adds Client secret basic and Client secret post client authentication type options on an agent's Authentication tab, controlling how the agent platform sends the client ID and secret when requesting an OAuth token from JumpCloud.

Pentest Distributions · 2026-09-22

Kali NetHunter Pro brings full desktop-class Kali Linux to ARM64 mobile devices including PinePhone and Qualcomm hardware⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Kali NetHunter Pro, a pure Kali Linux ARM64 distribution for mobile devices that runs without an Android overlay, supporting PinePhone, PinePhone Pro, Poco F1 (beryllium), OnePlus 6 (enchilada), OnePlus 6T (fajita), Nothing Phone 1 (spacewar), Xiaomi Mi MIX 2S (polaris), and SHIFT SHIFT6mq (axolotl).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports desktop experience via HDMI output on PinePhone and PinePhone Pro, enabling use of a full Kali desktop from a mobile device.
• Supports dual-boot alongside other operating systems on compatible devices.

Secure Access (VPN / SASE / ZTNA) · 2026-09-22

Knocknoc adds Cisco Meraki integration for dynamic source-IP access control⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates with Cisco Meraki to dynamically control which source IPs are allowed through network access policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-22

Mend Renovate adds PyPI backend support for mise, regex versioning ranges, and array-of-inline-tables parsing for mise tool versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pypi backend support to manager/mise, enabling Renovate to manage PyPI-sourced tool versions declared in mise configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds range support to the regex versioning scheme, allowing dependency version constraints expressed as ranges to be evaluated under the regex scheme.
• Adds support for arrays of inline tables as tool versions in manager/mise, broadening the set of mise config shapes Renovate can parse.

Threat Intelligence · 2026-09-22

MSTICPy 3.1.0 adds a new ScanMalware TI provider for DNS, IP, and URL observables with no API key required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the ScanMalware threat-intelligence provider supporting verdict lookups for hosts and URLs, passive-DNS context for IP addresses, and quick query modes for bulk lookups — no API credentials required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Python 3.14 to the supported package classifiers and CI test matrix.

Network Analysis & Monitoring · 2026-09-22

FlowCarp adds statistical C2 protocol classification and a free demo API at demo.flowcarp.com supporting 600+ protocols⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-09-22

Obsidian 1.14.2 lets you open files from outside the vault and always uses fuzzy matching in large vaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Open file from outside the vault... command to open any file on your computer in the current window (Desktop only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Obsidian now registers itself in the OS Open with menu and can be set as the default app for Markdown files (requires reinstalling the latest installer).
• Kanban: Cards can now be moved between folder columns when grouped by file.folder.

Identity & Access Management · 2026-09-22

Okta 2026.09.0 adds AI agent identity management, MCP server DCR and OIN catalog support, NFC authenticator, Okta Verify for Linux, and malware proxy detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds REMOTE_DESKTOP IP service category to Enhanced Dynamic Network Zones, letting admins include or exclude remote-desktop traffic in global session and app sign-in policies for precise access control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MALWARE_PROXIES IP service category to Enhanced Dynamic Network Zones, powered by Okta CyberDefense, covering proxy services tied to malware and botnet activity (including 911 S5, NSOCKS, iProxy, and BHProxies).
• Supports Dynamic Client Registration (DCR) when manually registering an MCP server — Okta automatically registers a client with the provider and populates credentials.

Identity & Access Management · 2026-09-22

Okta for AI Agents adds Agent Gateway runtime enforcement, Agent SSO, shadow AI discovery, ephemeral credentialing, HITL guardrails, and FedRAMP/HIPAA compliance tiers for non-human identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Agent Gateway to verify agent identity, broker credentials at runtime, and log every tool call without code changes to agents or tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Agent Single Sign-On (SSO) to manage Cross-App Access agents in core SSO with centralized policies and full lifecycle governance.
• Adds multi-surface shadow AI discovery that continuously scans browsers, managed endpoints, and cloud environments to uncover unvetted agents and unauthorized OAuth consent grants.

Identity & Access Management · 2026-09-22

Okta for AI Agents adds shadow endpoint discovery, Agent Gateway runtime enforcement, agent-to-agent connection rules, and visual Configuration Designer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Shadow AI Agent Discovery for Endpoints, which surfaces unmanaged AI agents running on employee devices so they can be discovered and registered before becoming governance blind spots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Agent Gateway, a runtime enforcement point that sits in the execution path between an agent and its tool calls, enforcing policy and logging every interaction.
• Adds Agent-to-Agent Connections, which sets rules for which agents can call other agents, scopes what each agent can access, and captures the handoff in an auditable chain.

Threat Intelligence · 2026-09-22

OpenCTI adds four new Prometheus metrics and a background health monitor with configurable refresh intervals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds opencti_dependency_up metric reporting connectivity state (up/down) for each platform dependency (elasticsearch, storage, rabbitmq, redis) as a Boolean.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds opencti_elasticsearch_used_size_bytes metric reporting total ElasticSearch/OpenSearch primary store size in bytes, replicas excluded.
• Adds opencti_storage_used_size_bytes metric reporting total size of objects stored in the S3/MinIO bucket in bytes.

Threat Intelligence · 2026-09-22

OpenCTI adds health-monitoring intervals, Redis TLS SNI, usage-metrics manager, and exponential missing-reference retry tuning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds app:health_monitoring:dependency_check_interval / APP__HEALTH_MONITORING__DEPENDENCY_CHECK_INTERVAL config key to set the interval in milliseconds between dependency health checks for ElasticSearch/OpenSearch, S3/MinIO, RabbitMQ, and Redis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds app:health_monitoring:usage_metrics_interval / APP__HEALTH_MONITORING__USAGE_METRICS_INTERVAL config key to control how often storage and ingestion usage metrics are collected and shared across the cluster via Redis; set to 0 to disable collection.
• Adds redis:tls_servername / REDIS__TLS_SERVERNAME config key to supply an optional shared server name for TLS SNI and certificate validation in Redis cluster mode.

Threat Intelligence · 2026-09-22

OpenCTI 7.260921.0 adds News Feed integration support, Fintel column selection, and user-merge history reattribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds column selection for entity attributes in Fintel reports, letting analysts customize which fields appear in generated tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds News Feed support for OCTI integrations (excluding connectors), surfacing a new integration resource type in the feed.
• Extends user merge to re-point assignee and participant relations to the target user.

SAST / SCA / Code Security · 2026-09-22

Openlayer adds EU data residency with a dedicated eu.openlayer.com host alongside the existing US region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a European Union data region accessible at eu.openlayer.com, separate from the existing United States region at app.openlayer.com.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Data region selector on the login and signup forms, letting users choose between US data region and EU data region before authenticating.

SAST / SCA / Code Security · 2026-09-22

Openlayer adds EU data region support, letting users choose between United States and European Union at login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-22

Openlayer adds bulk test config export from the Results page, downloading definitions as a ready-to-use tests.json array.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Export test config from a single test's row overflow menu (⋯) on the Results page to download its definition as a tests.json array.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Export selected test configs bulk action on the Results page to download multiple test definitions as a single tests.json array, also copying the JSON to the clipboard.
• Exported tests.json array can be checked into a repository and used with openlayer push to keep tests in sync — distinct from the openlayer tests command output, which wraps definitions in _meta and items.

SAST / SCA / Code Security · 2026-09-22

Openlayer adds OpenAI Compliance integration to ingest ChatGPT Enterprise and Codex activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenAI Compliance integration to ingest ChatGPT Enterprise and Codex activity into Openlayer for monitoring and analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-22

Openlayer adds a full Governance API, prompt-injection detection, data residency choice, OpenAI Compliance Logs ingestion, and Google Gemini integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /governance/frameworks (List frameworks), POST /governance/frameworks (Create a framework), GET /governance/frameworks/{id} (Retrieve a framework), PATCH /governance/frameworks/{id} (Update a framework), and GET /governance/frameworks/{id}/export (Export a framework) REST endpoints to programmatically manage governance frameworks and download audit-ready zip archives.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET /governance/frameworks/{id}/rules (List a framework's rules), GET /governance/frameworks/{id}/projects (List a framework's projects), GET /governance/frameworks/{id}/project-rule-stats (List a framework's per-project compliance), GET /governance/frameworks/{id}/documents (List a framework's documents), and GET /governance/frameworks/{id}/documents/{docId} (Retrieve a framework document) REST endpoints for deep inspection of framework structure and compliance roll-ups.
• Adds GET /governance/frameworks/{id}/documents/{docId}/sections/{sectionId}/rules (List a section's rules) and GET /governance/frameworks/{id}/documents/{docId}/sections/{sectionId}/subsections/{subsectionId}/rules (List a subsection's rules) REST endpoints to enumerate rules mapped to specific document sections.

General Utilities & Libraries · 2026-09-22

OpenSSL adds Ascon-AEAD128 lightweight authenticated encryption via the EVP_CIPHER interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds EVP_CIPHER-ASCON-AEAD128 implementation, bringing Ascon-AEAD128 lightweight authenticated encryption to the EVP_CIPHER API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-09-22

Ory Network gains workspace contact registration for technical, business, security, and privacy roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Register technical, business, security, and privacy contacts for an Ory Network workspace so Ory knows who to reach for each purpose.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-22

OSSEC HIDS rule-list files now support trailing comments using the ### delimiter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds trailing comment support to rule-list files using the ### multi-character delimiter; everything from ### to end-of-line is discarded at compile time, and leading spaces/tabs before ### are stripped so stored values carry no trailing whitespace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• A single # is explicitly not a comment marker, allowing keys and values to contain # characters (e.g. URL fragments) without escaping.

Endpoint Security (EDR/XDR) · 2026-09-22

OSSEC HIDS Logcollector gains modsec-audit format for ingesting full ModSecurity serial audit logs as single events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds modsec-audit log format to Logcollector, which reads serial ModSecurity/libmodsecurity audit files (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ /var/log/modsec_audit.log), collects one full transaction from the --id-A-- header through the --id-Z-- trailer, and emits it as a single event to analysisd.

Firewalls & Network Defense · 2026-09-22

Palo Alto Networks launches Unit 42 Continuous Frontier AI Defense, an always-on agentic offensive security service powered by Anthropic Claude Mythos 5 and OpenAI GPT-5.6-Cyber.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Unit 42 Continuous Frontier AI Defense, a new always-on agentic offensive security service that continuously finds, validates, and remediates enterprise exposures using proprietary multi-model AI harnesses with Anthropic Claude Mythos 5 and OpenAI GPT-5.6-Cyber.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Continuous Testing Engine that performs a full-estate baseline scan followed by always-on testing as an organization's environment changes, covering web apps, APIs, cloud infrastructure, source code repositories, and network assets.
• Introduces a proprietary Multi-Model AI Harness that routes offensive security tasks to the model best suited for each job, addressing the finding that no single model catches more than 40% of vulnerabilities and that leading models share less than 10% overlap in identified exposures.

Secure Access (VPN / SASE / ZTNA) · 2026-09-22

Prisma Access Android agent gains Android 17, IPv6 dual-stack, LDAP auth, system browser SAML, and enrollment log sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Android 17 support to the Prisma Access Android agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds IPv6 dual-stack support for Android agents.
• Adds LDAP authentication for Android agents.

Firewalls & Network Defense · 2026-09-22

Advanced DNS Security Resolver gains DoT support, three new PoPs, a remote-access domain category, and a new Operator Dashboard in Strata Cloud Manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds remote-access domain category to DNS Security policy, enabling discrete block/allow actions for remote-access tool download sites such as TeamViewer, AnyDesk, and LogMeIn.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports DNS over TLS (DoT) query processing on TCP port 853 (RFC 7858) in the Advanced DNS Security Resolver, with TLS 1.2 minimum and TLS 1.3 preferred, alongside existing DoH support.
• Adds Point of Presence (PoP) service regions in Spain, Italy, and Switzerland to the Advanced DNS Security Resolver, with automatic client routing to the nearest regional endpoint.

SAST / SCA / Code Security · 2026-09-22

Pi Security integrates with Anthropic's Compliance API and delivers security context in-session via its Sloane agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates with Anthropic's Compliance API to maintain a complete compliance record of security context delivered to developers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Sloane, Pi's agent running natively in the coding session, to surface security context to developers as code is written rather than in post-review.

Identity & Access Management · 2026-09-22

PingOne adds outbound group sync, custom client IDs/secrets via API, AI agent type detection, and Protect SDK 5.6.11⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports setting a custom client ID and client secret for imported OIDC applications and custom resources via the PingOne API, enabling migration from PingFederate or third-party solutions and recovery of accidentally deleted applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds outbound group sync provisioning for external groups, including a Group Settings tab with Sync Status and an Outbound Name field (defaulting to the CN portion of the group name) for syncing directory groups to third-party apps such as AWS.
• Enhances the PingOne Protect Bot Detection predictor with new rules to identify specific computer-using agent (CUA) types for more granular AI-driven activity monitoring, requiring Protect (Signals) SDK version 5.6.10 or later and PingID Device Trust agent 1.2 or later for some workforce flows.

Identity & Access Management · 2026-09-22

PingOne DaVinci adds flow canvas Actions, inline variable editing, and a baseline CSP for production flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Actions option to the flow canvas options menu, providing predefined collections of nodes for accomplishing specific narrow purposes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables direct editing of variables in connector configuration fields by clicking a chip after adding a variable from the { } menu, allowing users to copy, paste, or modify attribute and variable references inline.

CNAPP · 2026-09-22

Plerion: Adds GET /v1/tenant/openapi endpoint that returns this API reference as an OpenAPI 3.1 document scoped to the calling key's role — operations the role cannot call are omitted; send Accept: application/yaml to receive YAML instead of the default JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-09-22

Prowler: Adds fedramp_20x_frr_class_c_2026 framework covering the 158 FedRAMP Class C rules for cloud service providers, with configurable checks mapped to rule text and an audit_config that cannot override hard requirements.

• Adds inspector2_active_findings_within_max_age check to flag active Inspector findings first observed more than inspector2_active_finding_max_age_days days ago (default 192).
• Adds elbv2_listener_fips_tls_enabled check to report HTTPS/TLS load balancer listeners not using a FIPS security policy.
• Adds transfer_server_fips_security_policy_enabled check to report Transfer Family servers not using a FIPS security policy.

Cloud Security Posture · 2026-09-22

Prowler 5.43.0 adds FedRAMP 20x 2026 frameworks, seven AWS Inspector/FIPS checks, partition failover, and a self-registration toggle⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds fedramp_20x_ksi_2026 universal compliance framework covering the 46 FedRAMP Key Security Indicators across AWS, Azure, GCP, Kubernetes, and M365 from a single definition, replacing the pilot per-provider frameworks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds fedramp_20x_frr_class_c_2026 universal compliance framework covering 158 FedRAMP Class C provider rules across AWS, Azure, GCP, Kubernetes, and M365.
• Adds seven new AWS checks: inspector2_coverage_scan_status_active, inspector2_coverage_recently_scanned (configurable via inspector2_max_days_since_last_scan, default 3), inspector2_active_findings_no_known_exploited_vulnerabilities, inspector2_active_findings_kev_within_due_date, inspector2_active_findings_within_max_age (configurable via inspector2_active_finding_max_age_days, default 192), elbv2_listener_fips_tls_enabled, and transfer_server_fips_security_policy_enabled.

Vulnerability Management · 2026-09-22

Rapid7 Insight Platform adds DNS Made Easy connector and new BitSight organization filter settings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds include and exclude organizations connector settings to the BitSight connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New DNS Made Easy connector imports managed domain details into the Rapid7 Platform.
• Hides the Workflows and Functions tabs in the Connector detail panel for users without required permissions.

CNAPP · 2026-09-22

InsightCloudSec 26.9.22 adds CrowdStrike Falcon OCI support, seven new Azure Insights, and six new Query Filters for Cosmos DB, MySQL, and PostgreSQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends CrowdStrike Falcon agent Query Filters to Oracle Cloud Infrastructure (OCI) compute instances, joining existing AWS, Azure, and GCP coverage — enabling security teams to identify OCI instances by Falcon agent presence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds harvesting of the disableLocalAuth property and firewall IP rules (including 0.0.0.0 datacenter-access detection) for Azure Distributed Table (Cosmos DB) resources.
• Adds harvesting of private endpoint connection counts for Azure Database for MySQL and PostgreSQL Flexible Servers.

Threat Intelligence · 2026-09-22

New POST endpoint retrieves full Dark Web Brand Playbook Alert intelligence in a single API call⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /dark-web/brand-playbook/alert/{id} endpoint to retrieve the complete intelligence picture for a single Dark Web Brand Playbook Alert, including workflow state, priority, assignee, matched assets, screenshot references, and source-specific details for forum, market, Telegram, and ransomware mentions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-09-22

New bulk lookup endpoint hydrates up to 250 Dark Web Brand Playbook Alerts in a single POST request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /dark-web-brand endpoint to fetch detailed panel data for up to 250 Dark Web Brand Playbook Alerts in one request, replacing per-alert detail calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The panels field on POST /dark-web-brand limits the response to only the panels needed (status, evidence summary, triage, analysis report, cached content, change log).

Attack Surface & Exposure Management · 2026-09-22

runZero adds vulnerability suppression API, OCSF 1.9.0 export, CBOM CycloneDX JSON, OAuth for MCP, and custom API key roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds vulnerability suppression and unsuppression via the runZero API, covering vulnerabilities, vulnerability groups, and findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an OCSF 1.9.0 export from the asset inventory, exporting assets as Device Inventory Info events and observed services as Live Evidence Info events, available from the inventory export menu and the Export API; fields without an OCSF equivalent are preserved under the event's unmapped object.
• Adds a Cryptographic Bill of Materials (CBOM) as a new CycloneDX JSON export and detailed report.

Data Security & DLP · 2026-09-22

AQtive Guard on-premises packages now available for RHEL 10.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports RHEL 10 as a deployment target for AQtive Guard on-premises packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-22

API surface changed: −2 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-09-22

SO-CRATES v4.2.0 adds ALLOWED_HOSTS env var for reverse-proxy deployments and tightens JSON API content-type enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ALLOWED_HOSTS environment variable (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ -e ALLOWED_HOSTS='*.killercoda.com') to support serving SO-CRATES behind a reverse proxy or cloud hostname; browsing via IP or localhost requires no change.
• Requires scripts calling the JSON API to send Content-Type: application/json; requests omitting this header will now fail.
• Docker/Podman compose files now publish the port on localhost only by default; change the port mapping to "8000:8000" to allow other hosts on the network.

SAST / SCA / Code Security · 2026-09-22

SonarQube Hunter Agent adds AI-driven detection of business logic, access control, and authentication flaws as standard issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Hunter Agent, a new AI-driven verification layer that detects business-logic, broken access control, and authentication/session vulnerabilities through structured multi-stage playbooks — classes of flaw that static analysis and SCA miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces Hunter Agent findings as standard SonarQube issues (with severity, file, and line) in the existing triage, assignment, and tracking workflow, with results also summarized on a dedicated Hunter Agent page.
• Supports running Hunter Agent manually or on a daily schedule against long-lived branches to suit different team cadences.

Firewalls & Network Defense · 2026-09-22

Sophos Switch now displays switch names as the primary identifier on management pages, with name-based search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Displays switch names as the primary identifier on the switch, site, and stack management pages in Sophos Central.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables searching for switches by name in the search box on switch, site, and stack management pages.

SAST / SCA / Code Security · 2026-09-22

StackHawk adds opt-in sessionVerification block to re-authenticate mid-scan and warn when session coverage drops.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sessionVerification block under app.authentication in stackhawk.yml with pollFrequency, activeScanPollFrequency, maxUnauthenticatedRequestPercent, and disabled fields to actively re-check and re-authenticate sessions during scans rather than relying on passive response indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds maxUnauthenticatedRequestPercent threshold that triggers a coverage warning at scan completion when too many mid-scan session checks fail, surfacing scans that silently ran as an anonymous user.
• Supports both HTTP testPath and gRPC testPath.grpcTestMethod styles for mid-scan session verification checks, with testPath.type values HEADER and BODY honored.

SAST / SCA / Code Security · 2026-09-22

StackHawk: Entity and transport headers — Content-Type, Content-Length, Accept, Accept-Encoding, Host, User-Agent, Referer — are no longer stripped from replayed requests during rescans, preventing spurious 415 responses from masking unresolved findings.

SAST / SCA / Code Security · 2026-09-22

HawkScan 6.5.0 adds mid-scan session verification, org-wide secrets, and a one-line CLI installer with version pinning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds app.authentication.sessionVerification config block to re-check and re-authenticate sessions mid-scan by polling authentication.testPath, with tunable pollFrequency (default 15), activeScanPollFrequency (default 5), and maxUnauthenticatedRequestPercent (default 5); a scan that spent too much time logged out now finishes with a coverage warning instead of a silently thin result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds disabled: true field inside app.authentication.sessionVerification to explicitly turn off session verification while still requiring an indicator-based check.
• Adds a one-line installer script at curl -sSf https://download.stackhawk.com/hawk/install.sh | sh that detects OS and architecture, verifies SHA-256 against the published manifest, and supports HAWK_INSTALL_VERSION and HAWK_INSTALL_DIR environment variables (default install location ~/.hawk/bin).

SAST / SCA / Code Security · 2026-09-22

StepSecurity Apps & PATs Inventory now available for GitHub Enterprise Server organizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends the Apps & PATs page to GitHub Enterprise Server organizations, inventorying installed GitHub Apps and fine-grained personal access tokens with permission, access scope, and status detail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-09-22

StepSecurity PAT Governance now supports CC recipients and per-class, per-band custom email content for pre-expiry token reminders.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CC recipient support so additional addresses (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ a security distribution list) are copied on every pre-expiry PAT reminder sent by the organization.
• Adds per-token-class reminder schedules with optional classic and fine-grained overrides that replace the shared default schedule (30, 7, 1 days before expiry) for one class.
• Adds per-token-class and per-reminder-band subject and body editors, prefilled with the default email, supporting placeholders for owner, token name, organization, days left, expiry date, and the management URL.

Network Analysis & Monitoring · 2026-09-22

tcpdump 4.99.7 extends MPTCP dissection, adds TCP AccECN flag support, and warns on misused --count.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an error message when --count is used without -r or -V.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds dissection of the MPTCP MP_TCPRST sub-option (subtype 0x8), including U/V/W/T flags and reset reasons such as Middlebox interference.
• Parses the data_len field in the MPTCP MP_CAPABLE option and prints all eight capability flags (A through H).

Detection Engineering · 2026-09-22

Tenzir Platform gains env-var controls for admin rules, internal proxy, external JWT auth, split blob storage URLs, and CORS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TENZIR_PLATFORM_ADMIN_RULES environment variable to define which users get admin access, using rules like auth_allow_all or auth_user with a user_id; generate valid rules with tenzir-platform tools print-auth-rule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds TENZIR_PLATFORM_INTERNAL_AUTH_SECRET, TENZIR_PLATFORM_INTERNAL_TENANT_TOKEN_ENCRYPTION_KEY, and TENZIR_PLATFORM_INTERNAL_APP_API_KEY environment variables for per-instance encryption and API access secrets.
• Adds BLOB_STORAGE__NODES_PUBLIC_ENDPOINT_URL environment variable to the platform container, allowing nodes in separate or restricted networks to reach S3-compatible blob storage via a different URL than the UI uses.

Detection Engineering · 2026-09-22

Tenzir Platform gains documented reverse-proxy configuration with native TLS support and four new endpoint env vars⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TENZIR_PLATFORM_UI_ENDPOINT, TENZIR_PLATFORM_NODES_ENDPOINT, TENZIR_PLATFORM_DOWNLOADS_ENDPOINT, and TENZIR_PLATFORM_API_ENDPOINT environment variables to configure the four platform entry points (UI, Gateway, Blob Storage, Platform API) behind a reverse proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds TLS_CERTFILE and TLS_KEYFILE environment variables to the app, websocket-gateway, and platform containers in docker-compose.yaml to enable native TLS serving per service without a terminating proxy.
• Adds TLS_CAFILE environment variable to the websocket-gateway container and REQUESTS_CA_BUNDLE / SSL_CERT_FILE to the platform container to support private or corporate CA certificates.

Detection Engineering · 2026-09-22

Tenzir Platform Sovereign Edition can now be deployed on AWS via a public CloudFormation template with Cognito or external OIDC auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Deploys the Tenzir Platform Sovereign Edition on AWS using a publicly hosted CloudFormation template at https://tenzir-marketplace-resources.s3.eu-west-1.amazonaws.com/tenzir-platform.yml, automating VPC, ECS Fargate, Lambda, App Runner, RDS PostgreSQL, S3, Cognito, ACM, and Route53 provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports external OIDC identity providers as an alternative to AWS Cognito via the UseExternalOIDC, ExternalOIDCIssuerURL, ExternalOIDCClientID, and ExternalOIDCClientSecret CloudFormation parameters.
• Accepts RandomSubdomain parameter to automatically prefix platform subdomains (e.g., ui.abc123.example.org) for staging or multi-tenant deployments.

Detection Engineering · 2026-09-22

Tenzir adds documented config knobs for parallelism, batching, catalog indexes, and partition compression tuning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds // parallelism: <n> pipeline directive (accepting disabled, max, or a positive integer) to run CPU-bound operators across multiple cores in a single pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tenzir.parallelism key in tenzir.yaml to set a node-wide default parallelism level that individual pipeline directives can override.
• Adds fuse=none, fuse=all, and fuse=parallel options to the // parallelism: directive to control whether operators are fused into a single group within a pipeline.

Detection Engineering · 2026-09-22

Tenzir documents how to expose its REST API via a built-in web server with four TLS deployment modes and token auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds web server --certfile / --keyfile / --mode flags to the tenzir-node --commands startup path to expose the REST API externally via a built-in HTTPS server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tenzir-ctl web generate-token command to create authentication tokens placed in the X-Tenzir-Token request header.
• Adds --mode=dev (plain HTTP, no token auth), --mode=server (HTTPS + token, default), --mode=upstream (localhost plain HTTP + token, for reverse proxies like nginx), and --mode=mtls (HTTPS + client certs + token, for load balancers) as four TLS deployment modes for the REST API.

Detection Engineering · 2026-09-22

Tenzir adds centralized TLS configuration in tenzir.yaml, covering cipher suites, mTLS, and per-platform overrides.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tenzir.tls block in tenzir.yaml with enable, skip-peer-verification, cacert, certfile, keyfile, password, tls-min-version, and tls-ciphers options to configure TLS once for all compatible operators (accept_relp, accept_splunk, from_http, to_opensearch, accept_opensearch, to_splunk).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tls-client-ca and require-client-cert keys under tenzir.tls in tenzir.yaml to enable mutual TLS (mTLS), rejecting client connections that do not present a certificate signed by the configured CA.
• Adds plugins.platform TLS block in tenzir.yaml with skip-peer-verification, cacert, certfile, keyfile, tls-min-version, and tls-ciphers to configure outbound TLS exclusively for the node-to-platform connection, overriding any matching tenzir.tls node-level setting.

Detection Engineering · 2026-09-22

Tenzir node docs add pipeline subprocesses, HTTP proxy routing, and endpoint disable options with concrete config keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tenzir.pipeline-subprocesses: true in tenzir.yaml (or TENZIR_PIPELINE_SUBPROCESSES=true env var) to move pipeline execution into subprocesses for improved error resilience and resource utilization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tenzir.http-proxy, tenzir.https-proxy, and tenzir.no-proxy config keys in tenzir.yaml to route outbound operator traffic through an HTTP proxy, with per-host/CIDR bypass support.
• Adds support for setting tenzir.endpoint to false to disable node-to-node TCP connections, making the node exclusively accessible through the Tenzir Platform.

Detection Engineering · 2026-09-22

Tenzir documents three pipeline execution modes: platform UI, tenzir CLI with -f file loading, and Pipelines-as-Code via tenzir.yaml⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -f flag to the tenzir binary to load a pipeline definition from a file instead of passing it inline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Pipelines-as-Code (PaC) by declaring pipelines under tenzir.pipelines in <prefix>/etc/tenzir/tenzir.yaml, with per-pipeline fields including name, description, definition, restart-on-error, labels, disabled, and unstoppable.
• Adds restart-on-error pipeline config key accepting true, false/null, or a duration (e.g. 1 minute) to automatically restart failed pipelines with a configurable delay.

Detection Engineering · 2026-09-22

Tenzir adds node-level TLS version/cipher controls, outbound proxy routing, and per-plugin YAML config files⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tenzir.tls.min-version config key (valid values: "1.0", "1.1", "1.2", "1.3") to enforce a minimum TLS protocol version across all operators and connectors, including to_opensearch, to_splunk, accept_tcp, from_tcp, serve_tcp, and accept_opensearch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tenzir.tls.ciphers config key accepting an OpenSSL cipher list string to restrict cipher suites for all node-level TLS connections.
• Supports per-plugin TLS overrides via tls-min-version and tls-ciphers keys in <configdir>/tenzir/plugin/platform.yaml, taking precedence over node-level tenzir.tls.* settings for Tenzir Platform connections.

Detection Engineering · 2026-09-22

Tenzir adds dashboards key to workspace.yaml for pre-defining ready-to-use visualizations in static workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dashboards key to workspace.yaml under workspaces.<id> to pre-define dashboards for static workspaces, with named cells, pipeline definition, visualization type (table, bar, line, etc.), and grid coordinates (x, y, w, h).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-09-22

Tenzir adds four chart operators — chart_pie, chart_bar, chart_line, chart_area — with inline aggregation, grouping, and dashboard export⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chart_pie operator with label (x), value (y) parameters to render pie charts directly in a TQL pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chart_bar operator with x, y, group, position (e.g. 'stacked'), and y_log parameters for categorical and grouped bar charts.
• Adds chart_line operator with x, y, group, resolution, x_min, x_max, y_min, y_max, and fill parameters for time-series and multi-series line charts.

Detection Engineering · 2026-09-22

Tenzir launches agent skills for AI coding agents, covering TQL, OCSF, ECS, CEF, LEEF, CIM, ASIM, EDM, and UDM schemas⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds npx skills add tenzir/skills (also via uvx skeel add or gh skill install) to install Tenzir agent skills into Claude Code, Cursor, Codex, GitHub Copilot, and 40+ other coding agents from the tenzir/skills repository.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tenzir skill packaging the entire Tenzir documentation — TQL, operators, functions, integrations, deployment, and configuration — with progressive disclosure for AI coding agents.
• Adds tenzir-ocsf skill providing OCSF schema reference for event classes, objects, attributes, profiles, and extensions for AI-assisted event mapping.

Detection Engineering · 2026-09-22

Tenzir v6.18.0 adds parallel pipeline execution, a recursive search function, and restores SentinelOne Data Lake operators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a search function for recursive value matching across pipeline data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds experimental warning suppression via quiet.
• Enables parallel execution for asynchronous transforms, increasing throughput for DNS, context, and Python workloads.

Runtime Security · 2026-09-22

Tetragon adds matchUserCallers selector to filter tracing policy events by user-space callstack depth and symbol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds matchUserCallers selector to TracingPolicy, enabling filtering based on the user-space callstack of a hooked uprobe function by depth (1–15 or "any"), symbol, startRange/endRange offsets, and an optional binary path field for cross-binary callers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports up to 5 entries in a single matchUserCallers selector, all of which must match for the selector to trigger.
• matchUserCallers selector is limited to uprobe hooks only, requires frame pointers in all binaries and linked libraries, and needs kernel ≥6.12 on amd64 to match the immediate caller (depth 1); arm64 does not support depth 1 matching.

SOAR · 2026-09-22

Tines 43.3.0 adds change control tracking and formula support for cases, plus visual case creation in the storyboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds change control tracking for cases directly within the storyboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds formula support for case details fields.
• Enables visual case creation from within the storyboard.

AI/LLM Security · 2026-09-22

ToolHive v0.51.0 adds SPIFFE JWT-SVID authentication for MCP clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Authenticates MCP clients using SPIFFE JWT-SVIDs, enabling workload identity-based access control for MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-09-22

Service Gateway Smart Protection Services 2.0.11 adds support for the TrendAI Vision One agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for the TrendAI Vision One™ agent on Service Gateway Smart Protection Services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-22

Ubiq PHP library gains typed dataset encryption, bulk key caching via loadCache, and typed search helpers for integer/date/datetime⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds \Ubiq\loadCache($credentials, $datasets) to prefetch all dataset configs and encryption keys in a single call to /api/v0/fpe/def_keys, eliminating per-dataset API round-trips on subsequent encrypt/decrypt calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds \Ubiq\encryptInteger and \Ubiq\decryptInteger entry points for datasets configured with data_type = 'integer' (size 32 or 64), bridging values through the FF1 cipher correctly.
• Adds \Ubiq\encryptDate and \Ubiq\decryptDate entry points for datasets configured with data_type = 'date', enforcing UTC-only DateTimeImmutable input.

Data Security & DLP · 2026-09-22

Ubiq JS library gains structured encryption for integers, datetimes, dates, tokens, and generic strings via new async methods⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds EncryptNumberAsync and DecryptNumberAsync on CryptographyBuilder-built structured objects for 32-bit (values −99,999,999 to 99,999,999) and 64-bit (values −9,999,999,999,999,999 to 9,999,999,999,999,999) integer datasets, plus encryptNumberForSearchAsync for searchable encryption across both sizes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds EncryptDateTimeAsync, DecryptDateTimeAsync, and encryptDateTimeForSearchAsync for structured encryption of DateTime values (supported range 1653-02-10 to 2286-11-20 UTC) against a pre-configured DateTime dataset.
• Adds EncryptDateAsync, DecryptDateAsync, and encryptDateForSearchAsync for structured encryption of Date-only values against a pre-configured Date dataset.

Data Security & DLP · 2026-09-22

Ubiq Java library adds integer, long, datetime, date, token, and generic-string FPE types plus thread-safe sessions, proxy support, and cache preloading.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds initSession() on UbiqUnstructuredEncryptSession and UbiqUnstructuredDecryptSession to manage state across begin, update, and end calls in a thread-safe way, enabling concurrent unstructured encrypt/decrypt operations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds encryptInt(), decryptInt(), and encryptIntForSearch() methods for 32-bit integer datasets (values between -99,999,999 and 99,999,999; encrypted range -1,470,375,551 to 1,470,375,551).
• Adds encryptLong(), decryptLong(), and encryptLongForSearch() methods for 64-bit integer datasets (values between -9,999,999,999,999,999 and 9,999,999,999,999,999).

Data Security & DLP · 2026-09-22

Ubiq Go v2 library adds typed structured encryption (int32/int64/date/datetime), key-number inspection methods, and cache preloading⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CipherAndKeyNumber method to return both the structured ciphertext and the key version used to encrypt it in a single call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GetCurrentKeyNumber method to fetch the active key number for a dataset from the server without encrypting anything, with automatic local cache update.
• Adds GetKeyNumber (on both StructuredEncryption and StructuredDecryption) to extract the key number embedded in an existing ciphertext without decrypting it or reporting a usage event.

Data Security & DLP · 2026-09-22

Ubiq C libraries gain Okta/Entra IDP authentication and a builder-pattern API for encryption objects⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds IDP integration supporting Okta and Entra as identity providers, with credentials set via UBIQ_IDP_USERNAME and UBIQ_IDP_PASSWORD environment variables instead of API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ubiq_platform_credentials_set_idp() (C) and credentials.set_idp_parameters() (C++) to configure IDP username, password, and host on a credentials object.
• Adds ubiq_platform_configuration_set_idp() (C) and configuration.set_idp_parameters() (C++) to configure IDP provider type (okta or entra), ubiq_customer_id, idp_token_endpoint_url, idp_tenant_id, and idp_client_secret on a configuration object.

Data Security & DLP · 2026-09-22

Ubiq Security adds Apache Airflow integration with UbiqEncryptOperator and UbiqDecryptOperator for DAG-based structured encryption.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Accepts a credentials parameter (Ubiq credentials object via ubiq.configCredentials()), a data_task parameter referencing a prior task's task_id, and a dataset_names list mapping column positions to Ubiq dataset names — with empty strings passed for columns to leave unencrypted.

Data Security & DLP · 2026-09-22

Ubiq Security BigQuery integration adds IDP authentication support, enabling SSO-based encrypt/decrypt without API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds IDP authentication for BigQuery integration via idp_setup.sh, IDP_CUSTOMER_ID, and IDP_PRIVATE_KEY_PATH env variables, enabling enterprise SSO users to encrypt/decrypt data without API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ubiq_idp_auth Cloud Function (deployed via gcloud functions deploy ubiq_idp_auth) to handle the SCIM-based handshake between Ubiq and BigQuery.
• Adds ubiq_idp_auth BigQuery remote function and ubiq_begin_idp_session procedure as IDP-aware replacements for begin_ubiq_session, requiring no API key arguments.

Data Security & DLP · 2026-09-22

Ubiq adds a Rust SDK, Kong gateway plugin, Airflow operators, Grafana Loki integration, and expanded dataset types across all client libraries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new loadCache function to the PHP library to prefetch dataset configuration and encryption keys for many datasets in a single call, reducing first-use latency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new CipherAndKeyNumber, GetCurrentKeyNumber, and GetKeyNumber functions to the Go library to return the key number behind a ciphertext without decrypting it.
• Adds new Ubiq Rust SDK (Beta) — available on crates.io as ubiq-rust — supporting structured and unstructured encryption, integer and date/time datasets, encrypt_for_search, and key zeroization.

Data Security & DLP · 2026-09-22

Varonis Private Cloud Data Collectors now support AWS Secrets Manager, Azure Key Vault, and HashiCorp Vault for credential storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for configuring Private Cloud Data Collectors to use AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault as external secret stores for collector credential storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-22

Varonis adds flexible on-demand scan prioritization, letting you choose between a Prioritized Scan and a standard queued rescan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds on-demand scan prioritization, letting you select either a Prioritized Scan for immediate execution or a standard queued rescan to balance urgency with resource efficiency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-22

Varonis now scans Confluence page history to surface sensitive data in older revisions and tag them for investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables analysis of historical versions of Confluence pages to detect sensitive content, with automatic tagging of affected pages to support investigation and remediation workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-22

Varonis Private Cloud Data Collector can now be deployed to AWS ECS using Terraform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports deploying the Varonis Private Cloud Data Collector to AWS ECS via Terraform, enabling infrastructure-as-code management of collector environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-22

Varonis adds Jira content visibility — track and analyze permissions on issues, comments, attachments, and worklogs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Tracks access to Jira content types — issues, comments, attachments, and worklogs — to surface who can access specific data and how that access is granted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Analyzes effective permissions across Jira to identify overexposed or broadly accessible resources.

Data Security & DLP · 2026-09-22

Varonis can now monitor GitHub Enterprise Cloud via a GitHub App with least-privilege permissions and enterprise-wide coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GitHub Enterprise Cloud monitoring via a GitHub App integration, scoping permissions to only what is required for monitoring and classification activities while providing enterprise-wide coverage and flexible deployment options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-09-22

Varonis now supports self-service Snowflake PrivateLink configuration via the integration wizard for AWS and Azure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for configuring Snowflake integrations using AWS PrivateLink or Azure Private Link directly from the Varonis integration wizard, with automatic endpoint URL generation, pre-deployment connectivity validation, and remediation guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-09-22

Velociraptor 0.76 adds an offline-capable local documentation search and preview directly in the Admin GUI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds in-GUI local documentation search and preview (accessible via an icon in the app footer) powered by the Bleve query engine, available from version 0.76.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Bleve query syntax with field-scoped searches across title, text, tags, and crumbs fields, including required (+), excluded (-), and phrase ("...") operators.
• The documentation index is managed as a tool in the root org and is automatically downloaded on first search; non-root orgs have their search redirected to the root org so all orgs share one copy.

Digital Forensics & Incident Response · 2026-09-22

Velociraptor GUI gains customizable pages, sidebar links, context menus, themes, and static file serving via GUI.reverse_proxy⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GUI.links config section to define custom sidebar links and context menu items globally for all users, with fields including text, url, icon_url, type (sidebar or context), parameter, new_tab, and disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GUI.reverse_proxy.url config setting to serve static files (e.g. images) from a disk path, making them available as GUI assets without recompiling the binary.
• Adds user_options VQL function to set per-user sidebar and context menu links, merged with global and default links.

Digital Forensics & Incident Response · 2026-09-22

Velociraptor gains a structured Logging config block for file-based and remote syslog log forwarding with per-component and per-level control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Logging.output_directory to server.config.yaml to write rotating log files to disk; when empty or omitted, no files are written.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Logging.separate_logs_per_component (default false) to split log output into per-component files such as VelociraptorFrontend_info.log, VelociraptorAudit_info.log, and VelociraptorAPI_info.log.
• Adds Logging.remote_syslog_server (host:port), Logging.remote_syslog_protocol (udp, tcp, or tls), and Logging.remote_syslog_components to forward log events to a remote syslog server or SIEM.

Digital Forensics & Incident Response · 2026-09-22

Velociraptor 0.77 adds an officially supported Docker container image published to ghcr.io/velocidex/velociraptor-server⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds VELOCIRAPTOR_NO_INITIALIZE environment variable (set to TRUE in .env) to skip building MSI/DEB/RPM client packages on first container start.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds VELOCIRAPTOR_LITERAL_CONFIG environment variable to pass a literal server config string to the container instead of reading from a file path.
• Adds VELOCIRAPTOR_HOSTNAME, VELOCIRAPTOR_FRONTEND_PORT, VELOCIRAPTOR_GUI_PORT, VELOCIRAPTOR_DATASTORE_PATH, VELOCIRAPTOR_CONFIG_PATH, and VELOCIRAPTOR_INITIAL_ADMIN_PASSWORD environment variables (set via .env) to control Docker container behavior.

Digital Forensics & Incident Response · 2026-09-22

Velociraptor gains experimental multi-frontend scaling via master/minion architecture with MemcacheFileDataStore and RemoteFileDataStore.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Datastore.master_implementation: MemcacheFileDataStore config key enabling the master node to cache datastore files in memory and flush to EFS asynchronously, reducing perceived write latency.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Datastore.minion_implementation: RemoteFileDataStore config key enabling minion nodes to access the master datastore over gRPC instead of reading/writing the shared filesystem directly.
• Adds ExtraFrontends configuration block to define additional minion frontend hostnames, bind addresses, ports, and dynamic DNS credentials.

SAST / SCA / Code Security · 2026-09-22

Veracode adds Jira 11 support, a redesigned EASM UI, and improved Python scanner flaw matching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Veracode Integration for Jira Server v5.0.2 adds support for Jira 11, including Java 21 and platform compatibility with Jira 11.3.10.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enhanced Python scanner now uses each application's initial scan baseline for consistent flaw matching across subsequent scans.

Cloud Security Posture · 2026-09-22

Wiz MCP gains a GA WIN partners endpoint so partner AI agents can pull live Issues, Findings, and resources on demand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a GA WIN partners endpoint in the Wiz MCP, letting partner AI agents (Claude Code, Cursor, GitHub Copilot, or any remote-MCP-capable agent) search WIN documentation, retrieve API operations and required scopes, and query demo environment data without manual API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces MCP-based agent integrations in the Wiz Integration Network (WIN), enabling partner AI agents to pull live Wiz context — Issues, Findings, affected resources, attack paths, and blast radius — directly from customer tenants on demand during investigations.

AI/LLM Security · 2026-09-21

AI SAFE² CLI 0.7.0 adds safe2 evidence truth and safe2 evidence changes to correlate multi-harness agent evidence and detect configuration drift.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds safe2 evidence truth command to correlate harness evidence, revision-bound task receipts, coverage, usage declarations, and completion claims across multiple agent harnesses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds safe2 evidence changes command to run a bounded one-shot inventory of skills and recognized agent configuration locally or in CI, detecting additions, modifications, and removals.
• Adds --baseline, --output, --strict, and --card flags to safe2 evidence subcommands for controlling baseline comparison, artifact output paths, strict-mode enforcement, and human-readable decision card generation.

SAST / SCA / Code Security · 2026-09-21

Aikido releases Altar, an open-weight AI security model for air-gapped and sovereign deployments inside Aikido Machine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Altar, an open-weight security AI model (328 GB, W4A16 quantization, 168 of 256 routed experts retained) that powers Aikido Machine's autonomous pentesting entirely inside customer-controlled or air-gapped infrastructure without sending code or findings to a third-party inference service.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Altar is deployable on a 4-H200s node using vLLM, with model weights, a model card, license, serving flags, and deployment instructions available under Aikido's organization.

Identity & Access Management · 2026-09-21

Auth0 FGA Permissions Index (Early Access) precomputes all user permissions and streams them into your own database for constant-time SQL JOIN-based access checks at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces FGA Permissions Index (Early Access), which precomputes every access implied by chosen relations (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ can_view) on an object type and streams the results directly into the customer's own database, enabling a simple SQL JOIN instead of runtime graph traversal for permission-filtered queries.
• Supports indexing high-cardinality relations on an object type so that permission lookups on indexed relations become constant-time, while non-indexed relations continue to be evaluated by FGA in real time.

Identity & Access Management · 2026-09-21

Auth0 Agent Gateway (beta) adds a CIAM control plane for governing customer-facing AI agents across multi-tenant SaaS products.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New Auth0 Agent Gateway beta provides a centralized policy-enforcement layer that evaluates tool-call authorization in real time using agent, user, and organization context before any external tool is invoked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Integrates with Auth0 Token Vault and on-behalf-of token exchange to broker short-lived, user-scoped tokens for internal and external APIs — keeping raw credentials out of LLM prompts, context windows, and logs.
• Supports organization-aware, multi-tenant routing that isolates tool access and connected credentials (e.g. Slack, Microsoft Teams) per customer tenant, preventing cross-tenant data exposure.

Identity & Access Management · 2026-09-21

Auth0 launches Identity Conversion Suite (Early Access) with Anonymous Sessions and Experiment Center for auth flow A/B testing⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Passes the anonymous session token to the Auth0 /authorize endpoint on sign-up or login, making all prior anonymous activity available inside Actions for custom handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Anonymous Sessions: issues OAuth 2.0-compliant access tokens to unauthenticated guest users, enabling guest checkout, cart tracking, pre-login personalization, and secure API access without authentication — with seamless transfer of anonymous metadata into the authenticated profile on sign-up or login.
• Adds Experiment Center: split authentication traffic into variants (by percentage or segment) for capabilities such as passkeys, MFA steps, signup form copy, and branding themes — across Universal Login (including Auth0 Custom Universal Login / ACUL), Forms, Actions, and Page Templates — without changing application code.

Data Security & DLP · 2026-09-21

BigID launches AgentIQ, enabling agentic automation of data security workflows via MCP through Claude, Copilot, ChatGPT, Gemini, and custom enterprise agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces AgentIQ, a new agentic automation layer that lets practitioners describe data and AI security workflows in natural language and have an agent investigate, prioritize, report, and take action across BigID's discovery, classification, access intelligence, and remediation capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes BigID's operational capabilities — discover, classify, investigate, remediate, govern, and fulfill — to external AI assistants (Claude, ChatGPT, Copilot, Gemini, and custom enterprise agents) through MCP and APIs, so teams can operate BigID from whichever AI interface they already use.
• Ships pre-built agents for sensitive data remediation, AI governance enforcement, access exposure analysis, and privacy operations, enabling teams to start without building custom agent workflows.

Web Application Security · 2026-09-21

BunkerWeb gains a guided install-bunkerweb.sh --docker upgrade path with automatic backup, health checks, and rollback for Docker stacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --compose-dir PATH flag to install-bunkerweb.sh --docker to specify the stack directory instead of defaulting to the current working directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -v, --version VERSION flag to target a specific BunkerWeb version during upgrade, deriving the image tag automatically.
• Adds --image-tag TAG flag to supply a Docker image tag directly instead of deriving it from a version string.

Web Application Security · 2026-09-21

BunkerWeb UI gains Redis-resilient session fallback with UI_USE_REDIS, per-service draft mode in the RAW editor, and scoped role controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds UI_USE_REDIS=no config variable to decouple the web UI from Redis independently of the global USE_REDIS setting, so Redis can be disabled for session storage without also disabling lock and report sharing between instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Redis-resilient session storage: when Redis is unavailable or rejects writes due to maxmemory, UI sessions fall back to a local per-host cache, with revocations (including logout and session-ID rotation) recorded in both stores to ensure they take effect regardless of Redis state.
• Adds draft mode in the RAW editor for services and global settings: prefix a KEY=value line with # to mark it as a draft (value stored but not applied), or press Backspace on a draft line to activate it; draft lines persist across saves until explicitly activated.

Web Application Security · 2026-09-21

BunkerWeb adds CrowdSec management APIs, header-based bypass rules, and session revocation memory config across multiple modules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SESSIONS_REVOCATION_MEMORY_SIZE config key to control the in-memory store size for revoked cookie session identifiers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ANTIBOT_IGNORE_HEADER_NAME and ANTIBOT_IGNORE_HEADER_VALUE config keys (numbered pairs _NAME_1/_VALUE_1) to allow requests matching a named header and optional PCRE regex to bypass the antibot challenge.
• Adds BLACKLIST_HEADER_NAME and BLACKLIST_HEADER_VALUE config keys (numbered pairs) to blacklist requests carrying a specific header and optional PCRE-matched value.

Web Application Security · 2026-09-21

BunkerWeb adds SentinelOne, SysWarden, and VirusTotal integrations plus ClamAV antivirus file scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds EXTERNAL_PLUGIN_URLS config key supporting https://github.com/bunkerity/bunkerweb-plugins/archive/refs/tags/v1.12.zip to install the new plugin bundle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bunkerweb-plugins/sentinelone plugin to check uploaded file hashes and client IPs against the SentinelOne API, blocking requests based on reputation or indicators of compromise.
• Adds bunkerweb-plugins/syswarden plugin to synchronize BunkerWeb bans to SysWarden for kernel-level nftables blocking and import its block/allow lists.

Web Application Security · 2026-09-21

BunkerWeb: The install script rewrites .env with the new image tag while preserving any manually added entries, and backs up both .env and docker-compose.yml with a .bak.<timestamp> copy before making changes.

• The upgrade process runs docker compose pull then docker compose up -d, recreating only containers whose image changed, and requires two healthy observations at least ten seconds apart before declaring success.

Web Application Security · 2026-09-21

BunkerWeb: Adds a Pages supplémentaires → CrowdSec UI page showing connection status, local API connectivity, decision synchronisation, allowlist entries, and IP investigation with pre-filled addresses from Reports and Bans pages.

Web Application Security · 2026-09-21

BunkerWeb 1.6.15 adds per-setting draft mode in the RAW editor, letting you toggle individual settings without losing their inherited defaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per-setting draft mode in RAW mode: press # at the start of a setting line to toggle it to draft state (showing a muted # prefix), and press Backspace at the start to reactivate it; draft settings retain their inherited or default value until activated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Draft settings are preserved when saving in Simple or Advanced mode, keeping editor metadata consistent across UI modes.