The week in full · Oct 2–8

Identity & Access Management · 2026-10-08

SaaS Manager adds a Budget threshold crossed workflow trigger, multi-year budgets, team app ownership, and a new Access tab on application pages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Budget threshold crossed workflow trigger that fires when a budget crosses a configured threshold or reaches 100%, and surfaces application, budget, current spend, budget amount, and budget period details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Access tab to application pages, consolidating the existing Access Level table, edit actions, and delete actions into a dedicated view.
• Supports budgets that span more than one year.

AI/LLM Security · 2026-10-08

AI SAFE² CLI v1.0.1 hardens MCP scoring, skill trust gating, and wrap-mode blocking with new rules TG-013 to TG-024.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds rules TG-013 to TG-024 to safe2 gate skill, rejecting hostile skills including paraphrased overrides, Unicode tags, homoglyphs, env exfiltration, persistence, and trigger hijack.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends safe2 scan mcp / safe2 gate mcp PATH to detect Python and TypeScript sinks previously missed, obfuscated execution, and evasion via file renaming (e.g. renaming a vulnerable file to test_server.py).
• Updates safe2 score mcp / safe2 gate mcp URL so self-attestation (.well-known/mcp-security.json) and unvalidated OAuth metadata no longer contribute to the score; hostile schema content caps the score, withholds the badge, and causes safe2 gate mcp to exit 1.

AI/LLM Security · 2026-10-08

Aurascape September 2026 adds sensitive data masking, granular per-model policy, MCP conversation detail, and classification management APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New APIs automate management of data patterns, data categories, and data combination lists for data classification configurations, and can retrieve the supporting objects those configurations reference.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sensitive data masking as a mode of the redact action in Protection policy, replacing sensitive values in prompts before they reach the LLM and restoring real values in the response the user reads.
• Adds administrator SSO activity to Audit Logs, recording successful and failed login attempts with timestamp, status, and source IP address.

Patch Management · 2026-10-08

AutoPkg 3.0 adds recipe-map caching, a new clear-cache verb, URLDownloader hashing, and sweeping audit and security hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds autopkg generate-recipe-map command and an on-disk JSON cache at ~/Library/AutoPkg/recipe_map.json that indexes every recipe and override by identifier and shortname, dramatically speeding up recipe resolution on systems with many repos; cache location is overridable with the RECIPE_MAP_PATH preference or AUTOPKG_RECIPE_MAP_PATH env var, and can be disabled entirely with DISABLE_RECIPE_MAP preference or AUTOPKG_DISABLE_RECIPE_MAP=1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new autopkg clear-cache verb to remove cached files for a named recipe or all cached files; supports --dry-run to preview deletions and -v/-vv for varying verbosity.
• Adds COMPUTE_HASHES input variable (default: False) to URLDownloader to enable on-demand computation of MD5, SHA1, and SHA256 hashes of downloaded files, made available as output variables to subsequent processors.

Identity & Access Management · 2026-10-08

BeyondTrust Pathfinder adds regional PII data residency, letting admins place user auth data in eight regions worldwide.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Organization Settings > Data Residency to let organization administrators set a regional PII store for all users, with a background migration to US East (Virginia), Canada, Brazil, Germany, the UK, India, Singapore, or Australia.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Data residency region field under Administration > User Management > Edit User for per-user region overrides that move PII auth data in a single operation without downtime.
• Adds identity provider region setting on SAML and directory providers (Identity & Authentication Providers > Edit Identity Provider and Directory Authentication > Edit Directory Provider) to control where new users are first stored at sign-in.

Identity & Access Management · 2026-10-08

BeyondTrust Pathfinder adds org-level IP allowlisting for the console, REST API, and MCP endpoints, with CSV bulk import and up to 900 entries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Administration > IP Allowlist in the Pathfinder console to define a per-organization allowlist of trusted public IPv4/IPv6 addresses and CIDR ranges (up to 900 entries) that gate access to the Pathfinder web console (app.beyondtrust.io), Platform REST API requests, and supported Model Context Protocol (MCP) endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports CSV bulk import of allowlist entries via the Import IP Addresses tab, where the first column is the IP address or CIDR range and an optional second column supplies descriptions.
• Supports per-entry formats including single IPv4/IPv6 addresses, CIDR blocks (e.g. 203.0.113.0/24, 2001:db8::/48), and IPv4 start-end ranges (e.g. 203.0.113.14-203.0.113.58), each with an optional description up to 140 characters.

Identity & Access Management · 2026-10-08

BeyondTrust Pathfinder adds a PII Region field to identity provider registration for data residency control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a PII Region field to the identity provider Manual Entry tab in BeyondTrust Pathfinder, letting administrators select which region stores the personally identifiable information (PII) authentication data of users created through that provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-08

BeyondTrust identity providers gain a PII region selector to control where user authentication data is stored.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a PII region setting to identity provider configuration, letting admins choose the data-residency region where personally identifiable information from IdP-authenticated users is stored; defaults to the US region if unset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-08

BeyondTrust Pathfinder adds multi-language UI support: English, French, German, and Spanish.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds language selection to Pathfinder account settings, supporting English, French, German, and Spanish, plus a Browser Default option that automatically matches the browser's configured language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-08

BeyondTrust adds the Pathfinder Authentication API for managing IP allowlists and auth settings via REST.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Pathfinder Authentication API at base URL https://api.beyondtrust.io/platform/auth, authenticated via Authorization: Bearer <token> (personal access token), with requests and responses in JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an IP allowlist API under the Pathfinder Authentication API to manage the IP addresses and ranges that can reach your organization's resources and toggle enforcement on or off.

Post-Exploitation · 2026-10-08

API surface changed: +8 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /api/v2/gpos/{object_id}/sites⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /api/v2/sites/{object_id}
• New endpoint GET /api/v2/sites/{object_id}/controllers

Post-Exploitation · 2026-10-08

BloodHound v9.8.0 adds AD Sites ingestion with 8 new API endpoints, GA Findings Table, Early Access Findings Prioritization, and archived_at API field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds archived_at response field to the List attack path findings API, returning a timestamp when a finding has been archived and omitting the field when it has not.
• Ingests and analyzes Active Directory Sites, SiteServer, and SiteSubnet objects — including containment, ACLs, site-linked GPOs, and ServerIs relationships — requiring SharpHound v2.17.0.
• Adds Tier Zero Computer Identified by Non-Tier Zero Site Server finding when a non-Tier Zero Site Server references a Tier Zero computer.

Post-Exploitation · 2026-10-08

Post-Exploitation · 2026-10-08

bloodhound: Adds Active Directory Sites collection in SharpHound v2.17.0: collect Sites, SiteServers, SiteSubnets, their mappings, site-linked GPOs, and Site ACLs.

• Makes Findings Prioritization generally available, enabling risk-based guidance to prioritize Attack Path findings for triage and remediation.
• Adds triage improvements to Attack Path findings: cross-platform indicators, clearer status, and copy actions for selected asset information.
• Extends Active Directory collection coverage to include the Builtin container and the underlying AD objectClass for collected nodes.

Post-Exploitation · 2026-10-08

BloodHound v9.8.0 adds ZIP bundle ingestion, AD site visualization, custom deny ACE counts, alerts retry, and richer saved queries with extension and category fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds extension_id and category fields to saved queries API responses, and supports extension and category assignment on query upsert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds is_cross_platform type field to the Findings Table for cross-platform finding classification.
• Supports ZIP bundle ingestion for the extension upload API.

Attack Surface & Exposure Management · 2026-10-08

Censys launches AI Investigations: automated multi-entity pivot analysis with a 100-indicator limit and API support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports launching investigations via the Investigations: Create job API endpoint, in addition to the UI.
• Caps submissions at 100 indicators per investigation, five concurrent investigations per user, and 150 investigations per week per organization (UI and API combined); investigations do not consume Censys Credits.

Internet Services · 2026-10-08

Cloudflare adds CASB custom Rego-based finding types, BGP over IPsec/GRE GA, Organizations GA, and MDM IPv4-preference setting for WARP clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an MDM setting to prefer IPv4 when resolving hostnames in proxy mode for Cloudflare One Client (macOS, Windows, Linux); the setting is off by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports routing non-RFC 1918 local IPv4 networks through the tunnel when unrestricted LAN inclusion is enabled by policy or MDM — available on macOS, Windows, and Linux clients.
• Adds CASB custom finding types, letting security teams write detection logic in Rego (Open Policy Agent) scoped to a provider (e.g., Google Workspace, Microsoft 365) and asset class (users, files, groups) with built-in expression validation via Validate.

Internet Services · 2026-10-08

Cloudflare adds Log Explorer Observability integration, DNS quota warnings, Organizations GA, and consistent AI Gateway error responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Log Explorer dataset querying from the Observability Logs page in the Cloudflare dashboard (Log Search has moved to Logs > Observability).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds DNS records quota warnings on the DNS records page before the quota limit is reached.
• Standardizes provider authentication failure HTTP status codes through the AI Gateway REST API.

Vulnerability Management · 2026-10-08

CVE MCP Server exposes 28 cyber tools across 24 APIs — anchored by a triage_cve orchestrator — letting Claude triage CVEs in one call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds triage_cve one-call orchestrator that fans out to NVD, EPSS, and CISA KEV concurrently, computes a composite 0–100 risk score with a KEV hard override, falls back to VulnCheck NVD++ when NIST NVD is throttled, and emits an SSVC v2 gated decision at depth='deep'.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes MCP Resources kev://catalog, epss://scores/{cve_id}, and manifest://tool-hash (SHA-256 over the registered tool surface for tamper detection), plus Prompts patch_decision, compare_and_prioritize, and dependency_triage.
• Adds lookup_cve, search_cves, get_epss_score, check_kev_status, get_cvss_details, get_cwe_info, get_cve_references, and bulk_cve_lookup (up to 20 CVEs per call) for core vulnerability intelligence.

SIEM · 2026-10-08

Databricks Lakeflow Connect adds a managed Google Workspace connector (Beta) for ingesting audit activity via OAuth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a managed Google Workspace connector in Databricks Lakeflow Connect (Beta) to ingest audit activity from Google Workspace applications and services, using OAuth user authorization and supporting incremental ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-08

Databricks Genie agents gain MCP connector support for external tools like Google Drive and Slack (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Attach MCP connectors to a Genie agent to enable access to external tools and sources such as Google Drive and Slack (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-08

DeepSeek V4.1 Flash now available with priority pay-per-token and reserved provisioned throughput on Databricks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds priority pay-per-token serving for DeepSeek V4.1 Flash to reduce latency for latency-sensitive traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds reserved provisioned throughput for DeepSeek V4.1 Flash for dedicated, predictable capacity.

SIEM · 2026-10-08

CREATE OR REPLACE VIEW will preserve grants, tags, and comments in-place by default starting December 2, 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds NOCOPY * modifier to CREATE OR REPLACE VIEW <catalog>.<schema>.<view> NOCOPY * to explicitly drop grants, tags, and comments when replacing a view (governed tags are still retained).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Raises a CANNOT_DROP_TAGGED_COLUMN error when a governed tag on a view column is not removed before dropping that column via CREATE OR REPLACE VIEW, protecting dependent ABAC policies.

SIEM · 2026-10-08

Databricks adds OAuth custom identity claims for service principal tokens, enabling per-user row filtering through a single service principal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds custom_claim parameter to OAuth token requests using client_credentials or urn:ietf:params:oauth:grant-type:token-exchange grant types, letting applications attach a custom identity claim to service principal tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds current_oauth_custom_identity_claim() SQL function to read the custom identity claim value at query time, returning NULL when no claim is present.
• The Genie Conversation API, the SQL Statement Execution API, and the Databricks JDBC Driver honor the custom_claim, enabling per-user data isolation through a single service principal via dynamic view row filters.

SIEM · 2026-10-08

Databricks enables remote_query table-valued function by default for compliance security profile workspaces in November 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the remote_query table-valued function by default for workspaces with the compliance security profile enabled, allowing queries on external databases in their native SQL syntax using Unity Catalog connection credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-08

ai_parse_document now extracts chart values, series, legends, and axes as structured JSON for search and agent use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends ai_parse_document to extract chart values, series, legends, and axes as structured JSON, enabling search and agents to use chart data in answers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-08

Datadog Cloud SIEM: Adds Entity Packs to identify users in your environment and enable user-based risk scoring and investigations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Supply Chain Firewall (SCFW) to the Content Pack catalog for Cloud SIEM.
• Adds Obsidian Security, Orca Security, and Wiz Vulnerabilities as new threat-intelligence and posture integrations in Content Packs.

SIEM · 2026-10-08

Cloud SIEM Content Packs gain Entity Packs for user-context signals, plus new integrations including Zscaler, Oracle Fusion, and BeyondTrust.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Entity Packs — a new pack category that identifies users in your environment, enabling user context in signals and risks, risk scoring per user, and user-based investigations (at least one Entity Pack is required to detect risky users).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Workload Protection pack covering Runtime Security Posture, File Integrity Monitoring, Intrusion Detection, and Malware Prevention across workloads.
• Expands threat intelligence and enrichment packs to include Falco, Google Security Command Center, Microsoft Graph, Obsidian Security, Orca Security, Palo Alto Networks Cortex XSOAR, Recorded Future, and Wiz Vulnerabilities.

SIEM · 2026-10-08

Cloud SIEM's Entity Risks adds federated user identity grouping, rolled-up risk scoring, and user-identity-targeted notification rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Entity Risks (formerly Risk Insights) with filtering by entity provider, entity type, entity name, risk score, and configuration risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports grouping risks by user identity to aggregate a single person's risk score across all resolved accounts, aliases, IAM roles, and repository accounts via an Entity Pack for Okta, Google Workspace, or Microsoft Entra ID.
• Adds notification rules scoped to User identity grouping that trigger when one person's rolled-up risk score crosses a threshold — distinct from per-entity rules — with template variables for display name, identity provider, rolled-up risk score, contributing entity count, and top contributing entities.

SIEM · 2026-10-08

Datadog Cloud SIEM: Adds Zscaler Internet Access to Entity Pack integrations for user identity context.

• Adds User Inventory and Entity Risks as new Cloud SIEM capabilities surfaced through Content Packs.

Endpoint Security (EDR/XDR) · 2026-10-08

Identity & Access Management · 2026-10-08

Didit adds scoped API keys with per-resource access, IP allowlists, workflow limits, and a 24-hour rotation overlap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds named API keys alongside the primary secret, each scoped to specific resources (Sessions, Decisions, Media, People, Companies, Transactions, Workflows, Webhooks, Application settings, Analytics, API keys) with None, Read, or Write granularity per resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports three access presets — Full access, Read only, and Custom — selectable at key creation and editable later without redeploying (new access applies within one minute).
• Introduces an Only approved sessions limit that hides declined, in-review, and unfinished sessions from a key.

Identity & Access Management · 2026-10-08

Didit blocklist now covers document-capture selfies separately, including sessions where users stopped before liveness.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables blocklisting of selfies captured by the front camera during document capture — not just the liveness selfie — so users who abandon before the liveness step can still be flagged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds FRONT_CAMERA_FACE_IN_BLOCKLIST and POSSIBLE_FRONT_CAMERA_FACE_IN_BLOCKLIST result codes: new sessions compare each document-capture selfie against the blocklist at document evaluation time, with the latter indicating a near match routed to review.
• Extends blocklist matching so every blocklisted face (liveness or document-capture origin) is checked against both the liveness selfie and all document-capture selfies in new sessions.

Identity & Access Management · 2026-10-08

Didit Networks gains PDF and CSV export, private team notes, and shared fraud-signal intelligence views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Download PDF export for a network, covering review status, connected accounts, source references, and shared signals; account and signal lists are capped at 500 entries and the PDF excludes global intelligence and private notes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Export CSV via the overflow menu for the account list inside a network.
• Adds a Notes panel in the network detail header for team-scoped investigation discussion; notes never enter shared intelligence, require read:networks to read and write:networks to add, and survive network merges.

Identity & Access Management · 2026-10-08

Didit manual review gains resubmission workflow with email preview, branding controls, and ?include=resubmissions on the Retrieve Session API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ?include=resubmissions query parameter to the Retrieve Session API endpoint to return all earlier submission data alongside the current session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports multiple numbered resubmission requests on a single session, each preserving who requested it, why, and all prior check results under per-step submission tabs (Submission 2 · latest, Submission 1).
• Adds email preview step before sending a resubmission request, showing recipient, sender, subject, and localized content — with white-label sessions using configured branding and verified sender.

Identity & Access Management · 2026-10-08

Didit: Supports optional per-key restrictions: limit to specific workflows, approved sessions only, an IP address allowlist, or an expiry date.

• Enables key rotation with a 24-hour overlap window, and immediate revocation of any scoped key.

Identity & Access Management · 2026-10-08

Didit launches an MCP server at https://mcp.didit.me/mcp with 156 tools spanning sessions, workflows, AML checks, lists, cases, reports, and webhooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a stateless Streamable HTTP MCP server at POST https://mcp.didit.me/mcp with a public health check at GET https://mcp.didit.me/healthz, requiring no session affinity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes 156 tools across sessions, workflows, standalone checks, transaction monitoring, lists, cases, reports, and webhooks for agent-driven automation.
• Authenticates via OAuth 2.1 with PKCE (Log in with Didit) — no API keys or secrets in config; headless stdio runs accept a user Bearer token.

Public Key Infrastructure (PKI) · 2026-10-08

CertCentral defaults to G5 RSA/ECC roots for all TLS issuance and trims self-signed roots from Apache downloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Switches default TLS certificate issuance (new orders, renewals, reissues, and duplicates) to DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 for all DV, OV, and EV certificates across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-10-08

VulnDB HQ gains token-based API auth, a dedicated /api/ endpoint with versioning via Accept header, and an open-source Ruby client library.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds token-based authentication for the VulnDB HQ API, replacing HTTP Basic auth — retrieve your token from the Profile page and pass it via a custom HTTP header; regenerate it at any time to revoke third-party access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a dedicated /api/ endpoint for VulnDB HQ API access, with API version negotiation via the Accept HTTP header (v2).
• Open-sources a Ruby client library (vulndbhq) for integrating VulnDB HQ with external tools, available at https://github.com/securityroots/vulndbhq.

Exploitation & C2 · 2026-10-08

Dradis adds white-labeling, MITRE ATT&CK calculator, kit downloads, REST export/upload endpoints, and a /jobs view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an endpoint for uploading tool outputs via the REST/JSON API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a /jobs view to view and manage background jobs.
• Adds a MITRE ATT&CK calculator supporting Enterprise, Mobile, and ICS matrices, accessible from the MITRE tab on Issues and as a standalone tool from the Tools menu.

Exploitation & C2 · 2026-10-08

Dradis Pro v4.18 adds BI Dashboard year-over-year trends, custom properties view, and mapping copy-on-upload for kits and report templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an option to copy existing mappings when uploading kits or report templates, so you can quickly apply or migrate mappings to new or updated templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Business Intelligence Dashboard view with year-over-year insights into activities and custom properties, plus lists of most common issues across projects.
• Adds a Custom Properties view to the Business Intelligence section.

Exploitation & C2 · 2026-10-08

Dradis v4.19 adds local-LLM AI assistance via Ollama, Gateway webhooks, and CSV bulk-import for IssueLibrary⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Dradis Echo, an optional AI integration that deploys a local LLM via Ollama to summarize raw scanner output, rewrite tester notes into executive language, and enhance remediation advice — no external connections required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds event-driven webhooks for Dradis Gateway, enabling automated actions on contributor requests, remediation progress, and project completions — with integrations to Slack, Jira, Azure DevOps, and ServiceNow.
• Adds CSV file upload to IssueLibrary for bulk-importing custom issues.

Exploitation & C2 · 2026-10-08

Dradis: Adds a new API endpoint for exporting and downloading reports, and adds Node Properties to the Node endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Docker Hub releases and a new command-line interface for streamlined remote-server deployment of Dradis CE.
• Adds Dradis OTP, a built-in MFA integration supporting any TOTP authenticator app via QR code scan, replacing the DuoWeb-only limitation.
• Adds Audit Logging that tracks instance-wide activity in one place and supports CSV export.

Exploitation & C2 · 2026-10-08

Dradis Pro v4.19.0 adds a full Business Intelligence Dashboard with custom Team/Project properties, trend analysis, and data-query views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Business Intelligence Dashboard (available in Dradis Pro v4.19.0+), accessible via Tools > Business Intelligence, replacing the previous command-line Year in Review script with an in-app UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds custom Team Properties (Integer, String, and List field types) to tag clients by industry, region, revenue, or any user-defined dimension for BI analysis.
• Adds custom Project Properties (Integer, String, and List field types) to categorize engagements by project type, scope accuracy, complexity, or testing methodology.

Exploitation & C2 · 2026-10-08

Dradis: Adds custom Team Properties and Project Properties with Integer, String, and List field types for Data Analysis queries in the Business Intelligence Dashboard.

• Adds a Services section to Dradis Gateway for creating and sending Questionnaires to Gateway Contributors, enabling pre-engagement scoping, post-engagement surveys, and retest request workflows.
• Adds Dradis OTP, a built-in multi-factor authentication integration.

Threat Intelligence · 2026-10-08

Feedly's GET /ioc-metadata endpoint now returns GreyNoise enrichment data when the GreyNoise Connector is configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The API endpoint https://developers.feedly.com/reference/getiocmetadata returns GreyNoise enrichment data for IoCs when the GreyNoise Connector is set up.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-08

Finite State adds Project-scoped Audit trail filtering, CSV export, and a per-Project Audit trail page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Project column, filter, and CSV field to the Audit trail so events can be sliced and exported by Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a dedicated Audit trail page on each Project for viewing that Project's events in isolation.

Reverse Engineering · 2026-10-08

Finite State audit-event endpoints now return project id and name, letting security engineers trace events to a specific Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds project object (with id and name) to responses from GET /public/v0/audit, GET /public/v0/audit/{id}, GET /public/v0/audit-events, GET /public/v0/audit-events/{id}, and GET /public/v0/projects/{projectId}/audit whenever the event is associated with a Project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-08

Claude Haiku 5.5 is now generally available in GitHub Copilot across all major IDEs and surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Claude Haiku 5.5 as a selectable model in GitHub Copilot's model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Copilot Enterprise and Business administrators can manage Claude Haiku 5.5 access via the model policy in Copilot settings, with automatic enablement under the default model enablement policy unless explicitly disabled.

SAST / SCA / Code Security · 2026-10-08

GitHub adds a purpose-built AI model for secret detection, extending coverage to push protection and the Copilot /security-review command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI-detected secret scanning to the GitHub Copilot /security-review command in supported Copilot CLI and Copilot App sessions, flagging unstructured credentials alongside existing LLM-based findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI push protection that checks for unstructured credentials at push time, before a secret enters repository history, available in private preview for GitHub Enterprise Cloud and GitHub Teams with GHSP or GHAS.
• Upgrades existing AI-detected Password alert scans to the new purpose-built fine-tuned model automatically, at no additional charge for GHSP and GHAS customers.

SAST / SCA / Code Security · 2026-10-08

GitHub Copilot gains GA local sandboxing via MXC, enforcing filesystem, network, and credential boundaries for agentic workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds local sandboxing for GitHub Copilot (powered by Microsoft eXecution Container, MXC) in GitHub Copilot CLI, the GitHub Copilot app, and VS Code Agent Host sessions, restricting agentic tool and command access to the filesystem, network, and credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables per-policy control over which files and directories agent-run commands can read or modify, and over access to the internet, local networks, Git credentials, and GitHub CLI credentials.
• Supports sandboxing of local MCP and language servers where supported.

SAST / SCA / Code Security · 2026-10-08

GitHub Copilot CLI v1.0.94-0 adds /model picker to discover and add local Ollama models without restarting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /model command in GitHub Copilot CLI (v1.0.94-0+) to discover models from a running local Ollama instance alongside configured and cloud models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables adding a discovered local model for the current session — with provider and endpoint review — via Add and use for this session or Add without switching, without restarting the CLI.
• Surfaces provider connection failures directly in the /model picker with explanations so you can identify misconfigured providers immediately.

Exploitation & C2 · 2026-10-08

NodeZero adds a new integration with CrowdStrike Falcon Next-Gen SIEM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds integration with CrowdStrike Falcon Next-Gen SIEM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-10-08

IPED Web API examples added for Python, JavaScript, and Java, covering search, download, and bookmark management via REST endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --webapi, --host, --port, and --sources flags to launch the IPED Web API server from the command line.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sources.json configuration file support to define case sources with id and path fields for the Web API server.
• Adds GET /search endpoint with q and sourceID query parameters to search across IPED case sources.

Patch Management · 2026-10-08

ITarian launches an AI-native MSP platform that auto-diagnoses tickets, recommends playbooks, and executes within authority.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Launches a new AI-native MSP platform that reads device history and past incidents when a ticket is opened, builds a diagnosis automatically, and recommends a remediation playbook before a technician engages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides region-specific platform instances for US and Europe, with existing users automatically carrying over their data, devices, and history with no migration required.

Patch Management · 2026-10-08

ITarian October 2026 adds Linux RMM monitoring via Custom Script monitors on Red Hat and Ubuntu/Debian devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Linux device monitoring in RMM for the first time via Custom Script monitors on Red Hat and Ubuntu/Debian devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Device File List tab now shows non-executable files (e.g. PowerShell and command scripts) by default, with the Show with non-executable file(s) filter pre-checked.

Web Application Security · 2026-10-08

Juice Shop adds a NextGen B2B REST API at /b2b/v2 with JWT bearer auth, replacing XML-based order endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /b2b/v2/orders endpoint (createCustomerOrder) for placing customer orders in JSON format, returning an OrderConfirmation with cid, orderNo, and paymentDue fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces JWT bearer auth (bearerAuth, bearerFormat: JWT) as the security scheme for all B2B v2 endpoints.
• Supports OrderLinesData schema for submitting order lines in customer-specific JSON string format, alongside the structured OrderLines array.

Identity & Access Management · 2026-10-08

Digital Forensics & Incident Response · 2026-10-08

AI/LLM Security · 2026-10-08

Mend Renovate gains credential-aware Crate git-index lookups, datasource reporting, and SLSA action extraction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Applies host rule credentials when resolving crate datasource git index registries, enabling authenticated private registry lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Reports which datasource served a dependency lookup, surfacing provenance information during version resolution.
• Extracts slsa-framework/actions/* action references in the github-actions manager for version tracking.

SAST / SCA / Code Security · 2026-10-08

Mend Renovate gains datasource reporting, Crate git-index credentials, GitHub Actions extraction improvements, and exec tool-version switching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports host rule credentials for git index registries in the datasource/crate datasource, enabling authenticated Cargo crate lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extracts slsa-framework/actions/* steps with with blocks in the manager/github-actions manager.
• Adds GitHub Releases as the version source for setup-deno in the manager/github-actions manager.

SAST / SCA / Code Security · 2026-10-08

Mend Renovate adds datasource reporting, crate git-index credentials, GitHub Actions extraction improvements, and exec re-run on version downgrade.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Reports the datasource which served a version lookup, giving practitioners visibility into which registry answered each dependency resolution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports host-rule credentials for crate git index registries via datasource/crate, enabling authenticated access to private Cargo git indexes.
• Extracts slsa-framework/actions/* references in manager/github-actions, broadening GitHub Actions dependency tracking to SLSA framework actions.

Patch Management · 2026-10-08

Intune 2609 brings Cloud PKI and Remote Help to GCC High, adds Android enrollment auto-launch for Defender, and raises iOS minimum to 18.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the Device features tour Setup Assistant skip key in Automated Device Enrollment profiles to hide the features tour pane on iPhone and iPad during enrollment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports assignment filters for Android Enterprise and Android Open Source Project (AOSP) Settings Catalog policies, allowing include/exclude rules based on device properties.
• Extends Microsoft Cloud PKI to GCC High tenants, enabling cloud-based certificate issuance, renewal, and revocation for Wi-Fi, VPN, and app authentication across Windows, Android, iOS/iPadOS, and macOS — no on-premises CA, NDES, or Certificate Connector required.

Patch Management · 2026-10-08

N-zo gains Asset Activity queries, Asset Tags analysis, and an '@' asset selector for faster AI-assisted troubleshooting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @ mention syntax in N-zo chat to invoke the Asset Selector, surfacing search suggestions so technicians confirm the correct endpoint before running a query or action — reducing mistakes in environments with similar device names across multiple customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Asset Activity querying in N-zo, letting technicians ask plain-language questions about device logins (successful and failed), user logoffs, workstation locks/unlocks, application and system crashes, and unexpected shutdowns — data collected on a 30-minute cycle.
• Adds Asset Tags analysis in N-zo, enabling plain-language queries across static and dynamic tags, tag categories, tag usage, and the devices associated with them — including multi-condition queries combining tags with other N-zo data (e.g. 'Have any assets tagged VIP had a blue screen in the last 14 days?').

Patch Management · 2026-10-08

Vulnerability Management gains Saved Views (filters, sort, columns, charts) and a Charts toggle in N-central and N-sight.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Saved Views to the All Detections and By Vulnerability tabs in Vulnerability Management, letting users save filters, sorting, search, and column settings (order, visibility, width, and pinning) as named views and switch between them from a Views menu in each tab's toolbar.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the ability to set a default view per tab so it loads automatically when opening Vulnerability Management, with views stored per user account and accessible from any device.
• Adds a Charts switch in the Saved Views menu to show or hide visual filter charts on the All Detections and By Vulnerability tabs, with chart state saved as part of each named view.

Patch Management · 2026-10-08

N-central 2026.4 adds native dark mode with themes, PowerShell 7 automation, a new mobile app, and Ecoverse navigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Run PowerShell 7 Script object in Automation Manager, enabling automation policies to use a modern PowerShell 7 runtime on 64-bit Windows alongside existing PowerShell 5.1 policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the new N-central Mobile app for iOS and Android, supporting device search, Take Control remote sessions, N-able Login with MFA, and Entra ID sign-in — requires N-central 2026.4 or later.
• Adds native Dark Mode and Light Mode toggle, four built-in themes (Modern Classic, Coastal Sky, Lavender Mist, Jade Garden), and seven contrast modes for accessibility and readability.

Network Analysis & Monitoring · 2026-10-08

NetworkMiner 3.2 adds RADIUS parsing and expands UMAS and IEC-104 OT protocol support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a RADIUS protocol parser that extracts usernames, passwords (encrypted or hashed), IP addresses, messages, and RADIUS-specific identifiers from captured traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for IEC-104 command ID 60 (C_RC_TA_1) 'Regulating step command with time tag CP56Time2a', covering increase/decrease of a data-point by one in European and Asian power grid monitoring.

Network Analysis & Monitoring · 2026-10-08

NETRESEC: Improves existing parsers for HTTP, SIP, and DNS to extract additional data into the UI tabs.

SAST / SCA / Code Security · 2026-10-08

OpenAI Codex Security launches with CLI/SDK, desktop workbench, and cloud GitHub scanning via @openai/codex-security⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @openai/codex-security npm package providing a CLI invocable via npx @openai/codex-security --help for local and CI-based security scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds TypeScript SDK (also via @openai/codex-security) to embed scanning, progress reporting, and cost controls into applications or developer tools.
• CLI supports SARIF upload, CSV-based bulk-scan inventories, resumable campaigns, severity policy enforcement, and false-positive feedback tracking across repositories.

Firewalls & Network Defense · 2026-10-08

Palo Alto Networks: Adds integration between Device Security and Infoblox via the Infoblox Outbound API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-08

Prisma Agent 26.4 brings Linux desktop notifications, hardware-backed cert auth, FedRAMP Moderate support, RHEL 9.8/10.2, session extension prompts, and third-party agent coe⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds hardware-backed certificate authentication for Prisma Agent on Linux.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds FedRAMP Moderate compliance support for Prisma Agent on Linux.
• Adds support for RHEL 9.8 and 10.2 with Prisma Agent.

Patch Management · 2026-10-08

Patch My PC Publisher 3.1.1.0 adds content distribution overrides and full default command-line customization⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds content distribution overrides configurable at the Product, Vendor, and All Vendors level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds republishing support for metadata-only WSUS products.
• Adds Version and Release Date columns in Show Package Info.

Patch Management · 2026-10-08

Patch My PC: Adds a filter in the Publisher to show only apps that have dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Warns administrators when All Vendors assignment changes will overwrite product-level assignments.

Post-Exploitation · 2026-10-08

phpsploit PROXY setting now supports SOCKS4A and SOCKS5H proxy schemes in addition to existing types⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SOCKS4A and SOCKS5H proxy scheme support to the PROXY setting, enabling remote DNS resolution through SOCKS proxies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-08

Digital Forensics & Incident Response · 2026-10-08

CNAPP · 2026-10-08

Plerion adds 39 live Reliability checks and 4 deletion-protection checks to Well-Architected AutoFill coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds checks PLERION-AWS-1197 (RDS DB instance deletion protection) and PLERION-AWS-1198 (EC2 instance termination protection) as new live-resource checks answering REL 9 and REL 11 in Well-Architected workloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends PLERION-AWS-311 (RDS cluster deletion protection) and PLERION-AWS-614 (load balancer deletion protection) to run against live AWS accounts in addition to infrastructure-as-code templates.
• Adds 39 live checks to the Reliability pillar covering backups for RDS, Aurora, DocumentDB, Neptune, ElastiCache, OpenSearch, and Redshift; snapshot encryption and sharing; RDS Multi-AZ; DynamoDB global tables; CloudFront origin failover; VPN tunnel redundancy; and SQS dead-letter queues.

SAST / SCA / Code Security · 2026-10-08

Portkey adds Mistral AI content moderation guardrails with 9 policy categories and multilingual support across 11 languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds input_guardrails and output_guardrails config params to route requests through Mistral's Moderate Content guardrail check, supporting beforeRequestHook and afterRequestHook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Mistral Moderate Content guardrail check with configurable Moderation Checks (array) and Timeout (number, default 5000ms) parameters to detect harmful content across 9 policy categories: Sexual, Hate and Discrimination, Violence and Threats, Dangerous and Criminal Content, Self-harm, Health, Financial, Law, and PII.
• Supports Mistral's natively multilingual moderation across Arabic, Chinese, English, French, German, Italian, Japanese, Korean, Portuguese, Russian, and Spanish.

SAST / SCA / Code Security · 2026-10-08

Portkey adds Lakera Guard integration for prompt/response screening with PII redaction via /v2/guard⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Lakera Guard integration that screens prompts and responses via Lakera's /v2/guard API, blocking on policy hits and redacting PII spans when pii/* detectors fire.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes projectID, endInclusive, and timeout parameters on the Lakera Guard check, supporting both beforeRequestHook and afterRequestHook positions.
• Attaches Lakera guardrails to Portkey configs via input_guardrails and output_guardrails fields for SDK and gateway use.

Secure Access (VPN / SASE / ZTNA) · 2026-10-08

Prisma Access adds dedicated BYOIP locations and Prisma Browser Connector location support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dedicated Bring Your Own IP (BYOIP) location set for Prisma Access, separate from standard locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Prisma Browser Connector support for a defined subset of locations.

Cloud Security Posture · 2026-10-08

Prowler MCP Server adds namespaced tool groups for cloud scan scheduling, findings triage, Jira integration, and alert rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds prowler_cloud_* tools (Cloud MCP Server only) for Alerts, Findings Triage, Scan Scheduling, and Scan Configurations — capabilities not available in the Local MCP Server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Scan Configurations management via prowler_cloud_*: create reusable check and compliance selections and attach them to providers.
• Adds Findings Triage via prowler_cloud_*: record review statuses and notes for individual findings without suppressing them.

AI/LLM Security · 2026-10-08

QuilrAI adds a Detection Models page with configurable risk thresholds for data and AI adversarial checks across LLM and MCP Gateway policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Detection Models page under Govern in the QuilrAI Console, with two tabs — Data Risks and AI Adversarial Risks — as the central place to define what Quilr scans for and the default risk level of each finding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Out-of-the-box and Custom views under Data Risks, where built-in detections are split into Contextual (uses surrounding text) and Non-contextual (matches by format) sub-views.
• Adds contextual detection categories — PII, PHI, PFI, PCI, Insurance Data, Auth & Secrets, Code Scripts and Queries — each with a configurable Risk level (None, Low, Medium, High) that acts as a detection threshold: None detects nothing, Low fires only on High-priority subcategories, Medium on High and Medium, High on all three.

AI/LLM Security · 2026-10-08

QuilrAI Policy Engine gains a full draft-to-publish workflow with simulation, replay, and rollback on LLM and MCP Gateways.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Describe a request (MCP: Describe a call) simulation in the Policy Engine to show the winning value per control for a single request, with Add detection reporting a data type as found with a count per type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds synthetic-case simulation: run up to 100 synthetic cases against a draft to read the engine's actual decision evidence — which rules matched, on which stage, and the call-level outcome.
• Adds Replay of recorded traffic against a draft: up to 90 days and 5,000 requests on the LLM Gateway, with filters by window, MCP, tool, user, and route on the MCP Gateway.

AI/LLM Security · 2026-10-08

QuilrAI adds AI-designed custom dashboards with KPI/chart widgets, filters, caveats, and shareable ?dashboard= links.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ?dashboard= query parameter to dashboard URLs, enabling direct sharing of a specific dashboard with anyone who has access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New Observe > Dashboards section (titled Custom dashboards) lets practitioners build dashboards by describing them in plain language to an AI designer, which asks follow-up questions and generates a preview on live data.
• Dashboards support KPI and chart widgets, a Filters panel with time-period selection and Apply filters, a Caveats section noting data coverage, and a Revise with AI prompt to iteratively update the layout.

AI/LLM Security · 2026-10-08

QuilrAI adds an Agents view under Observe showing every AI agent, its skills, MCP servers, system prompts, models, and users across your estate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Observe > Agents screen listing every AI agent observed across the estate, with columns for Source, Capabilities (observed and declared), Calls, Users, Governance, and Last seen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds source-filter chips for Azure AI Foundry, Copilot Studio, Endpoint discovered, Endpoint runtime, MCP Gateway, and OpenAI Compliance to scope the agent inventory.
• Adds headline tiles for Agents observed, Observed calls, People, and MCP reach (with blocked-call counts) at the top of the Agents view.

AI/LLM Security · 2026-10-08

QuilrAI gains an Observe > Users hub with five tabs covering AI usage, risk, deployment coverage, accounts, and Quilly coaching feeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Observe > Users page with five tabs — All users, Browser deployment, Endpoint deployment, Accounts, and Quilly — giving a per-person view of AI usage, risk, and sensor coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds All users tab with headline tiles (People, Flagged people, Off-hours actors, Activity) and per-person cards showing apps, topics, posture per sensor, usage, active hours, risk, and origin.
• Adds Cards and Table layout toggle, saved views, Add filter, Refresh users, Columns, and Export controls on the All users tab.

AI/LLM Security · 2026-10-08

QuilrAI adds Findings & Interactions hub with investigation drawer, saved views, bulk triage, agent activation, and export center.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Findings & Interactions page (under Observe > Findings & Interactions in the sidebar) as a unified hub showing AI activity across all sensors, with Findings and Interactions tabs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Bird's-eye, Cards, and Table layout buttons on Findings & Interactions to switch between a trend-summary view, a card queue, and a sortable row-per-item table — filters and the selected period carry across all three.
• Adds Group related conversations toggle on the Interactions tab to fold related records (such as multiple prompts in one short session) into a single row.

AI/LLM Security · 2026-10-08

QuilrAI adds an interactive Graph view mapping AI estate relationships across people, agents, MCP servers, data, and controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports five graph lenses — Estate, People, Agentic, Risk, and Governance — each emphasising a different relational question.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sensor chips to show or hide data from LLM, MCP, Endpoint, Browser, Copilot, GitHub, Foundry, and OpenAI sources within the graph.
• Surfaces a central Organization node with category nodes for Apps, People, Agents, MCPs, Skills, Models, Data, Devices, Plugins, Hooks, Permissions, Tool families, and Work (working directories and repositories).

AI/LLM Security · 2026-10-08

QuilrAI console gains deep-link URL parameters, Bird's-eye layout, Export Center, and saved views across all list pages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ?person=, ?asset=, ?agent=, ?interaction=, ?dashboard=, ?workspace=, and ?manage= URL parameters that open the corresponding detail drawer directly, enabling shareable deep links to any drawer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Bird's-eye layout on Findings & Interactions that shows summary tiles and charts for the current filters before drilling into rows.
• Adds an Export Center where exports triggered from any list page are collected, recurring exports are configured, and past runs are downloaded.

AI/LLM Security · 2026-10-08

QuilrAI adds a Syslog integration that forwards Extension findings via TCP, UDP, or TLS in RFC 5424 or RFC 3164 format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Syslog integration supporting TCP, UDP, and TLS transport protocols to forward Extension findings to any syslog server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports RFC 5424 (default) and RFC 3164 message formats, configurable per connection.
• Supports TCP Message Framing options — None (default), Octet-Count (RFC 6587 octet-counting), and Non-Transparent (RFC 6587 trailing-newline) — for compatibility with receivers such as rsyslog and syslog-ng.

AI/LLM Security · 2026-10-08

QuilrAI adds a Triage Center with bulk-close suggestions, auto-resolve rules, activity undo, and detection tuning via learnings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Auto-resolve rules tab to automatically resolve, review, or tag new open findings that match a condition, running rules in list order with every change logged in Activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Suggestions tab for bulk-closing open findings grouped by reason (e.g. apps now approved, people no longer active, blocked for 14 days), with a re-checked count and full undo from Activity.
• Adds Activity tab listing every bulk close, auto-resolve rule change, and undo with filters for period, type (All / Suggestion / Undo), actor, and reason — plus View findings and Undo actions per row.

AI/LLM Security · 2026-10-08

QuilrAI adds a Google Workspace MCP with 42 tools spanning Gmail, Calendar, Drive, and Directory over customer-owned OAuth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables GOOGLE_ENABLE_DRIVE_SHARING=true environment variable to activate the otherwise-disabled share_google_drive_file tool for Drive permission changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds share_google_drive_file tool (disabled by default, destructive) for changing who can access a Google Drive file; grants to anyone require explicit confirmation.
• Adds Gmail tools: search_gmail_messages, get_gmail_messages, get_gmail_thread, read_gmail_attachment, list_gmail_drafts, get_gmail_draft, list_gmail_labels, sync_gmail_messages, save_gmail_draft, save_gmail_label, update_gmail_messages, send_gmail_message, trash_gmail_messages, delete_gmail_label, delete_gmail_draft.

AI/LLM Security · 2026-10-08

QuilrAI MCP Gateway sits between AI apps and MCP servers, enforcing tool rules, guardrails, and logging every call by user and agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the MCP Gateway, a proxy layer between AI apps (Claude, ChatGPT, Cursor, VS Code) and MCP servers that checks every tool call against tool rules and guardrails, then logs the user, agent, and result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OneMCP, a single gateway URL that serves every MCP server a user is authorized to reach, replacing per-server URLs.
• Adds per-server Quilr gateway URL (e.g. https://mcpgateway.quilr.ai/github/mcp) that AI clients call in place of the upstream MCP server.

AI/LLM Security · 2026-10-08

QuilrAI Workflow Agents: build, publish and run governed AI agents from console, chat, Slack or a schedule⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Workflow Agents to the QuilrAI Console, letting you create, publish and run AI agents that call tools via your organization's MCP connections and LLM Gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports four agent trigger surfaces: the QuilrAI Console (Start a task), Chat, Slack mention or DM, and scheduled runs.
• Agents can be assembled into a Team of two to six published agents under a lead model that combines their answers into one result.

AI/LLM Security · 2026-10-08

QuilrAI adds MCP Threat Detection — static code/dependency scans and live tool-surface enumeration with threat modelling for MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds live tool-surface enumeration for a running MCP server, performing a read-only inspection of the tools the server exposes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Accepts a public repository URL, a live MCP server, or both as inputs in a single scan run.
• Lists completed and in-progress scans under Recent scans with findings and coverage details for review.

AI/LLM Security · 2026-10-08

QuilrAI MCP Gateway gains per-server access control: restrict which AI agents, smart groups, and users can connect before any tool is listed or called.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Access control card on each MCP server's Configure > General page to set Allowed agents, Allowed smart groups, Denied smart groups, Allowed users, and Denied users — denying everyone not matched before any tool is listed or called.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MCP Server Access card (stage 1, Session) in Govern > Policy Engine > MCP Gateway with MCP access allow/deny effect, supporting match on MCP name, identity provider, client IP, agent name, agent classification, route kind (direct, onemcp, workflow), tags, transport, and auth type.
• Adds OneMCP Features card in the same Session stage to toggle OneMCP dynamic tools and memory on or off per caller.

AI/LLM Security · 2026-10-08

QuilrAI MCP Gateway gains a browsable MCP Library with one-click install, user install requests, and internal-network MCP support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an MCP Library in Settings > AI Gateway > MCP Gateway > Library for discovering and installing provider-native and Quilr-built MCP servers without manually entering URLs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports filtering MCP Library entries by Status (Installed, Not installed), Type (Remote (HTTP), Local package (stdio)), and Sign-in (OAuth, API key, OAuth passthrough, No sign-in).
• Provides per-MCP install actions: Install (no-credential MCPs), Set up (API key or custom OAuth app), Review (local packages), Continue setup, Settings, and Uninstall.

AI/LLM Security · 2026-10-08

QuilrAI MCP Gateway lets admins register MCP servers, govern tool access with guardrails, and monitor agent activity via a unified gateway URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Settings > AI Gateway > MCP Gateway to register MCP servers — supporting ready-made library integrations, remote servers (via Transport URL), REST APIs converted to MCP, and local CLI packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds https://mcpgateway.quilr.ai/quilrone/mcp as a OneMCP endpoint that exposes every permitted MCP server to an AI agent through a single connection.
• Adds per-server https://mcpgateway.quilr.ai/<slug>/mcp gateway URLs for single-server connections, with Authorization: Bearer <token> and mcpuser header support for non-OAuth clients.

AI/LLM Security · 2026-10-08

QuilrAI adds Costs & Savings dashboard with spend, token usage, savings techniques, attribution, and provider health across AI sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New Observe > Costs & Savings section shows organisation-wide AI spend in USD, token usage, and tokens already saved, broken down by source (LLM Gateway, MCP Gateway, Endpoint Agent, Browser Extension, and connected platforms).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Attribution tab lets teams group usage metrics (Spend, Tokens, or Tokens saved) by Applications, Users, Models, Tools, Agents, Departments, Smart Groups, Sources, Usage types, Topics, or Repositories — with per-entry daily sparklines and period-over-period spend change.
• Savings tab surfaces a ranked Settings to change list of token-saving opportunities, each with an Open settings deep-link to the relevant configuration page.

AI/LLM Security · 2026-10-08

QuilrAI LLM Gateway gains security guardrails covering PII/PHI/PCI redaction, adversarial-prompt detection, hallucination checks, and source-IP allowlisting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Guardrails tab in the app's Configure section with six parts: Default action, Data risks, Adversarial risks, Precision detections, Hallucination check, and Source IP restrictions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Adversarial risks guardrail with 13 categories including Prompt Injection Techniques, Jailbreak Techniques, Prompt Context Corruption, Semantic Adversarial Prompts, Social Engineering Prompts, System, Guardrail & Security Disclosure, Security Exploit & Payload Enablement, Cybersecurity Frameworks & Standards Mention, Response Risks, Hateful or Offensive Content, Violence & Harmful Content, Fraudulent or Illegal Activity Content, and Malicious Scripts (opt-in); each supports Block or Monitor.
• Adds Precision detections with a built-in catalog of more than 80 exact-match identifiers (SSN, Aadhaar, IBAN, IMEI, PUK code, and others), each independently switchable with its own action (Redact, Partial redact, Block, or Monitor; default Monitor).

AI/LLM Security · 2026-10-08

QuilrAI LLM Gateway V2 adds tenant-wide platform providers, a hosted model catalog at https://models.quilrai.dev/v1, scoped model API keys, and a browser Playground.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /chat/completions at https://models.quilrai.dev/v1 — an OpenAI-compatible endpoint for calling QuilrAI-hosted models directly with a sk-quilrllm-... model API key and Authorization: Bearer $QUILR_MODEL_API_KEY.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds model API keys (sk-quilrllm-...) scoped to specific allowed models from the hosted catalog, created at Settings > AI Gateway > Models > API keys; keys have no expiry, are recorded in the audit log, and are capped only by organization credit.
• Adds RBAC V2 permissions llm.apps.create, secrets.reveal, and llm.apps.delete controlling model API key creation and revocation.

AI/LLM Security · 2026-10-08

QuilrAI LLM Gateway quick-start: create apps with built-in guardrails, swap one base URL, and route across providers with failover.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Swap base_url to guardrails-usa-2.quilr.ai/openai_compatible/ and set api_key to your Quilr key to route any OpenAI-compatible SDK through the gateway without other code changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Create an LLM Gateway app via Settings > AI Gateway > LLM Gateway > Create App, choosing between Platform providers (shared team credentials, V2 console only) or App-only credentials (per-app isolation).
• Configure per-app Security Guardrails, Guardian Agent, Custom Detections, Rate and Token Limits, Routing, Token Saving, Prompt Store, Identity Aware, and Self-Service settings via the app card's Configure buttons.

AI/LLM Security · 2026-10-08

QuilrAI Policy Engine docs reveal a unified card-based enforcement layer spanning Browser Extension, LLM Gateway, MCP Gateway, and Endpoint Agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Describe a request button (LLM Gateway tab) and Describe a call button (MCP Gateway tab) to preview which policy wins for a given request before publishing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces QuilrQL policy language with a source view for reviewing, diffing, or bulk-editing policies as exact text.
• Surfaces block_request_secrets example policy showing named fields: name, priority, stage, conditions, and effects — with priority 500 as the default for new policies.

AI/LLM Security · 2026-10-08

QuilrAI adds an Observe > Overview dashboard with Adoption, Agentic Estate, and Posture & Risk tabs for AI governance at a glance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Observe > Overview dashboard with three tabs — Adoption, Agentic Estate, and Posture & Risk — and a period selector (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Last 7 days) that applies across all tabs.
• Adds the Adoption tab, showing headline tiles for People using AI, AI interactions, Power users, and AI applications, plus breakdowns by usage mode (Chat assistants, Coding agents, MCP agents, API & service accounts, Other) and a department/team/people flow chart marking sanctioned vs. unapproved apps.
• Adds the Agentic Estate tab, surfacing Agentic assets, Shadow AI, share of MCP servers through gateway, and High-risk assets, with an Act now queue and per-platform panels for OpenAI, Microsoft Copilot Studio, and Azure AI Foundry.

AI/LLM Security · 2026-10-08

QuilrAI adds integrations hub pulling AI usage from Claude, OpenAI, Copilot, Azure AI, GitHub, and TrueFoundry, with SIEM/syslog/webhook forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Console › Settings › Integrations hub to browse, install, and manage integrations by capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Pulls AI usage and inventory from Claude.ai via the Anthropic Compliance API integration.
• Pulls AI usage and inventory via the OpenAI Compliance integration.

AI/LLM Security · 2026-10-08

QuilrAI Endpoint Agent adds per-device AI governance: monitors desktop chat apps, coding agents, local models, and MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Endpoint Agent, accessible via Console › Govern › Policy Engine › Endpoint Agent, to discover and govern AI running on company devices — including desktop chat apps, coding agents, local models, and MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides per-app monitoring and guardrails through App Policies, letting teams set rules on individual AI applications detected on endpoints.
• Introduces an Agent Kill Switch to disable the endpoint agent per device or tenant-wide without a full redeploy.

AI/LLM Security · 2026-10-08

QuilrAI adds a browser extension to monitor AI app usage, block sensitive data at the prompt, and guide users in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a browser extension that surfaces which AI apps employees use, intercepts sensitive data before it reaches AI prompts, and delivers in-context guidance to end users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports deployment via Microsoft Intune, Jamf Pro, and Group Policy for enterprise-wide rollout.
• Introduces browser controls to monitor or act when a defined use case occurs in the browser.

AI/LLM Security · 2026-10-08

QuilrAI adds Red Teaming suite covering gateway apps, MCP servers, agents, and multi-model comparison via console and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Console › Assessments › Red Teaming to run attack suites against gateway apps through their configured model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MCP Threat Detection with static, dependency, and live tool-surface scanning of MCP servers.
• Adds agentic red teaming against any HTTP, WebSocket, or voice agent endpoint.

AI/LLM Security · 2026-10-08

QuilrAI: Adds Workflow Agents accessible via Console › Settings › AI Gateway › Workflow Agents, routing every model and tool call through your existing gateways.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports running agents from the console, chat, Slack (via Socket Mode Slack app), or on a schedule with recurring runs.
• Enables sharing agents with teams via groups, approvals, and versioning.
• Provides library templates for common use cases including research, support, and code review.

AI/LLM Security · 2026-10-08

QuilrAI MCP Gateway: governed AI agent access with OneMCP, tool-level ACLs, human approval, and provider integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces MCP Gateway, a managed control plane that lets teams register MCP servers once and enforce who can call which tool across AI agents such as Claude, Cursor, and ChatGPT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OneMCP, a single endpoint with dynamic tool calling that aggregates multiple registered MCP servers behind one connection.
• Supports turning any API into a set of MCP tools via the MCP Library.

AI/LLM Security · 2026-10-08

QuilrAI launches with browser extension, endpoint agent, LLM gateway, MCP gateway, red teaming, and open-source AgentGuard for enterprise AI governance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds LLM Gateway — a single endpoint routing traffic to OpenAI, Anthropic, Azure, Bedrock, and Vertex with security guardrails, cost tracking, and provider/model management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MCP Gateway — governed tool access for AI agents, connecting any MCP client or OneMCP to 400+ servers including GitHub, Slack, and Salesforce.
• Adds Red Teaming — attacks gateway apps, agents, models, and MCP servers on demand or on a schedule, and converts findings into detections.

AI-Powered Offensive Security · 2026-10-08

RAPTOR: agentic security analysis CLI with Semgrep/CodeQL, multi-stage exploit validation, SCA, binary fuzzing, and air-gap support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --max-cost-usd flag to cap per-run LLM analysis spend (default $10) when running the full validation pipeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --codeql flag to raptor to include CodeQL alongside Semgrep and Coccinelle in a scan.
• Adds --threat-model, --threat-model-refresh, and --threat-model-use-stale flags to control automated threat-model generation and freshness enforcement, writing threat-model.json and THREAT_MODEL.md per project.

Threat Intelligence · 2026-10-08

Recorded Future adds a bulk lookup endpoint for up to 250 Social Media Impersonation Playbook Alerts in one request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /social-media-impersonation bulk endpoint to hydrate up to 250 Social Media Impersonation Playbook Alert IDs in a single request, returning UI-ready panels covering status, impersonating profile evidence summary, and change log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports an optional panels field in the request body to limit the response to only the specific panels needed.

Threat Intelligence · 2026-10-08

Recorded Future adds POST /social-media-impersonation-playbook/{alert-id} endpoint to retrieve full impersonation alert detail via API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /social-media-impersonation-playbook/{alert-id} endpoint to retrieve full detail of a Social Media Impersonation Playbook Alert, including impersonating account metadata (platform, profile URL, display name, handle, bio, creation date, post and follower counts, private status), matched company or executive assets, assessments, workflow state, and alert history log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-08

MCP Servers & Tooling · 2026-10-08

Runlayer adds GET /api/v1/agents/metrics/usage and two MCP tools for agent usage reporting, plus artifact sort controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api/v1/agents/metrics/usage endpoint to pull every agent's creator, consumers, sharing, and token and cost usage into a BI tool or data warehouse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds get_agent_usage_report and list_agent_usage_consumers MCP tools in Runlayer MCP so AI clients can query agent usage, sharing, and token data directly.
• Adds sorting to the Artifacts page by newest, oldest, most recently updated, or least recently updated.

Network Analysis & Monitoring · 2026-10-08

Security Onion now has an official Azure Marketplace image supporting single-node and distributed grid deployments with Virtual Network TAP monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds official Security Onion VM image on the Azure Marketplace for deploying single-node or distributed grid architectures in Azure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Azure Virtual Network TAP (VTAP) for traffic monitoring, delivering mirrored traffic to the sniffing interface as VxLAN on port 4789.
• Documents sensor setup using eth0 as the main interface and eth1 as the monitoring interface on Azure sensor nodes.

Hacking Hardware · 2026-10-08

Shark Jack Display gains SSH access documentation covering Arming Mode setup, default credentials, and per-session vs persistent configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables SSH server access on Shark Jack Display via Settings → Arming Defaults → SSH Server set to Enabled, persisting across reboots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports per-session SSH activation via Settings → This Session without making the setting permanent.
• Connects to the device at 172.16.24.1 as root with default password hak5shark when NETMODE DHCP_SERVER is active in Arming Mode.

IDS / IPS · 2026-10-08

Suricata adds tcp.session keyword to match TCP lifecycle phases (setup, established, closing) in a single rule across IDS, IPS, and firewall modes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tcp.session keyword accepting a comma-separated subset of setup, established, and closing phases, letting a single rule cover the full TCP session lifecycle instead of requiring separate rules per phase; works in IDS, IPS, and firewall modes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports tcp.session midstream pickup: when a flow is picked up mid-connection, the keyword evaluates the flow's current TCP state directly (e.g., a midstream TCP_ESTABLISHED pickup matches tcp.session:established but not tcp.session:setup).
• Documents flow keyword options including only_frag and no_frag to match packets reassembled from fragments or not.

Secure Access (VPN / SASE / ZTNA) · 2026-10-08

Tailscale v1.104.1 adds client-side netmap caching, device pinning, Taildrop URL/text support, and new macOS/iOS app capabilities across platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DisableReauthWindow system policy on macOS to block the re-authentication window from appearing when a user's key has expired.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds client-side netmap caching on Linux, Windows, and macOS to improve start-up speed and maintain connectivity when the Tailscale control plane is unreachable.
• Adds Tailscale Services and Tailscale PAM Services to the macOS app window.

Identity & Access Management · 2026-10-08

Web Application Security · 2026-10-08

testssl.sh docs reveal --mtls, --reqheader, --basicauth, --proxy, and --ip=proxy options for mTLS, custom headers, and proxied scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --mtls <path_to_client_cert> (env: MTLS) to supply a PEM file containing a client certificate and unencrypted private key for mutual TLS authentication against remote servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --reqheader <header> (env: REQHEADER) to inject arbitrary HTTP request headers (e.g. Proxy-Authorization, ClientID) into security-header checks; the flag can be repeated for multiple headers.
• Adds --basicauth <user:pass> (env: BASICAUTH) to provide HTTP Basic Auth credentials used during security-header checks.

Secure Access (VPN / SASE / ZTNA) · 2026-10-08

Twingate adds granular admin roles including Internet Security, Access Requests, and Billing-scoped permissions in the Admin Console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scoped admin roles in the Twingate Admin Console: a read-only role across the entire console, an Internet Security role with read/write access limited to the Internet Security tab, an Access Requests role restricted to the Access Requests page, and a Billing role restricted to the Billing page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-06

1Password CLI 2.40.0 adds op provisioning google sync to trigger Google Workspace user provisioning on demand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds op provisioning google sync subcommand to trigger a Google Workspace user provisioning sync on demand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-10-06

Acalvio ShadowPlex is now available in the CrowdStrike Store, adding deception-based detection integrated with the Falcon platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Acalvio ShadowPlex as an application in the CrowdStrike Store, making it available to CrowdStrike Falcon platform customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Integrates ShadowPlex with the CrowdStrike Falcon platform to enable Adversary Traversal Analysis, identifying hosts compromised along an attacker's path to a decoy.
• Adds deception-based active threat hunting (Hypothesis testing) within ShadowPlex to expose latent threats using CrowdStrike endpoint telemetry.

Identity & Access Management · 2026-10-06

Aembit now secures personal AI agents (Meta Muse, etc.) with distinct identities, just-in-time credentials, and a per-agent kill switch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports the Aembit MCP Identity Gateway for enforcing identity and policy on personal AI agents such as Meta Muse, with integration into other gateways already in use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Assigns each personal AI agent its own distinct agentic identity — separate from the sponsoring employee's login — so credentials can be issued, scoped, and revoked independently.
• Provides a per-agent kill switch that revokes all access for a specific agent instantly across Microsoft 365, GitHub, and custom services without disrupting the employee.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds CSV export for asset inventory pages with configurable splitting, delimiters, row limits, and an Exports Page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Export CSV function on any Assets page to export query results or selected rows to a CSV file, with a default maximum of 1048500 rows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Split by asset entities option in the Export Data dialog to output each adapter-sourced entity as a separate row.
• Adds Split by field values option to expand complex fields and lists (e.g. Installed Software, Tags) into separate rows per value.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds per-asset Dashboards tab to Asset Profiles, with cross-asset relationship charts and import/export in JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exports Asset Profile dashboards in JSON format via the More Dashboard Menu.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Dashboards tab to every Asset Profile page, providing auto-filtered charts scoped to the selected asset's unique ID.
• Supports importing dashboards from file onto an Asset Profile page, with options to overwrite or copy on name collision (same asset type only).

Attack Surface & Exposure Management · 2026-10-06

Axonius adds Expand Assets by Complex Field view to pivot asset tables around nested fields like Installed Software or Network Interfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Expand Assets by option under Edit Table in any Assets page, letting practitioners pivot the asset table so each row expands by a chosen complex field (e.g., Installed Software, Network Interfaces) instead of the default Adapter Connections view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Refine Data filtering on expanded complex-field rows via the Query Wizard or the Refine Data Display dialog, allowing practitioners to isolate specific nested-field values (e.g., show only rows where Installed Software Vendor is Apache).
• Enables saving expanded-asset views and queries — selecting Expand Assets by in the New View dialog persists the chosen complex field so every subsequent application of a Saved View or Saved Query re-expands by that field automatically.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds a full Asset Profile page with correlated adapter data, historical snapshots, custom field display, and saved views per asset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Asset Profile page and drawer, surfacing all correlated adapter data for any selected asset in a unified side-pane-plus-table layout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Display by Date control on the Asset Profile page, letting practitioners view daily snapshots of asset data for any historical date without returning to the asset table.
• Adds JSON and XML Advanced View tabs on each Adapter Connections table to expose unparsed raw adapter data alongside the default table view.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds Data Refinement for Assets tables — filter columns, rows, and adapter connections without changing result counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Refine Data Display dialog (accessible via the icon on the right of each column header) to apply complex filter expressions to Assets table columns without affecting result counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Refine display by field value pane supporting AND/OR, NOT, field, operator, value, and parentheses controls to create multi-condition column filters, including on complex fields like Installed Software.
• Adds Refine field values by adapter connection pane to include or exclude column values from specific adapter connections or individual connections.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds Saved Views for Assets and Adapter tables, with per-role sharing, role-based defaults, and admin-managed System Views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Saved Views to Assets tables, Adapter Connections page, and Adapters Fetch History page, letting each user create, name, and switch between custom column arrangements per asset type or adapter table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Set as Default option so a chosen view loads automatically when a user opens a specific Assets or Adapter table, with separate defaults configurable per table type.
• Adds Expand Assets by setting when creating or editing a view, allowing rows to be expanded by a complex field.

Attack Surface & Exposure Management · 2026-10-06

Axonius introduces sub-assets: derived, filtered views of parent asset types with shared fields, queries, and permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds is_network_infra_device = true as the derivation condition for the new Network Devices sub-asset page (Cyber Asset Management module).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds nat_translations field presence as the derivation condition for the NAT Rules sub-asset under Network/Firewall Rules.
• Adds application_resource_type = repository as the derivation condition for the Repositories sub-asset under Application Resources.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds Alerts/Monitoring as a first-class asset type, centralizing monitoring alert data across Enforcement Center, Workflows, and Dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Alerts/Monitoring as a new asset type under the Assets menu, exposing monitoring alerts as standard Axonius assets queryable, filterable, and actionable across the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces alert fields including Alert ID, Rule Description, Trigger Date, Related Assets: Entity ID, Status, Monitoring Rule Name, Rule Severity, Rule Asset Type, Source, and Tags in the query results table.
• Supports Status values (Open, In Progress, Closed, Canceled) and Rule Severity levels (Informational, Low, Medium, High, Critical) for filtering and querying monitoring alerts.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds a Network Connections tab on device asset profiles, visualising inbound/outbound connections by protocol and port.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports interactive node selection with blue-border highlighting that dims unrelated nodes, making it easier to trace specific communication paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports hover-to-highlight on a protocol or port entry to isolate only the connections using that protocol or port.
• Supports click-through navigation from a connected device node directly to that device's asset profile.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds a Network Connections page giving consolidated visibility into asset-to-asset traffic, protocols, and connection types across IT, OT, and medical devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Network Connections page (Assets > Network > Network Connections) showing a consolidated view of all network connections between assets, with fields including Srce IP, Dest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ IP, Protocol, Source Port, Destination Port, Last Seen, Connection Type, Src. Device Model, and Dest. Device Model.
• Classifies each connection via the Connection Type field into Internal, External-Incoming, or External-Outgoing categories to surface risky communication patterns.
• Supports passive discovery of both standard IT protocols and industrial/medical protocols — including Modbus, DICOM, and EtherNet/IP — via CPA Collectors connected to network switches over a SPAN port, with no agents or active scanning required.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds Dynamic Value statements to Enforcement Actions, enabling asset-driven field population with All and Switch/Case logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Configure Dynamic Values toggle to Enforcement Actions, enabling Dynamic Value statements that populate action fields with values drawn from the assets themselves.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces two statement types: All statements (iterate every asset and populate action fields) and Switch/Case statements (evaluate an asset field against multiple criteria to set field values).
• Adds Ignore Empty Values on Asset Fields setting (enabled by default) so null entries in multi-value fields are skipped instead of failing the statement.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds a Repeat For Each workflow node that loops over assets in a single workflow run, reducing resource usage versus per-asset execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Repeat For Each node to workflows that processes multiple assets in a single workflow run instead of spawning a separate run per asset, reducing resource consumption.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports looping over assets from a Query Wizard query, resolved assets from a previous node via the Run on resolved assets from previous nodes selector, an array field from a non-Variable upstream node via Run on internal list object, or a list from a Variable node via Previous variable node.
• Adds an Exit Repeat node to break out of a Repeat For Each loop early, returning execution to the main workflow branch.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds a Query node to workflows, enabling dynamic asset lookups across Users, Devices, and Software without changing the trigger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Query node to Axonius workflows that dynamically fetches assets (Users, Devices, Software) using saved or custom queries, combining multiple query results via OR logic for downstream processing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports dynamic field values in query filters via the Workflow Data repository, letting values from upstream nodes drive query conditions at runtime.
• Provides a Run Test action on the Query node that surfaces per-query asset counts and a View Query Results link into the Assets view for validation without leaving the configuration drawer.

Attack Surface & Exposure Management · 2026-10-06

Axonius Workflows gain Nested Loop support via Repeat for Each node, enabling sequential multi-asset processing within a single run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports two asset-selection methods inside Repeat for Each: resolved assets from previous nodes (via the Run action on resolved assets from previous nodes dropdown) or a custom query built with the Query Wizard.
• Supports nesting one Repeat for Each node inside another, enabling multi-layered iteration for complex, multi-entity automation tasks.
• Nodes within a Nested Loop can access the data bank of the parent Workflow, but data generated inside a Nested Loop is scoped to that loop and not accessible by the parent or sibling nodes.

Attack Surface & Exposure Management · 2026-10-06

Axonius workflows gain an Exit node to terminate execution early on failed conditions or within loops.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Exit node to workflows that immediately terminates the entire workflow run when specific conditions are met (e.g., a Query returns 0 assets or a prior User Response was Deny).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Exit Repeat node (available when the Exit node is placed inside a Repeat For Each loop) that stops the current loop and resumes execution at the first node following the loop block, including support for nested Repeat For Each loops.

Attack Surface & Exposure Management · 2026-10-06

Axonius Workflows gain Variable nodes for dynamic data storage, scoped lifecycle control, and cross-run persistence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Variable nodes to Workflows, introducing a Write to Data Repository node where practitioners can define, update, and store typed variables (String, Date, Float, Integer, Boolean, Array, Object) for use across nodes in the same Workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Global and Local variable scopes within Workflows, with Local scope isolating each iteration of a Repeat For Each loop to prevent data accumulation across iterations.
• Enables cross-run data persistence by saving variable values to the Workflow Data repository, so values captured in one run remain accessible in future runs regardless of asset path.

Attack Surface & Exposure Management · 2026-10-06

Axonius workflows gain a Delay node to pause execution for minutes, hours, or days (up to 30 days) before proceeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Delay node type to the workflow canvas that pauses execution for a configured period (minutes, hours, or days) before proceeding to the next node, with a maximum of 30 days.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports per-iteration delays when a Delay node is placed inside a For Each loop, so each asset waits independently rather than the whole workflow waiting once.
• Displays delay configuration details — time, unit, node reference ID, and node status — in the workflow run panel for visibility into when delays occur.

Attack Surface & Exposure Management · 2026-10-06

Axonius: Adds Action Conditions node to Axonius Workflows, enabling IF/ELSE IF/ELSE branching based on Action outcomes or earlier node data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports Condition based on action result sub-type, routing the workflow along the true or after branch depending on whether the preceding Action returned Success or Failure.
• Supports Condition based on asset criteria sub-type, evaluating resolved assets against a Query Wizard-built or predefined query to decide which branch executes.
• Supports Condition is based on data repository sub-type, checking variables from the Workflow Data repository using operators including Equals, Contains, Does not contain, Starts with, Ends with, Regex match, >, and <.

Attack Surface & Exposure Management · 2026-10-06

Axonius: Adds Event Conditions node to Axonius Workflows, enabling IF/ELSE IF/ELSE branch logic that routes execution based on the outcome of a preceding Event node.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Condition based on data repository setting on the Event Conditions node, allowing conditions to reference any variable stored in the Workflow Data repository (e.g., Variable.failed_login_count > 3).
• Adds Timeout condition sub-type on Event Conditions, branching to the true path when the preceding non-triggering Event node reaches its configured timeout without receiving a trigger.
• Adds support for Previous Field Value comparison in Asset value changed event criteria, enabling conditions like 'status changed from Employed to Terminated'.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds workflow import/export in JSON format for sharing automation across environments⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Export Workflow action (3-dot menu on the Workflows page) to download a complete workflow definition as a JSON file, with credentials and sensitive inputs excluded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Import Workflow option under the Create Workflow list to load a JSON workflow file into any environment, with conflict resolution choices (Save as copy or Overwrite) for queries and data that already exist.

Attack Surface & Exposure Management · 2026-10-06

Axonius Workflows gain bulk delete, bulk activate/deactivate, and per-workflow deactivation without deletion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports bulk deletion of one or more Workflows directly from the All Workflows table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports deleting a single Workflow from its configuration page via the Delete Workflow button.
• Enables activating or deactivating one or more Workflows in bulk from the All Workflows table.

Attack Surface & Exposure Management · 2026-10-06

Axonius adds the ability to terminate in-progress or pending Workflow runs mid-execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Terminate Task option in the Workflow Run History menu to stop Running or Pending Workflow runs, with per-Action outcome states (Completed, Running (interrupted), Not started) preserved after termination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-06

Axonius adds a Workflow Run History page for diagnosing errors, analyzing performance, and monitoring automation activity across all Workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Run History page accessible from the Action Center menu under Action Center Tools, displaying a table of all past Workflow runs with fields including Run ID, Trigger Type, Workflow Name, Triggered On, Structure, Status, Last Reported Activity, Start Date, and End Date.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables per-Workflow run history by clicking View Runs on a Workflow's summary page, automatically filtering the Run History - Workflows tab to that Workflow.
• Adds a Run drawer with an Overview panel and a Node Details panel, showing step-by-step execution paths, node UUIDs, affected assets, dynamic value configurations, and per-node statuses (Success, Failure, Not Triggered, Awaiting, Timed Out, Completed).

Attack Surface & Exposure Management · 2026-10-06

Axonius: Workflow Events can now be configured as triggering or non-triggering nodes, each with a system-generated UUID for Workflow Data repository references.

• Webhook settings for Workflow Events are also reachable via System Settings > External Integrations > Workflows, providing a central location to view and update URLs and signing secrets.

Identity & Access Management · 2026-10-06

BeyondTrust Identity Security Insights debuts with True Privilege Graph, threat detection, and cross-domain identity correlation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Identity Security Insights, a new service that maps identity access paths via the True Privilege Graph to reveal direct, indirect, vertical, and lateral escalation routes across hybrid environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Threat Detection capability to spot session hijacking, unauthorized changes, and misuse of service principals in real time.
• Adds Cross-Domain Correlation to surface hidden identity relationships across cloud and on-premises environments.

Identity & Access Management · 2026-10-06

BeyondTrust launches Pathfinder, a unified single-pane-of-glass portal for all BeyondTrust SaaS products at app.beyondtrust.io.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Pathfinder, a new unified platform at app.beyondtrust.io providing single sign-on and cross-product navigation across all BeyondTrust SaaS products.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports a shared navigation menu and user profile menu spanning Password Safe, Privileged Remote Access, Remote Support, Endpoint Privilege Management for Windows & Mac, Endpoint Privilege Management for Linux, Identity Security Insights, and Entitle.
• Enables multi-site organisation within Pathfinder, letting administrators create isolated site groups (e.g. by department or region) with per-site product access controls.

Malware Analysis · 2026-10-06

CAPEv2 improves browser extension monitoring for URL analysis and documents the custom/parsers/ local parser override path.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Documents custom/parsers/ under the CAPE root as the supported location for local configuration parsers, where a custom parser takes precedence over an installed one with the same name.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates browsermonitor to locate the requests log written by agent >= 0.20 in a random %TEMP% folder (without the tmp prefix, named bext_<random>.json) and upload the last complete version once when analysis ends.
• Extends firefox_ext, chromium_ext, and tor_browser package support in browsermonitor with constants EXTENSION_PACKAGES, LOG_PREFIX = 'bext_', LOG_SUFFIX = '.json', and UPLOAD_PATH = 'browser/requests.log'.

Attack Surface & Exposure Management · 2026-10-06

Censys adds async CensEye pivot analysis jobs and a web-asset field-value count endpoint via API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an async CensEye pivot analysis job API that extracts default pivot fields from a host, web property, or certificate and counts matching documents per field-value pair; credit cost is 44 for a host, 28 for a web property, and 7 for a certificate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a web-asset count endpoint that accepts user-defined field-value pairs and combinations rather than the UI default fields, at one credit per count condition (array of objects).

Attack Surface & Exposure Management · 2026-10-06

Censys adds AI Investigations: automated multi-indicator pivoting and reporting, up to 100 indicators per job via UI or API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Investigations: Create job API endpoint to start AI Investigations programmatically, with a limit of 100 indicators per investigation and 150 investigations per week across UI and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces AI Investigations, which automatically checks entity history, pivots to related assets, profiles web resources in parallel, and delivers a ranked findings report — available to customers with the Adversary Investigation module at no Censys Credits cost.

Attack Surface & Exposure Management · 2026-10-06

Censys Platform adds OAuth 2 service accounts for org-level API access without consuming user seats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Platform service accounts — org-level, non-seat-consuming identities that authenticate to Platform APIs via the OAuth 2 client credentials flow, managed under Organization Settings > Service Accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Service account activity is recorded in the audit log, and credit usage can be retrieved via the get user credit usage API endpoint.
• Supports connecting service accounts to third-party apps (such as SentinelOne) by supplying the client ID, client secret, and access token URL with OAuth client credentials grant type.

Attack Surface & Exposure Management · 2026-10-06

Censys Platform gains granular RBAC with six named roles — Platform Admin, API Access, Global Search Analyst/Manager, and ASM Analyst/Manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Platform Admin role covering billing, user and role management, audit log, AI privacy configuration, authentication settings, and account management APIs — does not consume a module seat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces API Access role granting Platform API endpoint access scoped to the user's module and role combination; users with this role can generate, edit, and delete Personal Access Tokens without consuming a seat.
• Introduces Global Search - Analyst module role as the default for new members, granting access to search, collections, history, Adversary Investigation, and Critical Infrastructure modules.

Attack Surface & Exposure Management · 2026-10-06

Censys Platform Admins can now enforce org-wide MFA and reset individual users' MFA configurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Platform Admins to require MFA for all organization users to access the Censys Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables Platform Admins to reset the MFA configuration of any individual user in their organization.

Attack Surface & Exposure Management · 2026-10-06

Censys adds redesigned RBAC, service accounts, GA AI investigations with six new API endpoints, and new fingerprints/risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds six new API endpoints for AI investigations: Investigations: Create file upload, Investigations: Create job, Investigations: Get job results, Investigations: Get job status, Investigations: Get usage, and Investigations: List jobs — enabling programmatic initiation, polling, and retrieval of AI investigation reports and evidence (ZIP archive) from the Adversary Investigation module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Investigations: Create job endpoint that accepts indicators, previously uploaded evidence files (PDF, text, or image), or both, and returns a job_id for polling.
• Adds Investigations: Create file upload endpoint that returns a URL for uploading PDF, text, or image files to use as investigation evidence.

Attack Surface & Exposure Management · 2026-10-06

Censys: Service accounts are granted access through explicitly assigned module roles, with at least one role required at creation time.

• Service accounts are available only to organizations on the Censys Search or Censys Core plans and require the Platform Admin role to create or manage.

Container & Image Security · 2026-10-06

Chainguard Actions launches a 1,000+ hardened action catalog with Guardener bot, SLSA attestations, and chainctl actions discover for full dependency scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chainctl guardener github link to link a Chainguard organization to a GitHub organization for Guardener bot setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chainctl actions discover subcommand to scan workflows and composite actions and list all referenced actions and container images, with --recursive to follow transitive dependencies and --timeout to cap API usage.
• Adds .chainguard/actions.yaml config file — set at the repo or org-level .github repository — with migrate.enabled: true to activate automated migration pull requests via Guardener.

Container & Image Security · 2026-10-06

Chainguard Libraries adds direct lockfile verification for JavaScript via chainctl libraries verify⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for verifying JavaScript lockfiles directly with chainctl libraries verify package-lock.json, without requiring dependencies to be installed first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-10-06

Catalog Starter orgs can now authenticate CI pipelines via pull tokens using chainctl auth pull-token create --output=env.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chainctl auth pull-token create --output=env to generate pull-token credentials for CI pipelines in Catalog Starter organizations, setting CHAINGUARD_IDENTITY_ID and CHAINGUARD_TOKEN environment variables for use as registry secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Pull tokens support a configurable lifetime via --ttl (default 30 days, maximum --ttl=8760h for one year) before requiring rotation.
• Revoke a pull token by running chainctl iam role-bindings list to find its binding, then chainctl iam role-bindings delete <role-binding-id> — because chainctl iam identity delete is unavailable in Catalog Starter.

Container & Image Security · 2026-10-06

Athena coalition publishes first 14 silent Java CVE disclosures; Chainguard ships 37 new container images including crossplane-azure and openstack variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds advisories for 14 silent Java vulnerabilities (1 critical, 1 high, 8 medium, 4 low) to the Chainguard Libraries VEX feed, so scanners integrating with Chainguard Libraries now surface these previously uncategorized bugs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides remediated artifact versions in Chainguard Repository with a -0.cgr.N suffix for Chainguard Libraries customers, adoptable by updating a lockfile entry.
• Adds 8 new crossplane-azure-* and crossplane-aws-* container images (including FIPS variants): crossplane-azure-compute, crossplane-azure-containerservice, crossplane-azure-eventhub, crossplane-azure-network, crossplane-azure-operationalinsights, crossplane-aws-s3vectors, crossplane-azure-cognitiveservices, and crossplane-function-extra-resources.

Vulnerability Management · 2026-10-06

Cloudmersive: Improves scanning performance for large .pdf files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

VNS3 7.2.2 adds ARM Plugin Catalog support, enriches tunnel alerts with endpoint IDs, and enables IAM role auth for SNS alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Tunnel down/up alerts now include the endpoint ID, enabling direct use in follow-up API calls without additional lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• SNS Alert type can now authenticate via AWS IAM role, in addition to the existing Access Key/Secret Key credential method.
• Plugin Catalog now supports ARM plugins when the VNS3 instance is ARM-based.

Identity & Access Management · 2026-10-06

ConductorOne query results can now be downloaded as CSV, with selectable columns including AccountUserName and AccountDisplayName.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Generate CSV button above query results to download them, with a Download as CSV drawer for choosing which columns to include.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exports AccountUserName (the account's username, not display name) and a new AccountDisplayName column in the query CSV, inserted before AccountUserName, so the export can be joined with the accounts export on AccountUserName.

Identity & Access Management · 2026-10-06

ConductorOne adds shadow app findings, public API endpoints for attribute mappings and scope-role bindings, and c1i v0.8.0 with seven new command groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api/v1/catalogs/{catalog_id}/scope_role_bindings to the public API to read access profile scope-role bindings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds full CRUD + list for user attribute mappings to the public API, including Terraform generation metadata.
• Adds mcp classifiers command group to c1i v0.8.0 for MCP gateway AI governance.

Digital Forensics & Incident Response · 2026-10-06

Cortex-Analyzers 3.10.1 adds RDAP, XposedOrNot, macaddress.com, and ScanMalware analyzers plus a Splunk ES notable status sync responder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds RDAP analyzer for domain/IP registration data lookups via the RDAP protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds XposedOrNot analyzer for email breach lookups — no API key required.
• Adds macadress.com analyzer for MAC address enrichment.

SIEM · 2026-10-06

Databricks GA: customer-managed keys now decrypt query history fields statement_text and error_message in the system catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports customer-managed keys on the system catalog to decrypt statement_text and error_message fields in the query history system table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-06

Datadog Cloud Security adds @vulnerability.cisa.kev_added_at timestamp and CISA KEV-driven remediation timelines to vulnerability findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @vulnerability.cisa.kev_added_at timestamp field to vulnerability findings, recording when a CVE was added to the CISA Known Exploited Vulnerabilities catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Computes and attaches a remediation timeline to each vulnerability finding with one of five values: three_days_and_forensic_triage, three_days, fourteen_days, sixty_days, or fix_on_system_upgrade, plus a due date derived from that timeline.

CNAPP · 2026-10-06

SIEM · 2026-10-06

Datadog Cloud SIEM content packs expand to cover Oracle Fusion Applications, Zscaler Internet Access, and 20+ identity providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Oracle Fusion Applications content pack, auditing sign-in events, target user changes, user role assignment changes, and metadata permission checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Zscaler Internet Access content pack for Cloud SIEM ingestion and enrichment.
• Expands identity and access management content pack coverage to include 1Password, BeyondTrust Identity Security Insights, BeyondTrust Password Safe, BeyondTrust Privileged Remote Access, Bitwarden, Cisco Duo, Delinea Privilege Manager, Delinea Secret Server, Have I Been Pwned, Ivanti nZTA, JumpCloud, Keeper Security, Keycloak, LastPass, PingFederate, PingOne Advanced Identity Cloud, PingOne, Push Security, Symantec VIP, and Zscaler Internet Access.

SIEM · 2026-10-06

Cloud SIEM adds Oracle Fusion Applications and Zscaler Internet Access log sources, plus a Risk Contributors view for entity risk scoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a Risk Contributors section showing only the signals, misconfigurations, and identity risks that contribute points to an entity's risk score, with a View All Related Signals link to see non-scoring signals and a View in Vulnerability Explorer link for misconfigurations and identity risks.

Vulnerability Management · 2026-10-06

DefectDojo adds POST /api/v2/assets/bulk_update/ for bulk Asset moves, re-parenting, and dry-run previews across Organizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /api/v2/assets/bulk_update/ to apply the same change to up to 500 Assets in one atomic request, supporting fields products, prod_type, move_children, parent, asset_type, business_criticality, technical_contact, team_manager, product_manager, sla_configuration, prioritization_engine, and tags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds "dry_run": true field to POST /api/v2/assets/bulk_update/ to preview every field change, descendant move, parent-link removal, and refused Asset without writing anything.
• Adds "move_children": false field to POST /api/v2/assets/bulk_update/ to move an Asset without carrying its subtree, leaving children as top-level Assets in their original Organization.

Vulnerability Management · 2026-10-06

DefectDojo v3.4.0 adds webhook receivers for two-way Jira sync and a new webhook gateway service for self-hosted deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables webhookGateway.enabled in Helm deployments to run a new webhook gateway service in front of webhook receivers, with its own schema and database role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds webhook receivers so Jira and other tools can send changes back to DefectDojo.
• Adds two-way sync and Push Notes as Comments to the Jira Downstream Connector.

Vulnerability Management · 2026-10-06

DefectDojo 3.4.0 refreshes the UI theme, returns nested user shapes from API v3 expand, and eliminates N+1 queries on product and asset list endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Returns the v2 nested user shape from API v3 expand, giving callers richer user objects without a separate lookup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Eliminates N+1 queries on the product and asset list endpoints, enabling performant large-scale asset enumeration.
• Refreshes the DefectDojo UI theme to the updated DefectDojo brand.

Reverse Engineering · 2026-10-06

AI/LLM Security · 2026-10-06

Docker Sandboxes cloud CLI gains --rm flag to auto-remove sandboxes on agent exit and surfaces ttl_paused in JSON output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --rm flag to sbx --cloud run to automatically remove the sandbox when the agent session ends, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ sbx --cloud run --rm claude.
• Adds ttl_paused field to --json output so callers can detect whether a sandbox is stopped and its time-to-live is paused.
• Adds sbx --cloud ttl reporting for stopped sandboxes, showing stopped instead of an expiration time while the sandbox is paused.

AI/LLM Security · 2026-10-06

Docker Sandboxes adds --rm for throwaway sessions and --detached/-d to keep sandboxes running in the background.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --rm flag to sbx run to automatically remove the sandbox when the agent exits, without a confirmation prompt (exit status is preserved; incompatible with --detached and --detach-keys).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --detached / -d flag to sbx run to start a sandbox in the background, printing its ID and returning immediately without opening an agent session.
• Passing --detached / -d against an existing sandbox with sbx run -d --name <sandbox-name> permanently switches it to detached mode.

Digital Forensics & Incident Response · 2026-10-06

Elcomsoft Phone Breaker 11.05 adds iCloud extraction support for iOS 27, iPadOS 27, and the iPhone 18 lineup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds iCloud backup extraction support for iOS 27 and iPadOS 27 devices, including the iPhone 18 lineup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-06

Endor Labs adds Package Firewall user attribution and Claude Code compliance integration for agent governance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Connect the Anthropic Compliance API integration to enroll a Claude Enterprise directory so Coding Agent Governance can match Claude Code sessions to organization roles and groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Package Firewall user attribution to record the developer behind each request instead of the shared API key.

SAST / SCA / Code Security · 2026-10-06

Endor Labs integrates with SpaceXAI Grok Build to secure agentic code delivery via AURI, Agent Kit, and Coding Agent Governance hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Install the Endor Labs Agent Kit into Grok Build via the marketplace or by typing /add-plugin endorlabs in the agent chat to enable in-session security scanning, triage, and remediation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Coding Agent Governance, which uses deterministic hooks to record every MCP tool call, shell command, and file operation and enforce policies before each action runs — without relying on a model's judgment.
• Adds the Endor Labs Agent Kit, bringing specialized AURI remediation agents (AI SAST Remediation and SCA Remediation) directly into Grok Build sessions and CI/cloud runs via the Grok Build SDK.

Hacking Hardware · 2026-10-06

• Marauder v8 (marauder-v8) list price moved from $145 to $100 (-31%) at justcallmekokollc.com on 6 Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-10-06

Fastly NGWAF adds INSECURE-DESER anomaly signal to detect insecure deserialization attempts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds INSECURE-DESER anomaly signal to the NGWAF to detect attempts to exploit unsafe deserialization of data, with planned promotion to a full attack signal in a future release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Hacking Hardware · 2026-10-06

Flipper One gains two OS installation paths: Flipper OS Installer (via rockusb) and direct microSD image writing with Raspberry Pi Imager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds rockusb download-boot installer-falcon-loader.bin workflow to load Flipper OS Installer into RK3576 RAM via MaskROM mode and install OS to microSD or UFS storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Flipper OS Installer UI with selectable release branches (Release, Release candidate, Nightly, Dev), target storage (/dev/mmcblk0 [eMMC] or /dev/sda [UFS]), OS profiles (including Minimal), and fetch modes (Download & verify / Stream).
• Adds Reprovision UFS option in Flipper OS Installer to create required hardware partitions (logical units) on UFS storage before installation.

Hacking Hardware · 2026-10-06

Flipper One Debug Probe adds SWD/CMSIS-DAP debugging, four USB serial ports, USB-GPIO bridge, and open-source firmware via RP2350.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports SWD (Serial Wire Debug) via CMSIS-DAP for the Flipper One MCU (RP2350), enabling CPU execution control, memory and peripheral access, and MCU flash programming without full disassembly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes four USB serial ports: Port 1 (/dev/tty.usbmodemflip_one_debug2) for the RK3576 CPU console, Port 2 (/dev/tty.usbmodemflip_one_debug4) for the MCU CLI, Port 3 (/dev/tty.usbmodemflip_one_debug6) for real-time MCU log streaming, and Port 4 (/dev/tty.usbmodemflip_one_debug8) for the Debug Probe MCU CLI.
• Provides a USB-GPIO bridge giving read/write access to several GPIO pins of the Flipper One CPU and MCU via the Debug Probe CLI.

Hacking Hardware · 2026-10-06

• Flipper Zero (flipper-zero) list price moved from $239 to $169 (-29%) at flipper.net on 6 Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Hacking Hardware · 2026-10-06

GhostESP v2.2 adds LoRa/Meshtastic support, bledetect and mdnssniff commands, dual BLE+Wi-Fi wardriving, and richer capture metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bledetect CLI command and Devices menu row for BLE device detect scan, with list, track, and AirTag spoof actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -name <text> argument to blespam to advertise a custom device name over BLE.
• Adds mdnssniff CLI command for passive local-name sniffing across mDNS, LLMNR, SSDP, and NetBIOS per ARP-discovered host.

SAST / SCA / Code Security · 2026-10-06

GitHub Copilot CLI now supports custom instructions to give it project-specific context for building, testing, and validating changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds custom instructions for GitHub Copilot CLI, letting you provide project-specific context about how to build, test, and validate changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-06

GitHub secret scanning adds detectors for Lovable Labs, Pydantic Services Inc., and Supabase secret types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection for lovable_api_key (Lovable Labs) as a new secret scanning partner, forwarding matches in public repos to the partner for revocation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds detection for logfire_token and pydantic_ai_gateway_api_key (Pydantic Services Inc.) as new secret types generating alerts in public and private repositories.
• Adds detection for supabase_oauth_access_token and supabase_scoped_personal_access_token (Supabase) as new secret types generating alerts in public and private repositories.

SAST / SCA / Code Security · 2026-10-06

npm trusted publishing configurations now expire after 48 hours if unvalidated, and tokens from issue_comment events are rejected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Unvalidated npm trusted publishing configurations expire 48 hours after creation and can no longer authorize publishing until a successful publish validates them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• npm now rejects trusted publishing tokens from GitHub Actions issue_comment events; move publishing to push, release, or workflow_dispatch instead.
• Changing the repository or project identity resets the trust relationship with a fresh 48-hour validation window; ordinary edits do not restart the deadline.

SAST / SCA / Code Security · 2026-10-06

npm staged publishing now supports creating brand-new packages via npm stage publish, including from stage-only tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables npm stage publish to create new npm packages (public scoped, unscoped, and private scoped) without a manual first publish, using a local session or a granular access token including a stage-only token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• First-version publishes via staged workflow enter a queue and require a maintainer to promote before the version becomes installable.
• After package creation via staged publish, package settings and trusted publishing can be configured immediately.

SAST / SCA / Code Security · 2026-10-06

GitHub security overview gains AI Scan PR enablement status, filters, and a new CSV export column for org/enterprise admins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds code-scanning-ai-scan-pr-scan:enabled and code-scanning-ai-scan-pr-scan:not-enabled filter qualifiers to the security overview coverage view to isolate repositories by AI Scan for pull requests status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Code Scanning AI Scan for pull requests column (values: enabled, not-enabled) to the coverage CSV export.
• Shows AI Scan for pull requests enablement status in the security overview coverage view, including per-repository rows and summary counts of enabled and not-enabled repositories.

SAST / SCA / Code Security · 2026-10-06

GitLab Dependency Firewall (early access) blocks malicious, vulnerable, and non-compliant packages before they enter a build.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds warn and block enforcement modes to Dependency Firewall: warn logs every policy match as an audit event and CI summary line without stopping the build; block halts the pipeline and records the reason.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds policy dimensions for malicious status (GitLab malware advisory database), vulnerability severity (critical, high, medium, low) with a configurable finding count, license type (allow/deny by full name, plus handling for undetermined licenses), and package age (minimum age before a version may enter a build).
• Adds a logged bypass mechanism that lets a designated user or token push an approved package through Dependency Firewall on the record.

SAST / SCA / Code Security · 2026-10-06

GitLab Artifact Central launches in beta: one org-level registry for Maven, npm, Docker, and OCI with built-in build provenance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces CI_JOB_TOKEN as the authentication mechanism for publishing and pulling artifacts through Artifact Central, eliminating the need for separate service accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces GitLab Artifact Central, an organization-level registry replacing per-project package and container registries, with centralized retention rules, storage quotas, and access policies.
• Supports three repository types — Hosted (private packages your teams publish), Remote (proxy with caching for external sources like Docker Hub or Maven Central), and Virtual (single endpoint combining hosted and remote, with automatic fallback and cache).

SIEM · 2026-10-06

Google SecOps SIEM Search adds SQL/GoogleSQL query mode, natural-language query bar, UDM Lookup, and data RBAC scope enforcement across all search tabs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chronicle.events.fetchEnrichedEvent, chronicle.savedSearches.update, chronicle.searchViews.update, chronicle.parsers.list, chronicle.parsers.get, chronicle.cases.get, and chronicle.cases.list as granular IAM permissions gating advanced search features.
• Adds UDM Lookup — a field-discovery tool that searches schema field names or stored log values and lets you append results directly to a query in the editor.
• Supports configurable maximum search result limits with a custom option accepting values in a defined range, and a configurable auto-collapse behavior for the query editor.

SIEM · 2026-10-06

Google SecOps adds AI-driven parser generation, Object RBAC fetching, parser diagnostics, and ownership transfer endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v1alpha/{parent}:fetchShareableObjects endpoint to list all Object RBAC-enabled objects within an instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET /v1alpha/{parent}/parserRuntimeErrors endpoint to list parser runtime errors and diagnostics for a given log type and time window.
• Adds POST /v1alpha/{parent}/actions:aiGenerate endpoint to generate a new integration action definition using Gemini AI.

Container & Image Security · 2026-10-06

Container & Image Security · 2026-10-06

Container & Image Security · 2026-10-06

Grype adds a calculated risk score (0.0–100.0) combining CVSS, EPSS, and other severity metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a calculated risk score combining CVSS, EPSS, and other severity metrics into a single numeric value (0.0 to 100.0) for each vulnerability finding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-10-06

NodeZero adds network pivoting for external tests, new attack config controls, and expanded WebApp pentest options in September 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds network pivoting for external tests, enabling NodeZero to pivot beyond the originally configured scope to include additional hosts discovered during an operation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new on/off and rate-limiting options for Password Spray, credential pivoting, and post-exploitation to control attack surface and minimize account lockouts.
• Supports custom login fields and longer secrets in WebApp Pentest configuration, with clearer feedback when a Runner or read-only state limits an action.

Identity & Access Management · 2026-10-06

iDenfy adds MCP-based AI assistant integration, social screening APIs, and KYB pre-fill endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds KYB form pre-fill and update API endpoints covering company details, custom fields, beneficiaries, documents, and questionnaire answers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Generate KYB form token endpoint that creates a KYB session and returns tokenString and companyId.
• Adds Create new KYB form endpoint to initiate a KYB form with pre-filled company data, optionally including beneficiaries and documents.

Data Security & DLP · 2026-10-06

Immuta adds Agentic Access V1 API for ephemeral agent roles, plus new Snowflake integration settings including Low Row Access Policy Mode and Data Sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agentic Access V1 API to vend ephemeral roles for agents to access data on behalf of a user, with a dedicated Agent resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Snowflake Low Row Access Policy Mode integration setting for controlling row-level policy application in Snowflake.
• Adds Snowflake Table Grants integration setting for managing table-level grants in Snowflake.

Secrets Detection & Management · 2026-10-06

Infisical v0.165.17 adds OCSP responder for internal CAs, Stripe secret rotation, agent-vault session logs, and Terraform gateway support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a members/available API endpoint on agent-vault so add-member dialogs surface only unassigned actors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an OCSP responder for internal certificate authorities.
• Adds Stripe app connection and API key rotation to secret-rotation.

Container & Image Security · 2026-10-06

Inspektor Gadget v0.57.0 adds rootless ig run, ig image prune, and --drop-cap-sys-admin for reduced-privilege Kubernetes deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --drop-cap-sys-admin flag to kubectl-gadget deploy to drop CAP_SYS_ADMIN and rely on CAP_BPF and CAP_PERFMON instead, disabling fanotify-based container detection and switching to a non-fanotify hook mode (podinformer/nri/crio).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ig image prune command to reclaim blob disk space from unreferenced manifests in the local OCI store.
• Enables rootless ig run requiring only cap_bpf, cap_perfmon, and cap_sys_ptrace — without CAP_SYS_ADMIN; falls back to reporting events from already-running containers when fanotify-based enrichment is unavailable.

Endpoint Security (EDR/XDR) · 2026-10-06

Iru adds Windows 11 26H2 enrollment support and a new Managed OS Library Item targeting that version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Managed OS Library Item for Windows 11 26H2, enabling IT teams to set 26H2 as the target version and enforce a consistent OS across device fleets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports enrollment of devices running Windows 11 26H2 into Iru.

Endpoint Security (EDR/XDR) · 2026-10-06

Iru adds Privacy Library Item for app permissions, AI-assisted Windows Update frameworks, and a new Startup bundle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Privacy Library Item to let administrators polish app permission prompts seen by end users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables defining common security frameworks when using Iru AI to configure Windows Updates.
• Introduces the Iru for Startup bundle as an all-in-one platform offering.

Endpoint Security (EDR/XDR) · 2026-10-06

Iru adds Audacity 4 as a new Auto App in the catalog, available to all customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Audacity 4 as a new Auto App available in the Iru catalog for all customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-06

JumpCloud 2022 adds certificate-based RADIUS auth, TOTP for LDAP, Password Manager, Remote Assist, OIDC SSO, and MSP command templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Command After Agent Install command type so admins can specify enrollment commands to run immediately after the JumpCloud agent is installed on new devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Running column to the commands queue to distinguish commands waiting in the queue from commands that are actively running.
• Adds certificate (passwordless) based authentication to JumpCloud RADIUS, supporting certificates from any X.509 compliant certificate authority.

Identity & Access Management · 2026-10-06

JumpCloud 2023 adds passwordless Go auth, Android zero-touch enrollment, Remote Assist background tools, dynamic groups, and push-bombing mitigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JumpCloud Go browser extension for hardware-protected, phishing-resistant passwordless login on managed macOS and Windows devices using Apple Touch ID and Windows Hello.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Conditional access policies for SSO apps now default to JumpCloud Go as the MFA method, with user and device verification on every application session.
• Adds Android zero-touch enrollment support for fully managed, dedicated, and company-owned Android devices with a work profile via Android EMM.

Identity & Access Management · 2026-10-06

JumpCloud 2024 adds Device Monitoring & Alerting, Windows App Catalog, SaaS Management, CSP-based MDM policies, and multi-IP RADIUS support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /systemusers?filter=department:$in:Finance | Accounting|IT support — the pipe | character can now be escaped with \ inside API in and nin filter search terms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Replaces deprecated GET api/systemusers/reactivate/{id} with POST https://console.jumpcloud.com/systemusers/reactivate/{id} (old endpoint now returns 404).
• Renames Dynamic Groups memberQuery filter operators $ge and $le to $gte and $lte to align API filter syntax across all list endpoints.

Identity & Access Management · 2026-10-06

JumpCloud adds MCP Server, Access Requests, Shadow AI Dashboard, Custom Admin Roles, and SAML/OIDC forced re-auth with AMR claims in 2025⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sso_auth event to logs specifically for forced re-authentication events, providing visibility for compliance and security reviews.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports ForceAuthn="true" in SAML and prompt=login in OIDC so applications can trigger step-up authentication without ending the user's existing session.
• Includes Authentication Methods References (AMR) claims in both SAML assertions and OIDC ID tokens, tagging logins with proof of factors used (e.g., password + OTP).

Identity & Access Management · 2026-10-06

JumpCloud adds MCP Server for Users, Custom Risk Policies, Patch Management Dashboards, AI knowledge-base uploads, and expanded Android/Apple MDM policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Patch Management Dashboards at Device Management > Patch Management, with a unified Overview tab plus dedicated Windows and Apple tabs — covering fleet patch compliance, KB-level drill-down, CVE details, bulk remediation, and CSV/JSON export.
• Adds Device Patch Report (Windows) under JumpCloud Reports, showing per-device KB patch status (Installed, Pending, Failed) with preview of up to 500 rows and full CSV export.
• Adds Knowledge Base Uploads for AI Assistant, letting admins upload internal docs (PDF, TXT, DOCX, MD; 10 MB per file, 25 files per org) into a private org-scoped knowledge base that the assistant cites by source document.

Identity & Access Management · 2026-10-06

JumpCloud RBAC preview adds CRUD-level granularity to Identity Management and Application Management scopes and reorganizes permission categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CRUD operations and No Access permission to Identity Management and Application Management scopes for more granular admin role assignments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Splits Identity Management and Directory and Groups Management into separate scopes, with Directory Management and Group Management nested under Directory and Groups Management.
• Groups SaaS Applications and Asset Management scopes under a unified SaaS and Asset Management permissions category.

Identity & Access Management · 2026-10-06

JumpCloud adds RSS feed subscriptions for release notes, agent updates, and bug fix announcements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Subscribe to Support RSS Feed option on the Release Notes and Bug Fixes page to receive notifications for any new Help Center content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Subscribe to Release Notes and Bug Fixes RSS Feed option to receive targeted notifications for product release notes, agent release notes, and bug fix reports.
• Adds Subscribe to Agent Release Notes RSS Feed option to receive notifications specifically for agent release notes.

Identity & Access Management · 2026-10-06

JumpCloud Password Manager Desktop App adds EU region support, 30K-item capacity, ARM/RPM builds, and admin-managed shared folders.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds EU region support for Password Manager; users select their region on the activation page (desktop) or pairing page (browser extension) before activating their account.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Raises item storage capacity to 13,000 items with autofill enabled, or up to 30,000 items when autofill is not used; a single shared folder can hold up to 5,000 items.
• Introduces a Move All items button in shared folders to relocate all items from a folder in one action.

Identity & Access Management · 2026-10-06

JumpCloud PAM expands Jump Server capabilities with credential backup, DB/server access auditing, and direct SSH connectivity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Jump Server credential backup configuration for PAM deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PAM Jump Server installation and update procedures.
• Adds monitoring and auditing of database access through the Jump Server.

Identity & Access Management · 2026-10-06

JumpCloud: Adds Duo Universal Prompt support for JumpCloud MFA, ahead of Duo's March 30, 2024 end-of-life for the traditional prompt.

Identity & Access Management · 2026-10-06

JumpCloud: Adds full Android 15 support in MDM.

• Allows admins to manually add applications to SaaS Management for tracking, warning, and blocking before automatic discovery occurs.
• Enables JumpCloud Go sessions to automatically refresh when a user logs in to or unlocks their managed device.

Identity & Access Management · 2026-10-06

JumpCloud: Adds ForceAuthn="true" (SAML) and prompt=login (OIDC) support so identity provider honors SP/RP requests for fresh logins even with an active session.

• Adds User Group Exclusion from JumpCloud Protect Unified MFA, allowing specified groups to use TOTP only instead of Push.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds Cisco Firepower and EDL (Passive) knoc types for just-in-time firewall access control⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cisco Firepower knoc type that connects to a Firepower management console via URL, API username/password, and a network group object UUID to control access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds EDL (Passive) knoc type that publishes an allowlist as an External Dynamic List (EDL) served by Knocknoc itself, requiring no agent.
• Supports an Insecure option on the Cisco Firepower integration for consoles whose certificates are not signed by a trusted CA.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds F5 BIG-IP inline integration, letting knocs write access rules directly to F5 Data Groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds F5 BIG-IP as an Inline knoc type, with a dedicated integration that stores management-interface URL, username, and password once and is shared across all knocs targeting the same device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports per-knoc Data Group and Partition configuration so two knocs sharing one F5 BIG-IP can write to different data groups independently.
• Adds a connection-validation step (Review) during knoc creation that checks the F5 integration before the knoc is saved.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds Passive mode for FortiGate: device polls a Knocknoc-hosted EDL allowlist without any firewall API calls or agent push.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Passive mode for FortiGate integrations, where the firewall polls a Knocknoc-hosted External Dynamic List (EDL) of authenticated user IPs — Knocknoc never calls the firewall API and nothing is pushed to the device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Sets Application Type to Passive on the FortiGate card via Configure Settings; a Passive Knoc carries no device fields, only description and display options.
• Exposes an EDL URL in the Knoc's Integration Info panel that is set as the External Dynamic List URL on the FortiGate.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds per-integration activity views, shared credential management, and a duplicate-integration merge workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds shared integrations so multiple Knocs protecting services behind the same firewall can reuse one set of credentials — enter or rotate them once and every Knoc picks up the change.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a per-integration activity page showing which Knocs use the integration, who has been connecting, grant volumes, average wait times, and failures — with a path from a failed user back to the enforcing system.
• Adds on-host enforcement support for ipset, nftables, pf, Windows Firewall, nginx, HAProxy, and custom scripts on the agent's own machine.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds Traefik middleware plugin, Palo Alto/Panorama firewall orchestration, firewalld host enforcement, and secret-authenticated EDL allowlists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Palo Alto firewall orchestration — directly or via Panorama — to dynamically control network access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Knocknoc Traefik plugin (middleware) to protect services running behind Traefik.
• Adds firewalld-based on-host enforcement for RHEL-family distributions.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds blocked-grant overrides with mandatory audit comments and full Trust Engine policy visibility in grant history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Grant Anyway override flow for blocked grants, requiring a mandatory comment before confirmation, so administrators can bypass a trust-policy block on a single grant without changing the underlying policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Records every override as an Admin overrode blocked grant audit-log entry under the Admin grants category, capturing the administrator, justification comment, user, IP address, requesting IP, Knoc, user agent, and timestamp.
• Expands blocked grant rows in a Knoc's grant history to show the full Trust Engine finding — which policy decided, which restrictions matched, and what each was set to at the time of the connection.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds manual access grants — give any IP a 20-minute access window without changing your default-deny policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Manual access section inside individual Knoc edit pages, letting admins grant a specific IP (internal or external) a 20-minute access window directly while editing that Knoc.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Manual access option in the Knocs list view via the vertical-ellipsis menu, so admins can grant a 20-minute IP access window without opening the full Knoc editor.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds per-Knoc additional client IP discovery with IPv4/IPv6 family controls and RFC1918 filtering⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Discover additional IP addresses per-Knoc option (requires Client IP discovery enabled in Settings) to add extra observed client addresses to the grant list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds https://v4.myip.knoc.io and https://v6.myip.knoc.io endpoints to capture IPv4-only or IPv6-only addresses, supplementing the default myip.knoc.io dual-stack URL.
• Per-Knoc Which discovered addresses to add control offers three modes: Add all IPs (default), Add RFC1918 only (includes fc00::/7 IPv6 unique-local), and Add non-RFC1918.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds referrer-based redirects, per-Knoc SAML enforcement, auto-browse, and instant redirect options for frictionless user access flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds referrer query parameter support on the Knocknoc login URL (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ https://my.example.knocknoc.com?referrer=https://my.website.com) to redirect authenticated users back to their originating resource.
• Adds a per-Knoc Always redirect to SAML login option in the Knoc Options section, sending unauthenticated visitors straight to SAML login without showing the local login page — scoped per Knoc rather than site-wide.
• Adds a per-Knoc Auto-browse option in Knoc configuration that automatically forwards a user after login directly to the Knoc when it is the only one available to them, and can trigger automatic launch of non-browser protocols (e.g. sftp, SAP).

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds per-Knoc TOTP enforcement, requiring a 6-digit authenticator code before each access grant is processed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Require TOTP code when accessing grant option in the Knoc Options area, enforcing a 6-digit authenticator code before each grant is processed — independent of and in addition to any SSO/MFA session (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Entra MFA).
• TOTP entry is rate-limited per grant, and users who have not yet enrolled are prompted to scan a QR code or copy a setup key to register their authenticator app before access is allowed.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc adds click to grant and click to revoke interactive access control buttons to Knocs for temporal access workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds click to grant and click to revoke buttons to Knocs, requiring users to manually trigger each access grant or revocation after logging in for an additional interactive security layer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Logs grant and revoke button clicks as specific events in Knocknoc's audit logging system.
• Combines click-to-grant/revoke with shorter grant periods for tighter temporal access control.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Knocknoc documents grant/revoke lifecycle, Knoc pause behavior on unreachable devices, and grant history filtering in the admin UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds revoke failed status and Errors status filter in each Knoc's grant history view, surfacing grants whose revokes could not be applied to the underlying device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces automatic Knoc pause-and-backoff logic: after two consecutive connection failures, the Agent pauses that Knoc for two minutes, doubling on each retry up to a fifteen-minute cap.
• Documents agent error #299003 (Device is unreachable) as the signal for held-back revokes, with a dedicated troubleshooting page at 299003 - Device Is Unreachable.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

New guide shows how to run Knocknoc behind HAProxy with HTTP/2, WebSocket, and TrustedForwarders support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a sample HAProxy frontend/backend configuration for Knocknoc, covering HTTP/2 (alpn h2), HTTP-to-HTTPS redirect, WebSocket support (required by knocknoc-agent), and a custom 403 error page served from /var/www/403.http.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Web Application Security · 2026-10-06

Levo 1.2.135.4 adds bulk API endpoint merging and a full create-validate-approve lifecycle for custom AI-authored tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bulk merge for duplicate API endpoints in the API Surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a full authoring lifecycle — create, validate, approve — for custom AI-authored tests, with each run bound to the exact code a human reviewed.

Web Application Security · 2026-10-06

Levo 1.2.135.5 adds an audit-format PDF export for Vulnerabilities and fixes auth-key viewing flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an audit-format option to the Vulnerabilities PDF export, producing a report suitable for handing to an auditor or a customer's security team.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Viewing a satellite, CLI, or test-runner auth key no longer redirects through the identity provider.

Threat Intelligence · 2026-10-06

Lookyloo v1.42.0 adds optional video recording of web captures, viewable at Capture > Video after completion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds optional video recording of captures (requires Lacus 1.27.0+), accessible after capture via Capture > Video; triggering video capture is admin-only on the public instance, but all users can watch recorded videos based on capture visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Most tables now have a copy-to-clipboard button.
• Changes the default mobile device (replacing Blackberry) used in captures.

AI/LLM Security · 2026-10-06

Mend Renovate gains rich version constraint support for Gradle Groovy/Kotlin DSL and re-applies auto-complete settings to existing Azure PRs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Re-applies auto-complete settings to existing pull requests on the Azure DevOps platform (platform/azure).

AI/LLM Security · 2026-10-06

Mend AI Runtime Protection expands multi-language support for Guardrails runtime threat detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands runtime threat detection in Mend AI Runtime Protection | Guardrails to additional languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-06

Mend AI adds multi-language runtime guardrails and per-finding Suppress/Review triage actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands Mend AI Runtime Protection Guardrails to cover additional languages, broadening runtime threat detection across more widely used programming languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-06

Mend SAST adds --print-to-console flag for live CLI log output and expands YAML/JSON config file entry-point detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automatic /_MACOSX/..* metadata file exclusions to mend code CLI scans across all SAST engines, applied via centralized settings even when default exclusions are otherwise disabled.
• Extends entry-point detection to support YAML and JSON configuration files, automatically identifying API endpoints, mapping them to implementation classes, and marking generated entry-point parameters as tainted for contract-first applications.
• Improves Python engine detection accuracy across 11 CWEs: CWE-022 Path Traversal, CWE-078 OS Command Injection, CWE-079 XSS, CWE-089 SQL Injection, CWE-094 Code Injection, CWE-209 Error Message Info Exposure, CWE-295 Improper Cert Validation, CWE-532 Sensitive Info in Log, CWE-601 Open Redirect, CWE-918 SSRF, and CWE-943 NoSQL Injection.

SAST / SCA / Code Security · 2026-10-06

Mend SAST gains automatic API endpoint detection from YAML/JSON config files, eliminating manual framework setup for contract-first apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for YAML and JSON configuration files as input to the entry point detection engine, enabling automatic identification of API endpoints and mapping to their implementation classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Automatically marks all generated entry point parameters as tainted for contract-first applications, removing the need for manual custom framework configuration.

Network Analysis & Monitoring · 2026-10-06

Netcap v0.10.3 ships faster native DPI with worker-owned nDPI contexts, bundled DB-IP Lite geolocation, and a rebuilt mutual-TLS 1.3 distributed collection wire format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -dpi-workers flag (env NC_DPI_WORKERS) to set the number of worker-owned nDPI contexts; one context minimizes native memory, automatic mode uses up to eight.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -geoProviders flag to select among bundled geolocation providers (e.g. dbip,geolite2); DB-IP Lite City data is now included in database downloads.
• Adds net agent -gen-keypair flag (env NC_GEN_KEYPAIR) to write a new agent certificate and key and print its fingerprint, replacing the former gen-config flow.

Network Analysis & Monitoring · 2026-10-06

Network Analysis & Monitoring · 2026-10-06

Network Analysis & Monitoring · 2026-10-06

Network Analysis & Monitoring · 2026-10-06

NETRESEC introduces FlowCarp, a statistical traffic-analysis engine that identifies application-layer protocols without signatures or formal specs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces FlowCarp, a protocol-identification engine that classifies application-layer protocols — including proprietary, encrypted, obfuscated, and C2 protocols — by analyzing statistical characteristics of network flows rather than static IDS signatures or protocol parsers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• FlowCarp can generate alerts and integrate with existing monitoring workflows, providing a complementary detection layer alongside traditional IDS rules and port-based detections.
• FlowCarp protocol models can be built from example traffic captures alone, without requiring a formal protocol specification.

Network Analysis & Monitoring · 2026-10-06

NETRESEC: FlowCarp can generate alerts and integrate with existing monitoring workflows.

Data Security & DLP · 2026-10-06

Netskope R142.0.0 introduces a new Client Steering capability and a redesigned Netskope Client UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a redesigned Netskope Client UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-06

Nudge Security launches adaptive risk management with automatic app tiering, dynamic risk scores, and a new Risk dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Dashboards > Risk view to quickly identify where exposure is concentrated across your SaaS and AI estate and track changes over time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces automatic app tiering that prioritizes apps based on organizational adoption and the sensitivity of up to 29 inferred data types, with no manual entry required.
• Adds always-on dynamic app risk scores driven by 30 internal and external factors, updating automatically without vendor participation.

General Utilities & Libraries · 2026-10-06

Obsidian 1.14 adds kanban view for Bases, six highlight colors, and the ability to open individual Markdown files from outside a vault.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Open file from outside the vault… command to open individual Markdown files from anywhere on disk, with image embeds and links resolving relative to the file's folder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Obsidian now appears in the OS Open with menu and can be set as the default app for .md files; macOS gains Quick Look previews for Markdown files even when Obsidian is closed.
• Groups are now collapsible in the table, cards, and list layouts of Bases.

General Utilities & Libraries · 2026-10-06

Obsidian 1.14 Mobile adds iOS Quick Capture from Lock Screen and widgets, RTL gesture flips, and extra-large iOS 27 widgets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --font-preferred-size CSS variable for text that should respect the system's preferred text size, combining --font-text-size with the --preferred-text-scale multiplier.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Quick Capture on iOS 26, enabling instant note creation from the Lock Screen, Control Center, Home Screen widgets, or Shortcuts without waiting for the vault to load — with configurable destinations (new note, daily note, bookmarked note, or any note) and optional templates.
• Flips swipe gestures and page animations for right-to-left (RTL) languages.

SAST / SCA / Code Security · 2026-10-06

Openlayer: Adds Palantir Foundry integration to monitor AIP Agents and AIP Logic functions with Openlayer.

SAST / SCA / Code Security · 2026-10-06

Openlayer adds governance/compliance REST APIs, Jev-as-a-judge test, and new integrations for Claude, Microsoft 365 Copilot, and Palantir Foundry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api-reference/rest/workspaces/retrieve-workspace endpoint to retrieve workspace details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Palantir Foundry integration to monitor AIP Agents and AIP Logic functions in Openlayer.

Reconnaissance & OSINT · 2026-10-06

OpenOSINT v2.31.0 adds a graph store that runs without native builds and zero-key onboarding for new users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables graph store operation without native builds, removing compiled-dependency barriers for installation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds zero-key onboarding so the tool can be used immediately without supplying any API keys.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

OpenSSH 10.6 adds post-quantum signatures, WarnWeakCrypto for sshd, AgentSocketPath, FIDO PIN-skip -P, and fractional ChannelTimeout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds WarnWeakCrypto option to sshd_config(5), enabled by default, logging when a client uses a key-agreement scheme that is not post-quantum safe (previously client-only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AgentSocketPath option to sshd_config(5) to control the location of $SSH_AUTH_SOCK for agent forwarding, supporting user:<path> (e.g. user:.ssh/agent) and shared:<path> (e.g. shared:/tmp) directory styles; sockets in shared directories are created inside a subdirectory with a randomised name.
• Adds PubkeyOptions max-pk-ok:nnnn to let a configurable number of PK_OK public-key probe tests proceed without counting against MaxAuthTries, defaulting to 6, allowing more keys in ssh-agent or on disk to be checked before disconnection.

Endpoint Security (EDR/XDR) · 2026-10-06

OSSEC 4.4.0 adds Windows FIM attribute/ACL checks, GeoLite2 MMDB GeoIP with IDS rules, and JSON syslog alert forwarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds opt-in check_attrs config key to Windows FIM to alert on Hidden/System/attribute changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds opt-in check_acl config key to Windows FIM to alert on NTFS DACL/ACE matrix changes.
• Replaces EOL GeoIP Legacy with libmaxminddb (GeoLite2 MMDB) for GeoIP lookups in analysisd, adding ASN and country enrichment.

Identity & Access Management · 2026-10-06

PingOne gains Entra ID hybrid join support in all geographies and a new default 2-minute MFA lock duration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Microsoft Entra ID hybrid join support to all geographies (previously US/North America only), enabling hybrid-joined Windows devices to obtain and renew primary refresh tokens (PRTs) via PingID Windows Login Passwordless or username/password — requires PingOne for Workforce Plus or Premium license.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Changes the default Lock duration in MFA policies for SMS, Voice, and Email from 0 to 2 minutes in new environments to guard against brute-force attacks.

Identity & Access Management · 2026-10-06

PingOne adds webhook status visibility, auto-enrollment from Verify to Recognize, and a new Account Updated notification template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds webhook status and last successful delivery visibility on the webhooks page in PingOne for each subscribed webhook.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds auto-enrollment of a user's verified selfie into PingOne Recognize immediately after a successful PingOne Verify transaction, now generally available.
• Adds a new Account Updated notification template in PingOne, usable via the PingOne connector in DaVinci to email users when their account is modified.

Identity & Access Management · 2026-10-06

MFA Use Case Connector gains PingID Workforce capabilities: Remember Me, backup auth, OATH resync, PingID Desktop, and YubiKey support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds extraOtpRequired error output to the Finish Device Registration capability, prompting users for an additional verification code when OATH hardware token time-drift resync is required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Update Device Nickname capability to the MFA Use Case Connector, allowing device renaming post-registration when permitted by the MFA policy.
• Adds an OATH Token Resync toggle in the Finish Device Registration capability for time-drift resync of OATH hardware tokens during device activation.

CNAPP · 2026-10-06

Plerion adds AI agent security inventory for Amazon Bedrock AgentCore and Agents Classic, plus KMS key visibility on Bedrock assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agent Security inventory covering Amazon Bedrock AgentCore runtimes and harnesses and Amazon Bedrock Agents Classic agents, letting you navigate from an agent to its gateways, tools, memory, guardrails, and IAM role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Scans container images and code inside AgentCore runtimes for exploitable vulnerabilities and secrets left in the image.
• Raises findings for risky agent configuration, such as a gateway reachable without credentials or a memory store open to any AWS account.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Pomerium adds SSH session recording, MCP OAuth hardening, distroless images, and new Enterprise Console startup flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -directory-provider and related startup flags to the Enterprise Console, enabling full directory sync configuration without the web UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -url startup flag to the Enterprise Console to auto-create the console's own Pomerium route on first boot.
• Adds base-nossl-debian12 distroless base image variant for published Pomerium container images, structurally removing libssl3 from every deployment.

SAST / SCA / Code Security · 2026-10-06

Portkey adds a /v1/decisions endpoint for typed model judgments (choice, score, probability) with guardrails on the state field⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v1/decisions endpoint that returns typed judgments (noul, choice, or score) instead of free text, accepting a state field and a questions map — currently available through TypeSafe's Jev models (jev-latest, jev-1.13.0).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds JWT_PREFER_USER_WORKSPACE_RESOLUTION environment variable to the gateway; set to ON to try a user token's own workspace membership before deployment and organisation defaults in the resolution order.
• Adds guardrails support for /v1/decisions requests, scanning only the caller-supplied state field (never model, questions, or criteria) via input_guardrails at the before-request stage — hard-deny returns 446, soft-deny returns 200 with an empty answers map.

Web Application Security · 2026-10-06

Qualys TotalAppSec achieves FedRAMP High authorization with continuous API discovery, BOLA/BFLA/BUA testing, and TruRisk prioritization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Qualys TotalAppSec is now FedRAMP High Authorized on the Qualys Government Platform (Class D, package FR2231052341), enabling organizations to inherit controls from an agency-accepted boundary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Continuously discovers known, unknown, shadow, zombie, and rogue web apps and APIs across cloud, on-premises, internet-facing environments, API gateways, AI-serving endpoints, and MCP servers.
• Imports API specs from Swagger, Postman, and Burp, pulling from gateway and cloud connectors, and reconciles every discovered endpoint against the declared inventory to surface shadow and zombie APIs.

Reverse Engineering · 2026-10-06

Radare2 6.2.4 adds s1c88 CPU support, Go/Swift calling conventions, sparse gap search, and compact try/catch commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds iw. command to show try/catch blocks of the current function only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds /xs sparse gap search command.
• Adds iicl command to list imports by class.

Vulnerability Management · 2026-10-06

Rapid7 Command Platform adds SCIM identity provisioning support for Entra ID, Okta, Duo, Google, and OneLogin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a SCIM provisioning is active toggle under Administration > Settings > SSO Settings on the Command Platform, activated via the Submit and turn on SSO action, to enable SCIM endpoints for IdP communication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports SCIM integration with Microsoft Entra ID, Okta, Duo, Google, and OneLogin as identity providers for automated user provisioning on the Command Platform.

CNAPP · 2026-10-06

InsightCloudSec 26.10.6 expands Remediation Hub access for cloud teams and ships a new Kubernetes Scanner version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands Remediation Hub access to empower cloud teams with broader remediation capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ships a new Kubernetes Scanner version with improved performance and stability.

SIEM · 2026-10-06

Command Platform now defaults to unified single-app navigation, eliminating page reloads when switching between Rapid7 products.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the Command Platform unified navigation and single platform application as the default experience for eligible customers, eliminating page reloads when switching between Vulnerability Management, SIEM, Cloud Security, Attack Surface Management, and Automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a redesigned collapsible vertical navigation that shows only the products and capabilities the user has access to.
• Adds cross-platform search with support for legacy product names (e.g., searching IDR returns SIEM-related results).

Vulnerability Management · 2026-10-06

InsightVM 8.62.0 adds CIS SQL Server 2025 policy content and bulk vulnerability data export via API key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables bulk vulnerability data export using any valid API key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new CIS SQL Server 2025 policy content for compliance checks.
• Expands vulnerability coverage for Oracle HTTP Server and Oracle JRE.

Threat Intelligence · 2026-10-06

Rapid7 Threat Command adds Intelligence Watchlist curation and a new Malware Library for faster malware querying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Intelligence Watchlist to curate and filter your threat intelligence feed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds analyst note preview endpoint to validate formatting and entity linking before publishing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new API endpoint that returns a fully rendered preview of an analyst note — with resolved entity references and formatted text — without saving or publishing it, enabling pre-publish validation of formatting, entity linking, and content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports a serialization parameter on the preview request body (alongside source and attributes such as title, text, and entity references) to control response detail level, matching the existing publish/draft format.

Threat Intelligence · 2026-10-06

New POST endpoint lets you create draft analyst notes programmatically before publishing them via the Recorded Future API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Analyst Notes: Draft endpoint, which accepts a JSON payload with source, attributes (title, text, entity references), and optional resolve_entities: true to stage a note for review without publishing it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Returns a report_id string (e.g., doc:wB0Rhk) usable with Analyst Notes: Lookup to retrieve the draft or Analyst Notes: Publish to make it live.

Threat Intelligence · 2026-10-06

Recorded Future adds an analyst note export endpoint returning rendered PDF or HTML via application/octet-stream.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /analyst-note-export endpoint with a format path parameter accepting pdf or html to export analyst notes as rendered, offline-readable files; response body is binary application/octet-stream — save directly to .pdf or .html.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds an API endpoint to download binary attachments from analyst notes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a GET endpoint that downloads the raw binary attachment associated with an analyst note, returning application/octet-stream content; responds with a 404 JSON error (with message, status_code, and trace_id fields) when the note has no attachment or does not exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds analyst-note-search API endpoint with cursor-based pagination and enterprise-only filtering⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /analyst-note-search endpoint to search published analyst notes across enterprise and Insikt Group content, filtering by topic, attached entities, publication date range, note source, or text.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports cursor-based pagination via next_offset in the response and from in the next request body.
• Adds enterprise_only: true filter field to restrict results to your organization's notes, excluding Insikt Group content.

Threat Intelligence · 2026-10-06

Recorded Future analyst note APIs gain a serialization parameter to control entity detail level in responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the serialization parameter to all analyst note API operations (Preview, Publish, Lookup, Search), accepting "id", "min", or "full" to control how much entity detail is returned — "full" is the default, returning complete objects with id, name, type, and description; "id" returns only the bare string identifier; "min" returns an object with name only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The serialization level applies uniformly to all entity fields in analyst note responses, including note_entities, context_entities, and nested entity references, enabling significant payload reduction when notes reference dozens or hundreds of entities.

Threat Intelligence · 2026-10-06

New Cases: Eligible Assignees API endpoint lists users who can be assigned to a specific case.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET endpoint Cases: Eligible Assignees that returns the list of users eligible to be assigned to a specific case, identified by a task:<UUID> ID in the id field, with optional text (name/email filter) and limit parameters; each result includes display name, email, and user_id for use as the assignee parameter in Cases: Create or Cases: Update.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds a Cases Update endpoint to modify case properties via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a PATCH /cases-update API endpoint that modifies one or more properties of an existing case identified by its TaskIdentity ID (formatted as task:<UUID>, obtainable from the Case Search endpoint), with each change recorded in the case activity log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports unassigning a case by passing an empty string for the assignee field in the update request.

Threat Intelligence · 2026-10-06

Recorded Future adds POST /cases/search API endpoint for paginated case filtering by status, priority, assignee, and date range.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a POST /cases/search endpoint that filters cases by status (New, InProgress, Resolved, Dismissed), priority (Informational, Moderate, High), assignee (uhash or empty string for unassigned), and created/modified date ranges, returning matching TaskIdentity IDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports sort control via order_by (created or modified) and direction (asc or desc) parameters on the search endpoint.
• Implements a two-step workflow: call Cases: Search to get IDs, then pass them to Cases: Lookup Many to retrieve full case details.

Threat Intelligence · 2026-10-06

New POST /dark-web/brand-playbook/alert/{id} endpoint retrieves the full intelligence picture for a single Dark Web Brand Playbook Alert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /dark-web/brand-playbook/alert/{id} API endpoint to retrieve the full intelligence picture for a single Dark Web Brand Playbook Alert, including workflow state, priority, assignee, matched targets, screenshot references, and source-specific details for forum, market, Telegram, and ransomware mentions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Adds sigma-retry-job API endpoint to resubmit failed Auto Sigma jobs; returns {retried: true/false} based on job state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sigma-retry-job endpoint at https://api.recordedfuture.com/malware-intelligence to resubmit failed Auto Sigma jobs; authenticate with X-RFToken header; returns {"retried": true} if requeued or {"retried": false} if job was not in a FAILED state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds DELETE endpoint for Auto Sigma jobs, permanently removing a job and its generated Sigma rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a DELETE endpoint for Auto Sigma jobs that permanently removes a job and all associated generated Sigma rules from the Malware Intelligence platform; the response includes a deleted boolean field confirming successful removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

New GET /sigma/job endpoint lets you poll Auto Sigma job status and retrieve generated Sigma detection rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /sigma/job endpoint to retrieve the current status (CREATED, RUNNING, FINISHED, FAILED), configuration, and results of a specific Auto Sigma job, including auto-generated Sigma detection rules in YAML format and behavioral patterns (process images, command-line patterns) extracted from malware sandbox executions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds POST /malware-intelligence endpoint to list all Auto Sigma jobs with pagination support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST https://api.recordedfuture.com/malware-intelligence (get_jobs) endpoint to list all Auto Sigma jobs created by the authenticated user, paginated via limit (default 10, max 1000) and offset parameters, authenticated with X-RFToken header.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Returns per-job malware family counts and processing status (finished, processing, or failed) across all Auto Sigma jobs, enabling bulk monitoring without fetching individual job details.

Threat Intelligence · 2026-10-06

Recorded Future adds Auto Sigma job API to generate Sigma detection rules from malware behavioral analysis⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST Auto Sigma job endpoint that analyzes malware samples from Malware Intelligence and automatically generates Sigma detection rules from behavioral patterns, using query, start_date, and end_date parameters to scope sample selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Returns a job_id (UUID) usable with the Get Sigma Job, Retry Sigma Rule, and Update Sigma Rule endpoints to poll status, retrieve generated rules, retry failures, and update rules.
• Supports malware-family-scoped queries such as sample.tags == "family:redline" with a start_date floor of 2023-11-01.

Threat Intelligence · 2026-10-06

Recorded Future adds Auto YARA retry endpoint to resubmit failed YARA rule generation jobs without creating new ones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Auto YARA: Retry Job API endpoint to resubmit a previously failed YARA rule generation job using its original hashes, without creating a new job — returns true if requeued, false if the job was not in a retriable state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds GET /yara-get-job endpoint to retrieve Auto YARA job results, including generated rules and pattern analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /yara-get-job endpoint to retrieve the full result of a specific Auto YARA job, returning the generated YARA rule text, hex byte patterns identified across malware samples, and a coverage analysis showing which samples contributed to the rule versus which were too distinct to cluster.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds YARA Edit Job API endpoint to update YARA rule strings on existing Auto YARA jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds YARA Edit Job API endpoint to update the yara_rule_str on an existing Auto YARA job, passing the job ID in the request body; returns the job_id of the updated job on success.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-06

Recorded Future adds GET /malware-intelligence Auto YARA job listing endpoint for monitoring rule-generation status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Returns coverage data per job indicating which submitted malware hashes shared enough common patterns to produce a YARA rule versus which were too unique to cluster.
• Full YARA rule text and pattern details are intentionally omitted from the list response — use the Get YARA Job endpoint with a specific job ID to retrieve complete output.

Threat Intelligence · 2026-10-06

Recorded Future: Adds POST /yara/create-job endpoint to create asynchronous Auto YARA jobs analyzing up to 100 malware samples and generating YARA detection rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Returns a job_id (UUID) usable with Get YARA Job, Edit YARA Job, Retry YARA Job, and Delete YARA Job endpoints to manage the full YARA rule generation lifecycle.
• Supports an optional query field on job creation to record the query used to find the sample hashes for reference, without affecting sample selection.

Threat Intelligence · 2026-10-06

New GET /malware-intelligence/sandbox-reports endpoint retrieves full sandbox analysis for a SHA-256 sample, including MITRE ATT&CK mappings, process trees, and C2 configs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Malware Intelligence: Sandbox Reports endpoint, which retrieves full sandbox analysis reports for a specific malware sample identified by its sha256 parameter and a query parameter using the Malware Intelligence query language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports a limit parameter (range 1–10, default 1) to control how many reports are returned, ordered by highest sandbox score first.
• Each report's dynamic section includes network flows with destination IPs and ports, DNS requests, HTTP sequences, process trees with command lines, MITRE ATT&CK TTP mappings with severity scores, extracted C2 servers and encryption keys, and dropped files with hashes.

Threat Intelligence · 2026-10-06

Recorded Future adds malware-intelligence-query-iocs endpoint to search sandbox analysis DB by SHA256, IP, domain, or URL IOC lists⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New POST endpoint Malware Intelligence: Query IOCs accepts sha256_list, ip_list, domain_list, and url_list parameters to pivot across Recorded Future's malware sandbox analysis database using known indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The field parameter controls which artifact type is aggregated in results — supported values include sha256 (related samples), ip_address (network infrastructure), and ttp (MITRE ATT&CK techniques).
• The operator parameter controls multi-list logic: and (default) requires matches across all provided IOC lists; or matches any.

Threat Intelligence · 2026-10-06

Recorded Future adds a natural-language malware sandbox query endpoint that auto-generates and returns the equivalent structured query.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New Malware Intelligence: Query NL endpoint accepts plain-English descriptions to search Recorded Future's malware sandbox analysis database, returning matching artifacts and the auto-generated executedQuery so practitioners can pivot to the structured Malware Intelligence: Query endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Response includes totalPages for paginated iteration over sandbox artifact results.

Threat Intelligence · 2026-10-06

Recorded Future: New POST /malware-intelligence/query endpoint queries malware sandbox database using Malware Intelligence query language with dynamic behavior filters⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports start_date parameter (required; earliest value 2023-11-01) to bound sandbox analysis results, with paginated response including name, count, risk score, and total_pages.

Threat Intelligence · 2026-10-06

Recorded Future documents available entity tags and their API names for the Lists: Replace Entity Tags endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Documents the full set of tags (57 named values such as tier0, critical, pci_dss, hipaa, gdpr, dora, iso_27001, sox, internet_facing, unpatched, false_positive, and more) that can be applied to entities on company-type lists via the Lists: Replace Entity Tags endpoint, with a limit of 9 tags per entity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Clarifies that while the Recorded Future UI organizes tags into logical groups (risk tiers, compliance frameworks, supply chain classification), the API treats them as a flat list and requires the API Name column values in requests.

Continuous Control Monitoring (CCM) · 2026-10-06

RegScale CLI 6.50.0 adds tag-filtered AWS Audit Manager syncs and richer Wiz asset and network vulnerability data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --tags flag to AWS Audit Manager sync to filter which assessments are scoped for evidence collection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Wiz asset syncs now populate the public-facing FQDN, IP address, and URL fields from confirmed application endpoints.
• Wiz network exposure vulnerabilities now carry port and protocol data.

SAST / SCA / Code Security · 2026-10-06

Retire.js 6.1.0 improves repository validation error output and warns on ignored positional arguments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Repository validation errors (for an invalid --jsrepo, and from repository/validate) are now listed one per line with the location of each problem, instead of as a nested JSON tree.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Positional arguments (e.g. retire . or retire src/) now print a warning directing users to use --path <path> instead of being silently ignored.

MCP Servers & Tooling · 2026-10-06

Runlayer 1.28.1019 adds voice input to agent chat, agent handoff approvals, and live Bedrock model validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bedrock:ListFoundationModels, bedrock:ListInferenceProfiles, and bedrock:GetFoundationModelAvailability IAM actions to the AWS Bedrock provider setup, enabling live connection validation that lists and checks only the models your account has enabled in that Region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds voice input to agent chat: click the microphone in the message box, speak, then click stop — Runlayer transcribes the recording into the message box using your workspace's OpenAI provider.
• Adds an approval gate for agent handoffs: before an agent passes work to another agent mid-conversation, the user must approve, with the target agent, its owner, and the task shown.

Identity & Access Management · 2026-10-06

SailPoint Data Access Security adds a Google BigQuery connector for warehouse inventory, effective-access visibility, and GCP classification tag ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Google BigQuery connector to Data Access Security, enabling crawl and inventory of BigQuery datasets, tables, views, and routines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Collects effective permissions for BigQuery resources, explaining access in enterprise identity terms across users, groups, and service accounts.
• Ingests classification tags already applied in Google Cloud onto the corresponding DAS assets, reusing existing GCP data classifications without re-classifying with the DAS engine.

Identity & Access Management · 2026-10-06

SailPoint Data Access Security adds an Atlassian Confluence Cloud connector for identity-first visibility and content classification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Confluence Cloud connector to Data Access Security, enabling inventory of Confluence spaces, pages, and attachments with effective-permission mapping expressed in enterprise identity terms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports data classification of unstructured Confluence content using the existing DAS classification approach, extending the same governance model already applied to other data sources.
• Surfaces unresolved-principal markers when a Confluence principal cannot be matched to a known identity, making permission gaps explicit.

Compliance Automation & Trust Management · 2026-10-06

Scrut Automation adds CrowdStrike XDR as a supported integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CrowdStrike as a supported XDR integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-10-06

Shannon v3.4.0 adds an exploit-readiness probe and --validate-auth preflight mode, plus hyperlinked finding IDs in PDF reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --validate-auth mode to the preflight command to verify authentication configuration before a pentest run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an exploit-readiness probe to the preflight subsystem to confirm the environment is ready to execute exploits.
• Links finding IDs in the PDF report to their corresponding detail sections for faster navigation.

SAST / SCA / Code Security · 2026-10-06

skill-scanner FAQ documents LLM judge setup, policy presets, OSV/VirusTotal/Cisco AI Defense integrations, and GitHub Actions workflow config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports SKILL_SCANNER_LLM_PROVIDER=openai-compatible to connect any OpenAI-compatible gateway or local server as the LLM judge backend.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Anthropic (anthropic/claude-sonnet-5-5 as default), OpenAI, AWS Bedrock, Google Vertex AI and Gemini, Azure OpenAI, OpenRouter, OrcaRouter, and Ollama as LLM judge providers.
• Adds experimental on-device Apple Foundation Model support via pip install 'apple-fm-sdk>=0.2.1,<0.3'.

SAST / SCA / Code Security · 2026-10-06

skill-scanner adds a reusable GitHub Actions workflow, pre-commit hook, and .skill_scannerrc config with LLM judge, VirusTotal, and OSV support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a self-hosted workflow path for role-based Bedrock or Vertex AI access using OIDC (id-token: write) and cisco-ai-skill-scanner[bedrock], running skill-scanner scan-all with --use-llm, --format sarif, and --output results.sarif for SARIF upload.
• Adds pre-commit hook support (rev: 2.2.1) that scans only the skills touched by a commit, with --use-llm enabled and Bedrock support via additional_dependencies: [boto3].
• Adds .skill_scannerrc config file at the repository root with keys skills_path, policy, use_llm, llm_model, severity_threshold, and fail_fast to drive the pre-commit hook.

SAST / SCA / Code Security · 2026-10-06

skill-scanner: Adds --use-llm flag to enable the LLM judge alongside deterministic rules, raising malicious-skill recall from ~8% to ~66.7% at the balanced preset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --policy flag accepting presets balanced, low-noise, quiet, and strict to control rule severity demotion and judge confidence capping.
• Adds --fail-on-severity flag (recommended value: high) to set the severity level that fails a scan.
• Adds --llm-decompose flag for the strict hunting preset, enabling per-component LLM decomposition of a skill.

SAST / SCA / Code Security · 2026-10-06

skill-scanner: Adds --use-llm flag to invoke an LLM judge that reads a skill for intent, controlled by SKILL_SCANNER_LLM_MODEL and SKILL_SCANNER_LLM_API_KEY.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds generate-policy --preset <name> -o <file> subcommand to scaffold a custom policy YAML from any built-in preset.
• Adds --use-behavioral flag to enable Python dataflow analysis.
• Adds --use-osv flag to check skills against known-vulnerable dependencies.

SAST / SCA / Code Security · 2026-10-06

skill-scanner: Adds Homebrew tap for macOS installs via brew tap cisco-ai-defense/skill-scanner and brew install cisco-ai-defense/skill-scanner/skill-scanner (macOS 14+).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Prebuilt wheels now available for glibc Linux x86-64/ARM64, macOS x86-64/ARM64 (macOS 14+), and Windows x86-64; source distribution requires Go 1.27.1+ for the CEL helper.

SAST / SCA / Code Security · 2026-10-06

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Sophos Connect 2.1 for macOS adds provisioning-file import, Microsoft Entra ID SSO, native Apple Silicon support, and double-click file import.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports importing .pro, .scx, .tgb, and .ovpn connection and provisioning files by double-clicking the file on your device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds provisioning file support to automatically import remote access SSL VPN and IPsec VPN configurations to Sophos Connect for macOS.
• Adds Microsoft Entra ID single sign-on (SSO) for remote access SSL VPN and IPsec VPN connections, with authentication in an embedded browser, the system browser, or a browser Sophos Connect automatically selects.

SAST / SCA / Code Security · 2026-10-06

StackHawk adds mutual TLS (mTLS) / client-certificate support, configured via hawk.config and combinable with any auth type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports mutual TLS (mTLS) client-certificate authentication configured via hawk.config, combinable with any existing authentication type for scans of mTLS-protected applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-06

HawkScan gains mutual TLS (mTLS) support via PKCS#12 client certificates configured with three new scan-engine override keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds network.clientCertificates.use, network.clientCertificates.pkcs12.file, and network.clientCertificates.pkcs12.password scan-engine override keys to present a PKCS#12 (.p12/.pfx) client certificate during the TLS handshake, enabling HawkScan to scan applications that require mutual TLS (mTLS).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-06

StepSecurity adds a repository-level Agent Skills inventory page showing AI agent skills, executable flags, declared behavior, and provenance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Agent Skills page under GitHub inventories listing every AI agent skill committed to the default branch of each org repository, refreshed daily, with per-skill detail on repository, loading agent (Claude Code, Cursor, Windsurf, or shared .agents/skills directory), path, and file and script counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports filtering the Agent Skills inventory by source, agent, repository, or flag, and searching by skill name.
• Flags skills with executable content markers: code (executable scripts), hooks (declared hooks block), shell (injected shell commands on skill load), invalid yaml (unparseable SKILL.md frontmatter), and symlink (skill reached through a symbolic link).

Firewalls & Network Defense · 2026-10-06

Sublime Security adds Tailored Phishing Simulations and Training, turning real detected attacks into employee simulations with immediate contextual training.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Tailored Phishing Simulations and Training, converting attacks detected in your environment into phishing simulations with immediate, context-aware training when employees click.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Integrates phishing simulation and training directly into the existing Sublime platform, eliminating the need for a separate tool to run employee security awareness programs.

SIEM · 2026-10-06

Sumo Logic scan budgets can now be scoped to specific request sources — Search API, AI Search (MCP), or Mobot — and managed via UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables scoping scan budgets to specific request sources, including Search API, AI Search (MCP), and Mobot, to control query cost per source.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds full UI management of the Stop all scans action within scan budget configuration.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Aperture admin dashboard provides org-wide AI activity monitoring, request inspection, access management, and gateway configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Aperture admin dashboard at http://<aperture-hostname>/admin/ for monitoring organization-wide AI activity, investigating requests, managing access and spending, and configuring the gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports per-user spending limits and team budgets configurable through the admin dashboard.
• Enables grant management for models, MCP tools, and connectors by label from the admin dashboard.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Tailscale Aperture gains gateway-generated client configs for Kilo Code, Grok Build, GitHub Copilot CLI, Pi, Hermes, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds gateway-generated configuration for Kilo Code: select Kilo Code on the Agents page, save the output as kilo.jsonc in your home config directory or project root, then reopen and pick an Aperture model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds gateway-generated configuration for Grok Build: select Grok on the Agents page, merge the generated TOML into ~/.grok/config.toml, and launch with grok; set XAI_API_KEY=not-needed if prompted for an xAI key at startup.
• Adds gateway-generated configuration for GitHub Copilot CLI, Pi (~/.pi/agent/models.json), and Hermes (~/.hermes/config.yaml) from the Agents page.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Tailscale Aperture adds a browser agent at /chat, per-user and org-wide usage tracking, session captures, and OpenAI-compatible provider support including Groq, Together AI,⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a browser agent available at /chat that connects tailnet machines to a task, runs commands with the user's access, and supports model chat, tool connections, and activity review — no separate client required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports OpenAI-compatible provider endpoints, enabling configuration of providers such as Groq, Together AI, Fireworks, Mistral, DeepSeek, and Perplexity through the generic OpenAI-compatible setup path.
• Records user, model, and token counts per request; users can review their own usage and admins can review organization-wide usage, export data, and set spending limits.

Secure Access (VPN / SASE / ZTNA) · 2026-10-06

Tailscale Aperture: new AI gateway with CLI, admin dashboard, and LLM provider routing via Tailscale identity⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Aperture gateway to route LLM requests through Tailscale identity authentication, eliminating shared provider API keys, with support for OpenAI, Anthropic, and Google.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Aperture CLI to discover, configure, and run coding agents through the Aperture gateway.
• Adds an Aperture Chat web interface for talking to models, connecting tools, and reviewing personal usage.

Identity & Access Management · 2026-10-06

SOAR · 2026-10-06

API surface changed: +2 endpoints, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v1/apps/{id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint POST /api/v1/apps/{id}/publish

Endpoint Security (EDR/XDR) · 2026-10-06

Trend Vision One adds two Network Overview widgets for TLS and post-quantum cryptography visibility on TippingPoint devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Encrypted Traffic Summary widget to Network Security → Network Overview, showing TLS version mix and post-quantum cryptography (PQC) usage across encrypted connections on TippingPoint devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Top Encrypted Traffic Regions widget to Network Security → Network Overview, showing top source and destination countries for TLS-encrypted traffic on TippingPoint devices.

Endpoint Security (EDR/XDR) · 2026-10-06

Secrets Detection & Management · 2026-10-06

TruffleHog v3.98.0 adds --no-ignore-tag flag, S3 scan progress display, and an SSRF egress guard for analyzer clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --no-ignore-tag CLI flag to force reporting of secrets on lines marked trufflehog:ignore, overriding the suppression tag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Shows scan progress within individual S3 buckets during active scans.
• Lists only the configured include prefixes during S3 scans, narrowing object enumeration to the specified scope.

Secrets Detection & Management · 2026-10-06

TruffleHog v3.98.1 adds a Kong Konnect detector and a configurable API timeout for Gerrit scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds api_timeout_seconds field to the Gerrit source configuration, accepting values between 0 and 3600 seconds (unset or 0 retains the existing 20 s default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a detector for Kong Konnect Platform (api.konghq.com), matching personal and system access tokens with prefixes kpat_ or spat_ followed by 49 alphanumeric characters, with live verification against https://global.api.konghq.com/v3/organizations/me.

Network Analysis & Monitoring · 2026-10-06

Wireshark: Adds capture.zstd_compression_level preference to control Zstandard compression for saved or exported captures with .zst suffix.

• Adds Zstandard (zstd) as a supported capture-file compression format alongside gzip and LZ4, selectable when writing captures to disk.
• Adds packet tagging: display-filter-based rules set the frame.tag field and show a short label (typically an emoji) in a dedicated Tag column, with optional per-tag URLs that open on click; managed via 'Tagging Rules...' dialog and stored per configuration profile.
• Adds Aggregation Fields section (11.6.7) to Preferences, accessible at Preferences → Aggregation → Aggregation fields.

Identity & Access Management · 2026-10-05

1Password for Mac 8.12.40 adds macOS Autofill OTP saving and GitHub Actions setup instructions in Developer Environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables saving one-time passwords in 1Password via macOS Autofill by navigating to System Settings > General > AutoFill & Passwords > Set Up Codes In and selecting 1Password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a button in Developer > Environments > GitHub Actions destination to view setup instructions.
• Surfaces API Credential item type near the top of the New Item screen for faster access.

Identity & Access Management · 2026-10-05

Aembit adds Meta Muse support, brokering short-lived credentials through its MCP Identity Gateway and MCP Authorization Server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Meta Muse as a supported client workload in Aembit's IAM for Agentic AI Platform, routing Muse's enterprise resource requests through the MCP Identity Gateway and MCP Authorization Server for policy-evaluated, short-lived credential issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Meta Muse Dynamic Client Registration against the Aembit authorization server — no manual app creation, client ID, or secret required.
• Enables Muse to connect to the MCP Identity Gateway by requesting the gateway URL as an OAuth scope, matching the gateway's protected-resource metadata advertisement.

AI/LLM Security · 2026-10-05

NEXUS v0.5.0 debuts the Sovereign Payment Gateway — a deterministic, fail-closed security boundary for AI agents that can initiate or influence payments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the nexus-a2a-sdk==0.5.0 Python package (import nexus_sdk) delivering the Sovereign Payment Gateway — a monotonic, fail-closed transaction lifecycle that prevents AI agents from self-granting authority, accessing unrestricted payment keys, or overriding deterministic controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Key Guardian component, which isolates signing authority from the agent and signs only approved canonical transactions.
• Adds the Policy Authority component for independent deterministic evaluation of payment policy.

AI/LLM Security · 2026-10-05

AI SAFE² CLI 1.0.0 debuts a local-first evidence and decision-support layer for agent systems with 10 new commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds safe2 assess command to create a sealed project assessment bundle containing canonical JSON, an evidence manifest, and a human-readable Decision Card.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds safe2 doctor command to inventory multi-harness environments — including WSL distributions and explicit SSH targets — and expose missing or partial coverage.
• Adds safe2 gate skill command to statically screen a skill before installation or use without executing it.

Container & Image Security · 2026-10-05

Anchore Enterprise adds EU CRA quickstart with product-lifecycle SBOM modeling, continuous KEV-gated policy evaluation, and VDR export via anchorectl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds anchorectl app add and anchorectl app version add subcommands to model a product as an App and each release as a Version, enabling product-level (not scan-level) compliance tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds anchorectl app version asset add container-image-remote and anchorectl app version asset add sbom subcommands to attach heterogeneous assets — direct container images or supplier-delivered SBOMs — to a versioned product release.
• Adds anchorectl app update --policy-id and anchorectl app version policy status get --fail-based-on-results to attach and evaluate a CRA-focused policy (blocking on any KEV-listed finding) at the product level in CI.

Attack Surface & Exposure Management · 2026-10-05

Axonius adds faster asset/user deletion settings for adapters with active successful fetches⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new adapter setting to delete devices and other assets sooner when a connection is fetching successfully, as a faster cutoff than the existing 'Delete devices that have not been returned from the source in the last X hours' setting — configurable per adapter or per individual connection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new adapter setting to delete users sooner when a connection is fetching successfully, as a faster cutoff than the existing 'Delete users that have not been returned from the source in the last X hours' setting — configurable per adapter or per individual connection.

Attack Surface & Exposure Management · 2026-10-05

Axonius Pivot Chart gains editable number and date fields with formatting, short notation, value ranges, and date aggregation options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds number field editing in Pivot Chart, with options for field display name, short notation (K/M/B), decimal places, format (none, percentage, currency sign, or currency code), and value range (min/max filter).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds date field editing in Pivot Chart, supporting custom display names, aggregation levels (Hour, Hour in a day, Day, Day in a week, Week, Month, Quarter, Year), and selectable display format.

Attack Surface & Exposure Management · 2026-10-05

Axonius adds multi-line timeline charts to the Pivot Chart widget with dimension-based and multi-measure modes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Line visualization option under Visualization in the Pivot Chart widget, enabling multi-line timeline charts that compare trends across categories or multiple metrics over time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports dimension-based segmentation via Dimension Row — each unique field value (e.g., OS: Type, Status) creates a separate line, up to 20 lines displayed.
• Supports multi-measure comparison mode: leave Dimension Row empty and use + Add under Metrics to plot multiple fields (e.g., asset counts, vulnerability scores) on the same time axis.

Attack Surface & Exposure Management · 2026-10-05

Axonius Pivot charts now support two-dimension stacked bar configuration with separate row, column, and metric axes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds two-dimension stacked bar support to the Pivot chart, letting practitioners set a Dimensions Row (y-axis), Dimensions Column (stacking), and Metrics (x-axis count) independently for richer vulnerability and asset visualizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-05

Axonius adds a Pivot Chart Table visualization with CSV export, click-through asset drawers, unlimited dimensions, and grand total rows/columns.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Pivot Chart Table visualization type selectable under Visualization in the chart wizard, supporting unlimited row and column dimensions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds click-through on table cells to open a drawer listing all assets represented in that cell, with an Asset Page link for further investigation.
• Adds Show Grand total for rows and Show Grand total for columns presentation options to Pivot Chart Tables.

Attack Surface & Exposure Management · 2026-10-05

Axonius adds a Map chart visualization to the Pivot Chart widget, showing Activities data on a geographical map.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Map visualization option under the Pivot Chart widget on editable dashboards, displaying Activities module data geographically for Okta, Microsoft Azure, and Microsoft Active Directory (AD) location fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports configuring Dimensions, Metrics, Calculation (including historical data and entities with no value), and Presentation (threshold colors, chart title toggle) for Map charts.
• Shows a popup with location-specific data when hovering over a map region that contains activity data.

Attack Surface & Exposure Management · 2026-10-05

Axonius: Supports three line chart modes: single-line (one aggregated trend), multi-line with dimension segmentation (one line per category value such as OS type or asset status), and multi-line with multi-measure comparison (multiple metrics on one timeline).

• Introduces Schema option in line chart configuration with two modes: Latest Data (aggregates by a selected date field from the current fetch) and Data over time (snapshots) (historical snapshots, available for asset modules only).
• Adds Dimension Column time-field selector for the x-axis with configurable aggregation granularity: Day, Week, Month, Quarter, or Year.
• Modules Adapter Fetch History, Activity Logs, Audit, and Security Findings are available for line charts but restricted to Latest Data schema only — historical snapshots are not supported for these modules.

Attack Surface & Exposure Management · 2026-10-05

Axonius adds a Pivot Chart widget with bar, pie, stacked, line, table, and map visualizations for flexible asset-data segmentation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Pivot Chart dashboard widget that segments asset fields across Bar, Pie, Summary, Stacked, Line, Table, and Map visualization types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Data over time (snapshots) schema mode in the Pivot Chart to query historical asset data alongside Latest data from the most recent fetch.
• Adds Show results for previous date toggle in Pivot Chart Data settings to pin results to a fixed or relative historical date.

Attack Surface & Exposure Management · 2026-10-05

Axonius adds a Dashboard Templates gallery with 40+ pre-built workspaces spanning asset inventory, cloud, identity, SaaS, compliance, and incident response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Dashboard Templates gallery where selecting a template instantly creates a new dashboard pre-populated with charts and queries — no manual chart building required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Executive & Security Posture templates: Executive Report, Security Posture, Environment Hygiene, IT Audit Insights, Exposures Management (requires Risk Score feature), and External Exposures.
• Adds Inventory by Device Class templates covering Comprehensive Asset Inventory, Device Inventory Management, Windows Workstations, Windows Servers, Linux Devices, Mobile Devices, Network Devices, Printers, Medical Devices (IoMT/IoT-OT), and OT Devices.

Attack Surface & Exposure Management · 2026-10-05

Axonius adds preconfigured Dashboard Templates with per-template previews, adapter gap detection, and personal preference-based recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Dashboard Templates: preconfigured dashboards built around common themes (use-case categories), pre-populated with saved queries, accessible from the Add Dashboard list by selecting Dashboard Templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a template preview flow — hover any template tile, click Preview to see chart thumbnails, sample data, and What's this chart? descriptions before committing to a template.
• Adds an adapter gap widget within templated dashboards that lists missing adapter categories and surfaces a Connect Adapters shortcut filtered to the relevant category.

Attack Surface & Exposure Management · 2026-10-05

Axonius gains Dashboard import/export in JSON format, enabling migration between environments with granular access controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Export Dashboard action (via the three-dot menu next to a Dashboard name) to download any non-system Dashboard as a JSON file containing all charts, settings, and queries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Import Dashboard option in the Add Dashboard dropdown, supporting upload of a JSON dashboard file with Overwrite or Create a Copy conflict resolution and per-role access assignment at import time.
• Requires the Export dashboard permission on an unrestricted role to export, and Import Dashboard, View Dashboards, Add Dashboards, Add charts, Delete charts, View entity, Add saved queries, and Edit saved queries permissions to import.

Attack Surface & Exposure Management · 2026-10-05

Axonius adds dashboard access permission controls with cascading query permission updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the ability to change access permissions (Private, Shared, Public) for dashboards via the 3-dot menu > Edit > Who has access on the Dashboards page, automatically moving the dashboard to the appropriate folder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cascades permission changes to underlying chart queries: when a dashboard is promoted (e.g., Private to Public), queries with lower permissions are automatically updated to match, and Axonius verifies the user has the required permissions before applying changes.

Hacking Hardware · 2026-10-05

Bruce gains two companion apps — a desktop/Android app for flashing and mirroring, and an iOS BLE remote with capture and replay.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Bruce App for Linux (x86-64), Windows, macOS, and Android — supports firmware flashing via esptool, serial command execution, and live device screen mirroring over WiFi using bruce.local or a device IP in the Screen Mirror panel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Bruce Remote for iOS (requires iOS 17+) — connects over Bluetooth Low Energy, mirrors the device screen with a D-pad that drives firmware menus, and supports IR, Sub-GHz, and NFC capture and replay, a file manager, offline capture library, and a community app store.
• Enables BLE connectivity on the Bruce device via Config → Advanced → Toggle BLE API (off by default) to allow Bruce Remote to discover and connect to the device.

Hacking Hardware · 2026-10-05

Bruce gains a companion desktop/mobile app for flashing firmware from Linux, Windows, macOS, or Android.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Bruce App, a companion application for flashing Bruce firmware from desktop (Linux, Windows, macOS) or Android devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-10-05

Identity & Access Management · 2026-10-05

Internet Services · 2026-10-05

Cloudflare: Adds --jurisdiction=us flag to wrangler d1 create for creating D1 databases that run and persist data within the United States.

• Adds --jurisdiction flag (values: eu, us, fedramp) to wrangler kv namespace create and cf kv namespaces create, and a jurisdiction field to POST /storage/kv/namespaces REST API, for Workers KV namespace data localization — now generally available.
• Adds two new datasets — Workers Observability — Logs and Workers Observability — Traces (OTel) — to Custom Dashboards, enabling charts of Worker invocations, log levels, errors, CPU/wall time, span counts, and durations alongside HTTP traffic and security events.
• Expands analytics retention to at least 31 days for Free and Pro domains across adaptive datasets (HTTP requests, security events, DNS analytics), with a 30-day single-query window; applies in the dashboard, Custom Dashboards, and the GraphQL Analytics API.

Vulnerability Management · 2026-10-05

DLP AI API v2-10-0 adds audio redaction batch job support for output files exceeding 2 GB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports audio redaction batch job responses where the output file exceeds 2 GB in size.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-05

Cloudsmith: Adds connected_repositories field to client log exports, listing the connected repositories a package was served through so downloads can be traced back to their source.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports pushing Nix packages via the Cloudsmith CLI (v1.21.0–v1.26.0).

General Utilities & Libraries · 2026-10-05

VS Code adds agent sandboxing for Local and Copilot Agent Host sessions, with per-session toggles, network restrictions, and org-managed policy controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sandboxing support for Local sessions and Copilot Agent Host sessions, controlling file system and network access for terminal commands run by agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a permissions picker toggle to change the current Agent Host session's sandbox state without affecting other sessions or global settings.
• Supports per-session sandbox state that persists across session restores, window reloads, and VS Code restarts unless overridden by a managed policy.

General Utilities & Libraries · 2026-10-05

VS Code gains remote agent session delegation and chat-without-workspace on remote hosts, both experimental.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables sessions.chat.unifiedWorkspacePicker.enabled to start a chat without a workspace on a remote SSH or dev-tunnel host via the workspace picker Chat entry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.remoteAgentHostsEnabled and chat.remoteSessions.tools.enabled settings to let an agent delegate work to connected remote hosts from an Agent Host session.
• Adds list_agent_hosts tool so an agent can discover connected remote hosts, available models, resource capacity, and session load.

General Utilities & Libraries · 2026-10-05

VS Code agent sessions gain peer chats, per-chat done state, context compaction, and orchestration-limit controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sessions.showChatTabs config key to control how peer chats appear — Multiple (each chat as a tab, arrangeable in split groups) or Single (active chat fills the pane).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.agentHost.agentOrchestrationLimits config key to control process-wide limits on sessions, chats, messages, and recursive session creation; supports on (default) and off values, effective without restarting the Agent Host.
• Adds peer chats to Agent Host sessions — create additional chats that share the session's workspace and worktree without interrupting the main conversation, via right-click > New Chat in This Session on an active session.

General Utilities & Libraries · 2026-10-05

VS Code Agents window gains experimental welcome phrases and grouped composer controls with new config keys and keyboard shortcuts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sessions.chat.experimental.welcomePhrases to show a rotating welcome phrase above the new-session composer in the Agents window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sessions.chat.experimental.welcomeName (also settable via the Set Welcome Name action) to personalize the welcome heading; the name syncs across devices.
• Adds accessibility.verbosity.newSessionWelcome to control whether the welcome heading is announced in screen reader optimized mode.

General Utilities & Libraries · 2026-10-05

code-oss: Adds chat.agentHost.devContainer.idleTimeout config setting to control container idle shutdown period; set to 0 to disable automatic shutdown entirely (default is 300 seconds).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Agent merge Changes changeset dropdown entry that compares the latest completed agent merge repair turn against the preceding completed user turn, making repair diffs reviewable in one click.

General Utilities & Libraries · 2026-10-05

VS Code Agent Host chat now supports peer chats within a session and per-session target, agent, model, and permissions controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the Copilot session target to apply and save edits directly to a selected folder or worktree, with per-request changed-files summaries available.

Endpoint Security (EDR/XDR) · 2026-10-05

Endpoint Security (EDR/XDR) · 2026-10-05

CrowdStrike: Adds an Application Abuse Exclusions API group under Prevention Policy.

• Adds an Audit API group with 86 operations for querying audit events.
• Adds a Prevention Policy API group for managing host prevention policies.

AI/LLM Security · 2026-10-05

CrowdStrike Falcon AI Detection and Response: Adds a Stream interface for real-time interaction with AI agents.

Cloud Security Posture · 2026-10-05

SAST / SCA / Code Security · 2026-10-05

cve-lite-cli v1.38.0 adds contextual per-finding prioritization signals and a new override-hygiene rule OA011⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds reachability, exposure, and usage contextual prioritization signals to each verbose finding, surfaced separately from the EPSS prioritySignal; reachability reports path_depth_2 and above or falls back to direct_dependency, exposure flags findings whose path runs through a request-handling package, and usage is omitted entirely on a default scan rather than printed as n/a.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new override-hygiene rule OA011 — detects an override floor that exceeds every declaring package's range — joining the OverrideRuleId union alongside OA001–OA010.
• The --all findings table drops the IDs column; advisory IDs remain available in --verbose, JSON, SARIF, CycloneDX, and the HTML report.

CNAPP · 2026-10-05

Runtime prioritization engine now surfaces CISA KEV catalog dates and computed remediation timelines on vulnerability findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Surfaces a due date derived from the computed remediation timeline directly on each vulnerability finding.

SIEM · 2026-10-05

SIEM · 2026-10-05

Reverse Engineering · 2026-10-05

Endpoint Security (EDR/XDR) · 2026-10-05

Identity & Access Management · 2026-10-05

Didit adds digital ID wallets, KYB data tiers, AML monitoring APIs, MCP tools, and a Web SDK 0.4.0 with transaction submission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AML monitoring APIs (POST /v3/users/aml-monitoring/, /v3/businesses/aml-monitoring/) supporting batch operations for up to 1,000 profiles, with dry-run mode and async job support; adds POST /v3/kyb/shareholders/ and POST /v3/kyb/ubo/ endpoints for shareholder and UBO data; adds GET /v3/users/{vendor_data}/generate-pdf/ for branded session PDFs
• Adds sandbox_scenario parameter to simulate AML hits in sandbox, workflow_terminal_node_id field to expose workflow decision paths, and X-Signature-V2 webhook verification header (deprecating X-Signature-Simple)
• Adds Didit MCP tools for AI-agent-driven session debugging and workflow building: didit_session_explain_decision, didit_session_webhooks, didit_session_webhook_resend, didit_workflow_build_graph, didit_workflow_get_kyb_registry_catalog, plus webhook delivery management

AI/LLM Security · 2026-10-05

Docker Sandboxes v0.47.0 adds sbx run --rm auto-cleanup, long-running kit capability, and richer cloud TTL reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sbx run --rm to automatically remove a local or cloud sandbox after its agent session ends (cannot be combined with --detached; cloud sandboxes interrupted by a dropped connection are kept and the CLI prints the removal command).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds com.docker.sandbox/long-running@1 kit capability declaration to keep local sandboxes running after all sessions disconnect (cloud sandboxes and sbx kit add cannot provide this capability: required entries are rejected, optional entries are skipped).
• Adds stopped and ttl_paused fields to sbx --cloud ttl JSON output; stopped sandboxes are reported as stopped instead of expired, and the TTL restarts on resume.

SIEM · 2026-10-05

Elastic Security 9.5 introduces the AlertZero suite: automated alert analysis workflow and enhanced Attack Discovery for agentic SOC triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Security alert analysis workflow in Elastic Security 9.5, which performs a first-pass classification of alerts as true positive, false positive, or inconclusive — with a confidence score and rationale note — for rules selected by a SIEM engineer or SOC manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables high-confidence false positive auto-closure within the Security alert analysis workflow, reducing analyst queue volume before alerts reach human review.
• Integrates Security alert analysis with Attack Discovery so that classified alert results feed a cleaner, noise-reduced starting point for deeper attack investigation.

SIEM · 2026-10-05

SIEM · 2026-10-05

SIEM · 2026-10-05

SIEM · 2026-10-05

Elastic SIEM adds monthly-refreshed Noise, Performance, Threat, and Profile tags to all 1,781 prebuilt detection rules to guide enablement decisions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Noise: Low, Noise: Medium, Noise: High, and Noise: Unknown tags to prebuilt rules, scored monthly from 30-day fleet telemetry using a global_noise metric (mean alerts per distinct environment on firing days), with per-platform percentile cuts for Windows, Linux, macOS, AWS, Azure, GCP, Google Workspace, Microsoft 365, Okta, and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Performance: Fast, Performance: Normal, Performance: Slow, Performance: Very Slow, and Performance: Unknown tags using absolute execution-time thresholds (e.g. Performance: Fast requires average ≤400 ms, p95 <1 s, zero 30-second executions, and ≥5 sampled environments).
• Adds Threat tags drawn from a managed TRaDE-team catalog — covering categories such as Supply Chain, ClickFix, Phishing Kits, and RMM abuse — applied deterministically via heuristics and, as a fallback, via LLM suggestion capped at five tags per rule and filtered against the approved catalog.

Hacking Hardware · 2026-10-05

• Marauder v8 (marauder-v8) list price moved from $100 to $145 (+45%) at justcallmekokollc.com on 5 Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Hacking Hardware · 2026-10-05

• Marauder v8 (marauder-v8) back in stock at justcallmekokollc.com on 4 Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-05

Threat Intelligence · 2026-10-05

Flashpoint adds MCP Server, Natural Language Search in Echosec, EASM module, ATM Receipts Dashboard, and Anonymous Browser in Managed Attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Natural Language Search and AI Results Refinement to the Echosec Locate view for geospatial OSINT discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Launches Flashpoint External Attack Surface Management (EASM) as an add-on module in Ignite, providing a continuous attacker's-eye view of the perimeter.
• Introduces the ATM Receipts Dashboard in Flashpoint Fraud Intelligence for analyzing compromised ATM receipt images, exposing card and account data, deposits, and fraud trends.

Hacking Hardware · 2026-10-05

Flipper One: Adds rockusb tool installation support on Linux (Debian) via sudo apt install rockusb and on macOS via cargo install from the collabora/rockchiprs repository.

• Adds rockusb list command to enumerate devices currently in MaskROM mode before flashing.
• Adds Device selection in Flipper OS Installer between /dev/mmcblk0 [eMMC] (microSD) and /dev/sda [UFS] storage targets.

Hacking Hardware · 2026-10-05

Hacking Hardware · 2026-10-05

• Flipper Zero (flipper-zero) list price moved from $169 to $239 (+41%) at flipper.net on 5 Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Hacking Hardware · 2026-10-05

• Flipper Zero (flipper-zero) back in stock at flipper.net on 4 Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-05

Terraform providers and Google Cloud client libraries now available for 14 Google SecOps Chronicle API resource types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Terraform provider support for managing Google SecOps resources as code across Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOAR Domains, and SOAR Networks via the Chronicle API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Google Cloud client library support for building custom integrations and automating Google SecOps workflows programmatically across the same Chronicle API resource types: Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOAR Domains, and SOAR Networks.

Digital Forensics & Incident Response · 2026-10-05

Hayabusa 4.1.0 adds Windows executable version metadata and deterministic scan ordering across OSes and filesystems.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds embedded VERSIONINFO metadata to Windows executables, including product name, file description, company name, copyright, and original filename, with file and product versions auto-generated from the package version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Log files found with -l, --live-analysis (evtx or JSON/JSONL via -J) are now scanned in sorted path order, producing a reproducible timeline across OSes and filesystems.
• Rule files loaded from a rules/ directory (via -r <dir>) are now loaded in sorted path order, ensuring deterministic ordering of same-batch detections across OSes and filesystems.

Web Application Security · 2026-10-05

HUMAN launches Ad Integrity Suite for Platforms, unifying IVT, viewability, and brand safety signals for DSPs, SSPs, and exchanges.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds HUMAN Ad Integrity Suite for Platforms, a new offering for DSPs, SSPs, and programmatic exchanges that unifies IVT, viewability, and brand-safety verification in a single architecture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides explainable signals and reason codes so platform teams can see why an impression or placement received a particular classification and surface that rationale to buyers and sellers.
• Delivers supply-path and inventory intelligence with granular analysis across publishers, URLs, traffic sources, and supply paths to support supply-path optimization and distinguish trusted inventory.

Endpoint Security (EDR/XDR) · 2026-10-05

Huntress adds a SIEM Log Sources API to list source coverage, status, and 30-day data volume programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a SIEM Log Sources API endpoint that returns each source's name, type, organization, agent, status, last activity, and 30-day data volume — the same data shown on the Source Management page — so partners can audit coverage and detect silent sources without opening the portal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-05

iDenfy Sprint 136 adds MCP for AI assistants, Shopify age-estimation billing, accessibility compliance, and company risk API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes iDenfy account data over MCP so AI assistants such as Claude and Claude Code can connect, with a consent screen to select which data areas they can view or edit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Returns risk assessment results from the company verification API.
• Adds a dedicated accounting email setting for Pay-As-You-Go partners to receive invoices and payment receipts.

Web Application Security · 2026-10-05

Invicti: Adds AI Credit Usage section under the Pentests nav item to review every credit addition and deduction alongside current available balance, with pending credits reserved at assessment start.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds real-time credit usage display in the Summary tab for each assessment, reflecting consumed credits as the run progresses.
• Enables HTML format download for assessment reports, ready to open in any browser or share with stakeholders.
• Enables download of scanner logs and raw agent traces as a single compressed archive per assessment.

Web Application Security · 2026-10-05

Invicti Platform on-premises now supports Linux installation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Linux as a supported installation platform for Invicti on-premises deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-10-05

Katana v1.8.0 adds recorded-flow headless auth replay, chrome-headless-shell support, and per-page crawl hooks for the hybrid engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -rf / --recorded-flow flag to replay a Chrome DevTools Recorder JSON (or explicit steps file) before a headless crawl, enabling authenticated crawling without manual session setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds BrowserContextID exposure to the hybrid crawler, allowing callers to correlate crawl traffic to a specific browser context.
• Adds optional per-page BeforeNavigate and AfterLoad hooks to the hybrid engine, enabling custom logic to run at each page lifecycle event during a crawl.

Identity & Access Management · 2026-10-05

Keycloak: Adds a new client policy executor to restrict the may_act claim in access tokens, giving per-client control over which clients can participate in delegation.

• Promotes Client Admin API v2 from experimental to preview, now enabled with --features=client-admin-api:v2 or --features=preview, supporting declarative OIDC and SAML client management with strict validation and an accurate OpenAPI specification.

SAST / SCA / Code Security · 2026-10-05

Lakera Red gains tool-response poisoning delivery via traced tool calls, with session-id-based scan correlation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tool-response-poisoning strategy that splices adversarial payloads into traced tool return values — targeting string fields in plain text, JSON objects/arrays (including content[].text MCP shape), while passing numbers, booleans, and null through unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces session-id binding (setSessionId / set_session_id) to tie reported tool calls to the correct scan and correlate findings with application logs.
• Scopes poisoning delivery to traced tools only — tools omitted from the tracing allowlist cannot be targeted, giving practitioners explicit control over attack surface.

SAST / SCA / Code Security · 2026-10-05

Lakera Red documents 23 default scan objectives by ID, indirect Tool Response Poisoning attacks, and custom objective support via SDK/CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds objectives parameter support for passing specific objective IDs (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ security.instruction-override.1, safety.hate-speech.1) when creating a scan via the SDK/CLI, covering 23 built-in defaults across Security, Safety, and Responsible categories.
• Introduces Tool Response Poisoning as the first indirect attack strategy, delivering payloads through tool results rather than user messages.
• Supports custom objective definitions inline in SDK/CLI scan requests — requiring a stable key, name, attack description, and at least one success indicator — via the CustomObjective type in TypeScript and Python.

AI/LLM Security · 2026-10-05

Mend AI 26.9.2 adds workflow email controls with per-user/group recipients, a new Send Email action, and dedicated zero-day alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enhances workflow email notifications to allow creators to select specific users or groups as recipients for scan summary emails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds dedicated zero-day alerts to provide immediate awareness when the organization is vulnerable to emerging threats.

AI/LLM Security · 2026-10-05

Mend Renovate adds rich version constraint support for Gradle Groovy/Kotlin DSL and broader vulnerability fix coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for rich version constraints in the Gradle Groovy/Kotlin DSL via the manager/gradle manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-10-05

Mend Container raises the image scan size limit from 2 GB to 4 GB, enabling scanning of larger container images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the mend image scan size limit from 2 GB to 4 GB, enabling successful pulling, extraction, and scanning of larger container images across all registry integrations, including ECR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-10-05

Mend Container gains configurable Send Email workflow action and dedicated zero-day alerts for emerging threats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Send Email workflow action that notifies users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables workflow creators to select specific users or groups as recipients for scan summary emails.
• Adds dedicated zero-day alerts to provide immediate awareness when the organization is vulnerable to emerging threats.

Container & Image Security · 2026-10-05

Mend Container raises the image scan size limit from 2 GB to 4 GB, with clear errors for images that exceed it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the container image scan size limit from 2 GB to 4 GB across all registry integrations, including ECR, enabling successful pulling, extraction, and scanning of larger images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces a clear error message when a scanned image exceeds the new 4 GB limit, instead of failing silently.

SAST / SCA / Code Security · 2026-10-05

Mend CLI 26.9.1 adds Bun package manager support and a --print-to-console flag for SAST scans⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --print-to-console flag to mend code SAST scans to stream CLI logs directly to stdout during the scan, mirroring behaviour already available in mend dep.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for the Bun package manager in JavaScript projects, with automatic detection of direct and transitive dependencies via package.json alongside bun.lock or bun.lockb files.

SAST / SCA / Code Security · 2026-10-05

Mend AI extends Suppress and Review triage actions to individual finding level for more precise remediation workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Suppress and Review triage actions to the individual finding level, allowing security teams to triage specific findings within an entity independently rather than only at the entity level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-05

Mend CLI SAST gains --print-to-console flag and automatic /_MACOSX/..* exclusions in v26.9.1⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Default exclusions in mend code CLI scans now automatically ignore /_MACOSX/..* metadata files across all SAST scan engines, preventing macOS system files from interfering with the TreeSitter parser on Windows.

SAST / SCA / Code Security · 2026-10-05

Mend Renovate gains rich Gradle version-constraint support, Azure PR auto-complete re-application, and improved vulnerability fix raising.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports rich version constraints in the Groovy/Kotlin DSL for the gradle manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Re-applies auto-complete settings to existing PRs on the azure platform.

SAST / SCA / Code Security · 2026-10-05

Mend Container raises image scan size limit from 2 GB to 4 GB, covering all registry integrations including ECR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the image scan size limit for Mend Container from 2 GB to 4 GB, enabling pulling, extraction, and scanning of larger container images across all registry integrations, including ECR, with a clear error message for images exceeding 4 GB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-05

Mend Platform 26.9.2 adds a Send Email Automation Workflow action and dedicated zero-day vulnerability alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Automation Workflow email controls to let workflow creators select specific users or groups as recipients for scan summary emails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds dedicated zero-day alerts to provide immediate awareness when your organization is exposed to emerging threats.

SAST / SCA / Code Security · 2026-10-05

Mend SAST gains workflow email controls with user/group recipient selection, a new Send Email action, and dedicated zero-day alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Send Email workflow action to notify users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables workflow creators to select specific users or groups as recipients for scan summary emails.
• Adds dedicated zero-day alerts to provide immediate awareness when the organization is vulnerable to emerging threats.

SAST / SCA / Code Security · 2026-10-05

SAST / SCA / Code Security · 2026-10-05

Mend CLI 26.9.1 adds Bun package manager support and a --print-to-console flag for SAST scans⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --print-to-console flag to mend code (SAST scans) to print CLI logs directly to stdout as the scan runs, in addition to writing them to the log file — previously only available for mend dep (SCA scans).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Bun package manager support for JavaScript projects, with automatic detection and reporting of direct and transitive dependencies when package.json is present alongside bun.lock or bun.lockb files.
• Default exclusions in mend code CLI scans now automatically ignore /_MACOSX/..* metadata files across all SAST scan engines, even when default exclusions are otherwise disabled.

SAST / SCA / Code Security · 2026-10-05

Mend AI now supports Suppress and Review triage actions at the individual finding level, not just entity level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Suppress and Review triage actions to the individual finding level, enabling security teams to triage specific findings within an entity independently rather than only at the entity level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-05

Mend SCA adds workflow email controls, a new Send Email action for CVE alerts, and dedicated zero-day vulnerability notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enhances workflow email notifications to allow creators to select specific users or groups as recipients for scan summary emails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds dedicated zero-day alerts to provide immediate awareness when the organization is exposed to emerging threats.

SAST / SCA / Code Security · 2026-10-05

Mend Renovate adds Gradle rich version constraint support and re-applies Azure auto-complete settings to existing PRs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports rich version constraints in the Groovy/Kotlin DSL for the manager/gradle manager.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Re-applies auto-complete settings to existing PRs on the platform/azure integration.

Network Analysis & Monitoring · 2026-10-05

Netcap v0.10.0 replaces bleve vulnerability indexes with a single SQLite+FTS5 database, cutting disk use from 4.1 GB to 299 MB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Switches vulnerability and exploit lookups from nvd.bleve and exploit-db.bleve to a single netcap.sqlite (SQLite + FTS5) database, shrinking disk usage from ~4.1 GB to 299 MB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds net util -download-dbs to fetch the new layout 2 database from https://dbs.netcap.io/dbs/v2/ with sha256 verification.
• Updates net util -index to accept any value (e.g. -index all) and rebuild netcap.sqlite from NVD and exploit-db feeds via the new BuildVulnDB path.

Network Analysis & Monitoring · 2026-10-05

Network Analysis & Monitoring · 2026-10-05

Network Analysis & Monitoring · 2026-10-05

Network Analysis & Monitoring · 2026-10-05

Network Analysis & Monitoring · 2026-10-05

Network Analysis & Monitoring · 2026-10-05

Network Analysis & Monitoring · 2026-10-05

Network Analysis & Monitoring · 2026-10-05

Network Analysis & Monitoring · 2026-10-05

Reconnaissance & OSINT · 2026-10-05

Nmap gains 8 new DICOM auditing NSE scripts and a full DIMSE toolkit (C-STORE/FIND/GET/MOVE, TLS) for medical imaging services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-05

SAST / SCA / Code Security · 2026-10-05

Noir adds React Router framework support for endpoint detection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-05

Noir documents NOIR_CONCURRENCY env var for controlling worker count and clarifies filtered export context retention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports NOIR_CONCURRENCY environment variable to set the worker count (default: CPU count, clamped to 4–32).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Filtered exports retain supporting evidence context for each selected signal, with cross-bucket priority roll-up included when signals are selected explicitly.

SAST / SCA / Code Security · 2026-10-05

SAST / SCA / Code Security · 2026-10-05

SAST / SCA / Code Security · 2026-10-05

General Utilities & Libraries · 2026-10-05

Obsidian adds Quick Capture templates, Quick Look previews, RTL workspace flip, font-size commands, and a new Open file from outside the vault command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Hide column to the right-click menu of a Bases kanban column.
• Search in the File Explorer, Bookmarks, Outline, and Sync views now matches the full path of each item, and excluding a term (e.g. -Archive) hides the matching folder and everything inside it.
• The Outline and Outgoing links views now work for files opened from outside the vault.

Identity & Access Management · 2026-10-05

Firewalls & Network Defense · 2026-10-05

Palo Alto Networks: Integrates Device Security with the Infoblox Outbound API, enabling security data to flow from Palo Alto Networks IoT Security to Infoblox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-05

CNAPP · 2026-10-05

Plerion exposes preferences and dashboards management via API, enabling programmatic control of home dashboards and sidebar navigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds API key-authenticated endpoints to set a user's or user group's home dashboard and sidebar navigation, set the tenant default home dashboard, and list custom dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-05

Detection Engineering · 2026-10-05

pySigma 2.0 centralises all security controls in a new SigmaPolicy dataclass and hardens the default regex engine to RE2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces SigmaPolicy dataclass (importable from sigma.policy) to declare trust-model settings — allow_template_vars, allow_external_sources, vars_allowed_paths, regex_engine — once, with those settings propagating automatically through every pipeline call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds predefined SafePolicy (RE2 engine, all security features disabled) and TrustedPolicy (Python engine, fully trusted sources) profiles for common deployment patterns.
• Adds a policy parameter to ProcessingPipeline.from_yaml() and ProcessingPipeline.from_dict() to pass a SigmaPolicy instance instead of individual flags.

Threat Intelligence · 2026-10-05

Recorded Future adds POST /collective-insights/submit-detections endpoint to ingest IoC detections from external cyber tools into Collective Insights.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /collective-insights/submit-detections endpoint to ingest IoC detections (IP addresses, domains, file hashes, CVEs, and URLs) into Collective Insights, with optional MITRE ATT&CK technique codes, malware names, incident references, and source metadata fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports a debug option set to true to validate detection submissions without persisting them, enabling safe development-time testing.
• Supports a summary option that returns a per-type breakdown (IP, domain, hash, vulnerability, URL) of processed IoC counts and details on any dropped detections in the response.

Threat Intelligence · 2026-10-05

Recorded Future adds the Collective Insights API — a bidirectional pipeline with /detections, /search, and /exclusions endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /detections endpoint to push telemetry from any SIEM, EDR, Firewall, or SOAR into the Recorded Future Intelligence Cloud, converting indicators into Enriched Events linked to malware families, Threat Actors, and MITRE ATT&CK techniques.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET /search endpoint for programmatic, filterable access to the full history of enriched detections — aggregating API submissions, built-in integrations, Autonomous Threat Operations, and Sandbox results into a single queryable interface.
• Adds GET /exclusions (plus create, update, delete operations) to manage an organization-level exclusion list that suppresses known-benign observables, IP ranges, or device names from the enriched detection stream, with mandatory comments and a full audit log.

Threat Intelligence · 2026-10-05

New API endpoint retrieves Sigma, Snort, YARA, YARA-L, KQL, FQL, and S1QL detection rules from Recorded Future threat prevention profiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Returns rule content fields containing complete, deployment-ready rule text (Sigma YAML, Snort signatures, YARA rules, etc.) tagged with MITRE ATT&CK techniques, sourced from Insikt Group research.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-05

New API endpoint retrieves block-list IOCs from Recorded Future threat prevention profiles for firewall and proxy ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /threat-prevention-profile-indicators endpoint to retrieve confirmed-malicious IPs, domains, file hashes, and URLs from a named threat prevention profile, ready for direct ingestion into firewalls, web proxies, and endpoint tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports filtering by observable type (e.g., ip, domain, hash) so each downstream tool pulls only the indicator types it needs.
• Enables risk score enrichment per indicator via include.risk.score: true to prioritize which IOCs to act on first.

Threat Intelligence · 2026-10-05

New Threat Prevention Profiles Query endpoint discovers block-list profile UUIDs for firewalls, proxies, and endpoint tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /threat-prevention-profiles-query endpoint that accepts ids (array of UUIDs, max 100) or enterprise (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ uhash:XXXXXXXXXX) to discover threat prevention profiles available to your organization — returns profile UUIDs for use with the Threat Prevention: Get Profile Indicators and Threat Prevention: Get Profile Rules endpoints.
• Threat prevention profiles represent continuously-updated block lists targeting specific threat categories for ingestion into firewalls, proxies, or endpoint tools — distinct from detection profiles used in SIEM/EDR workflows.

Threat Intelligence · 2026-10-05

Recorded Future: Adds Threat Detection: Get Profile Rules API endpoint to retrieve detection rules from a specific threat detection profile, filtered by filter.types; supported values are sigma, snort, yara, yaral, kql, fql, and s1ql.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-05

New GET /threat-detection/profile/indicators endpoint retrieves continuously updated IOCs filtered by type, hash algorithm, and risk score.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports include.risk.score: true request field to enrich returned IOCs with risk scores and triggered rule details for prioritization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-05

Recorded Future adds a Threat Detection Profiles Query endpoint that surfaces preconfigured SIEM/EDR rulesets via UUID lookup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Returns detection profile UUIDs usable as inputs to the Threat Detection: Get Profile Indicators and Threat Detection: Get Profile Rules endpoints for SIEM and EDR ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-05

Recorded Future adds Threat Hunting Profiles Query endpoint to discover profile schedules and async job workflows⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /threat-hunting/profiles/query endpoint to discover threat hunting profiles available to your organization, returning schedule (cron expression), lookback (in seconds), and nextRun timestamp for each profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports filtering by ids (array of UUIDs, max 100) or enterprise (e.g., uhash:XXXXXXXXXX) — at least one parameter required; empty body or empty ids returns 400.
• Each profile's id links to jobs surfaced via the Threat Hunting: Get Pending Jobs endpoint, enabling poll-cadence alignment with the profile's async job generation rhythm.

Threat Intelligence · 2026-10-05

Recorded Future adds a Threat Hunting Job Status API endpoint for integration-driven hunt orchestration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Threat Hunting: Update Job Status API endpoint, which lets integrations set a hunt job's execution status to started, completed, or failed using a job ID obtained from Threat Hunting: Get Pending Jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports an optional message field on the status update to capture outcome details, and an externalId field to link the job to an external system.
• Returns {"previousStatus": "...", "currentStatus": "..."} on success, with the full status enum (ready, started, completed, abandoned, failed), and a 404 when the job ID is not found.

Attack Surface & Exposure Management · 2026-10-05

Identity & Access Management · 2026-10-05

SailPoint adds a HashiCorp Vault (On-Premise) connector to discover Vault token and userpass NHIs in Identity Security Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new HashiCorp Vault (On-Premise) ISC Source connector that discovers and aggregates Vault token metadata (issue/expiration time, policies, token type) and userpass account metadata (username, policies, token TTL/period settings) as non-human identities — without reading secret payloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Connects to on-premises HashiCorp Vault Community edition through the Virtual Appliance using the Vault host URL and an API token, keeping the existing HashiCorp Vault Credential Provider unchanged.
• Surfaces NHI metadata as Dataset resources in Identity Security Cloud: Vault tokens modeled as credentials, and Vault userpass accounts modeled as machine accounts.

Identity & Access Management · 2026-10-05

SailPoint Delimited File Connector gains IAM role-based authentication for AWS S3, eliminating long-lived access keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Authentication Type dropdown (values: IAM User or IAM Role) to the Delimited File Connector when File Transport = AWS S3, letting practitioners choose IAM role auth instead of static access keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Role Name (name or path such as sailpoint/S3ReaderRole), Account ID, External ID, Role Session Name, and Role Session Duration (default 3600 seconds) as new IAM Role configuration fields in source configuration.
• Enables cross-account S3 bucket access by populating the optional 12-digit Account ID field when the target role lives in a different AWS account than the Virtual Appliance.

Identity & Access Management · 2026-10-05

SailPoint Delimited File Connector adds SMB2/SMB3 file transport with Kerberos auth, eliminating SFTP/S3 staging for Windows shares.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SMB as a File Transport option on the VA-based Delimited File Connector, enabling direct aggregation from Windows File Server and Samba shares over SMB2/SMB3 without staging files to SFTP or S3.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Kerberos authentication for SMB transport, configured via Host (FQDN), Port (default 445), Share Name, Kerberos Realm, Username, Password, and optional Kerberos Configuration Directory (folder on the VA containing krb5.conf) fields in source configuration.
• Returns explicit success or failure messages for authentication, path, permission, and network errors when using Test Connection to validate Kerberos login, share access, and file read before scheduling aggregation.

Compliance Automation & Trust Management · 2026-10-05

Scrut Automation adds a structured three-step employee offboarding workflow with bulk completion and HRIS/IDP sync support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a three-step employee offboarding workflow in People → Employees covering termination, document upload, and completion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports bulk offboarding via People → Employees → All Employees — select multiple employees, click Edit, and choose Mark as Offboarded to finalize several records at once.
• Integrates with HRIS/IDP systems so that employees terminated in an external HRIS/IDP automatically surface with Offboarding Needed status in Scrut without manual intervention.

Compliance Automation & Trust Management · 2026-10-05

Scrut adds CSV/XLSX bulk import for vendor questionnaire templates, including conditional follow-up question hierarchies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Import (CSV/XLSX) option under Risk → Vendors → Settings → Templates → Add Template to bulk-import vendor questionnaire templates from a spreadsheet instead of building from scratch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports conditional follow-up questions in the import file via Question number (e.g., Q1, Q1.1, Q1.1.1) and Condition for follow-up question columns, with up to two levels of nesting.
• Defaults the Question Type column to Subjective when left blank; supports Objective (Single Select) and Objective (Multi Select) types with answer options and risk scores in the import file.

SAST / SCA / Code Security · 2026-10-05

Semgrep adds SCIM provisioning (public beta) and surfaces active Supply Chain incidents on the Advisories page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-05

Socket Fix overhauls dependency upgrades for Maven, Gradle, sbt, NuGet, Cargo, RubyGems, and pnpm with tool-native resolution semantics⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• JVM reachability analysis uses the per-subproject classpath from the Socket CLI's compute-artifacts sidecar when one is provided.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Socket Fix for pnpm now refuses an upgrade that needs a new version of a private package, and instructs running it where the registry is reachable.

AI-Powered Offensive Security · 2026-10-05

Strix v1.7.0 adds --fail-on severity gating, STRIX_API_TYPE forcing, budget_policy=pause, lazy MCP connections, and an interactive --resume picker.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --fail-on flag to the CLI to gate headless exit code on finding severity, enabling CI pipelines to fail on configurable severity thresholds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds STRIX_API_TYPE environment variable to force the Responses API vs chat completions endpoint, overriding model-based auto-detection.
• Adds budget_policy=pause to park every agent at the cost limit until the operator explicitly resumes, preventing runaway spend.

Cloud Security Posture · 2026-10-05

Sysdig Secure now sources CVSS scores for non-OS packages from the GitHub Advisory Database, delivering earlier scores across 11 ecosystems.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sources severity and CVSS scores for non-OS package vulnerabilities from the GitHub Advisory Database, falling back to NVD when GitHub has no score, covering Java, JavaScript, Python, Go, Rust, PHP, Ruby, .NET, Erlang, Dart, and Swift packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-05

Endpoint Security (EDR/XDR) · 2026-10-05

Container & Image Security · 2026-10-05

Trivy: Adds a cryptographic asset scanner to the image command, surfacing keys, certificates, and signature algorithms in scan results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-10-05

Velociraptor 0.77.3 adds Windows ARM64 binaries and MSI, dropping official 32-bit Windows builds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-10-05

Velociraptor v0.77.3 adds Azure Monitor upload, a VQL LSP server, ARM64 Windows support, and custom .deb/.rpm service user/group options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds azure_monitor_upload() VQL plugin and Azure.Monitor.Upload server-event artifact to stream completed-flow results to an Azure Log Analytics workspace via the Logs Ingestion API, supporting service principal, AZURE_* environment variables, managed identity, and the Azure SDK default credential chain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Azure Monitor Creds secret type for storing Log Analytics credentials and destination in the secrets service.
• Adds a VQL Language Server Protocol (LSP) server (velociraptor lsp) providing diagnostics, syntax highlighting, hover, completions, and document symbols for VQL artifact development.

Web Application Security · 2026-10-04

Arcjet adds outbound threat detection for AI agents, scoring every external destination against real-time threat intelligence before requests are made.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GUARD_POLICY_DETECTOR_KIND_IP_THREAT detector kind for agent threat detection, exposing per-host and rolled-up risk signals under input.signals.ip_threat.<detector_id> in Rego policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes rolled-up fields detected, risk_level, reputation, activities, host, ip, and assessments under input.signals.ip_threat.<detector_id> for worst-wins assessment across all scored public destinations.
• Provides a coding-agent.destination-threat starter policy in the Arcjet Console to automatically block destinations with high or critical risk levels on Tool call executions.

Web Application Security · 2026-10-04

Arcjet adds threat-intel scoring for outbound destinations, screening hosts a call would contact against its IP-risk engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Arcjet threat intel (IP threat) guard to score outbound destination hosts using the same IP-risk engine applied to inbound HTTP callers, writing results to signals.ip_threat.dest.risk_level with values "high" or "critical".⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Returns error code AJP1009 when a threat-intel lookup for a destination host cannot be completed in a live rule.

Web Application Security · 2026-10-04

Arcjet adds coding-agent policies for AWS access blocking, threat detection, and autonomous-mode enforcement across Claude Code, Codex, Cursor, Copilot, and Muse Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds coding-agent.aws-access policy with three layered checks covering CLI names (aws, paths ending in /aws), AWS API destinations (.amazonaws.com, .aws.amazon.com), and credential markers (AWS_ACCESS_KEY, AWS_SECRET_ACCESS, .aws/credentials, .aws/config) in a single round trip.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds coding-agent.no-auto-mode policy to deny tool calls when Claude Code or Codex reports bypassPermissions or dontAsk permission mode, while allowing plan and acceptEdits modes.
• Adds coding-agent.tainted-session policy to block shell, web, MCP, and file-write events while any session-taint flag is active.

Web Application Security · 2026-10-04

Arcjet now supports Muse Code: enforce policies and record sessions via .muse/hooks.json hook scripts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Muse Code integration via arcjet-hook.sh (Linux/macOS) and arcjet-hook.ps1 (Windows) hook scripts that POST hook payloads to https://decide.arcjet.com/v1/agent-hooks/<vendor>?event=<event> with Authorization: Bearer $ARCJET_KEY and X-Arcjet-Principal headers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds .muse/hooks.json configuration supporting PreToolUse, PermissionRequest, UserPromptSubmit, PostToolUse, PostToolUseFailure, Stop, SubagentStart, SubagentStop, SessionStart, SessionEnd, PreCompact, and PostCompact hook events, using command and commandWindows fields to dispatch to the hook script on all platforms.
• Supports three Muse Code hook deployment scopes: project-level (.muse/hooks.json), user-level (hooks block in ~/.config/muse/settings.json), and managed (file at managed_hooks_path), each with different trust and removal controls.

Web Application Security · 2026-10-04

Arcjet adds coding agent support for Claude Code, GitHub Copilot, Muse Code, OpenAI Codex, and Cursor⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds coding agent support to apply security policies, protect prompts from injection, redact sensitive data, and enforce organizational policy controls within the development environment — supported agents include Claude Code, GitHub Copilot, Muse Code, OpenAI Codex, and Cursor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-04

Axonius adds node-by-node workflow testing with a safe single-asset sandbox, live dynamic value resolution, and per-node Test Panel UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a View Test Panel button on every testable workflow node, letting practitioners open, inspect, and run isolated tests on individual nodes as they build a workflow — without affecting production assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Basic Inputs and JSON input modes in the Test Panel for nodes that require manual data entry during testing.
• Adds a Run Test button in the Test Panel to execute a test on a single selected node, distinct from the header-level Test Run button that runs the entire workflow.

Attack Surface & Exposure Management · 2026-10-04

Axonius Workflows gain Dynamic Value Statements with a built-in Simulator for testing field interpolation before running actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Configure Dynamic Values toggle in Workflow Action nodes to dynamically populate action fields using the Dynamic Value Statement Wizard, Syntax Helper, and Autocomplete.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Workflow Data repository — accessible via the + icon in the header when Configure Dynamic Values is enabled — to copy field values from prior Workflow nodes directly into a Dynamic Value Statement.
• Adds a Simulate button above Dynamic Value Statements (in Syntax mode) to test statements against a randomly selected asset without running the full Workflow.

Attack Surface & Exposure Management · 2026-10-04

Axonius Workflows gain a centralized data repository letting nodes dynamically consume assets, fields, variables, and artifacts from earlier steps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Workflow Data repository that stores assets, Dynamic Value results, variables, and artifacts from preceding nodes so later nodes can reference them without manual handoff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Events Data tab in the Workflow Data dialog to expose parsed fields and asset-field queries from each Event node that triggered the workflow.
• Adds an Actions Data tab in the Workflow Data dialog to expose resolved assets, Dynamic Value statement results, and adapter fields from each completed Action node.

Attack Surface & Exposure Management · 2026-10-04

Axonius Workflows gain node-by-node action testing, bulk-asset runs, and conditional asset filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Stop the workflow when this action fails setting on Action nodes to halt workflow execution immediately on action failure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Only assets that match the latest condition option on Action nodes following a Condition node, enabling conditional asset filtering with per-path propagation rules.
• Adds Run action on resolved assets from previous nodes dropdown in the Action Setup drawer, letting actions target assets from any upstream Event or Action node (identified as Action[node UUID]. or Event[node UUID].).

Attack Surface & Exposure Management · 2026-10-04

Axonius Workflows gain configurable Events with webhook integration, field parsing via AXONIUSPARSER, and per-node timeout settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Parse additional fields toggle and Select event field to parse JSON from dropdown on any Workflow Event node, enabling automatic parsing of string fields containing AXONIUSPARSER {"key1": "value1"} into key-value pairs for use in Dynamic Value Statements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Add Timeout toggle on non-triggering Event nodes, configurable in Days, Weeks, or Months (default 90 days), with a choice to define a Timeout condition branch or terminate the Workflow run on timeout.
• Adds webhook configuration for third-party Workflow Events, accessible from System Settings > External Integrations > Workflows or directly from the Event pane, supporting a dedicated Webhook URL and signing secret exchange with the vendor.

Attack Surface & Exposure Management · 2026-10-04

Axonius adds flexible workflow scheduling with seven schedule plans, cycle-aware delay, and configurable end conditions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Every Successful Adapter Fetch schedule plan, which triggers a workflow after each successful fetch of a single adapter connection selected from the Select Connection dropdown — covering fetches inside or outside the Discovery Cycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Custom schedule plan for workflows, supporting repeat intervals in hours, days, weeks, or months (X > 0, max 24, fractions allowed), specific weekday selection, and hour-range constraints.
• Adds Wait until cycle ends option for scheduled workflows that overlap a Discovery Cycle, postponing execution until the cycle completes (available for all plans except Every Global Discovery Cycle and Every Successful Adapter Fetch).

Attack Surface & Exposure Management · 2026-10-04

Axonius Workflows gain three trigger types — Event, Scheduled, and Manual — with per-trigger asset and event filters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds three Workflow trigger types: Event (default, fires on internal Axonius or third-party events), Scheduled (runs on a defined schedule), and Manual (on-demand via Save and Run).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Trigger workflow even if no assets are found option on Event triggers, letting third-party-triggered Workflows (e.g. new-employee onboarding, policy-violation alerts) proceed even when no assets are resolved.
• Adds Run on added entities only checkbox for Scheduled triggers, so the Workflow runs only against assets that are new since the previous run — useful for tagging new devices or alerting on new vulnerabilities.

Attack Surface & Exposure Management · 2026-10-04

Axonius introduces a visual Workflows builder with trigger types, conditional branching, delay nodes, and an AI-powered node recommendation engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a visual workflow canvas with a two-pane interface: a left Workflow canvas and a right Configuration pane for the selected node.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports three trigger types — Event (webhook/external), Scheduled, and Manual — selectable when creating a workflow in Action Center > Workflows.
• Adds Add Condition node type, which creates Event Conditions or Action Conditions branches with After and True paths for conditional workflow logic.

Attack Surface & Exposure Management · 2026-10-04

Axonius Workflows gains a folder pane for organizing workflows into up to five levels of nested subfolders.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Folders pane on the Workflows page with three system folders — All Workflows, Shared Workflows, and Drafts — to organize and locate workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Search Folders box in the Folders pane to find specific folders quickly.
• Enables creating, renaming, moving, and deleting custom subfolders (up to five levels deep) under the Shared Workflows folder.

Attack Surface & Exposure Management · 2026-10-04

Axonius Workflows adds a no-code automation engine for chaining events, conditions, actions, and delays across third-party systems.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Repeat For Each loop node in the Workflow canvas to iterate a Workflow over individual assets when a query returns multiple results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Workflows engine: define chains of Events, Conditions, Actions, and Delays triggered by internal Axonius events (asset added/removed across Discovery Cycles), scheduled runs, manual execution, or incoming external events from integrations such as Slack, BambooHR, Okta, Workday, Zendesk, and Rapid7.
• Adds a Workflows canvas for visually building sequential and conditional automations, with support for bulk runs (all assets available in a single Workflow context) or per-asset iteration via loop nodes.

Attack Surface & Exposure Management · 2026-10-04

Axonius adds Import/Export Enforcement Sets to share and migrate enforcement workflows across environments and data scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Import Enforcement Set capability from the Create Enforcement Set dropdown in the Action Center, allowing one or more enforcement sets to be imported from a ZIP file with conflict resolution options (Save as copy or Overwrite).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Export option via the 3-dot menu on individual enforcement sets or in bulk (via checkbox selection), packaging selected enforcement sets into a ZIP file for transfer across Axonius environments or data scopes.
• Introduces Add/Import Enforcement and Export Enforcement permission controls governing who can import or export enforcement sets.

Attack Surface & Exposure Management · 2026-10-04

Axonius adds manual termination of In Progress and Pending Enforcement Set runs from the Run History page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Terminate icon on individual Enforcement Set run rows in the Run History table to stop a single In Progress or Pending run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Terminate Task bulk action in Run History to terminate multiple selected Enforcement Set runs at once, available when at least one selected run has a Result of In Progress or Pending.

Attack Surface & Exposure Management · 2026-10-04

Axonius adds Enforcement Set duplication, with optional cloning of automation/scheduling settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the ability to duplicate an Enforcement Set via the Duplicate icon or Duplicate action on the Enforcements page, with a Clone automation settings checkbox to carry over or strip the run schedule from the copy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-04

Axonius: Adds Run on top N results only and Run on added entities only result-limiting options under the Additional Conditions section so Enforcement Sets operate on a bounded or delta asset set.

• Adds If number of assets is above N and If number of assets is below N triggering conditions so an Enforcement Set fires only when the query result count meets a numeric threshold.
• Adds If assets have been added since the last execution and If assets have been removed since the last execution last-run-comparison triggers so Enforcement Sets react to asset-count changes.
• Adds an Only if the following adapter connections successfully completed condition that gates Enforcement Set runs on successful fetches from selected adapter connections.

Attack Surface & Exposure Management · 2026-10-04

Axonius adds a dedicated Enforcement Set Run History page with filtering, drill-down, and CSV export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Run History page accessible from the Enforcements page (via the upper-right Run History button) to view all Enforcement Set runs or a single set's runs in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Enforcement Run History entry under Action Center > Action Center Tools in the new navigation experience.
• Adds an Export CSV button on the Run History page to export run results.

Attack Surface & Exposure Management · 2026-10-04

Axonius adds Test Run for Enforcement Sets, letting you validate actions on a single random asset before a full run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Test Run button in the Create Enforcement Set drawer to execute an Enforcement Set against one randomly selected asset before applying it to all matching assets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-04

Axonius adds a Predefined Enforcement Sets library so practitioners can copy and customize enforcement workflows without starting from scratch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Predefined Enforcements sets folder on the Enforcements page containing read-only, copyable Enforcement Set templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Copying a predefined Enforcement Set auto-saves to Shared Enforcements when the Module, Query, and required fields are filled in, or to Drafts otherwise.
• Incomplete copies saved to Drafts remain editable and can be promoted to Shared Enforcements once all required fields are completed.

Attack Surface & Exposure Management · 2026-10-04

Axonius adds folder-based organization for Enforcement Sets, with up to five levels of subfolders under Shared Enforcements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Folders pane on the Enforcements page to organize Enforcement Sets into named folders and subfolders, searchable via a Search box.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports up to five levels of subfolders under the Shared Enforcements folder, with create, rename, move (drag-and-drop), and delete operations.
• Introduces system folders — All Enforcements, Shared Enforcements, Quick Actions, Findings Notification Enforcements, Predefined Enforcements sets, Drafts, System Enrichments, and Field Mappings — each with distinct rules on editability and deletion.

Attack Surface & Exposure Management · 2026-10-04

Axonius lets users duplicate read-only workspace Home page dashboards into editable Shared dashboard copies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Duplicate action on Axonius-managed workspace Home page dashboards (via the three-dot menu inside the dashboard or from the left pane) to create an editable copy in the Shared folder, prefixed with COPY -.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables the Allow sharing dashboards and queries to all Data Scopes setting under Settings > User and Role Management > Special Permissions > Object Sharing Settings to unlock the Duplicate option for workspace Home page dashboards.

Exploitation & C2 · 2026-10-04

Bugcrowd Researcher Platform adds the ability to request a response withdrawal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Request a Response Withdrawal capability, allowing researchers to formally request that a submitted response be withdrawn.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-10-04

Chainguard FIPS Provider for OpenSSL v3.6 achieves FIPS 140-3 validation with post-quantum ML-KEM, ML-DSA, and SLH-DSA; Go and .NET Libraries enter invite-only beta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports hybrid post-quantum key exchange for TLS pairing classical key exchange with ML-KEM as an approved FIPS service under the newly FIPS 140-3-validated Chainguard FIPS Provider for OpenSSL v3.6 (Certificate #5523).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Includes standardized post-quantum algorithms ML-KEM, ML-DSA, and SLH-DSA alongside classical FIPS algorithms AES, SHA-2, SHA-3, ECDSA, and RSA in the validated module.
• Chainguard FIPS container images can opt in to the v3.6 module starting October 1, 2026; note that SHA-1 is not an approved algorithm in v3.6.

Integrated & IT Risk Management · 2026-10-04

CISO Assistant v4.1.0 adds BSI C5 2026 framework, MCP risk-review write tools, CSV/XLSX entity-assessment export, and a new user-creator group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds user-creator builtin group to control which users can create new accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds export of entity assessments to CSV and XLSX formats in the TPRM module.
• Adds MCP risk-review write tools with actor resolution for automated risk-review workflows.

Identity & Access Management · 2026-10-04

Clerk adds self-serve Directory Sync inside <OrganizationProfile /> and SSO bypass allowlists for enterprise connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds org:sys_entconns:manage permission-gated self-serve Directory Sync wizard inside the <OrganizationProfile /> Security tab, supporting Okta Workforce, Microsoft Entra ID, Google Workspace, and custom SAML/OIDC connections — admins get a generated SCIM endpoint URL and bearer token without needing Clerk Dashboard access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sign_in.sso_bypass.succeeded audit event logged each time a user on an SSO bypass allowlist signs in via one-time email code instead of through the IdP.
• Adds org:sys_entconns_sso_bypass:manage system permission, included in the default Admin role, allowing Organization members to manage their SSO bypass allowlist from <OrganizationProfile />.

Internet Services · 2026-10-04

Cloudflare: New endpoint GET /accounts/{account_id}/argo/count_zones_enabled

• New endpoint GET /user/argo/count_zones_enabled

Internet Services · 2026-10-04

Cloudflare adds Web Search API beta, strict service token auth, Pi Durable agent harness, 30-day analytics for all plans, and KV namespace jurisdictions GA.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds strict_service_token_auth field to the PATCH https://api.cloudflare.com/client/v4/accounts/{account_id}/access/organizations endpoint to enforce consistent service-token-only authentication behavior in Cloudflare Access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds hash_in_range() function to Cloudflare Rules expressions across all plans and HTTP products, enabling deterministic percentage-based request sampling using cf.random_seed.
• Introduces Web Search API (beta) at /{account_id}/ai/websearch/ supporting query, provider (ceramic, exa, linkup), limit, and options.gateway.id parameters, routing search through AI Gateway with Zero Data Retention.

Vulnerability Management · 2026-10-04

Cloudmersive Cloud Document AI API v2-13-0 adds failure retry options for Managed Instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds failure retry options for Managed Instance deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-04

Cloudmersive Reverse Proxy v4.16 adds new Advanced Virus Scan policy configuration options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds additional policy configuration options for Advanced Virus Scan in the reverse proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-04

Cloudsmith adds connected_repositories to log exports, GA SCIM group provisioning, and CLI Nix/Cargo/pnpm support in v1.21–v1.26.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Promotes SCIM group provisioning to general availability on Ultra and Enterprise plans, automatically syncing Cloudsmith team membership when users are added or removed from mapped IdP groups.
• CLI v1.21.0–v1.26.0 adds push support for Nix packages.
• CLI v1.21.0–v1.26.0 adds credential helpers for Cargo and pnpm, enabling automatic authentication against Cloudsmith repositories.

Web Application Security · 2026-10-04

CMSeeK 1.1.3 adds WordPress XML-RPC brute-force, --light-scan, --only-cms flags, and 10 new CMS fingerprints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --light-scan argument to enable a lighter scanning mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --only-cms (-o) argument to limit scans to CMS identification only.
• Adds WordPress brute-force capability via XML-RPC.

General Utilities & Libraries · 2026-10-04

VS Code adds chat.tools.terminal.outputReflow to control whether terminal output previews reflow to fit chat width.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.tools.terminal.outputReflow setting to control whether terminal output previews reflow to fit the available chat width (default: on); disable to preserve the terminal's column width and use horizontal scrolling for long lines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

General Utilities & Libraries · 2026-10-04

code-oss adds experimental persistent progress indicator for agent responses with new config keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.experimental.persistentProgress config key to keep a progress indicator visible until an agent response finishes, with Draw (colored or monochrome animation) or Off options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.experimental.persistentProgressVerbosity config key to control completed tool-call detail visibility: Compact replaces completed groups with expandable summaries, Verbose keeps full details visible.
• With persistent progress enabled, reasoning appears in separate collapsible previews and tool calls remain visible while running.

General Utilities & Libraries · 2026-10-04

VS Code Agents window adds agent merge for automated PR unblocking and multi-chat split groups in Agent Host sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Agents window, a dedicated VS Code window for tracking and reviewing agent sessions across multiple projects without switching between project windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds agent merge, an experimental feature that monitors a PR associated with an agent session and automatically asks the agent to address blockers until the PR is ready to merge.
• Adds the Agent merge Changes changeset in the changeset dropdown to review changes from the most recent agent merge repair cycle.

General Utilities & Libraries · 2026-10-04

VS Code Agent chat view gains peer chat switching, Session Target controls, and a changed-files summary toggle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds peer chat switching in the Sessions view: expand a main chat row to open a peer conversation in the Chat view without starting a new session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Session Target, Agent, Language model, and Permissions controls to the chat input area for configuring each session before the first prompt.
• Adds a changed-files summary toggle to the Copilot session target, displaying a summary of changed files after each request.

Identity & Access Management · 2026-10-04

ConductorOne adds MCP server governance: auto-discovery, per-resource approval, toolset bundles, and full audit logging for AI tool calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Automatically discovers and classifies tools and resources exposed by MCP servers, with tools starting as Unset and resources starting as Pending until reviewed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-resource approval gating: admins review, approve, or disable each static resource and URI template; C1 checks approval state and a linked read entitlement on every read.
• Introduces MCP resource as a governed object — a static resource or URI template exposed by an MCP server, independent of toolsets and catalog items.

Identity & Access Management · 2026-10-04

ConductorOne now auto-creates provisioning links when delegated provisioning is configured between entitlements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds delegated provisioning and deprovisioning: linking two entitlements so that granting or revoking one automatically grants or revokes the other, with C1 creating the provisioning link automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces proposed provisioning-link changes in the UI whenever delegated provisioning is added or removed, showing both new links being created and existing links being removed when switching to manual or connector-based provisioning.

Identity & Access Management · 2026-10-04

ConductorOne adds an MCP server integration for Gemini Enterprise, enabling AI-driven C1 tool access via OAuth and Cloud Storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for hosting the OAuth client metadata document in a public Cloud Storage bucket, using the bucket URL as the C1 client ID (no secret, no rotation required).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds roles/discoveryengine.admin as the required Google Cloud IAM role for creating C1 data stores and managing MCP server connectors in Gemini Enterprise.
• Adds a Gemini Enterprise data store connector that fetches the C1 tool list via MCP and enforces a maximum of 100 enabled actions per data store.

Endpoint Security (EDR/XDR) · 2026-10-04

Corellium on-premise gains parity with cloud 7.12.0; adds iOS/iPadOS 26.5.2, 26.6.0, and 27.0.0 beta support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds iOS/iPadOS 26.5.2 virtual device support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds iOS/iPadOS 26.6.0 RC1/GA virtual device support.
• Adds iOS/iPadOS 26.6.0 betas 2, 3, 4, and 5 virtual device support for SA Falcon Premium subscribers only.

Endpoint Security (EDR/XDR) · 2026-10-04

CrowdStrike API adds Seraphic (enterprise browser, 40 ops), Scanning Orchestrator, and Network Scan Detections/Containment surface areas⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Network Scan Detections API operations for reviewing scan detections and reporting on scan results.
• Adds Network Containment API operations for managing network containment allowlists across scanned zones.

Endpoint Security (EDR/XDR) · 2026-10-04

CrowdStrike API adds Seraphic browser security, Scanning Orchestrator, and Application Abuse Exclusions with 142 new operations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds 16 API operations for host management, detection investigation, incident response, and sensor tracking.

Cloud Security Posture · 2026-10-04

Web Application Security · 2026-10-04

Dalfox gains a REST API server, MCP server, Caido integration, and AI agent skill for XSS scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Runs Dalfox as a REST API server supporting async scan jobs, polling, cancellation, CORS, JSONP, webhook delivery, and API key authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Runs Dalfox as an MCP server, enabling use as a structured XSS scanning tool from MCP clients such as Claude and Cursor.
• Integrates Dalfox with Caido Active Workflows and Findings to automate XSS checks on captured requests.

CNAPP · 2026-10-04

Datadog Cloud Security MCP server gains six IaC custom-rule tools for generating, validating, and publishing Rego rules from natural language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds get_datadog_security_iac_custom_rules MCP tool to retrieve a single IaC custom rule by ID or list all custom rules in the organization, with filtering by platform, provider, published state, or text query.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds get_datadog_security_iac_custom_rules_schema MCP tool to return allowed platforms, categories, severities, the rule ID format, and fields each write tool accepts — intended to be called before generating, validating, or creating a rule.
• Adds generate_datadog_security_iac_custom_rule MCP tool to generate and scanner-validate a Rego IaC custom rule from a natural-language description without saving it.

Reverse Engineering · 2026-10-04

Reverse Engineering · 2026-10-04

Endpoint Security (EDR/XDR) · 2026-10-04

Identity & Access Management · 2026-10-04

Didit: Adds white-label branding to wallet sign-in pages, with Smart-ID and Mobile-ID running inside the same verification design.

• Adds per-country source selection for database lookups where more than one lookup source is available.
• Adds session timeline display of each branch decision and terminal status node in workflow sessions.
• Adds liveness video analysis option to decline a session outright (not only report) on non-live recordings.

Identity & Access Management · 2026-10-04

Didit adds canonical KYB registry ownership/shareholding schemas and expands phone OTP delivery to WhatsApp, SMS, Telegram, voice, RCS, Viber, and Zalo.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v3/phone/send/ endpoint to send OTP codes via whatsapp (default), sms, telegram, voice, rcs, viber, or zalo, with automatic SMS fallback when the preferred channel is unavailable for the destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds options.preferred_channel field on phone-send requests to select the OTP delivery channel.
• Adds options.sms_sender_name field (1–30 chars, max 30) to sign a specific SMS with a custom sender name instead of the application default, allowing up to two new names per day per application.

Identity & Access Management · 2026-10-04

Secure Access (VPN / SASE / ZTNA) · 2026-10-04

DNSFilter Windows Roaming Client 3.8.15 adds LocalDomainFallbackEnabled, VPN compatibility improvements, and ISP DNS interception fallback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds LocalDomainFallbackEnabled setting to the Windows Roaming Client to control whether unresolvable local-domain queries fall back to DNSFilter or stay on the network — enabling split-horizon and internal-zone isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Roaming Client now detects ISP DNS interception and automatically moves the query to the next protocol in the configured order (e.g., DNS-over-TLS) so sites load normally.
• Active Directory domain-joined devices in Transparent Proxy and PreCheck modes now register DNS records with the domain controller via secure dynamic updates.

Backup & Recovery · 2026-10-04

Druva adds 30-day free trials for Okta, Active Directory, and Dynamics 365, plus ServiceNow Australia Cloud and FedRAMP GovCloud support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports the Australia Cloud and FedRAMP GovCloud regions for the Druva ServiceNow integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables 30-day free trials for Okta, Active Directory, and Microsoft Dynamics 365 workloads, accessible to both new and existing customers via login.druva.com/signup or the product console Workloads section.

Secure Access (VPN / SASE / ZTNA) · 2026-10-04

Firezone adds Device Trust: mutual TLS certificate attestation gates Resource access by cryptographic device identity⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Device Trust, a mutual TLS attestation layer that requires a Client to prove possession of a hardware-backed private key (via TPM, Keychain, CNG, Android KeyChain, or PKCS#11) before a Policy grants access to a Resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports per-platform key storage: Windows via CNG in the local computer store, Apple platforms via a Keychain identity linked to the managed VPN configuration, Android via the KeyChain, and Linux via a PKCS#11 provider (TPM, smart card, or HSM).
• Validates device certificates against administrator-configured trust anchors, checking chain, lifetime, intended usage, and device identifier from the Subject Alternative Name — compatible with certificates provisioned by any MDM or PKI via SCEP or ACME.

Secrets Detection & Management · 2026-10-04

GitGuardian adds 9 new detectors (Ory, Kong Konnect, AppSignal, PostHog, Datadog, NinzaSMS, TypeSafe AI, Mistral AI v2) and a Cohere analyzer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the mistralai_apikey_v2 detector for Mistral AI's new prefixed API key format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new detector for Ory API keys.
• Adds a new detector for Kong Konnect personal access tokens.

Secrets Detection & Management · 2026-10-04

GitGuardian SaaS: Adds POST /v1/secret-observability/identities/{identity_id}/owners to add up to 5 owners (by email) to a non-human identity without removing existing ones.

• Introduces NHI Governance / NHI Identity Owners as a new API surface area, requiring nhi:ownership:read or nhi:ownership:write scopes and Manager access level or above (or a service account token).

Secrets Detection & Management · 2026-10-04

GitGuardian Self-Hosted adds honeytoken-based AWS credential decoy planting for endpoint credential-harvesting detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Plants a decoy AWS credential in the file credential-harvesting malware reads first, triggering an alert that names the compromised endpoint when the honeytoken is used.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a coverage card to the Endpoints dashboard showing the share of your fleet protected by the decoy credential feature.

SIEM · 2026-10-04

Google SecOps SIEM Search gains SQL/GoogleSQL dialect, natural-language query generation via Gemini, UDM Lookup, and granular IAM permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SQL (GoogleSQL) dialect to the query editor, enabling BigQuery-compatible queries, complex multi-table joins across UDM and Entity Context Graph (ECG), and advanced aggregations directly in the console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chronicle.events.fetchEnrichedEvent IAM permission to gate access to enriched or extended event details in search results.
• Adds chronicle.savedSearches.update and chronicle.searchViews.update IAM permissions to gate saving searches and editing search views.

SIEM · 2026-10-04

The roles/chronicle.restrictedDataAccessViewer IAM role now includes all read-only permissions from roles/chronicle.viewer, except global data access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands roles/chronicle.restrictedDataAccessViewer to include all read-only permissions from roles/chronicle.viewer — covering SOAR cases and playbooks, investigations, threat collections, findings, security validation, and ingestion resources — while still excluding chronicle.globalDataAccessScopes.permit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Password & Credential Cracking · 2026-10-04

Hashcat PCFG attack mode 4 gains a mask= parameter to pre-filter grammar candidates by shape before the run starts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds mask= parameter to -a 4 (PCFG attack mode) that applies a mask in -a 3 syntax to the grammar before the run, keeping only candidates whose shape satisfies the mask and ordering survivors by probability — not by brute-force enumeration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports pcfg-go (Go, single static binary, trains and generates) and Cpcfg (C, mdxfind-oriented, interchangeable grammar format with pcfg-go) as fast PCFG trainers whose rulesets load directly into attack mode 4.
• PCFG attack mode 4 handles encoding automatically, requiring no extra flag for corpora containing umlauts, accents, or Cyrillic characters.

Password & Credential Cracking · 2026-10-04

Hashcat expands custom charsets to 8 slots and adds PCFG-guided mask attack mode (-a 4) in master branch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --custom-charset5, --custom-charset6, --custom-charset7, and --custom-charset8 options (shortcuts -5 through -8) for defining up to eight custom charsets in a mask attack, up from four in versions before 7.0.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends .hcmask file format to support up to eight inline custom charset fields ([?1] through [?8]) per mask line, enabling per-line charset definitions for charset slots 5–8.
• Adds attack mode -a 4, a PCFG-guided mask attack available in the master branch (not in the 7.1.2 release), which applies a trained probabilistic grammar to a mask via mask=<pattern> syntax to order candidates by real-world password likelihood and prune impossible shapes before the run starts.

Endpoint Security (EDR/XDR) · 2026-10-04

Huntress adds five new Microsoft 365 hardening controls for Entra inactive accounts, shared mailboxes, spam, and Bookings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Microsoft Entra control to block sign-in for member accounts inactive for 90 days, schedulable for deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Microsoft Entra control to block sign-in for guest accounts inactive for 30 days, schedulable for deployment.
• Adds Microsoft Entra control to block sign-in to shared mailboxes, schedulable for deployment.

Identity & Access Management · 2026-10-04

iDenfy Sprint 136 adds MCP for AI assistants, Age Estimation dashboard, Spanish business verification, and CPF date-of-birth collection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Age Estimation sessions to the dashboard, including session creation, filtering, and result details.

Web Application Security · 2026-10-04

Invicti adds agentic pentest management, credit ledger, HTML/archive report downloads, and scan log retention controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Octo now confirms time-based findings over multiple rounds with varied delay values to reduce false positives from network latency or server load.
• Assessment confirmation dialog now references the AI Services Addendum.

Web Application Security · 2026-10-04

Invicti Agentic Pentesting adds credit ledger, HTML/Markdown/JSON reports, repo source selection, vulnerability chaining agent, and expanded detection coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds HTML format to assessment report downloads, alongside the existing Markdown (.md) and raw JSON exports introduced in the 20260831 release.
• Adds Markdown (.md) and raw JSON assessment report export formats for importing results into automated pipelines or external tools.
• Adds repository selection in the pentest wizard source code step, allowing use of a repo already connected to Invicti AppSec Core instead of uploading an archive.

Identity & Access Management · 2026-10-04

JumpCloud adds MCP Server for Users, Custom Risk Policies, App Settings Privacy for Apple MDM, and User Portal Folders in its September 2026 release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Asset Visibility and Asset Acknowledgement via Device Management > Asset Management > Settings and Fields > General Settings so end users see assigned assets in the User Portal and admins can request acknowledgement recorded in Asset History.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds JumpCloud MCP Server for Users, letting users connect AI clients to User Portal capabilities over OAuth; admins toggle it on and can configure automatic session expiration or manually revoke sessions, and users manage their own sessions under JumpCloud MCP in the User Portal.
• Adds Custom Risk Policies for Admin Portal, User Portal, device, and SSO application logins, allowing admins to select risk factors, adjust score contributions, and set policy precedence per user group or SSO application, with a Default Policy covering unmatched logins.

Backup & Recovery · 2026-10-04

Kasten K10 9.0.6 adds changed block tracking for VM backups and expiry management on RestorePoints, plus tunable Kubernetes API rate limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds kubeClient.qps and kubeClient.burst Helm parameters to make Kubernetes API client rate limits configurable, with defaults raised from 20/50 to 50/100.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for setting, updating, and removing expiry on existing RestorePoints and RestorePointContents resources.
• [Technical Preview] Adds changed block tracking for VM backups independent of underlying Kubernetes storage via the VirtualMachineBackup API.

Identity & Access Management · 2026-10-04

Keycloak 26.8.0 adds OID4VP credential verification, SCIM API support, multi-cluster stateless mode, token delegation with FGAP, and a wave of preview promotions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables OID4VCI with --features=oid4vc-vci or --features=preview; adds experimental oid4vc-mdoc format support, credential revocation on refresh token revocation, and an Application Initiated Action for in-session credential issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds oid4vc-vp experimental feature for OID4VP verifier support, enabling cross-device wallet credential presentations with direct_post.jwt encrypted response mode and SD-JWT User Attribute and Session mappers.
• Promotes multi-cluster v2 (--features=stateless) to supported, enabling multi-cluster deployments without an external Infinispan cluster by storing session data in the database.

SAST / SCA / Code Security · 2026-10-04

Lakera adds US-specific (us.api.lakera.ai) and Singapore/Asia (ap-southeast-1) API endpoints alongside existing EU routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds us.api.lakera.ai as a dedicated US-region API endpoint, complementing the existing https://eu.api.lakera.ai for EU traffic and https://api.lakera.ai for closest-region routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports pinning requests to a specific region using the ["eu-south-2"] region identifier in API configuration.

SAST / SCA / Code Security · 2026-10-04

Lakera adds request_uuid in API response metadata and direct dashboard lookup via URL or Request IDs filter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Every API response now includes a request_uuid field in its metadata object, enabling direct lookup of any request in the dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports direct Log Details URL navigation at https://platform.lakera.ai/dashboard/requests/<request_uuid> to reach any request across all dates.
• Adds a Request IDs filter on the dashboard requests view, accepting one or more UUIDs to locate requests within a selected time range.

AI/LLM Security · 2026-10-04

nono command-sandbox proxy credentials now support aws_auth for SigV4-signed AWS routing without exposing real credentials inside the sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds aws_auth as an alternative to credential_key on proxy credential type in command sandbox policies, letting the host supervisor resolve an AWS profile and sign outbound requests with SigV4 so real AWS credentials never enter the sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds aws_auth.profile config key to specify which host-side AWS profile (including SSO profiles) is used for signing permitted outbound requests from a command-scoped proxy credential.
• Supports setting AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE to /dev/null inside the sandbox to prevent the sandboxed CLI from probing ~/.aws, while aws_auth.profile is still resolved by the host supervisor.

AI/LLM Security · 2026-10-04

nono adds diagnostics.redaction.extra_env_vars and network_denial_audit rate-limit controls for audit hygiene⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds diagnostics.redaction.extra_env_vars config key to redact additional environment variable values (by exact name or glob such as ACME_*, *_SECRET) from diagnostics, session records, and the audit log — for variables not already derived from the profile's deny or credential declarations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds network_denial_audit profile section with rate_per_sec (max 1000) and burst (max 10000) integer fields to control how many per-run network syscall denials are individually recorded in the audit trail on Linux seccomp-mediated runs.
• Adds --network-denial-audit-rate and --network-denial-audit-burst CLI flags to override the network_denial_audit profile settings for a single run.

Identity & Access Management · 2026-10-04

Nudge Security launches AI agents for automated OAuth grant revocation and browser extension risk remediation at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the OAuth Grant Risk Analyst AI agent, accessible via Automations > AI Agents, which reviews new OAuth grants as they are discovered, revokes overly permissive or high-risk ones automatically, or nudges the OAuth grantor to remove access, with human-in-the-loop oversight.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Browser Extension Risk Analyst AI agent, accessible via Automations > AI Agents, which inspects browser extension artifacts and metadata to flag malicious, compromised, or misrepresented extensions and orchestrates disable and uninstall workflows.

General Utilities & Libraries · 2026-10-04

Obsidian adds Quick Capture templates, Quick Look for Markdown, RTL workspace flip, and new Bases Group/Hide-column controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --tooltip-, --notice-, --hotkey, --tab-inner-, and --tab-container- CSS variable prefixes for theming tooltips, notices, hotkeys, and tabs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Group menu to the Bases toolbar for choosing the property to group by, with the ability to reorder, hide, and add groups manually in any view type.
• Adds the Open file from outside the vault… command, letting users pick and view any file on their computer in the app.

Identity & Access Management · 2026-10-04

Okta for AI Agents adds Databricks import, CIMD registration, requester timeline view, and automatic manager-change reassignment⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Databricks AI agent import: import and manage AI agents built in Databricks directly through Okta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds CIMD (Client ID Metadata Document) support for AI agents, letting agents identify themselves with a URL instead of a static client ID.
• Adds a separate dialog for custom MCP server scopes when adding scopes to an MCP server.

SAST / SCA / Code Security · 2026-10-04

OpenAI Codex Security launches with CLI (@openai/codex-security), TypeScript SDK, desktop workbench, and GitHub cloud scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the @openai/codex-security npm package, providing a CLI (npx @openai/codex-security --help) and TypeScript SDK for running security scans from a terminal, CI pipeline, or custom application.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports SARIF upload and severity-policy enforcement when running scans in CI, enabling PR-gating on vulnerability severity.
• Supports bulk security scans via GitHub repository discovery or a CSV inventory file, with resumable campaign support and cross-scan finding tracking.

SAST / SCA / Code Security · 2026-10-04

Openlayer adds workspace-level AI feature configuration with per-project overrides, model selection, and cost tracking⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds workspace-level AI feature configuration with per-project override support, covering Intake assistant, Trace summaries, and other AI-powered features.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Intake assistant to draft project details, intake answers, and risk scores during project registration or from the project's Lifecycle page.
• Adds a per-feature enable/disable lock that stops individual projects from turning a feature on or off, while still allowing per-project model overrides.

SAST / SCA / Code Security · 2026-10-04

Openlayer adds governance lifecycle stages, AI-assisted intake drafting, and a workspace-level review approval queue.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports PDF, DOCX, MD, and TXT documents up to 25 MB as context for AI-assisted intake drafting (browser extracts text; up to ~60,000 characters used; file is not stored by Openlayer).
• Adds workspace-level lifecycle stages configured under Settings › Governance › Lifecycle stages, with an Openlayer-provided four-stage template (Requirements, development, pipeline, and production stages) or a blank starting point.
• Adds two approval-order modes per stage — Concurrent (all reviewers approve simultaneously) and Ordered (reviewers notified and approve in sequence).

SAST / SCA / Code Security · 2026-10-04

Openlayer adds API key expiry, rotation with grace periods, and full programmatic key management via REST API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds expiresAt field to API key creation and rotation API calls, with UI options of 7, 30, 60, or 90 days, or 1 year; keys default to never expiring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds gracePeriodHours parameter to the POST /v1/workspaces/<workspace-id>/api-keys/<api-key-id>/rotate endpoint, allowing the previous secret to remain valid for up to 7 days after rotation to enable zero-downtime rollover.
• Adds secret field in rotate API responses, returning the new secret exactly once.

SAST / SCA / Code Security · 2026-10-04

Openlayer adds Claude Code traces, Microsoft 365 Copilot prompt/response import, and Claude Compliance ingestion for claude.ai and Cowork sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Claude Code integration to send Claude Code traces to Openlayer via managed organizational settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Microsoft 365 Copilot integration to import first-party prompts and responses from Microsoft Graph.
• Adds Claude Compliance integration to ingest claude.ai chats and Cowork / Claude Code sessions into Openlayer.

SAST / SCA / Code Security · 2026-10-04

Openlayer: Adds GET /api-reference/rest/workspaces/retrieve-workspace endpoint to retrieve workspace details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds API key management endpoints: List API keys, Create API key, Retrieve API key, Update API key (rename), Delete API key, and Rotate API key (replace the secret).
• Adds List invites endpoint to list invites in a workspace.
• Adds test management endpoints: Create test, List tests, and Update tests for a project.

Firewalls & Network Defense · 2026-10-04

Palo Alto Networks IoT Security adds Infoblox Outbound API integration for device security data sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds integration between Device Security and the Infoblox Outbound API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-10-04