The week in full · Oct 9–15

Backup & Recovery · 2026-10-15

Acronis MDR gains multilingual support, customer comms add-on, telco self-activation, and Cloud Storage adds an Anti-Ransomware Recovery Warranty⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Spanish, Italian, Japanese and Portuguese language support to Acronis MDR by Acronis TRU, with French planned by November 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an optional customer communication add-on to Acronis MDR that enables Acronis to send incident notifications and reports directly to designated client contacts.
• Adds telco self-activation for Acronis MDR, allowing eligible customers to activate the service from the console once their provider enables the relevant offering.

AI Red Teaming & Testing · 2026-10-15

AI-Infra-Guard v4.6.6 adds Atlas Cloud and API Route agent presets, memory/RAG poisoning detection, JSON scan output, and a bilingual BadPhoneAgent benchmark.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Atlas Cloud provider preset to Agent-Scan, enabling out-of-the-box scanning of Atlas Cloud-hosted AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds API Route provider preset to Agent-Scan, covering API-routed agent surfaces without manual configuration.
• Adds a memory/RAG poisoning detection skill to Agent-Scan, surfacing data-poisoning attacks against retrieval-augmented generation pipelines.

OTHER · 2026-10-15

Arcade now publishes an API — 59 endpoints across 8 areas: Admin, Tools, Gateways, …⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Admin (21 endpoints) — Project administration: auth providers, secrets, user connections, and session verification settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Tools (12 endpoints) — Discover tools, inspect their authorization requirements, and execute them by name.
• Gateways (7 endpoints) — MCP gateways — federate tools from multiple MCP servers behind a single URL.

WAF, Bot & API Protection · 2026-10-15

Arcjet adds @arcjet/sensitive-info-rampart package for on-device sensitive information detection via the rampart backend.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @arcjet/sensitive-info-rampart package providing a rampart backend that runs the Rampart sensitive-information model on-device.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-15

Arcjet adds on-device sensitive-info detection via @arcjet/sensitive-info-rampart, covering PII types including emails, card numbers, and government IDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @arcjet/sensitive-info-rampart backend for on-device PII detection, covering email addresses, phone numbers, IP addresses, card numbers, names, street addresses, and government or financial identifiers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-15

Arcjet adds AI agent behavior drift analysis with cross-session state tracking, Cloudflare Clef scoring, and Rego-based Guard policy enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cross-session risk analysis for coding agents (Claude Code, Codex, Cursor, Muse Code, GitHub Copilot, and custom agents) that flags a session as tainted when it detects prompt injection in tool results, PII in files the agent read, or action sequences resembling credential theft.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Uses @cf/cloudflare/clef-flash via env.AI.run() to score structured, typed questions (yes/no probability, multiple-choice distribution, scale position) over session activity sequences — replacing broad single-question hazard checks.
• Stores per-session risk state in a Cloudflare Durable Object (created on demand per session) that serializes writes, exposes active flags and explanations, and is readable by the next hook request with minimal latency.

Managed Detection & Response (MDR) · 2026-10-15

Arctic Wolf introduces Aurora Adaptive Threat Protection, an AI-driven endpoint security solution with intent-based, mid-flight attack disruption.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Aurora Adaptive Threat Protection, a next-generation endpoint security solution using AI-driven, intent-based detection to disrupt attacks mid-flight.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Managed Detection & Response (MDR) · 2026-10-15

Arctic Wolf announces SwarmView™, giving customers visibility into AI-driven SOC investigations for greater trust and accountability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces SwarmView™, a new capability that surfaces AI-driven investigation activity from the Swarm agentic SOC, giving customers visibility into how AI reaches its conclusions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Managed Detection & Response (MDR) · 2026-10-15

Arctic Wolf adds Shadow AI Discovery, new Aurora Security Assistant skills, and expanded integrations to the Aurora Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Shadow AI Discovery™ capability to identify and govern unsanctioned AI usage across the organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands Aurora Security Assistant with new generative assistant skills to accelerate investigations.
• Delivers broader security coverage through expanded integrations.

SIEM · 2026-10-15

Artemis integrates with Cursor Origin: audit-log ingestion, read-only code analysis, and a new Origin connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Cursor Audit Logs connector that ingests logins, member and role changes, API key and token activity, team and privacy settings, and Origin namespace, repository, and app-installation events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Artemis app for Cursor Origin that grants read-only access to customer repositories — contents, metadata, pull requests, reviews, checks, and rulesets — for AI-driven investigation context.
• Installs the Origin connector directly from the Artemis portal via Install on Origin on the connector's setup page, with no new account or personal access token required.

Identity & Access Management · 2026-10-15

Auth0 launches an official Kotlin Multiplatform SDK for Android and iOS, enabling shared authentication logic in commonMain Kotlin code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the auth0 umbrella module (com.auth0.kmp:auth0:1.0.0-beta.1) to Maven Central, bundling Web Auth, Authentication API, and credential management into a single KMP artifact usable from commonMain shared code, plus auth0-webauth and auth0-credentials as individual feature modules for lighter-weight dependencies instead of the full auth0 module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Auth0Account and Auth0 client classes in com.auth0.kmp, initialised once and sharing a single network transport across webAuth, authentication, and credentials() subsystems.
• Adds auth0.webAuth.login(LoginOptions(...)) and auth0.webAuth.logout() suspend functions that open Universal Login via Custom Tabs (Android) or ASWebAuthenticationSession (iOS) and return a sealed Result type.

Identity & Access Management · 2026-10-15

New @auth0/auth0-tanstack-start-react SDK brings native Auth0 authentication to TanStack Start apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_SECRET, and APP_BASE_URL environment variables to configure Auth0 in a TanStack Start app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds core setup primitives for wiring Auth0 into a TanStack Start app: auth0Server() from @auth0/auth0-tanstack-start-react/server for a server-side Auth0 instance, auth0Middleware() from @auth0/auth0-tanstack-start-react/server/middleware to register Auth0 and automatically mount /auth/login, /auth/callback, /auth/logout, /auth/profile, and /auth/backchannel-logout routes, and auth0RouterContext with auth0BeforeLoad() from @auth0/auth0-tanstack-start-react/client to wire Auth0 state into the router context.
• Adds access-control helpers for protecting routes and API handlers: requireAuth and requireOrg route guards for use in a route's beforeLoad, plus server middleware helpers requireAuthMiddleware, withApiAuth, withApiScopes, withApiOrg, and claim-based guard withApiClaimIncludes.

AI/LLM Security · 2026-10-15

Backslash launches AI Fabric Graph, connecting enterprise endpoints, AI agents, MCP servers, skills, and plugins in one risk-investigation view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the AI Fabric Graph, a connected visualization that chains enterprise endpoints, AI agents, MCP servers, skills, rules, and plugins into one view with risk severity and Shadow AI indicators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables filtering the graph for policy violations and drilling into agent-level violation details to identify the root cause and affected components.
• Supports tracing a flagged asset back to every agent and endpoint connected to it, revealing shared exposure across the agentic fabric.

Runtime Security · 2026-10-15

bubblewrap v0.13.1 allows multiple --sync-fd arguments to be passed in a single invocation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports multiple --sync-fd arguments in a single bwrap invocation, with all provided file descriptors handled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-15

BunkerWeb adds a plugin system with 12 official plugins (Authentik, ClamAV, Cloudflare, Coraza, open-appsec, SentinelOne, VirusTotal, and more) installable via EXTERNAL_PLUG⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds EXTERNAL_PLUGIN_URLS setting to automatically install one or more plugins from space-separated ZIP archive URLs at startup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a plugin system supporting custom NGINX configs (confs/), Lua code (plugin.lua), scheduler jobs (jobs/), UI pages (ui/template.html), Flask hooks (ui/hooks.py), Flask blueprints (ui/blueprints/), and custom templates (templates/my-template.json), all declared in plugin.json.
• Adds bwcli field in plugin.json to map CLI command names to files in the plugin's bwcli/ directory, enabling CLI-accessible plugin commands.

WAF, Bot & API Protection · 2026-10-15

BunkerWeb 1.6.16 adds keepalived VRRP active/passive HA and a smarter healthcheck that stays ok during config reloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds healthcheck.sh ok argument to /usr/share/bunkerweb/helpers/healthcheck.sh so the health endpoint returns success during config reloads (when NGINX is still serving the previous config), exiting non-zero only when the instance is still in loading state or NGINX is stopped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds documented keepalived VRRP active/passive HA topology (section 6) using /etc/keepalived/keepalived.conf with vrrp_script chk_bunkerweb calling healthcheck.sh ok, enabling sub-10-second failover between BunkerWeb workers without a load balancer.
• Documents shared-state guidance for active/passive HA: enable Redis (USE_REDIS) on both workers and set identical fixed values for SESSIONS_SECRET and SESSIONS_NAME via global Manager settings to preserve locks, counters, and sessions across failover.

WAF, Bot & API Protection · 2026-10-15

BunkerWeb adds BANS_TLS_DROP_REASONS to drop banned IPs at the TLS handshake and CROWDSEC_BAN_REFRESH to convert CrowdSec blocks into native bans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds BANS_TLS_DROP_REASONS config key to drop banned clients at the TLS handshake — before certificate or key-exchange work — saving CPU on repeat offenders; accepts a space-separated list of ban reasons (bad_behavior, manual, ui, api); never applies to HTTP/3 (QUIC); drops are counted per-reason in metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds CROWDSEC_BAN_REFRESH config key to convert CrowdSec blocks into short-lived native BunkerWeb bans that renew while the CrowdSec decision persists, stopping repeat requests at the ban-check stage before other plugins or a fresh CrowdSec query.
• Introduces the shared-memory zone bans_meta (declared at 10 MiB, allocated only when CROWDSEC_BAN_REFRESH or BANS_TLS_DROP_REASONS is set) to hold TLS-drop state and CrowdSec ban state.

WAF, Bot & API Protection · 2026-10-15

BunkerWeb adds an open-appsec ML WAF sidecar plugin that blocks requests flagged by the open-appsec agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the openappsec external plugin (via bunkerweb-plugins/openappsec) to inspect and block requests using the open-appsec machine-learning WAF through a sidecar agent, installable with EXTERNAL_PLUGIN_URLS=https://github.com/bunkerity/bunkerweb-plugins/archive/refs/tags/v1.13.zip.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-15

BunkerWeb 1.6.16 adds active/passive high-availability via keepalived with VRRP-based VIP failover for multi-worker deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds keepalived active/passive HA mode using VRRP virtual IP (VIP) failover as a load-balancer-free alternative to multi-worker deployments, configured via /etc/keepalived/keepalived.conf.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ok argument to /usr/share/bunkerweb/helpers/healthcheck.sh to return exit code 0 only when the instance is fully ready (NGINX running and configuration applied), enabling keepalived to withhold the VIP from instances still in loading state.
• Supports shared ban/counter state across HA workers by pointing both workers at the same Redis/Valkey instance via the Redis settings.

WAF, Bot & API Protection · 2026-10-15

BunkerWeb: Adds JSON fragment filters for IP/URL list sources, e.g. ...ip-ranges.json#service=CLOUDFRONT keeps matching entries; & combines terms.

• Supports duration suffixes (ms, s, m, h, d, w, M, y) on all time-based config keys including CROWDSEC_BAN_REFRESH, ANTIBOT_JAVASCRIPT_DIFFICULTY timeouts, CORS preflight cache, and UI session retention.

WAF, Bot & API Protection · 2026-10-15

WAF, Bot & API Protection · 2026-10-15

BunkerWeb: Adds floating-IP high availability via keepalived VRRP, so workers run active/passive without a load balancer; the VIP fails over in ~4 seconds on container stop.

• Documents /etc/keepalived/keepalived.conf configuration for BunkerWeb workers, using vrrp_script chk_bunkerweb with interval 2, fall 2, rise 2 to gate VIP ownership on the healthcheck result.

WAF, Bot & API Protection · 2026-10-15

BunkerWeb v1.6.16 adds Redis Cluster support, TLS-drop banning, IPv4 Let's Encrypt certs, and richer IP-list formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds REDIS_CLUSTER_NODES setting to enable Redis Cluster support for the redis integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds BANS_TLS_DROP_REASONS to close TLS handshakes of banned IPs for specified ban reasons instead of serving a 403 page, including dropping banned clients at the TLS ClientHello behind PROXY protocol when real IP uses proxy_protocol (trusted only from proxies in REAL_IP_FROM).
• Adds CROWDSEC_BAN_REFRESH to turn CrowdSec blocks into short, renewed bans listed on the Bans page and removed with their decisions on Unban.

Malware Analysis · 2026-10-15

CAPEv2 wires CAPE_ENGINE env var, adds enforce_timeout fallback on package start error, and expands environment variables in executiondir/curdir.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Wires the CAPE_ENGINE environment variable to control the autoprocess engine selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Improves analyzer/windows: honors enforce_timeout so analysis runs for the full timeout even when package.start() fails, instead of aborting immediately; expands environment variables in executiondir and curdir inside Process.execute(); and falls back to CreateProcessW without PROC_THREAD_ATTRIBUTE_PARENT_PROCESS when launching with explorer.exe as parent fails (e.g. ERROR_ELEVATION_REQUIRED on installers with requireAdministrator manifests).
• Adds a generic attributes JSON column to Machine and Task models, and uses Task.attributes to store distributed main_task_id and parent_sample.

Container & Image Security · 2026-10-15

API surface changed: 15 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GET /registry/v1/entitlements/{parent}/catalog-images: param includeDeleted (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GET /registry/v1/entitlements/{parent}/images: param includeDeleted (query) added

Digital Forensics & Incident Response · 2026-10-15

Chainsaw v2.17.1 adds initial support for Sigma's windash modifier and fixes lint exit codes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds initial support for Sigma's windash modifier, enabling detection rules that use windash-based pattern matching to be correctly processed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-15

Internet Services · 2026-10-15

API surface changed: +96 endpoints, −24 endpoints, 177 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /accounts/{account_id}/access/user_populations/{user_population_id}/users/{user_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /accounts/{account_id}/ai-search/namespaces/{namespace}/instances/{id}
• New endpoint DELETE /accounts/{account_id}/ai-search/namespaces/{namespace}/instances/{id}/items/{item_id}

Internet Services · 2026-10-15

Cloudflare Workers AI adds Google's Gemini 4 Argon frontier model for complex coding, finance, legal, cybersecurity, and science tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds gemini-4-argon, Google's Gemini 4 family frontier model, to Cloudflare Workers AI for deep work on complex tasks across coding, finance, legal, cybersecurity, and science.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-10-15

Cloudflare adds configurable session duration for infrastructure apps, nameserver sets (beta), trim functions for Rules, DNS64 via EDNS, and LCP/INP sub-parts in Web Analytic⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds nameserver_set_id field to PATCH /zones/{zone_id}/dns_settings and a new POST /accounts/{account_id}/dns_settings/nameserver_sets endpoint to create reusable Advanced Custom Nameserver sets (beta, Enterprise), supporting up to 3 IPv4 and 3 IPv6 addresses per nameserver and an advanced: true flag to allocate from Advanced anycast network groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds trim(), trim_start(), and trim_end() functions to Cloudflare Rules for stripping surrounding bytes (ASCII whitespace by default, or a custom byte string) from request values before comparison — available on all HTTP products and all plans.
• Adds Enable DNS64 toggle for Gateway DNS locations and support for requesting DNS64 via EDNS option in individual queries, enabling AAAA record synthesis from A records for IPv6-only/NAT64 networks across UDP, TCP, DoT, and DoH.

Internet Services · 2026-10-15

Cloudflare: Adds endpoints to manage Rego modules in Cloud Workload Security, including GET/POST /accounts/{account_id}/cws/rego-modules

• Adds GET/POST /accounts/{account_id}/cws/tenant-structures and GET/PUT/DELETE /accounts/{account_id}/cws/tenant-structures/{structure_id} endpoints for managing CWS tenant structures.
• Adds GET/POST /accounts/{account_id}/cws/tenant-structures/{structure_id}/nodes, GET/PUT/DELETE .../nodes/{node_id}, and POST .../nodes/batch endpoints for managing and batch-mutating nodes within a CWS tenant structure.

Internet Services · 2026-10-15

Cloudflare: Enables DNS64 configuration per Gateway DNS location, or per-query synthesis via an empty EDNS option.

• Adds nameserver sets for Advanced Custom Nameservers (beta), allowing standard or advanced account-level sets to be created and assigned to zones via the DNS settings API.

Internet Services · 2026-10-15

Cloudflare: Adds view-action capture to Audit Logs v2, surfacing records through the API, Logpush, and dashboard.

Internet Services · 2026-10-15

General Utilities & Libraries · 2026-10-15

VS Code gains an Agent Customizations editor, Customization Marketplace, monorepo parent-repo discovery, and a quality-evaluation extension for customization files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chat.customizations.marketplace.enabled setting to turn on a unified Discover page for finding skills, MCP servers, plugins, and other agent customizations from configured sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.customizations.marketplace.sources.publicFeed.enabled setting to show or hide the GitHub Feed source in the Customization Marketplace.
• Adds chat.useCustomizationsInParentRepositories setting to discover customization files from parent repository folders (up to the .git root) when only a monorepo subfolder is opened — applies to copilot-instructions.md, AGENTS.md, CLAUDE.md, *.instructions.md, *.prompt.md, *.agent.md, and hooks.

General Utilities & Libraries · 2026-10-15

Copilot harness sessions gain OS-level agent sandboxing, worktree isolation, and Autopilot permission level in code-oss⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Copilot harness sessions support configurable tool-call approval levels, including manual approval, auto-approve, and an Autopilot mode that auto-approves all tools and drives the agent until the task is complete.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Copilot harness sessions using default tools gain OS-level agent sandboxing that confines shell execution, child processes, MCP servers, and language servers — available on Windows, macOS, and Linux, independent of permission level.
• Review pending agent edits in a diff editor before committing, merging, or creating a pull request; Local harness sessions and existing extension-host sessions also support keeping or undoing pending edits.

General Utilities & Libraries · 2026-10-15

VS Code Copilot agent sessions gain per-session sandbox toggle, Claude permission modes, and Codex approval presets in the permissions picker.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds github.copilot.chat.claudeAgent.allowDangerouslySkipPermissions setting to bypass all Claude permission checks — recommended only in an isolated, air-gapped sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes Claude harness permission modes (Edit automatically, Ask, Plan) in the permissions picker for Claude agent sessions.
• Adds Codex approval presets (Default Permissions, Auto-Review, Full Access) to the direct Codex integration via the permissions picker.

General Utilities & Libraries · 2026-10-15

VS Code Agents adds Rubber Duck second-opinion critic and per-harness review workflows for inspecting, reverting, and integrating agent edits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /rubber-duck <question> chat command to invoke the Rubber Duck critic, a read-only complementary-model reviewer that flags blocking issues, non-blocking issues, and suggestions on the agent's plans, code, and tests — without editing files or running commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-harness change-review workflows: Copilot/Claude/Codex harness sessions expose diffs in the Chat view, Agents window, or Source Control; Local harness sessions mark edits as pending for individual keep/revert; Cloud sessions return changes as a GitHub pull request.
• Adds a pill above the chat input showing affected-file count and diff statistics; selecting it opens a multi-diff editor with all session changes.

General Utilities & Libraries · 2026-10-15

VS Code agents gain remote-machine delegation, browser-based management, Dev Container support, and GitHub Mobile remote control for agent sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds experimental remote-machine task delegation in the Agents window, letting the agent target connected remote machines automatically by criteria (Windows, Linux, or macOS, minimum memory, logical CPU count, optional model) without manually selecting a machine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds /remote on command inside a Copilot harness session to remotely monitor and steer that session from GitHub.com or the GitHub Mobile app, with session history, tool activity, status, approvals, and questions synchronized.
• Adds /remote off command to stop sharing a remotely controlled Copilot harness session.

General Utilities & Libraries · 2026-10-15

VS Code gains a searchable, cross-device Copilot session history that syncs to GitHub and spans CLI, cloud agent, code review, and Copilot Desktop.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a searchable history of Copilot harness sessions, synced by default to your GitHub account for cross-device access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables sharing of selected sessions and unified querying of work from VS Code, Copilot CLI, cloud agent, code review, and the GitHub Copilot Desktop app.

General Utilities & Libraries · 2026-10-15

VS Code agent sessions gain chat-to-folder/worktree moves, side chats, Copilot CLI terminal integration, and cross-session coordination tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds natural-language prompts to move the current chat to an existing local folder (Move this chat to <absolute folder path> and continue the current task there.) or a new Git worktree (Continue this task in a new Git worktree of the current repository before implementing it.) while preserving conversation history.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds side chats for Copilot and Claude harness sessions in the Agents window, letting practitioners work on related tasks in peer chats without interrupting an ongoing conversation.
• Adds Chat: New Copilot CLI Session command and a GitHub Copilot CLI terminal profile to start a Copilot CLI session from VS Code, with a Resume in Terminal right-click action to continue an existing Copilot harness session from the terminal.

General Utilities & Libraries · 2026-10-15

VS Code adds experimental cloud automations that run Copilot agent tasks on GitHub even when VS Code and your computer are off.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables chat.automations.cloud.enabled to surface cloud automation controls, letting scheduled Copilot agent tasks run remotely on GitHub without requiring VS Code or your computer to stay on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Cloud session type when creating an automation, targeting an eligible private GitHub.com repository instead of the local working tree.
• Adds Refresh and Open on GitHub actions on automation cards so practitioners can pull live status (queued, running, completed, failed) and manage runs directly on GitHub.

General Utilities & Libraries · 2026-10-15

code-oss agents gain shell-profile initialization for Copilot harness sessions and editable tool-call confirmation dialogs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables chat.agentHost.shellTool.initScript.enabled to load ~/.bashrc (macOS/Linux) or PowerShell profiles (Windows) before each command in Copilot harness sessions using the SDK built-in shell tool.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports parameter editing directly inside Local harness and extension-contributed tool confirmation dialogs, letting users adjust inputs before approving a tool call.
• With python-envs.terminal.autoActivationType set to shellStartup, the selected workspace Python environment is automatically activated alongside shell initialization.

General Utilities & Libraries · 2026-10-15

VS Code Insiders adds /research <topic> in Copilot harness sessions to gather findings from codebases, GitHub repos, and the web before planning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /research <topic> command (Preview) in VS Code Insiders Copilot harness sessions to gather findings from your codebase, relevant GitHub repositories, and the web, returning a detailed Markdown report with citations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a built-in Plan agent in the Local harness session with distinct controls separate from Copilot Plan mode.

General Utilities & Libraries · 2026-10-15

VS Code adds multi-harness agent selection (Copilot, Claude, Codex, Cloud), canvas extensions, and cross-harness handoffs in the Agents window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds canvas support across the product: enable interactive canvases shared with the agent via chat.canvases.enabled for Copilot harness sessions, generate a canvas extension in your workspace with the /create-canvas skill, open canvases from Add Tab (+) > Canvas in the Agents window editor area, and install chat plugins containing canvas extensions from the GitHub Copilot app for use in VS Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Agents window for selecting a harness (Copilot, Claude, Codex, or Cloud) and a GitHub repository or local folder before a session starts.
• Supports harness handoffs so a running session can continue with a different harness or Cloud target while carrying conversation history and context.

General Utilities & Libraries · 2026-10-15

VS Code Agents window gains worktree isolation, cloud automations, canvas support, and BYOK model configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sessions.useWorktree setting to control whether worktree isolation is selected by default when creating a new workspace session in VS Code Insiders, along with git.worktreeIncludeFiles to copy Git-ignored files (such as .env files and installed dependencies) into new worktrees and git.worktreeSymlinkFolders (Experimental) to symlink large ignored folders into a worktree instead of copying them, introducing worktree isolation for Agents window workspace sessions so agents can work in a separate Git worktree to keep changes out of the active workspace — useful for parallel tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chat.automations.cloud.enabled setting to enable cloud automations that run recurring agent tasks on a schedule (hourly, daily, or weekly) remotely in GitHub, continuing even after VS Code is closed.
• Supports Canvases (preview) as a Copilot canvas type, bring-your-own-key (BYOK) models via provider configuration, and using Claude and Codex without GitHub sign-in (Experimental), all in the Agents window.

General Utilities & Libraries · 2026-10-15

VS Code agent sessions gain multi-chat support, cross-interface continuity, /delegate handoff, and local session discovery from Copilot CLI, Claude Code, and Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports running multiple chats in one session against the same codebase simultaneously, available with Copilot and Claude harnesses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables moving an existing chat to a different folder or Git worktree in supported single-chat sessions in the Agents window, preserving full conversation history.
• Access and continue the same live Copilot or Claude session across both the Chat view and the Agents window without forking the conversation, harness, workspace, or worktree.

General Utilities & Libraries · 2026-10-15

VS Code 1.142 adds interactive canvases, portable chat context, expanded Markdown editor, and granular enterprise controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds visual and interactive canvases for working with content in VS Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables moving chats without losing context.
• Expands the Markdown editor with new capabilities.

Identity & Access Management · 2026-10-15

ConductorOne adds AWS IAM Account Access Manager integration for JIT provisioning, access reviews, and risk detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new AWS IAM Account Access Manager integration that syncs IAM roles and account assignments into ConductorOne alongside existing IAM Identity Center data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables bidirectional just-in-time (JIT) provisioning so employees can request time-bound access to an AWS account or IAM role through ConductorOne, with automatic revocation on expiration.
• Surfaces AWS IAM Account Access Manager-assigned roles that are unowned, orphaned, or otherwise risky through ConductorOne's detection engine.

Security Data Pipeline · 2026-10-15

Cribl StreamAI routes AI model traffic, applies security/spend controls, and emits normalized telemetry into the existing Cribl platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Cribl StreamAI, an AI gateway that routes requests across models, applies security and spending controls, and records model calls and routing decisions as normalized telemetry.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports outputting AI inference telemetry in OCSF, UDM, and ECS schemas (or a custom schema) for routing to a SIEM, observability platform, or archive.
• Enables smart routing of AI requests across models based on task, balancing quality, performance, and cost rather than hard-coding applications to a single model.

Attack Surface & Exposure Management · 2026-10-15

CybelAngel Live Attacks now surfaces attacker TTPs, ports, paths, and timestamps per event with a New badge for recent activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Live Attacks view now displays tactics, techniques, and procedures (TTPs) observed against each target, with a per-event timestamp showing how attacker activity builds over time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Live Attacks surface now shows which methods, ports, and paths an attacker is testing against a target.
• Recent Live Attacks entries receive a New badge to make the latest attacker activity stand out in the list.

Attack Surface & Exposure Management · 2026-10-15

Claimed attack details now include title, summary, and source in the side panel and public API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes title, summary, and source fields for claimed attacks in the public API, giving downstream tools full claim context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds title, summary, and source link directly to the claimed attack side panel for at-a-glance assessment before escalation.

Attack Surface & Exposure Management · 2026-10-15

CybelAngel adds Custom CISO Dashboard for executive-ready reporting without exposing sensitive dark web or credential data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Custom CISO Dashboard with tailored executive views scoped to leadership indicators, shareable with brand or legal teams while redacting dark web and credential data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-15

CybelAngel Starter tier launches Q4: self-serve sign-up with no credit card, surfacing passwords, domains, and employee exposures on cybercriminal channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a self-serve Starter tier — sign up with a business email, no credit card and no demo required, to immediately see real exposure found on cybercriminal channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Automatically generates monitoring keywords on sign-up and surfaces findings covering passwords, domains, and employee data with plain-language explanations and attack scenario context.
• Provides one-click access to a CybelAngel expert directly from any finding for teams that want to escalate or investigate further.

Attack Surface & Exposure Management · 2026-10-15

CybelAngel adds continuous Dark Web Monitoring matched to your keywords, with no manual intervention required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds continuous dark web intelligence ingestion matched to user-defined keywords, delivering relevant findings automatically as they appear.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-15

CybelAngel adds Infected Machines View to consolidate leaked credentials by source machine for faster remediation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Infected Machines View, a consolidated view that maps leaked credentials back to the infected machines that exposed them, including per-machine credential details and leak-tracing metadata — replacing manual CSV export workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-15

CybelAngel expands exposed bucket detection to S3-compatible providers: Scaleway, Linode, and IBM Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends exposed cloud storage bucket detection beyond AWS, Azure, and Google Cloud to S3-compatible providers, starting with Scaleway, then Linode and IBM Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-15

CybelAngel adds automatic detection of fraudulent Telegram channels impersonating your brand or executives.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Detects fraudulent Telegram channels impersonating your brand or executives, generating actionable reports consistent with existing social network impersonation coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-15

CybelAngel adds a prioritized, actively-exploited vulnerability list to its Unified Threat Intelligence view in Q4.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a prioritized list of actively-exploited vulnerabilities to the Unified Threat Intelligence view, filtering out noise so teams can focus patching on CVEs attackers are actually using in their environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-15

CybelAngel adds Vendor Exposure Monitoring to alert you when an attack against a supplier is claimed on attacker channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Vendor Exposure Monitoring to surface attacker-channel claims targeting your suppliers, enabling impact assessment and supplier contact before an incident propagates to your organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-15

AI Runtime extends to compliance security profile workspaces on AWS and Azure, enabling serverless GPU model training without infrastructure management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends AI Runtime availability to workspaces with the compliance security profile enabled (mid-November 2026), supporting serverless GPU model training and fine-tuning without provisioning infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-15

Databricks AI Runtime SDK (databricks-sdk-air) replaces serverless_gpu in GPU environment v6, bringing new databricks.air namespace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the databricks-sdk-air package with @distributed and ray_init APIs and databricks.air.data utilities under the databricks.air namespace, replacing the deprecated serverless_gpu package starting in GPU environment version 6.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Renames gpus and gpu_type arguments to num_accelerators and accelerator_type; the old names still work in databricks.air but emit a FutureWarning and will be removed in version 7.

SIEM · 2026-10-15

Unity REST API now supports external engine queries against Unity Catalog views over Delta Lake tables (GA).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables external engines to query Unity Catalog views over Delta Lake tables through the Unity REST API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-15

DefectDojo v3.4.101 adds CRA Annex I Part I to EU regulatory assessment, new import formats (.ckl, .cklb, .jsonl), and FOSSA connector sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds .ckl, .cklb, and .jsonl file formats to the import file pickers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends the EU regulatory assessment to include CRA Annex I Part I requirements.
• Enables Ask Sensei from any page, with answers built from live views of your data.

Public Key Infrastructure (PKI) · 2026-10-15

DigiCert transitions all browser-trusted TLS certificate issuance to G5 root hierarchies (RSA4096 and ECC P384) on November 12, 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Switches default TLS certificate issuance — new orders, renewals, reissues, and duplicates — to DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 root hierarchies across all DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Applies to all browser-trusted DV, OV, and EV TLS certificates for all public TLS customers; certificate chains may include server, intermediate CA, and cross-signed root certificates.
• Customers managing custom trust stores must add and trust the G5 root and intermediate CA certificates to maintain service continuity.

AI/LLM Security · 2026-10-15

Harbor eval framework integrates with Docker Sandboxes, enabling isolated microVM agent evals locally or in the cloud via sbx engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds harbor[sbx] install target to run Harbor eval tasks inside Docker Sandboxes microVM environments via uv tool install 'harbor[sbx]'.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -e sbx engine flag to harbor run to execute eval tasks in Docker Sandboxes instead of plain containers.
• Adds --ek target=local extended-key argument to harbor run to direct tasks to a local Docker Sandboxes instance instead of Cloud Sandboxes.

Software Supply Chain Security · 2026-10-15

Endor Labs AI SAST gains BYOK support for OpenAI, Azure OpenAI, Gemini, and Vertex AI accounts, plus first-class C and custom org context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports passing provider API keys as environment variables during AI SAST scans so keys are never stored with Endor Labs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bring your own key (BYOK) support for AI SAST and AI Chat, routing all model requests through your own OpenAI, Azure OpenAI, Gemini, or Vertex AI account instead of Endor Labs' provider accounts.
• Routes BYOK requests through the Endor Labs AI Gateway with an encrypted key store, provider allowlist, and tenant isolation.

WAF, Bot & API Protection · 2026-10-15

Fastly adds Network Protect for real-time visibility and defense against network-based DDoS attacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Fastly Network Protect, providing real-time visibility into and defense against common network-based DDoS attacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-15

Fastly launches Network Protect: always-on Layer 3/4 DDoS defense delivered inline via BGP anycast and GRE tunnels, no scrubbing-center detour.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Fastly Network Protect, a new always-on Layer 3 and Layer 4 DDoS mitigation service delivered inline across Fastly's global POP network, eliminating centralized scrubbing-center detours.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Announces customer IP prefixes via BGP, pulling all inbound traffic through Network Protect before forwarding clean traffic to the origin network over a GRE tunnel.
• Supports rule-based network firewall policies filtering traffic by any combination of IP protocol, source and destination port, and source and destination address.

WAF, Bot & API Protection · 2026-10-15

Fastly API now supports targeted cache purges for staging environments via the Fastly-Purge-Environment: staging header.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Fastly-Purge-Environment: staging header support to purge-everything, purge-by-surrogate-key, and purge-multiple-surrogate-key-tags API requests, scoping the purge to the staging environment instead of production.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports purging an individual URL from the staging environment by sending a purge-a-URL request to the staging IP address of the service.

Secure Access (VPN / SASE / ZTNA) · 2026-10-15

Firezone macOS/iOS 1.5.22 adds device pool grouping in the resource list and improves packet-processing performance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sends a notification instead of displaying an alert when the session ends.
• Improves packet-processing performance when flow logging is enabled.
• Improves packet-processing performance by speeding up peer and route lookups.

SAST / SCA / Code Security · 2026-10-15

HydraFusion gains Claude Opus 5.5, GPT-6 models, and a new HydraFusion Max tier for demanding agentic tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces HydraFusion Max, a new model-orchestration option tuned for frontier capability on demanding tasks with higher reasoning effort and token-efficiency orchestration, available in VS Code, GitHub Copilot app, and GitHub Copilot CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands the HydraFusion model pool to include Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol, and GPT-6 Luna.
• Adds per-stage reasoning-effort tuning to HydraFusion orchestration, using medium effort for initial drafts and high effort for review steps.

SAST / SCA / Code Security · 2026-10-15

GitHub adds GET /repos/{owner}/{repo}/stats/star_history returning up to 30 weeks of daily star counts without user identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Restricts the existing GET /repos/{owner}/{repo}/stargazers endpoint so that callers without repository administrator or collaborator access receive an empty response or a 403 Forbidden response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-15

GitHub Actions workflow lockfiles hit public preview — pin action commits via gh actions-lock and enforce with a Require lockfile policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the gh actions-lock CLI extension to generate and maintain .github/workflows/actions.lock, pinning actions and their transitive dependencies (including reusable workflows) to exact commits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports gradual onboarding: individual workflows can be opted in, after which GitHub Actions enforces that every dependency of that workflow has a lockfile entry and runs its recorded commit.
• Introduces the Require lockfile policy (public preview) allowing Enterprise, organization, and repository administrators to mandate lockfile use across their scope.

SAST / SCA / Code Security · 2026-10-15

Gemini 4 Argon joins GitLab Duo Agent Platform for long-horizon agentic tasks, selectable today via model selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Gemini 4 Argon as a selectable model on GitLab Duo Agent Platform, optimized for long-running, multi-step agentic tasks across the software lifecycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables model selection between Gemini 4 Argon and Flash models on GitLab Duo Agent Platform, letting teams match each workload to cost and performance needs.
• Agent output from Argon-powered runs lands in a merge request for team review with full change context.

SIEM · 2026-10-15

SIEM · 2026-10-15

AI-Powered Offensive Security · 2026-10-15

Hacktron adds Jira/Linear two-way status sync, a unified Integrations page, and richer Whitebox PDF reports with live-validation evidence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Whitebox PDF reports now include repositories and targets in scope, testing window, severity rubric, limitations, confidentiality notice, and — where available — methodology and code-coverage detail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Findings with recorded live-validation evidence gain a Live Validation section in the PDF report showing what the attempt established, what it did not establish, any blocker, and observed output for successful exploits.
• Adds two-way Jira and Linear status sync: finding status changes propagate to linked issues and supported issue status changes flow back into Hacktron, with each direction independently toggled by organization admins in integration settings; Jira updates follow the project workflow's available transitions.

AI-Powered Offensive Security · 2026-10-15

Hacktron gains in-app GitHub repo selection, per-repo PR-review toggles, and GitHub.com support for self-hosted appliances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds in-app GitHub repository selection so organization admins can choose which repos to enable from the GitHub integration without leaving Hacktron, within the access granted to the GitHub App.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-repository PR-review toggle to keep a repository available to Hacktron while independently switching its automatic PR reviews on or off.
• Expands the Repositories table to show Repository and Owner as separate columns alongside Open Findings, PR Scans, and Last Scan, with a platform filter scoped to only connected providers.

AI-Powered Offensive Security · 2026-10-15

Hacktron adds finding retest requests, login preview for dynamic validation, and improved People list search for Whitebox Code Review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Retest findings workflow on completed hosted Whitebox scans: select findings, provide fix instructions, and the Hacktron pentest team records each outcome and notes; completed retests appear in the scan's retest history and PDF report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds login instruction preview for dynamic validation in the Whitebox scan wizard: supply login instructions and test credentials, then preview the browser session before starting so Hacktron can authenticate against deployed targets during finding validation.
• Adds name, email, and SCM username search to the People list, with filters by role or Code Review seat, plus sort and pagination across the full member list rather than only loaded rows.

Secrets Detection & Management · 2026-10-15

API surface changed: +65 endpoints, −3 endpoints, 39 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agent Vault member management endpoints: DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/members, DELETE /api/v1/agent-vault/members, and PATCH /api/v1/agent-vault/members.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Keeper app connection integration with endpoints GET /api/v1/app-connections/keeper, GET /api/v1/app-connections/keeper/available, GET /api/v1/app-connections/keeper/connection-name/{connectionName}, GET /api/v1/app-connections/keeper/{connectionId}, POST /api/v1/app-connections/keeper, POST /api/v1/app-connections/keeper/{connectionId}/rotate-credentials, PATCH /api/v1/app-connections/keeper/{connectionId}, and DELETE /api/v1/app-connections/keeper/{connectionId}.
• Adds a Palo Alto Networks app connection integration with endpoints GET /api/v1/app-connections/palo-alto-networks, GET /api/v1/app-connections/palo-alto-networks/available, GET /api/v1/app-connections/palo-alto-networks/connection-name/{connectionName}, GET /api/v1/app-connections/palo-alto-networks/{connectionId}, POST /api/v1/app-connections/palo-alto-networks, POST /api/v1/app-connections/palo-alto-networks/{connectionId}/rotate-credentials, PATCH /api/v1/app-connections/palo-alto-networks/{connectionId}, and DELETE /api/v1/app-connections/palo-alto-networks/{connectionId}.

Secrets Detection & Management · 2026-10-15

Infisical v0.166.7 adds Kafka dynamic secrets, a PAM alerting module, and an edit sheet for single-environment secret views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Kafka support to dynamic secrets, enabling short-lived Kafka credentials to be generated on demand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Moves PAM to a dedicated alerting module.
• Adds an edit secret sheet and comment preview in the single-environment secrets view.

Endpoint Management (UEM/RMM) · 2026-10-15

Iru's Privacy Library now supports recommended permission bundles for macOS apps and Safari websites.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends the Privacy Library Item's Recommended privacy permissions area to support macOS, allowing admins to bundle app and Safari website permissions into a single user consent prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-10-15

Iru AI can now recommend and apply Windows Update settings guided by CIS benchmarks or Microsoft defaults via conversational follow-up.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Iru AI assistance inside Windows Update Library Items to recommend and implement settings based on CIS benchmarks or Microsoft defaults, with preview of each change before approval.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables conversational follow-up questions within the Windows Update configuration workflow — for example, asking 'What changes if I move from CIS to Microsoft defaults?' — to refine active hours, restart prompts, notifications, and deferral access in plain language.

Threat Intelligence · 2026-10-15

isMalicious ships bulk IOC API, STIX/TAXII 2.1 feeds, NRD feed, DNS history, ransomware tracker, and CVE intelligence pages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /api-docs/bulk endpoint accepting mixed IP, domain, and URL batches in a single request, up to 500 indicators per request; responses stream via chunked transfer encoding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds TAXII 2.1 collections serving STIX 2.1 objects for OpenCTI, MISP, and Sentinel; included in Pro and Enterprise plans.
• Adds a daily NRD (newly registered domain) feed with age, registrar, nameserver, and isMalicious verdict, available in CSV and JSON.

Endpoint Management (UEM/RMM) · 2026-10-15

ITarian 11.2 adds forced remote-session recording, CSV ticket export, and file/process-hash alert search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Force Screen Recording toggle in the Screen Recording tab under Remote Control in Device Profile that automatically captures every remote session with no manual start/stop controls and no session-length limit; recordings can be stored on the Technician (Viewer) machine, the Host (Endpoint) machine, or both simultaneously, with host recordings defaulting to ProgramData\ScreenRecords; and a new Procedure Scheduler workflow auto-uploads finished recordings to the cloud and deletes local copies to keep endpoints clean.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Export to CSV button on the MDR Tickets page, enabling download of ticket data by selected date range for reporting, audit, and BI platforms.
• Expands the MDR Tickets filter from Subject to Subject / Description, allowing full-text search across ticket bodies.

Identity & Access Management · 2026-10-15

JumpCloud PKI adds cloud-hosted private CA, EAP-TLS Wi-Fi via Cloud RADIUS, VPN/mTLS cert auth, and automated SCEP/MDM delivery for Windows and macOS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JumpCloud PKI: a cloud-hosted private Root CA managed natively in the JumpCloud Admin Portal — no dedicated CA servers required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds EAP-TLS Wi-Fi authentication by pairing JumpCloud PKI certificates with JumpCloud Cloud RADIUS for 802.1X passwordless network access.
• Supports client certificate deployment to compatible VPN gateways (such as FortiGate) and mutual TLS (mTLS) web applications for identity-based access beyond Wi-Fi.

Container & Image Security · 2026-10-15

Kubescape v4.0.16 adds PSS compliance prediction, interactive remediation, image diff, Red Hat Quay scanning, and new MCP tools for AI assistants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --kube-version and --api-versions flags to kubescape scan for accurate Helm chart rendering against a specific Kubernetes API surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --interactive mode to kubescape fix for granular, step-by-step remediation of misconfigurations.
• Adds kubescape diff subcommand to compare image scan reports and surface newly introduced and resolved vulnerabilities.

Exploitation & C2 · 2026-10-15

Merlin Server gains dotnetBin flag to specify a custom dotnet executable path for the SharpGen module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dotnetBin server-launch flag to set a custom file path to the dotnet executable used by the SharpGen module when the .NET SDK is not on the server's PATH (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ $HOME/.dotnet/dotnet from a dotnet-install.sh installation).

Exploitation & C2 · 2026-10-15

Merlin Server v2.2.2 adds -dotnetBin server flag to configure the dotnet executable path at launch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -dotnetBin server-launch flag to configure the path to the dotnet executable (default dotnet, resolved from PATH), giving teamserver operators install-location flexibility without exposing the option to authenticated operators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-10-15

NinjaOne Katana AI brings an agentic AI assistant natively into the platform for device summarization, fix recommendations, and plain-language environment search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Katana AI, a new agentic AI assistant built natively into NinjaOne, that summarizes device health, recent activity, and correlated alerts inline so technicians understand context before starting remediation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables plain-language search across the NinjaOne environment, replacing manual filter-building.
• Provides role-based access controls, per-AI permissions, and a global kill switch so IT leaders control where Katana AI is active down to the individual technician.

Identity & Access Management · 2026-10-15

Nudge Security lets you define custom SSO domains so the browser extension auto-fills SSO provider and enables SSO-based app filtering and auto-approval.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds custom SSO domain configuration via Settings > Browser extension, letting the browser extension recognise logins through those domains and automatically fill in the SSO provider for each app — even without a connected identity provider.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables filtering the app inventory by SSO coverage once custom SSO domains are configured.
• Enables auto-approval of apps that users sign into through a configured custom SSO domain.

Threat Intelligence · 2026-10-15

OpenCTI adds app:max_upload_file_size and app:max_upload_files config keys to cap file upload size and batch count.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds app:max_upload_file_size / APP__MAX_UPLOAD_FILE_SIZE config key (default 1gb) to set the maximum size of a single file uploaded to the platform (files, imports, artifacts); accepts a byte count or a unit suffix (kb, mb, gb) — a larger file is rejected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds app:max_upload_files / APP__MAX_UPLOAD_FILES config key to cap the maximum number of files uploaded in a single request.

Threat Intelligence · 2026-10-15

OpenCTI 7.261014.0 adds custom fields, dashboard variable foundations, enrichment from investigation graphs, and manual security-coverage results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dashboard variables manifest foundations, including a GraphQL API and token resolution, enabling dynamic, parameterized dashboards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Status variable to FINTEL report templates.
• Adds external-ref, object-covered, and result-of ref relationship types to in regards of filters.

AI Runtime Defense & Guardrails · 2026-10-15

Operant Agent Protector adds Agentic Commerce Defenses and Semantic Firewall covering x402, MPP, and AP2 payment protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agentic Commerce Defenses to Operant Agent Protector, evaluating each agent payment attempt — combining task context, paid tool call, MCP server identity, payment destination, amount, and org policy — before forwarding, across the x402, MPP, and AP2 protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces task-aware payment gating that blocks payments when the paid tool call falls outside the agent's assigned task, even when credentials are valid and the amount is within budget.
• Introduces commercial scope controls that let organizations define approved MCP servers, payment networks, assets, and wallet destinations, blocking payments to unapproved destinations regardless of credential validity.

Identity & Access Management · 2026-10-15

Ory v26.4.1 adds FIPS 140-3 container images and Helm chart support for Kratos, Hydra, and Polis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds FIPS 140-3 container images and Helm chart support for Ory Kratos, Ory Hydra, and Ory Polis under Ory Enterprise License releases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-10-15

Peirates v1.1.34 adds kubectl auth checking across all tokens, Azure IMDS identity harvesting, and a JSON pretty-printer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds kubectl-can-i command to check kubectl auth can-i permissions across all stored service account tokens and certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds json-cat command to pretty-print JSON files.
• Adds gathering of Azure managed identity tokens from the Azure Instance Metadata Service (IMDS).

SAST / SCA / Code Security · 2026-10-15

Phoenix Security adds an AWS connector to ingest ECR images, ECS tasks, and EKS telemetry directly into its risk platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Amazon Web Services connector (configured via Integrations › Connectors › Amazon Web Services) that authenticates with an IAM Access Key ID and Secret Access Key to pull container inventory from a specified AWS Region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Detect Base Images From Image Layers option for the ECR capability (also requiring ecr:BatchGetImage and ecr:GetDownloadUrlForLayer) to identify each image's base image from its layer data.
• Adds a Max New Images To Inspect Per Run setting for the ECR capability to cap how many new images are inspected on each collection cycle.

Exploitation & C2 · 2026-10-15

PhoneSploit-Pro v2.4 adds clipboard management features and revamps the CLI landing page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds clipboard management features to the CLI for interacting with a connected device's clipboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Revamps the CLI landing page with consistency improvements across the interface.

CNAPP · 2026-10-15

Plerion adds Sumo Logic integration for findings and audit logs, and refreshes Global CBPR compliance mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Sumo Logic integration that posts to a Sumo Logic HTTP Source, sending workflow-selected findings as they open, change, and resolve, with every open finding resent weekly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables sending tenant audit logs to Sumo Logic in real time via the Send tenant audit logs option on the integration.
• Provides a Sync now action on the Sumo Logic integration to push changes immediately on demand.

General Utilities & Libraries · 2026-10-15

python-pipx: Adds pipx list --outdated with JSON output to show which installed packages have newer versions available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PIPX_COOLDOWN environment variable as a default for --cooldown on install, install-all, inject, upgrade, upgrade-all, and run, so a single release-age policy covers every command; --cooldown 0 opts a single command out.
• Runs reinstall-all, upgrade-all, and install-all across venvs in parallel.
• Defers every import, including dependencies, on Python 3.15 for faster startup; set PYTHON_LAZY_IMPORTS=normal to opt out, with entry point pipx.__main__.

General Utilities & Libraries · 2026-10-15

pipx now documents pipx.run entry point group, shell completion auto-linking via PIPX_COMPLETION_DIR, and pipx_metadata.json detection for package authors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for a pipx.run entry point group in pyproject.toml (under [project.entry-points.'pipx.run']) and setup.cfg (under [options.entry_points] pipx.run) so package authors can declare which function pipx run PACKAGE invokes, taking priority over console scripts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes gui-scripts entry points declared in [project.gui-scripts] (pyproject.toml), gui_scripts (setup.cfg), or entry_points (setup.py) so GUI apps on Windows launch without a console window.
• Auto-links shell completion scripts shipped in share/bash-completion/completions/, share/fish/vendor_completions.d/, and share/zsh/site-functions/ wheel directories under PIPX_COMPLETION_DIR (default ~/.local/share), so completions arrive and leave with the package.

General Utilities & Libraries · 2026-10-15

pipx adds --output json machine-readable envelope output to most commands, enabling scripted pipx workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --output json flag to most pipx commands (install, inject, uninject, expose, unexpose, pin, unpin, upgrade, upgrade-all, upgrade-shared, uninstall, uninstall-all, reinstall, reinstall-all, reset, health, repair, manifest lock, manifest sync, interpreter list, interpreter prune, interpreter upgrade, cache dir, cache purge, and list --outdated) to emit a structured JSON envelope on stdout instead of human-readable text.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Defines a versioned JSON envelope schema with top-level keys pipx_result_version (currently "1"), command, status ("success", "partial", or "error"), exit_code, data, and errors (each error carrying code, message, and optional environment and package fields).
• Errors that occur after argument parsing — including an invalid PIPX_COOLDOWN environment variable, an unresolvable --python, a path or URL where a package name is expected, or --backend uv without a uv executable — are surfaced inside the envelope with status: "error" and code: pipx_error rather than plain text.

General Utilities & Libraries · 2026-10-15

pipx documents all environment variables, including new PIPX_COOLDOWN, PIPX_FETCH_PYTHON, PIPX_DEFAULT_BACKEND, and PIPX_DISABLE_SHARED_LIBS_AUTO_UPGRADE settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sets PIPX_DEFAULT_BACKEND to pip or uv to choose the backend for new virtual environments; defaults to uv when uv 0.9.17 or newer is available, else pip.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Sets PIPX_COOLDOWN to ignore index artifacts uploaded fewer than N days ago across install, install-all, inject, upgrade, upgrade-all, and run; overridden per-command by --cooldown.
• Sets PIPX_FETCH_PYTHON to always, missing, or never to control when pipx fetches a standalone Python build (default: never), and supports PIPX_FETCH_MISSING_PYTHON as a deprecated alias for PIPX_FETCH_PYTHON=missing.

General Utilities & Libraries · 2026-10-15

pipx gains install-all, uninject, expose/unexpose, pin/unpin, manifest, interpreter, cache, health, repair, exec commands plus json output and uv backend support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --upgrade flag (-U) to pipx install to upgrade or downgrade an existing package when its version does not satisfy the supplied spec.
• Adds new subcommands pipx install-all (installs all packages from a spec metadata file generated via pipx list --output json, installing up to eight environments in parallel), pipx uninject (uninstalls injected packages from an existing pipx-managed virtual environment), pipx expose and pipx unexpose, pipx pin and pipx unpin, pipx manifest, pipx interpreter, pipx cache, pipx health, pipx repair, and pipx exec.
• Adds PIPX_GLOBAL_HOME, PIPX_GLOBAL_BIN_DIR, PIPX_GLOBAL_MAN_DIR, and PIPX_GLOBAL_COMPLETION_DIR environment variables for overriding global-mode paths when --global is used, along with PIPX_COMPLETION_DIR for overriding shell completion installation locations and PIPX_MAN_DIR for overriding the manual pages installation location.

General Utilities & Libraries · 2026-10-15

pipx gains health, repair, and reset commands plus --fetch-python, PIPX_MAX_LOGS, and lazy-import controls for Python 3.15⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pipx health command to check every managed environment's Python interpreter without modifying it; exits with status 1 on failure, accepts package names to check a subset, and supports --output json for scripting (unhealthy environments appear in errors with code environment_unhealthy).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds pipx repair command to rebuild broken environments using recorded metadata, with --python to target a specific interpreter; skips healthy environments and refuses pinned packages (run pipx unpin PACKAGE first).
• Adds pipx reset command to wipe all managed packages, shared libraries, caches, standalone interpreters, logs, and trash back to install-time state; supports --yes for scripted use and --dry-run to preview removals.

General Utilities & Libraries · 2026-10-15

pipx gains a uv backend: install with [uv] extra or set PIPX_DEFAULT_BACKEND=uv to replace pip/venv with uv across all commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the --backend flag (accepted by install, install-all, inject, upgrade, upgrade-all, reinstall, reinstall-all, and run) to choose uv or pip per invocation; the PIPX_DEFAULT_BACKEND environment variable to set the backend globally, with pipx auto-selecting uv when uv 0.9.17+ is bundled or found on PATH; PIPX_RESOLVED_BACKEND, inspectable via pipx environment --value PIPX_RESOLVED_BACKEND, to confirm which backend pipx will use for new venvs; and the ability to switch an already-installed app's backend with pipx reinstall NAME --backend uv.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PIPX_COOLDOWN environment variable (and --cooldown DAYS flag) that maps to uv's --exclude-newer P{DAYS}D when the uv backend is active.
• Supports pipx install pipx[uv] extra to ship a bundled uv binary alongside pipx.

General Utilities & Libraries · 2026-10-15

pipx now upgrades and rebuilds up to eight environments in parallel, with safe interrupt handling and ordered output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Upgrades up to eight environments at once via pipx upgrade-all, printing output in environment order; a failed environment does not block the others.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Pass --verbose to pipx upgrade-all to force one-at-a-time execution and see pip/uv output in real time.
• Ctrl-C, SIGTERM, or SIGHUP during a parallel upgrade stops new upgrades from starting, lets in-progress ones finish, flags any environment cut short, and triggers automatic reinstall on the next upgrade or install of that environment.

General Utilities & Libraries · 2026-10-15

pipx 1.18.0 adds parallel multi-env operations, graceful Ctrl-C handling, and Python 3.15 lazy-import startup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Sets PYTHON_LAZY_IMPORTS=normal to disable lazy imports that Python 3.15 uses to accelerate pipx startup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --backend flag to install-all to translate recorded index options between pip and uv backends, refusing environments whose index cannot be carried over.
• reinstall-all, upgrade-all, and install-all now operate on several environments in parallel; pass --verbose to force sequential execution.

Continuous Control Monitoring (CCM) · 2026-10-15

RegScale CLI 6.53.0 adds regscale trust-center evidence push and strict-exit-code failure reporting for eMASS commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds regscale trust-center evidence push subcommand to push JSON evidence to a Trust Center evidence record by its evidence ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• eMASS commands now report failed records under REGSCALE_STRICT_EXIT_CODES, with importers counting failed saves, milestones, custom fields, and role assignments.

MCP Servers & Tooling · 2026-10-15

Runlayer adds per-agent network access policies — allow/block lists enforced at the network layer for every agent sandbox connection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per-agent network access policies with three modes — Unrestricted, Allow list, and Block list — configurable in each agent's settings or via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Writes every connection attempt to the audit log with the run, agent, host, and outcome, without logging sensitive data such as request bodies or credentials.
• Fails closed: if a network policy cannot be enforced, the agent does not run.

MCP Servers & Tooling · 2026-10-15

Runlayer adds enterprise governance for Meta Muse, including a single MCP gateway endpoint, shadow AI discovery, and SIEM-exportable audit logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a single Runlayer plugin endpoint that routes all Muse tool calls through Runlayer's MCP gateway, replacing ungoverned per-connector MCP setups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds shadow AI discovery that detects when Muse is used inside company systems without Runlayer governance and surfaces per-employee activity.
• Adds on-behalf-of authentication for Muse, with employee identity sourced from your IDP via SCIM so Muse acts within that person's permissions only.

SAST / SCA / Code Security · 2026-10-15

Semgrep now integrates with Cursor Origin, scanning every pull request for code vulnerabilities, supply chain risks, and secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cursor Origin as a supported source code manager, installable from Codebase Settings via the Origin marketplace Semgrep app.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Triggers Semgrep Managed Scan on every pull request in Origin repositories, covering Semgrep Code, Semgrep Supply Chain, and Semgrep Secrets, with results posted as checks and comments inline.
• Supports automatic repository sync between Cursor Origin and Semgrep — connect once with no manual re-linking or scripts.

SAST / SCA / Code Security · 2026-10-15

Skill Scanner 2.3.0 maps every finding to Cisco AI taxonomy codes, adds ACTIVE_SENSITIVE_EXFILTRATION detection, and surfaces SYMLINK_NOT_SCANNED and SKILL_LOAD_FAILED findin⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds aitech, aitech_name, aisubtech, aisubtech_name, aitech_mappings, aisubtech_mappings, framework_mappings, taxonomy_status, and taxonomy_source fields to every finding, plus scan_metadata.taxonomy counts and SARIF result properties, mapping to OWASP, MITRE ATLAS, and NIST AML crosswalks from a hash-pinned taxonomy 2.0.0 snapshot bundled with the scanner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new detection ACTIVE_SENSITIVE_EXFILTRATION to catch plain-language instructions that read a local credential file and send it to a remote host.
• Reports symlinks among a skill's files as SYMLINK_NOT_SCANNED findings (HIGH when the target leaves the skill root) and skills that fail to load as SKILL_LOAD_FAILED findings in scan-all, instead of silently skipping them.

SAST / SCA / Code Security · 2026-10-15

Snyk CLI v1.1308.1 adds a Pending Ignore Request status and filter to the Project Issues page, plus API support for pending ignore status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pending as a reportable ignore status in the issues API, enabling programmatic distinction between open, pending, and ignored findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Pending Ignore Request status indicator on the Project's Issues page and in issue details when a finding is awaiting Ignore Approval Workflow review.
• Adds a Pending Ignore filter to the Issues list alongside the existing Open and Ignored filters, so reviewers can triage the pending-approval queue without scanning every issue.

SAST / SCA / Code Security · 2026-10-15

Snyk CLI HTML reports via --html and --html-file-output now available to all users without preview feature flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables --html and --html-file-output flags on snyk test for all users, removing the requirement to opt in to preview features.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Displays the project name consistently in the snyk test summary output when a project name is available.

Software Supply Chain Security · 2026-10-15

Socket for Origin brings automatic dependency scanning and security findings to Origin (Cursor) pull requests via the Origin App Marketplace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Socket for Origin integration in the Origin App Marketplace, enabling automatic dependency scans on Origin pull requests when opened or new commits are pushed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Posts a Socket Security / Dependency scan check on Origin pull requests, showing scan progress, a policy-based verdict, and a link to the full report — with a rerun button directly in Origin.
• Posts PR comments with dependency overviews, scores, severity labels, and report links, updating automatically as the PR changes.

SAST / SCA / Code Security · 2026-10-15

SonarQube Advanced Security adds vulnerability reachability analysis for Java, C#, and Python via call graph analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Surfaces reachability status in the Dependency Risks tab with a Reachability filter and a Reachable badge on individual risk cards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds reachability status to the Detailed Risk view alongside CVSS, EPSS, and KEV data under the What's the Risk? tab.
• Includes reachability status in downloadable dependency risk reports in JSON and CSV formats (Enterprise plan only).

SAST / SCA / Code Security · 2026-10-15

SonarQube Cloud adds bulk import for Azure DevOps and Bitbucket, completing coverage across all four DevOps platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Import all repositories button on the Analyze projects page for SonarQube Cloud organizations bound to Azure DevOps or Bitbucket, enabling a single-action bulk import of every repository in the organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides a real-time progress indicator on the Analyze projects page while a bulk import is running, replacing the previous opaque all-or-nothing wait.
• Generates a downloadable summary report after bulk import completes, listing which repositories were imported, skipped, or failed for an auditable record.

SAST / SCA / Code Security · 2026-10-15

SonarQube Hunter Agent gains OpenAI GPT Cyber Models via Daybreak Defense Network, with GPT-6.1 Sol now available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenAI GPT Cyber Models to SonarQube Hunter Agent via the OpenAI Daybreak Defense Network, enabling deeper agentic security reasoning across codebases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Makes GPT-6.1 Sol available inside Hunter Agent, delivering 67% complete-finding coverage and up to 43% faster scans on large codebases.

Email Security · 2026-10-15

Sophos Email 2026.41 adds an S/MIME Certificate Management API, URL export from quarantine (CSV/PDF), and enhanced custom branding workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the S/MIME Certificate Management API to programmatically manage S/MIME certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds URL export from the URLs tab in Message Details for quarantined messages, available in CSV and PDF formats with basic message details for identification.
• Enhances the custom branding provisioning workflow.

Endpoint Security (EDR/XDR) · 2026-10-15

Sophos Protection for Linux 5.21.0 adds kernel 7.2 support, Kubernetes Secret MCS token injection, and container metadata in XDR process events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Helm charts now support passing the MCS token using a Kubernetes Secret.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• XDR process events include container information and metadata where available.

SAST / SCA / Code Security · 2026-10-15

HawkScan 6.6.0 adds app.openApiConf.basePath and disableServerBasePath config keys to control OpenAPI base path resolution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds app.openApiConf.basePath to stackhawk.yml to explicitly set the API base path HawkScan uses when requesting operations, taking precedence over the host path and spec's servers[].url.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds disableServerBasePath to stackhawk.yml to force HawkScan to request all operations at the root of app.host, even when the spec declares a base path in servers[].url.
• Adds a defined priority order for base path resolution in HawkScan 6.6.0+: app.openApiConf.basePath → path on app.host → spec's servers[].url → root of app.host.

SAST / SCA / Code Security · 2026-10-15

StackHawk: Unresolved ${VARIABLE} references in config now fail the scan with Missing environment variable: VARIABLE; use ${VARIABLE:} to allow empty values.

• The ajax spider now loads each seed path in a browser after the start page, capturing and testing XHR calls and other requests made on load — not just adding routes to the site tree.

SAST / SCA / Code Security · 2026-10-15

HawkScan 6.6.0 adds GitHub-ready SARIF output, Windows CLI installer, OpenAPI base-path awareness, and ajax spider seed-path support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --sarif-ghas flag (SARIF_GHAS env var) that writes stackhawk-ghas.sarif — a SARIF file accepted by GitHub Advanced Security code scanning, with rule IDs keyed by plugin ID, relative request-path locations, and stable fingerprints; upload with github/codeql-action/upload-sarif.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds app.openApiConf.basePath to set the OpenAPI base path explicitly and app.openApiConf.disableServerBasePath: true to suppress automatic base-path detection from servers[] (Swagger 2.0 basePath), preserving prior behavior.
• Adds official hawk CLI installers: on Windows, run irm https://download.stackhawk.com/hawk/install.ps1 | iex in PowerShell or use https://download.stackhawk.com/hawk/install.bat in cmd.exe; on Linux/macOS, run curl -sSf https://download.stackhawk.com/hawk/install.sh | sh with OS/architecture detection; all support HAWK_INSTALL_VERSION and HAWK_INSTALL_DIR env vars for pinning version and install location (default %USERPROFILE%\.hawk\bin on Windows, ~/.hawk/bin on Linux/macOS), and verify SHA-256 before installing.

Email Security · 2026-10-15

Sublime now detects and removes malicious events from shared and delegated calendars, not just primary mailbox calendars.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Delete Calendar Events Action to search all calendars a mailbox has access to, including shared and delegated calendars — not just the primary calendar.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Requires Google Workspace customers to grant the additional read-only OAuth scope https://www.googleapis.com/auth/calendar.calendarlist.readonly so Sublime can enumerate accessible calendars; Microsoft 365 requires no action.
• Automatically applies Delete Calendar Events whenever a Quarantine, Trash, or Move to Spam Action is triggered, covering shared and delegated calendar events in the same pass.

Cloud Security Posture · 2026-10-15

Sysdig Secure adds SIEM forwarding rules to filter by data type, severity, and policy name before sending to downstream platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds forwarding rules to SIEM & Data Platforms integrations, replacing the Data to Send field, with per-rule filters including severity and policy name for Runtime Policy Events and type for Activity Audit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Rules column to the integrations list showing the number of active forwarding rules per integration.

Attack Surface & Exposure Management · 2026-10-15

syzkaller gains RDMA fuzzing support with rxe0 device setup, extended RDMA uverbs descriptions, and faster PatchTest corpus triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables syz_memcpy_off on all architectures in the executor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Sets up an rxe0 RDMA device in init_net for RDMA fuzzing coverage.
• Enables RDMA fuzzing in the syz-cluster net focus configuration.

Digital Forensics & Incident Response · 2026-10-15

Timesketch 20261014 adds OIDC group/role-based access control, Sec-Gemini BYOT log analysis, and an OpenSearch index prefix config option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OPENSEARCH_INDEX_PREFIX config key to namespace OpenSearch indices for new Timesketch installations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Implements Sec-Gemini Bring-Your-Own-Token (BYOT) log analysis support, enabling AI-assisted timeline analysis via the SecGemini LLM provider.
• Adds OIDC Group/Role-Based Access Control with membership sync, enabling identity-provider groups to drive Timesketch sketch permissions.

Non-Human & Agent Identity · 2026-10-15

Token Security adds Attack Path Analysis to visualize multi-hop privilege escalation chains across AWS, Azure, Okta, Entra ID, and GitHub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Surfaces a prioritized, filterable table of discovered attack chains showing source identity, destination resource, severity, number of hops, and environments involved.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides an interactive graph view for each path where identity nodes are labeled by type and environment, edges show attacker actions (such as federated SSO and cross-account role chaining), and a sidebar exposes the findings — unrotated credentials, excessive permissions, missing MFA — that make each hop exploitable.
• Assigns each attack path a severity score based on destination criticality, source identity risk level, administrative access involvement, and exploitability from existing findings.

AI/LLM Security · 2026-10-15

ToolHive v0.54.0 adds Pi coding agent as a supported MCP client and a SPIFFE file bundle source for identity federation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Refreshes upstream tokens automatically when the ID token expires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-10-15

TruffleHog adds focused S3 scanning with prefix/extension filters, OAuth2 for custom verification, and Atlassian scan reliability improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --include-prefix, --exclude-prefix, --include-extension, and --exclude-extension flags to trufflehog s3 (Open Source) to limit scans to specific S3 key prefixes and file extensions, pushing included prefixes into S3 list requests so only matching keys are enumerated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds auth.oauth2 block to custom detector verification config, supporting tokenEndpoint, tokenHeader (optional, defaults to Authorization), and ropc credentials (username, password, clientId, clientSecret, scope) so verification endpoints behind an identity-aware proxy can be reached without exposing them to unauthenticated traffic.
• Jira integrations now validate endpoint reachability and credentials at scan start, failing immediately with a clear error on bad URLs or auth problems rather than stalling.

Hacking Hardware · 2026-10-15

unlshd-094 adds targeted write lists for iButton/RFID, 10+ new SubGHz protocols, Texkom NFC emulation, Seed Capturer app, and two new menu styles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Settings -> Write Blanks list in the iButton app letting users enable/disable individual blank targets (RW1990.1, RW1990.2, TM2004, TM01x) so a write only attempts the selected types; choice is saved and honoured by the iButton CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Settings -> Write Chips list in the 125 kHz RFID app letting users enable/disable individual chip targets (T5577, EM4305, Hitag micro / ID82xx variants 8265, 8210, H5.5) so a write skips unselected chips; choice is saved and honoured by the rfid CLI.
• Adds ID82xx (F8268, 8211 and relatives) china clone Hitag S chip as an EM4100 write target in the 125 kHz RFID app and rfid CLI; disabled by default — enable via Settings -> Write Chips (8268) to use.

Compliance Automation & Trust Management · 2026-10-15

API surface changed: +13 endpoints, 7 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /frameworks/{frameworkId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new endpoints for managing risk-scenario mappings: DELETE /risk-scenarios/{riskScenarioId}/mappings/accounts, DELETE /risk-scenarios/{riskScenarioId}/mappings/custom-assets, DELETE /risk-scenarios/{riskScenarioId}/mappings/integrations, DELETE /risk-scenarios/{riskScenarioId}/mappings/issues, GET /risk-scenarios/{riskScenarioId}/mappings/accounts, GET /risk-scenarios/{riskScenarioId}/mappings/custom-assets, GET /risk-scenarios/{riskScenarioId}/mappings/integrations, GET /risk-scenarios/{riskScenarioId}/mappings/issues, POST /risk-scenarios/{riskScenarioId}/mappings/accounts, POST /risk-scenarios/{riskScenarioId}/mappings/custom-assets, POST /risk-scenarios/{riskScenarioId}/mappings/integrations, and POST /risk-scenarios/{riskScenarioId}/mappings/issues.

Data Security & DLP · 2026-10-15

Varonis adds scope controls to limit LLM-based classification to designated services and accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scoped configuration for LLM-based classification, letting you select specific services and accounts for AI processing across structured, semi-structured, and unstructured classification workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-15

Varonis applies Data Concentration to database tables, grouping by schema and classifying up to 10 representative tables per group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Data Concentration to database table classification, grouping tables with the same schema and classifying up to 10 representative tables per group to reduce repetitive scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-15

Varonis adds automated Databricks column-level data masking, with centralized coverage visibility and policy-driven remediation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automated Databricks column-level data masking, enabling masking to be enabled or disabled directly from Varonis policy automation workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides a centralized view of Databricks masking coverage by synchronizing each column's effective masking state and tagging columns as masked or unmasked.

Data Security & DLP · 2026-10-15

Varonis adds CSV export of scoped database instance sizes in bytes, MB, and GB for capacity planning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exports scoped database instance information — including sizes in raw bytes, MB, and GB — directly to CSV for capacity planning and reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-15

Varonis now shows Snowflake database sizes in Investigation views, exportable to CSV in bytes or MB/GB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes Snowflake database size metadata in Investigation views, exportable to CSV in both raw bytes and human-readable MB/GB units, to support capacity planning and reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-15

Varonis adds configurable scan ratios to balance collector capacity between initial discovery and incremental scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds configurable scan ratios to control how local collector processing capacity is split between initial discovery and incremental scans, with a balanced 50/50 default allocation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-15

Varonis lets you configure private container repositories directly in the collector deployment UI, auto-populating the generated Helm chart.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables configuration of private container repositories directly from the collector deployment UI, with repository details automatically incorporated into the generated Helm chart.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-15

Vuls v0.42.0 adds Windows 11 26H2 scanning support and expands Fortinet CSAF coverage with three new RangeType values.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands Fortinet CSAF vulnerability data with three new RangeType values: fortinet-fortisiem_cloud, fortinet-fortimonitoronsight, and fortinet-fortipam_chrome_extension.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-10-15

Wiz AI Agents now available in Wiz for Gov (FedRAMP High), enabling autonomous and human-in-the-loop remediation for U.S.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ public sector.

• Wiz AI Agents are now available within Wiz for Gov, the FedRAMP High authorized environment, bringing AI-driven risk remediation to U.S.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ public sector organizations handling sensitive and mission-critical data.
• Wiz AI Agents offer configurable operational boundaries, allowing security teams to authorize agents to execute routine remediations autonomously or require human-in-the-loop approval before applying changes on sensitive systems.

Runtime Security · 2026-10-15

Wiz Defend gains Blue Agent for automated threat triage and Red Agent for continuous runtime attack-path mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Wiz Blue Agent, which automatically triages threats that fire in Wiz Defend, generating an investigation summary and severity verdict to reduce MTTA and MTTR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Wiz Red Agent, which continuously analyzes live production environments to map multi-step attack paths and prioritize exploitable risk combinations before they are exploited.

Endpoint Security (EDR/XDR) · 2026-10-15

XFA Desktop Application now supports NixOS, installable via system flake with automatic updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds NixOS support for the XFA Desktop Application, installable via system flake with nix flake update xfa fetching the latest release and the running XFA switching over automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-15

Zscaler Client Connector 5.0 debuts a modernized UI with custom branding and granular per-notification admin controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds granular notification control in the admin portal, letting administrators configure the visibility and persistence of each individual notification per solution and per category (service status, app update, and more), with different settings per supported operating system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces optional custom branding for Client Connector so organizations can tailor the agent UI to match internal applications and company identity.
• Delivers a modernized Client Connector UI in version 5.0 that surfaces clear service-status feedback by default while retaining access to advanced details and a fallback to the classic UI.

Identity & Access Management · 2026-10-14

1Password Environments now accessible via local .env file mount or op run --environment CLI flag across all platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports accessing project secrets stored in an Environment via a locally mounted .env file (Mac, Linux) — contents are not tracked by Git or stored on disk.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds op run --environment <environmentID> -- <command> to inject Environment secrets as environment variables scoped to a subprocess for the duration of the process.
• Enables reading project secrets from Environments in code via 1Password SDKs.

Identity & Access Management · 2026-10-14

1Password CLI 2.41.0 adds --environment flag to op run for loading secrets from 1Password Environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Reduces op run --environment network requests from 6 to 4, improving performance for environment-based secret injection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Non-Human & Agent Identity · 2026-10-14

Aembit adds MCP user session management, expanded MCP auth methods, and inline Dynamic/Literal value validation for Credential Providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Sessions tab to each Identity Provider in the Aembit Tenant UI, listing active MCP user sessions with the ability to filter, revoke individual sessions, or revoke all sessions for a user or MCP client at once.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Prompts to revoke active sessions when deleting an Identity Provider that has sessions tied to an OIDC ID Token Credential Provider with Enable Refresh Token Support turned on.
• MCP Server Workloads now support all authentication methods available to HTTP Server Workloads, including API Key, HTTP Authentication with the Basic scheme, and Static HTTP Headers.

Non-Human & Agent Identity · 2026-10-14

General Utilities & Libraries · 2026-10-14

bpf-linker v0.12.0 adds Linux RISC-V binary releases and fixes extern symbol internalization with proper section info.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pre-built Linux RISC-V binaries to the release distribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Preserves extern definitions from internalization and emits proper section info during linking.

Exploitation & C2 · 2026-10-14

Bugcrowd adds a POST /scan_configurations/{id}/scan_executions endpoint to trigger Savant Pathseeker tests from CI/CD pipelines and APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /scan_configurations/{id}/scan_executions endpoint (API v1.2.0) to start an existing Pathseeker test programmatically using its saved targets, credentials, and settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds trigger_source label field on API-triggered runs to record the origin (e.g., github-actions) alongside the token owner and timestamp for full run traceability.
• Adds Allow API-triggered runs option in Pathseeker test setup, which surfaces a Configuration ID used to reference the test in API calls.

Attack Surface & Exposure Management · 2026-10-14

Censys adds PQC key exchange fields on host/web endpoints, Splunk integration v1.2.0 with host enrichment API, and Sentinel log ingestion API support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds key_exchange_group and pqc_groups fields to host services and web property endpoints, exposing post-quantum cryptography (PQC) key exchange group data including ML-KEM (Kyber) and hybrid exchanges like X25519MLKEM768.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Censys Splunk Platform integration v1.2.0 adds support for the get host enrichment API endpoint, configurable as the default instead of the get host API endpoint.
• Censys Splunk Platform integration v1.2.0 adds a workflow action and a custom command for related infrastructure data.

Container & Image Security · 2026-10-14

Chainguard adds chainctl skills verify and --verify flag to confirm Sigstore-signed agent skill provenance before install or pull.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chainctl skills verify subcommand to confirm a Chainguard-signed agent skill's Sigstore bundle against the owning organization's SKILLS identity, accepting a tag or digest reference and outputting results in table or JSON (-o json) format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --verify flag to chainctl skills pull and chainctl skills install to check the skill's signature on the exact fetched digest before writing any files or symlinks to disk; a non-verified result exits nonzero and writes nothing.
• Adds --allow-unverifiable-host flag alongside --verify to accept skills from staging or development registries (not skills.cgr.dev) with a warning rather than a hard failure.

Container & Image Security · 2026-10-14

Chainguard Actions and Compliance Dashboard hit GA; Guardener AI migration agent launches in Early Access with 17 new images added.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Launches Chainguard Actions (GA) with 1,000+ continuously hardened, drop-in replacements for GitHub Actions, including pinning of transitive action dependencies and a Hardening.md report per action listing removed vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds self-serve action requests via Chainguard Actions with a one-business-day SLA and automated migration through the Chainguard App or migration skill.
• Launches the Chainguard Compliance Dashboard (GA) in the Chainguard Console, providing a centralized view of container compliance, vulnerability posture, and audit-ready reporting with continuously logged image attestations and real-time CVE status.

Reconnaissance & OSINT · 2026-10-14

cloudlist v1.5.0 adds auto-discovery, OVH DNS, keyless AWS auth, 20+ new resource types across 8 providers, and an exclude_services filter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -auto-discovery flag to automatically detect and enumerate AWS, GCP, Azure, and Kubernetes using ambient environment credentials — no provider config file required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds exclude_services filter (-es / -exclude-service) to skip specific services for a provider during enumeration.
• Adds AWS keyless authentication via IRSA and EC2 instance profiles, removing the need to store long-lived credentials in provider-config.yaml.

SIEM · 2026-10-14

Databricks adds a Data Science Agent that builds entire notebooks — EDA, forecasting, ML — from a single chat prompt.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Data Science Agent that orchestrates multi-step notebook workflows from a single prompt, supporting tasks like EDA, forecasting, and machine learning from scratch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-14

Google Gemini 4 Argon is now accessible via Databricks Foundation Model APIs on Unity Gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Google Gemini 4 Argon model support on Unity Gateway, accessible through Foundation Model APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-14

Databricks GA: resize shuffle partitions in stateful Structured Streaming or Lakeflow pipelines without losing checkpoint state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports on-demand state repartitioning for stateful Structured Streaming queries and Lakeflow pipelines, allowing the number of shuffle partitions to be resized without losing checkpoint state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-14

Context-based ingress policies for inbound Private Link reach GA, letting admins combine VPC endpoint rules with identity and request-type conditions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the Context-Based Ingress: Workspace Private Access Policies feature via the account console Previews page for accounts where it is not yet active.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-10-14

Decepticon v1.4.3 adds mid-session mode switching via /mode plan, /mode red, and /mode blue, and streamlines engagement creation to name-only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /mode plan, /mode red, and /mode blue commands to switch conversations during a running session, preserving each mode's thread, pending question, and paused checkpoint; failure to pause keeps the original mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds /mode red approve to grant execution permission for Red operations against the validated Plan scope.
• Adds /resume command to reopen a paused question after escaping with Escape to enter commands.

Secure Access (VPN / SASE / ZTNA) · 2026-10-14

Unblock Request Form now displays in Spanish, French, and German; branded subdomains move from .app.dnsfilter.app to app.dnsfilter.io⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Block page Unblock Request Form now displays in Spanish, French, and German based on the user's browser language setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Managed branded subdomains migrate from .app.dnsfilter.app to app.dnsfilter.io; existing subdomains carry over automatically.

Software Supply Chain Security · 2026-10-14

Endor Labs extends Threat Center detection and Package Firewall blocking to VS Code extensions, stopping malicious installs and poisoned updates before they reach developer w⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Threat Center malicious-package detection to the Visual Studio Marketplace, covering VS Code extensions alongside npm, PyPI, Go, Maven, and NuGet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends Package Firewall blocking to VS Code extensions, preventing unsafe versions from appearing in the VS Code marketplace and blocking unsafe extensions installed through the command line.
• Adds three Package Firewall policy controls for VS Code extensions: Malware (block versions identified as malicious), Minimum package age (hold back new versions until vetted), and Exceptions (always-allow list for trusted extensions).

WAF, Bot & API Protection · 2026-10-14

Fastly adds AI agent setup support via the Fastly Agent Toolkit and MCP server for Claude Code, Codex, and Cursor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports AI coding agents (Claude Code, Codex, Cursor) via the Fastly Agent Toolkit for command-capable agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Fastly MCP server for AI agents that cannot run commands directly.

WAF, Bot & API Protection · 2026-10-14

Fastly Terraform Provider (beta) 0.2.3 adds five new resource types and optional service_id filtering for List Resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds optional service_id filtering to service-scoped Terraform query List Resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds fastly_service_request_setting explicit/default resource with Terraform query support.
• Adds fastly_service_response_object explicit/default resource with Terraform query support.

Reverse Engineering · 2026-10-14

Reverse Engineering · 2026-10-14

Finite State adds a version-comparison endpoint and parallel project permission loading to accelerate Finding triage and Component review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId} to compare two Versions of a Project, returning Findings introduced, no longer present, or changed, and Components added, removed, or changed version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Loads Project details and permissions together on GET /api/public/v0/projects in parallel, eliminating the serial wait between the two fetches.

Secure Access (VPN / SASE / ZTNA) · 2026-10-14

Linux GUI 1.5.19 replaces the disconnection alert with a notification and shows device pools in the resource list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Replaces the Firezone disconnected alert with a notification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Shows device pools in the resource list instead of all connected devices in one view.

SAST / SCA / Code Security · 2026-10-14

GitHub Apps gain two new fine-grained permissions, offline_access support, cross-app visibility, and a dedicated Credentials tab.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds repository_creation:write fine-grained permission for GitHub Apps and fine-grained PATs, allowing repository creation without the broader repository_administration:write permission.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds installation_repositories:write repository-level fine-grained permission, allowing GitHub Apps and fine-grained PATs to add or remove a repository from any installation in the organization via the Add/Remove a repository to an installation APIs (previously only the coarse-grained repo scope was supported).
• Supports the offline_access scope for GitHub Apps, enabling gradual migration to short-lived rotating tokens by issuing a refresh token alongside the expiring access token without forcing all users to switch simultaneously.

SAST / SCA / Code Security · 2026-10-14

Gemini 4 Argon is now generally available in GitHub Copilot for complex coding, agentic, and reasoning tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Gemini 4 Argon to the GitHub Copilot model picker, available to Copilot Pro+, Max, Business, and Enterprise users across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot coding agent, GitHub Copilot app, JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Copilot Enterprise and Business administrators can manage access to Gemini 4 Argon via the model policy in Copilot settings, with new models automatically enabled under the default model enablement policy unless the global default is off or the model is explicitly disabled.

SAST / SCA / Code Security · 2026-10-14

GitHub audit log gains two new events for Code Quality finding dismissals and reopenings, queryable via API on Enterprise Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds repo.code_quality_findings_dismissed audit log event, recording who dismissed one or more backlog Code Quality findings, when, the repository and rule, and the identifiers and count of affected findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds repo.code_quality_findings_reopened audit log event with the same metadata for reopened backlog findings.
• Enables retrieval of both new events via the audit log API on GitHub Enterprise Cloud.

SAST / SCA / Code Security · 2026-10-14

GitHub secret scanning adds Salesforce as a partner, detects Anthropic and Cloudsmith keys, and blocks Anthropic keys by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds salesforce_marketing_cloud_api_oauth2_token detection via a new Salesforce secret scanning partnership, automatically forwarding found secrets to Salesforce for revocation in public repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds detection of anthropic_service_api_key and anthropic_user_api_key secret types, generating alerts in both public and private repositories.
• Adds detection of cloudsmith_api_key, generating alerts in public and private repositories.

SAST / SCA / Code Security · 2026-10-14

GitHub Copilot enterprise managed settings gain force-refresh on startup and minimum client version enforcement for the sandbox key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds forceRemoteSettingsRefresh setting (supported in server-managed, MDM-managed, and file-based delivery) to require Copilot clients to fetch current server-managed settings at startup rather than using a cached policy, failing closed if current policy cannot be confirmed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enforces a minimum required client version on the sandbox managed settings key, forcing users pinned to older Copilot client versions to update before Copilot will run.

SAST / SCA / Code Security · 2026-10-14

Dependabot alert webhooks gain a withdrawn action and the REST API now returns 410 Gone for withdrawn alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a withdrawn action to the dependabot_alert webhook event, with a payload containing the alert number, GHSA and CVE IDs, package, and manifest path captured before removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• REST API requests to get or update a withdrawn Dependabot alert now return 410 Gone instead of 404 Not Found, allowing callers to distinguish withdrawn alerts from alerts that never existed.

SAST / SCA / Code Security · 2026-10-14

GitHub billing Budgets and alerts page gains search and filter by scope, product, SKU, and user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds search and filter to the Budgets and alerts billing page, letting you find budgets by scope, product, or SKU without paginating through the full list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds user-level budget search in enterprises and organizations, so you can look up which budget applies to a specific user.
• Adds a Scope menu to narrow the budget list to a single scope, such as organizations or cost centers.

SAST / SCA / Code Security · 2026-10-14

GitLab 19.4 adds MCP server governance, Slack integration, /goal CLI command, and broad MCP tooling for CI/CD, MRs, repos, and work items.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /goal <task> slash command to GitLab Duo CLI (requires GitLab 19.3+ and GitLab Duo CLI 9.17.0+) to delegate open-ended objectives to a governed, goal-driven local flow with pause, update, and redirect controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new MCP server tools across several areas: save_pipeline and get_job for CI/CD (trigger, retry, cancel pipelines and retrieve job metadata with trace logs); save_merge_request, get_merge_request, save_merge_request_review, and accept_merge_request for the full merge request loop (diff/conflict/approval inspection and line-level review comments); list_projects and get_user for project discovery and user lookup for assignment and mentions; list_repository_tree, list_tags, list_releases, get_commit, list_commits, add_commit, and fork_repository for browsing repositories, reading history, and proposing changes; and get_work_item, list_work_items, save_work_item, and save_note for issues, epics, tasks, incidents, objectives, and key results, including commenting and replying in discussion threads.
• Renames semantic_code_search MCP tool to semantic_search and adds a scope parameter (currently accepts code only) for future content-type expansion.

SAST / SCA / Code Security · 2026-10-14

GitLab adds goal-driven flows, Custom Flows, and Slack-triggered agent orchestration to Duo Agent Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /goal slash command in Duo CLI and duo run --goal in headless mode to start goal-driven flows that run review, tests, security scans, and approvals as one connected sequence until a defined objective is met.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds @GitLab mention support in Slack channels and threads via GitLab for Slack, letting teams trigger flows (e.g. fix a failing pipeline, create an issue) directly from a conversation.
• Adds Custom Flows to chain agents into multi-step sequences triggered by GitLab events (mention, assignment, or pipeline) and run them in CI/CD pipelines, including human-in-the-loop checkpoints.

SAST / SCA / Code Security · 2026-10-14

GitLab adds open-weight model hosting, Orbit context graph, Impact Analytics, and per-user credit caps to Duo Agent Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Model Selection > Manage Models admin setting in top-level group GitLab Duo settings to pin a specific model (e.g., GLM 5.3, Kimi K3, MiniMax M3) to each Duo feature, controlling which models team members can use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces three GitLab-managed open-weight models — GLM 5.3, Kimi K3, and MiniMax M3 — hosted in Duo Agent Platform as lower-cost alternatives to frontier models.
• Introduces GitLab Orbit, a lifecycle context graph mapping code, work items, merge requests, pipelines, deployments, and security findings into a single queryable graph to reduce agent retries and token consumption.

SAST / SCA / Code Security · 2026-10-14

GitLab next-gen SCM (private beta) delivers agent-native Git interfaces with up to 50x faster workloads and 1,000x less network traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces next-gen SCM architecture with agent-native interfaces that let agents request specific files and history without cloning entire repositories, reducing per-invocation data transfer from 5–10 GB to a fraction of that.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Delivers stateless compute scaling horizontally against shared object storage, supporting thousands of concurrent agents working against large monorepos.
• Supports deployment on GitLab.com and on S3-compatible storage in customer-controlled infrastructure, including air-gapped data centers, preserving data sovereignty.

Secrets Detection & Management · 2026-10-14

Infisical v0.166.6 adds MSSQL PAM discovery, Palo Alto Networks cert sync, OpenRouter workspace support, and Chef encrypted data bag sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MSSQL discovery for Privileged Access Management (PAM), enabling automated detection of MSSQL database credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Palo Alto Networks app connection and certificate syncs via the PKI sync subsystem.
• Adds workspace support for OpenRouter secret rotation.

Identity & Access Management · 2026-10-14

JumpCloud adds REST APIs for AI Agent identity management and a Custom Messaging system for User Portal login dialogs and banners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds REST APIs (Agents API and Agent Groups API) to register, retrieve, update, suspend, activate, and delete AI Agent identities, manage agent credentials, manage Agent Groups, and handle group memberships and application assignments programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-10-14

v0.1.4 adds gRPC server reflection, operator-only credential retrieval, stable credential placeholders, CLI label management, TypeScript log streaming, and Python sandbox sta⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds gRPC server reflection (v1 protocol) to the gateway, enabling grpcurl -plaintext localhost:18080 list and schema introspection without supplying proto files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds operator-only provider credential retrieval so privileged identities can fetch provider credentials without exposing them to sandbox workloads.
• Adds createdAtMs field to SandboxRef in the TypeScript SDK for millisecond-precision sandbox creation timestamps.

Identity & Access Management · 2026-10-14

Ory Network v26.4.0 adds TraceID to live event stream payloads for cross-event request correlation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Live event stream payloads now include a TraceID key in eventAttributes, enabling correlation of all events belonging to a single request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-14

Plerion adds APEC Cross-Border Privacy Rules (CBPR) System Program Requirements as a new compliance framework mapping to AWS, Azure, GCP, and Kubernetes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The APEC CBPR framework is off by default and must be enabled from Compliance under Manage frameworks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.1284 adds single-grant fetch to the Session Grants API, expands Detect to cover 15 new vendor coding agents, and enables agent thread replies without @mention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands AI Watch Detect to inventory MCP servers from configs for Mistral Vibe, Atlassian Rovo Dev CLI, Snowflake Cortex Code, Command Code, Letta Code, Blackbox CLI, Poolside's pool, Rowboat, Eigent, and Verdent, and reports Cline Desktop, CodeRabbit CLI, Google Jules Tools, Docker Agent, and Qodo CLI when installed.
• Extends AI Watch Detect on Windows hosts with WSL to read per-user MCP config files from inside WSL distros for clients such as Gemini CLI, GitHub Copilot CLI, OpenCode, Kimi Code, Junie, and Kilo Code.
• Enables agents to answer replies to their own Slack posts (for example, scheduled-run updates) without an @mention when Thread follow-ups is set to Anyone in the thread.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.1271 adds bot thread monitoring, headless OAuth via --no-browser, new API endpoints for webhooks, routing rules, and a DoorDash connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds runlayer run --no-browser flag for headless OAuth, letting you authorize local HTTP/SSE connectors on a browserless host and complete login with curl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a GET endpoint to read a single agent webhook by its ID; webhook creation now returns fields at the top level of the response (nested webhook object still returned for existing integrations).
• Adds API support for setting a routing rule's evaluation position when creating or updating it, enabling automation to manage LLM gateway rule order one rule at a time.

MCP Servers & Tooling · 2026-10-14

Runlayer: Adds runlayer_plugin Terraform resource to define plugins with their connectors and skills as code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds runlayer_agent_schedule Terraform resource to deploy an agent's cron schedules alongside the agent itself.
• Adds a new endpoint to return a single LLM gateway usage rule by ID.
• Adds a new endpoint to fetch a single LLM gateway virtual key by ID (secret shown only at creation).

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.1158 adds Slack bot filtering, Deploy autoscaling via infrastructure.scaling, AI Watch browser-extension and Office add-in detection, and signed support-acces⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds infrastructure.scaling config to run Runlayer Deploy MCP servers as multiple replicas — fixed count or CPU/network autoscaled — with each MCP session pinned to one replica.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds DEBUG_OPS_REQUEST_SIGNING_JWKS environment variable (Kubernetes runlayer-app Secret) and debug_ops_request_signing_jwks Terraform input (ECS) to supply Runlayer's trusted public signing keys for signed, encrypted diagnostic support-access requests.
• Adds long-lived API keys for agent accounts, creatable from the Manage API keys menu, usable on the MCP gateway in place of the client credentials flow — unavailable when Require DPoP, Strict mode, or Enforce audience is on.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.1115 adds agent inventory bulk management, artifact folders, hook daemon on by default, and new AI client detections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds artifact folder organization: the folder option on create_artifact and new set_artifact_folder tool let agents file published artifacts into nested folder paths using / separators, and the UI adds a Move to folder action on an artifact's menu with /-separated nested paths browsable from the Artifacts page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a per-user hook daemon enabled by default on enrolled macOS and Windows devices, giving Claude Code, Codex, and other hook-driven clients faster hook responses without spawning a new process on every call, plus a new aiwatch daemon status command to verify it.
• Adds Inventory tab to the Agents page, listing every editable agent with owner, model, recent runs, and upkeep issues (idle, never run, newer model available, owner left), with bulk model-upgrade and bulk-disable actions; replaces the Unused tab.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.1078 adds a GET /api/v1/agents/metrics/usage feed and MCP tools for agent usage reporting, plus faster Monitor-mode hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /api/v1/agents/metrics/usage endpoint to pull every agent's creator, consumers, sharing, and token and cost usage into a BI tool or data warehouse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds get_agent_usage_report and list_agent_usage_consumers tools to the Runlayer MCP so AI clients can query agent usage directly.
• Reduces latency in AI Watch Monitor mode by delivering tool-call hook answers before output scanning runs, so coding-agent sessions no longer block on scanner latency per tool call.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.1073 adds scoped AI Watch policy rules API, plugin-scoped agent tokens, allowed-agent controls, and Island Enterprise Browser support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the /ai-watch/policy-rules API to set AI Watch mode, session capture, browser controls, detection phases, and scan bounds per team, group, user, or device without a separate deployment (device rules override user rules, which override team and group rules), plus GET /ai-watch/policy-rules/check?device_id=… to preview the effective AI Watch policy a specific machine receives before applying changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds plugin-scoped agent on-behalf-of tokens by passing a plugin's MCP URL as resource, restricting the token to that plugin's endpoint only.
• Adds an Allowed agents section on an agent's detail page so each user of a shared agent can choose which agents it may hand work to on their behalf, and adds an Approve always option on agent handoff prompts in the web app, Slack, and Microsoft Teams, which adds the agent to Allowed agents so future handoffs skip the approval prompt.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.1019 adds in-chat voice input, agent handoff approvals, and Bedrock connection validation with model selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bedrock:ListFoundationModels, bedrock:ListInferenceProfiles, and bedrock:GetFoundationModelAvailability IAM permissions to AWS Bedrock provider setup, enabling Validate connection to check the role and list only the models your account has enabled in that Region.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds agent handoff approvals: when in a conversation, an agent hands work to another agent only after you approve, showing the target agent and owner, the task it will send, and the agent's summary of what it shares and expects back.
• Adds in-chat voice input — click the microphone in the message box, speak, then click stop; Runlayer transcribes the recording into the message box using your workspace's OpenAI provider.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.991 adds agent-to-agent handoffs, Cursor billing integration, named env-var inheritance for local MCPs, and a delegation review policy template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GH_TOKEN, NODE_OPTIONS, and other named environment variables to the inherit list on a local stdio connector so runlayer run copies each user's shell values into the MCP process without storing the values server-side.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Can hand work to other agents toggle in agent settings to control whether an agent can discover and delegate tasks to other agents.
• Adds a Review agent delegation policy template under Policies so workspaces with approval policies can require approval for every agent-to-agent run, including scheduled ones.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.979 adds interactive agent cards, PagerDuty triggers, MCP schedule/trigger/webhook editing, private artifact previews, and agent failure analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds rl_session_id to the list_audit_logs MCP tool for fetching a single session's audit activity without paging the full window, and group_by=actor to get_agent_token_usage, returning an Other actors row for everyone past the top 30 so per-person spend always totals to the org.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds update_agent_schedule, update_agent_trigger, and update_agent_webhook MCP tools to edit existing schedules, triggers, and webhooks in place — preserving webhook URLs.
• Adds PagerDuty triggers so agents can start when a PagerDuty incident is triggered, acknowledged, reassigned, or has its priority changed.

MCP Servers & Tooling · 2026-10-14

Invisible character detection splits into per-category actions (Allow/Alert/Mask/Block) overridable per connector, client, or tool.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Splits invisible character detection into distinct categories — Hidden characters, ANSI colour codes, Control characters, Isolated zero-width characters, C1 control characters, and Encoded hidden text — each configurable with its own action (Allow, Alert, Mask, or Block).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new ANSI colour codes category (allowed by default) so colourised output from tools like git, lefthook, and pytest no longer triggers detection events.
• Adds three opt-in strict categories — Isolated zero-width characters, C1 control characters, and Encoded hidden text (covering Unicode tags, invisible operators, unbalanced bidi isolates, and dense zero-width sequences) — all allowed by default so nothing new fires until explicitly enabled.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.943 adds agent web browsing, SkillGuard security scoring, MCP team listing, and Kubernetes operator enhancements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds RunlayerInstance.spec.extraEnv to the Kubernetes operator CRD to append environment variables to every backend-image workload (backend, worker, migration job, consumers) for settings the CRD has no dedicated field for, and introduces OpenTelemetry collector sidecar health metric export — queue depth, send failures, and receiver refusals — published to endpoints named runlayer-* using protocol: http.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds list_teams tool to Runlayer MCP for listing workspace teams.
• Extends list_agents in Runlayer MCP to filter by drafts, tags, disabled status, team, and All Workspace, and to sort by name, last used, or run count.

MCP Servers & Tooling · 2026-10-14

Org LLM budget now enforces spend limits across agent runs and virtual keys, not just devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends the organization usage rule's total budget to cover agent runs and virtual keys, halting both at the LLM gateway once the budget is exhausted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Uninstalling AI Watch on macOS and Windows now removes LLM routing from Claude Code and Codex managed settings, returning retired devices to their normal provider.

MCP Servers & Tooling · 2026-10-14

Shadow AI dashboard drill-downs now link to filtered Detail tables with shareable URLs, and MCP gains artifact custom-link management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Clicking a row on a Shadow AI dashboard card (skill risk level or managed connector) now opens the Details table with matching filters applied.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Details table filters are persisted in the page URL, enabling shareable filtered views and a functioning Back button that returns to the originating dashboard tab.
• Assistants and agents can now set, change, or remove an artifact's custom link, and open an artifact from its custom link, through Runlayer MCP.

MCP Servers & Tooling · 2026-10-14

Runlayer 1.28.902 adds artifact view analytics, custom artifact links, editable LLM Gateway routing rules, Slack DMs from any agent run, and AI-generated agent icons.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds enable_channels=["slack"] parameter to the create_agent MCP tool to opt in to Slack app creation; agents created without it no longer receive a Slack app or slack_app_created event, and Slack can be added later via update_agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds RUNLAYER_HAPPY_EYEBALLS=0 environment variable to restore previous per-IP connect behaviour for AI Watch hooks when the network path to Runlayer is unavailable.
• Adds an artifact views counter in the artifact header showing who opened it and whether they arrived from Runlayer, Slack, or an MCP client, plus an org-wide Artifacts tab in Analytics for admins showing the most viewed artifacts.

Attack Surface & Exposure Management · 2026-10-14

Attack Surface & Exposure Management · 2026-10-14

SIEM · 2026-10-14

Splunk Cloud Platform gains OpenAPI-based Configuration Management REST API endpoints for managing instance configurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenAPI-specification-based Configuration Management API REST endpoints to create and update Splunk Cloud Platform instance configurations, complementing the existing standard REST API methods.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-14

New Sumo Logic app for Google Workspace Activities adds predefined dashboards for Gmail, Drive, Calendar, Meet, Gemini, and security activities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Sumo Logic app for Google Workspace Activities, collecting audit events via the Google Admin SDK Reports API to monitor user and administrator activity across Google Workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides predefined dashboards for Gmail, Drive, Calendar, Meet, and Gemini productivity services, plus security, identity, and administration activities.

Secure Access (VPN / SASE / ZTNA) · 2026-10-14

Tailscale Aperture adds Claude Sonnet and Opus 5.5 model support with subscription passthrough for API keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds claude-sonnet-5-5 and claude-opus-5-5 as supported models in Aperture provider configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports subscription passthrough providers so users can supply their own API key via provider config rather than using shared keys.

Secure Access (VPN / SASE / ZTNA) · 2026-10-14

Tailscale Kubernetes Operator v1.104.1 adds shared Let's Encrypt account keys, custom PeerRelay UDP ports, and DNS image pull secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TS_SERVE_ALLOW_ALL_INTERFACES environment variable set automatically on proxies for Ingress resources annotated with tailscale.com/experimental-forward-cluster-traffic-via-ingress, keeping them reachable from inside the cluster after Tailscale Serve on Linux narrowed its listening interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds nameOverride and fullnameOverride values to the operator Helm chart to customize the names of installed resources.
• Ingress ProxyGroups can now share a single persistent Let's Encrypt account key per tailnet to maintain rate-limit exemptions across certificate renewals.

Attack Surface & Exposure Management · 2026-10-14

AI/LLM Security · 2026-10-14

ToolHive v0.53.0 adds group-based upstream filtering in authserver-config.yaml for the vMCP embedded auth server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• MCPServer.spec.permissionProfile is deprecated; the Kubernetes operator now ignores it, emits a PermissionProfileUnsupported Warning event on MCPServers that set it, and thv export --format k8s no longer emits the field — use podTemplateSpec security contexts and NetworkPolicy resources instead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-14

Service Gateway 3.0.35 expands appliance logs with service network diagnostics and improves upgrade history tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Improves appliance upgrade history visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-14

Generic Caching Service 1.0.8 adds appliance-managed certificate bundle support for custom certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports appliance-managed certificate bundle for custom certificate configuration in the Generic Caching Service.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-14

Trend Vision One agent gains macOS Golden Gate (27.0+) support for Standard Endpoint Protection and XDR/EDR deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports deploying the Trend Vision One agent to macOS Golden Gate (27.0 and later) endpoints, including Standard Endpoint Protection and XDR for Endpoint (EDR) features.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-14

Trend Vision One unifies Data Source and Log Management and Third-Party Integrations into a single Data Sources and Connectors hub.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Data Sources and Connectors, a unified hub replacing the separate Data Source and Log Management and Third-Party Integrations capabilities, accessible under Agentic SIEM & XDR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-14

Upwind integrates with Cursor Origin to scan every pull request and branch push, delivering findings as PR comments, checks, and console alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Installs the Upwind app from the Upwind console under Components > Integrations > Origin to connect to Cursor Origin and begin repository scanning in seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Scans every pull request on open, reopen, or update, and every push to a branch in Cursor Origin, with no pipeline changes required.
• Delivers findings in three places: inline pull request comments, the PR Checks tab, and the Upwind console — enabling agents to read and act on results in the same pass.

CNAPP · 2026-10-14

SAST / SCA / Code Security · 2026-10-14

Veracode integrations gain new predependency_command, policy, and build_runs_on params across GitHub, GitLab, and Azure DevOps workflow configs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new veracode.yml parameters across Workflow Integrations: predependency_command for GitHub Workflow Integration v2.1.9, GitLab Workflow Integration v2.1.9, and Azure DevOps Workflow Integration v2.4.4, enabling single-line or multiline commands to run before Veracode packages the project; build_runs_on for GitHub Workflow Integration v2.1.9 SCA scans; policy for Azure DevOps Workflow Integration v2.4.5, GitLab Workflow Integration v2.1.9, and GitHub Workflow Integration v2.1.7 infrastructure-as-code (IaC) scans; and support for a custom agent pool name parameter for Azure DevOps Workflow Integration v2.4.3, letting you specify the agent pool for pipeline execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds analysis_branch support in veracode.yml for Azure DevOps Workflow Integration v2.3.10 so scheduled scans run against the specified branch instead of the default branch.
• Adds a Scan Scope setting to Veracode Scan for Visual Studio v0.8.0 to scan the full project directory or only the active solution for faster, more focused results.

WAF, Bot & API Protection · 2026-10-14

Wallarm adds a Discovered Inventory dashboard giving at-a-glance visibility into shadow APIs, zombie APIs, MCP servers, and attack traffic hot spots.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Dashboards → Discovered inventory dashboard surfacing internet-exposed APIs, unauthenticated endpoints, shadow and zombie APIs, and open security issues in a single view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces endpoints with the highest proportion of attack traffic so teams can prioritize remediation by actual threat signal.
• Adds visibility into exposed MCP servers, including their tools, resources, authentication status, and any sensitive data detected.

Identity & Access Management · 2026-10-13

Auth0 adds a guided dashboard UI for building, sequencing, and toggling Tenant ACL rules without manual syntax.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Guided Rule Builder under Security > Access Control with step-by-step prompts for scope, entity, and action selection to construct Tenant ACL policies without syntax errors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Visual Rule Sequencing canvas to reorder Tenant ACL policy priorities and inspect exact rule execution order.
• Adds Instant Status Toggles to enable or disable individual Tenant ACL rules in a single click while Auth0 handles the underlying API calls.

AI/LLM Security · 2026-10-13

Backslash flags Claude Code mod risks: use claude plugin validate, allowManagedModsOnly, and ~/.claude/skills/ audits to govern agent plugins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Run claude plugin validate on a mod's folder to list the events it hooks and the functions it calls before installing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enable allowManagedModsOnly in company policy so only company-deployed mods can run in Claude Code sessions on managed machines.
• Audit ~/.claude/skills/ periodically — plugin folders placed there load automatically in every Claude Code session with no install step.

Data Security & DLP · 2026-10-13

API surface changed: 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• POST /bytebase.v1.SQLService/GetQueryHistory: param Connect-Protocol-Version (header) now optional⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• POST /bytebase.v1.SQLService/ListQueryHistories: param Connect-Protocol-Version (header) now optional
• POST /bytebase.v1.SQLService/SearchQueryHistories: param Connect-Protocol-Version (header) now optional

Internet Services · 2026-10-13

Cloudflare adds MCP event streaming for Workers Issues, persistent browser sessions, LCP/INP sub-part RUM metrics, and a new web_fetch agent tool.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds browserTool to the Agents SDK — a persistent browser that retains tabs and logins between turns, with adapters for Pi Durable, AI SDK, and TanStack AI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cloudflare API MCP server now streams Workers Issues as MCP events, enabling MCP clients to subscribe and receive each new issue in real time.
• Real User Monitoring in Cloudflare Web Analytics now breaks LCP and INP into sub-part metrics and splits connection time into TCP and TLS, surfaced in the dashboard and via the GraphQL Analytics API.

Internet Services · 2026-10-13

Workers subrequests to BYOIP destinations now preserve CF-Worker header and cf.worker.upstream_zone, fixing Bot Management and security rule evaluation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Workers subrequests to BYOIP-proxied hostnames now preserve the CF-Worker header and cf.worker.upstream_zone field, ensuring consistent security rule evaluation across same-zone and cross-zone subrequests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Bot Management fields on destination zones — including bot scores, verified bot status, and JA3/JA4 fingerprints — now reflect the original end-user connection rather than the internal Cloudflare-to-Cloudflare connection for BYOIP subrequests.

SIEM · 2026-10-13

Databricks Apps gains GA workspace-level default Python and npm package repository configuration with per-app overrides.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Workspace admins can configure default Python and npm package repositories for Databricks Apps, with app-level overrides still supported.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-13

Databricks launches Agent memory pipelines in Beta, letting agents distill and recall facts across conversations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agent memory pipelines (Beta), which connect a session store to a memory store and use an LLM to distill durable facts, preferences, and decisions from stored conversations into memory entries recalled in later sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports running a memory pipeline on demand or on an approximately 24-hour schedule.

SIEM · 2026-10-13

Databricks Feature Views reach GA for batch, streaming, and request-time data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Feature Views are now generally available for batch, streaming, and request-time data workloads; compliance security profile workspaces will gain access in mid-November 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-13

Databricks Feature Views reach GA and will auto-enable for compliance security profile workspaces in mid-November 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Feature Views are now generally available, enabling declarative feature definition and computation from batch or streaming data for model training and online serving.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-13

Unity Catalog adds Beta tag propagation — governed tags auto-apply to derived tables and views via lineage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables tag propagation in Unity Catalog (Beta): when activated for a governed tag, Unity Catalog uses lineage to automatically apply that tag to derived tables and views whenever CREATE TABLE AS SELECT, CREATE VIEW, INSERT INTO ...⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ SELECT, or MERGE runs, keeping classification and ABAC enforcement consistent at table and column levels as data moves downstream.

SIEM · 2026-10-13

Lakeflow pipeline parameters are now GA, letting a single pipeline target different catalogs, schemas, or tables via key-value overrides.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pipeline parameters (GA) to Lakeflow: define key-value pair defaults in pipeline settings, override them at update start, and reference them in SQL with named parameter syntax — so one pipeline can run against different catalogs, schemas, or tables without editing source code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-13

Unity Gateway Skills REST API launches in Beta with full CRUD plus finalize, available across all Databricks SDKs and CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Unity Gateway Skills REST API in Beta, supporting create, read, update, list, delete, and finalize operations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes Skills API support across Databricks CLI, Python SDK, Go SDK, Go Modular SDK, Java SDK, and JavaScript SDK.

SIEM · 2026-10-13

JDBC Unity Catalog connections with SSL certificate support become available by default for compliance security profile workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables JDBC Unity Catalog connections — including SSL certificate support — by default for workspaces with the compliance security profile enabled, allowing external database access via custom JDBC drivers governed by Unity Catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-13

Unity Gateway now routes Amazon Bedrock Mantle models through Unity Catalog with permissions, rate limits, budgets, and inference tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Amazon Bedrock Mantle as a supported model provider in Unity Gateway, enabling access through Unity Catalog permissions, rate limits, budgets, and inference tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-13

DefectDojo 3.4.100 adds locations as a findings/products prefetch option and system checks for default settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds system checks for settings left at their shipped values in settings.dist.py / local_settings.py.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Stores the SonarQube issue key as unique_id_from_tool for REST API imports.
• Applies API token settings to API v3 token auth and applies the token endpoint's account rules to HTTP Basic auth on the API (new settings.dist.py / local_settings.py setting).

AI/LLM Security · 2026-10-13

v0.48.0 adds managed Codex/Claude Desktop SSH targets, v3 kit capabilities, and a unified --format output system with breaking CLI changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --format table, --format json, --format yaml, and --format github-issue to sbx diagnose (replacing the old --output / -o flag) and --format json/--format yaml to sbx prune --dry-run for structured dry-run output; --format json and --format yaml are now mutually exclusive with --json and -q, and unsupported format values fail at flag-parse time instead of silently falling back to human-readable output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --detach / -d to sbx run and sbx env run as the replacement for --detached, --no-progress to sbx create as the replacement for --quiet / -q (suppressing progress while still printing the creation summary), and --env-name to sbx secret ls and sbx secret rm as the replacement for --env.
• Adds sbx setup ssh --auto-create on macOS and Windows to register Docker Sandbox connections in Codex and Claude Desktop, creating a dedicated sandbox on first use.

AI-Powered Offensive Security · 2026-10-13

Dreadnode adds file/folder uploads in Web Chat, structured binary-analysis output, and a severity_policy parameter for AI red-teaming.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds severity_policy parameter to generate_attack so you can define custom risk taxonomies — thresholds, matrices, and aliases — that the agent applies when classifying findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ?tool_call=<id> linkable URL parameter and a View in transcript button in the Media tab to jump directly to the tool call that logged an artifact.
• Adds dependencies.path field in capability.yaml so capabilities can declare additional tool directories for agents running in E2B sandboxes.

AI-Powered Offensive Security · 2026-10-13

Dreadnode adds pre-launch sandbox config, bulk finding triage, and SDK Assessment.record_attack_result() for custom-target attacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Assessment.record_attack_result() SDK method so custom-target attacks (multistep tool attacks, indirect injection flows) can emit traces and materialize findings in the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bulk triage on the Agent Output page — select multiple findings and set their triage status in a single action, with per-row results and a confirmation toast.
• Adds pre-launch sandbox configuration panel in the web chat session view: teams can choose capabilities, compute, secrets, and idle timeout before a sandbox starts, then inspect its runtime status, installed capabilities, health issues, and logs in a panel beside the chat.

Software Supply Chain Security · 2026-10-13

Software Supply Chain Security · 2026-10-13

Endor Labs launches Zero-Day Patches — AI-generated, verified fixes for novel open source vulns delivered in under 24 hours.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Joins the Linux Foundation's Project Akrites as a founding member, routing coordinated vulnerability disclosure and remediation through a shared channel alongside Anthropic, OpenAI, Amazon, Chainguard, Cisco, Citi, IBM, JPMorgan Chase, and Microsoft.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Applies function-level reachability analysis across direct and transitive dependencies to rank which zero-day findings are actually reachable from a customer's specific application code.

Software Supply Chain Security · 2026-10-13

Endor Labs AI SAST adds full C language support with buildless scanning in the IDE and on PRs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Pairs AI SAST for C with C SCA in the same platform, covering first-party C code and open-source dependencies together under a single analysis run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Integrates C scanning into AURI by Endor Labs, providing an independent security harness for agentic SDLC workflows with function-level call paths, reproducible evidence, and policy enforcement across any agent, model, or CI stage.

SAST / SCA / Code Security · 2026-10-13

Security overview gains AI Scan metrics for pull requests, with a dedicated tab showing findings, autofix rates, and remediation trends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an AI Scan tab to the Code scanning on pull requests page in security overview, showing total findings, autofix suggestion coverage, remediation rate, and developer adoption of autofix across repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Renames the CodeQL pull requests page to Code scanning on pull requests and splits existing CodeQL metrics into a separate CodeQL tab alongside the new AI Scan tab.

SAST / SCA / Code Security · 2026-10-13

GitHub Copilot enterprise telemetry gains user attribution and five independently toggleable OTel capture classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds telemetry.capture.identity setting to attribute Copilot activity to a user, appending user.name, process.user.name, and host.name to OpenTelemetry data — off by default, separate from existing pseudonymous identifiers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds five independently controllable capture classes — prompts, responses, toolArguments, toolOutput, and policyDetail — each off by default, available in Copilot CLI, the GitHub Copilot app, and VS Code sessions using Agent Host.
• Retains captureContent as a legacy shorthand covering all five content capture classes, but explicitly never enables identity capture.

SAST / SCA / Code Security · 2026-10-13

GitHub adds durable push attribution to commits, exposing the authenticated pusher in the UI, API, and a new Committer must match pusher ruleset condition.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new repository rule condition, Committer must match pusher, that blocks pushes where the committer metadata does not match any verified email address of the authenticated pusher.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Every commit pushed to a repository now has a durable, authenticated pusher identity attached to it, independent of author and committer metadata.
• Surfaces the authenticated pusher identity in the UI and API alongside the existing author and committer fields, enabling spot-checks of suspicious activity and faster security investigations.

SAST / SCA / Code Security · 2026-10-13

Dependabot now supports Anonymous authentication for organization-level private registries, enabling credential-free internal package mirrors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Anonymous as a selectable authentication method for organization-level private registries in Dependabot, enabling registries that allow unauthenticated reads (such as internal package mirrors) without requiring a placeholder token workaround.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Organization-level private registries configured with Anonymous authentication apply to every granted repository, including those using only Dependabot security updates with no dependabot.yml file.

SAST / SCA / Code Security · 2026-10-13

graudit v4.1 adds secrets, ReDoS, iOS, Ruby, and default rule databases alongside a rule linter script.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds misc/redos database for detecting Regex Denial-of-Service patterns in source code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds secrets database for detecting hardcoded secrets in source code.
• Adds ios database for scanning iOS source code.

Identity & Access Management · 2026-10-13

iDenfy adds MCP integration for AI assistants, free AML checks, marital name field, and European Accessibility Act compliance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a marital name field to KYC responses when an ID document contains a second surname.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MCP connectivity so AI assistants (Claude and Claude Code) can access iDenfy accounts, with a consent screen to control which data areas they can view or edit.
• Adds free AML checks: accounts without AML screening can now run 10 complimentary AML checks from the dashboard.

Secrets Detection & Management · 2026-10-13

Infisical v0.166.5 moves secret scanning to project-level, adds global secret-change approvals, and supports nested JSON import as folders.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Moves secret scanning to a single-project product scope, scoping all scanning operations and results to individual projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports importing nested JSON objects as folder hierarchies when importing secrets.

Software Supply Chain Security · 2026-10-13

JFrog introduces the Agentic Process Evidence Protocol and AppTrust Prompt-to-Release Traceability to govern AI agent activity across the SDLC.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Prompt to Release Traceability in JFrog AppTrust, connecting AI agent session logs to signed SLSA-compatible provenance attestations and binding them to git commits, artifacts, and released versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Agentic Process Evidence Protocol, a four-step framework that captures agent session telemetry (user prompts, thinking tokens, file edits, tool calls), cryptographically signs and attaches evidence to SDLC entities, evaluates evidence at policy gates before promotion, and persists session logs for post-release auditing.
• Enables policy-as-code release gates that evaluate Agentic Process Evidence to enforce checks such as approved LLM usage, approved MCP tool usage, human accountability, human review presence, and absence of unapproved lateral operations.

Identity & Access Management · 2026-10-13

JumpCloud 2022 adds certificate-based RADIUS auth, TOTP for LDAP MFA, Remote Assist, Password Manager, OIDC SSO, and a Linux Forbidden Services policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new RADIUS authentication options: certificate-based (passwordless) authentication to JumpCloud RADIUS supporting any X.509 compliant certificate authority, with organizations able to import existing certificates, and RADIUS authentication using Azure AD as the identity provider, enabling secure RADIUS access without managing users and passwords outside Azure AD.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds TOTP as a supported MFA factor for LDAP applications, alongside the existing JumpCloud Protect push-notification factor.
• Adds OpenID Connect (OIDC) Single Sign-On, letting users authenticate to OIDC-capable web applications with a single set of JumpCloud credentials.

Identity & Access Management · 2026-10-13

JumpCloud 2023 adds passwordless Go auth, Android zero-touch EMM, remote Background Tools, dynamic groups, and Password Manager shared folders.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JumpCloud Go, a hardware-protected, phishing-resistant passwordless login method using Apple Touch ID and Windows Hello on managed macOS and Windows devices, with user and device verification on every SSO session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Android zero-touch enrollment support for fully managed, dedicated, and company-owned Android devices with a work profile, plus streamlined enrollment token creation.
• Adds Remote Assist Background Tools enabling admins to use a remote command line and remote file transfer to access and troubleshoot end-user devices without disrupting the user's work.

Identity & Access Management · 2026-10-13

JumpCloud 2024 adds Device Monitoring & Alerting, SaaS Management, Windows App Catalog, BYOD iOS 18 MDM, CSP-based Windows policies, and API filter improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pipe | escape support via backslash \ in API in and nin filter operators, enabling pipe characters within search terms for requests like GET /systemusers?filter=department:$in:Finance | Accounting|IT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Replaces deprecated GET api/systemusers/reactivate/{id} with POST https://console.jumpcloud.com/systemusers/reactivate/{id} accepting an activation_email body field.
• Replaces deprecated $ge and $le Dynamic Groups memberQuery filter operators with $gte and $lte to align filter syntax across API list endpoints.

Identity & Access Management · 2026-10-13

JumpCloud adds Access Requests, MCP Server, AI Commands Builder, Shadow AI Dashboard, Custom Admin Roles, and major SSO security upgrades in 2025.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sso_auth event to logs for forced re-authentication, supporting ForceAuthn="true" in SAML and prompt=login in OIDC so IdP now honors step-up authentication requests from connected apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Includes Authentication Methods References (AMR) claims in both SAML assertions and OIDC ID tokens, tagging logins with proof of factors used (e.g., password + OTP) for Zero Trust compliance.
• Introduces JumpCloud MCP Server (GA) to connect compatible AI tools and code editors to JumpCloud via the Model Context Protocol.

Identity & Access Management · 2026-10-13

JumpCloud adds MCP Server for Users, Custom Risk Policies, Patch Management Dashboards, AI knowledge-base uploads, and Android policy expansion in October 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP Server for Users (enabled at Settings > JumpCloud AI), letting JumpCloud users connect AI clients to User Portal capabilities over OAuth; admins can review and revoke active sessions or set an automatic expiration window, and users can self-manage sessions at Security > JumpCloud MCP in the User Portal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Custom Risk Policies (at Access Risk) to tailor risk detection for Admin Portal, User Portal, device, and SSO application logins — choose risk factors, adjust score contributions, assign to specific user groups or SSO apps, and set policy precedence over the Default Policy.
• Adds unified Patch Management dashboards at Device Management > Patch Management — an Overview tab for cross-platform Windows and Apple compliance, a Windows KB-centric view with CSV and JSON export, and an Apple Compliance Dashboard tracking OS rollout progress against active update policies — alongside a new Device Patch Report (Windows) under JumpCloud Reports showing per-device KB patch status (Installed, Pending, Failed) with Admin Portal preview of up to 500 rows and full CSV download.

Identity & Access Management · 2026-10-13

JumpCloud RBAC gains CRUD + No Access granularity for Identity Management and Application Management scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CRUD operations and No Access permission to the Identity Management and Application Management scopes, enabling more granular per-scope admin permissions instead of bundled access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Splits Identity Management and Directory and Groups Management into separate, independently assignable scopes.
• Groups Directory Management and Group Management scopes under a unified Directory and Groups Management permission.

Identity & Access Management · 2026-10-13

JumpCloud adds RSS feed subscriptions for release notes, agent updates, and bug fix announcements via the Help Center.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Subscribe to Support RSS Feed option on the Release Notes and Bug Fixes page to receive notifications for any new Help Center content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Subscribe to Release Notes and Bug Fixes RSS Feed option to receive product release notes, agent release notes, and bug fix reports.
• Adds Subscribe to Agent Release Notes RSS Feed option to receive agent-specific release note notifications.

Identity & Access Management · 2026-10-13

JumpCloud Password Manager Desktop App adds EU region support, ARM Mac build, 30K-item capacity, and admin shared-folder management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports EU region for Password Manager; users select their region on the activation page (desktop) or pairing page (browser extension) before activating their account.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a native ARM build for macOS devices with M1 and above silicon, available on the Downloads page, with automatic update to the ARM build when the chip is detected; and adds an RPM build for Linux (x64 Red Hat distributions such as Fedora) with auto-update support, in addition to the existing Debian build.
• Scales item storage capacity to up to 30,000 items (without autofill) or 13,000 items (with autofill), and up to 5,000 items per shared folder; adds the ability to sort items by nicknames; and paginates the items list, displaying 100 items per page.

WAF, Bot & API Protection · 2026-10-13

Levo 1.3.0 adds multi-GitHub-account support, AI bulk triage, and a new authentication-bypass gateway test.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for connecting multiple GitHub accounts to a single organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI-assisted triage to bulk vulnerability selections.
• Adds an authentication-bypass test for gateway path handling.

WAF, Bot & API Protection · 2026-10-13

Levo 1.2.135 adds bulk API endpoint merging and a full create-validate-approve lifecycle for custom AI-authored tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bulk merge for duplicate API endpoints in the API Surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a full authoring lifecycle — create, validate, approve — for custom AI-authored tests, with every test run bound to the exact code a human reviewed.

WAF, Bot & API Protection · 2026-10-13

Levo 1.2.135.2/1.2.135.3 adds WSO2 API Gateway integration, full-screen Service Graph, AI-assisted triage, and MFA support in DAST scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds one-click push of endpoints to WSO2 API Gateway from Levo.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a dedicated full-screen page for the Service Graph.
• Adds second-factor (MFA) support for DAST scans.

WAF, Bot & API Protection · 2026-10-13

Levo 1.2.135.1 adds per-app API security test tuning, bulk delete with RBAC, Beta Service Graph, form-encoded and unauthenticated-access test coverage, and quieter on-prem he⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a Beta Service Graph in the API catalog for visualizing service relationships.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-application tuning of API security testing settings.
• Adds bulk delete of test runs under role-based access control.

Exploitation & C2 · 2026-10-13

Merlin v2.2.1 adds macOS arm64 and Linux armv7/arm64 server binaries to the release bundle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds macOS (Darwin) arm64 and Linux armv7 and arm64 server binaries to the release bundle, alongside the existing Windows x64, Linux x64, and macOS x64 builds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-10-13

Merlin agent v2.5.1 adds macOS arm64 and Linux armv7/arm64 pre-built binaries to the release matrix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pre-built agent binaries for macOS (Darwin) arm64, Linux armv7, and Linux arm64, expanding the existing Windows x64, Linux x64, FreeBSD x64, and macOS x64 build matrix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-10-13

Intune adds the Windows 11 26H2 security baseline, reflecting Microsoft's latest recommended security settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Windows 11, version 26H2 security baseline in Intune, reflecting current Microsoft security recommendations with new settings, updated default values, and revised security guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-10-13

NETRESEC publishes Suricata rules and IOCs for AtlasRAT C2 detection across SFuck, BFuck, TLS, and fake-cert variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Suricata rule sid:1471105 to detect AtlasRAT loader SFuck C2 check-in (|53 46 75 63 6b 00 00 00| on tcp-pkt).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Suricata rule sid:1471106 to detect AtlasRAT loader BFuck C2 check-in (|42 46 75 63 6b 00 00 00| on tcp-pkt).
• Adds Suricata rule sid:1471107 to detect AtlasRAT TLS C2 handshake on TCP port 443.

AI/LLM Security · 2026-10-13

nono v0.80.0 adds SHA-256 executable pinning, per-command AWS SigV4 auth, and macOS keychain_access grants for tool sandboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sha256 field to CommandPolicyConfig in the command-policy config to pin a command to its expected SHA-256 executable digest, blocking substituted or tampered binaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds aws_auth field (type AwsAuthConfig) to CommandCredentialConfig in the command-policy config, enabling per-command AWS SigV4 signing in tool-sandbox scoped-proxy routes — the child process sees only dummy keys while real credentials are resolved host-side.
• Adds command-level keychain_access grant for macOS, letting profiles permit a specific sandboxed command to access the macOS Keychain without widening the entire session sandbox.

Reconnaissance & OSINT · 2026-10-13

OpenOSINT v2.35.0 promotes a stable library API and adds a --public-only network guard to the exposure module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --public-only flag to guard network exposure, restricting investigations to public-only targets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-13

Plerion migrates Agent Registry checks to AWS's new standalone Agent Registry service ahead of the 30 October 2026 Bedrock AgentCore API shutdown.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Updates check PLERION-AWS-1110 ('Agent registry publishes new records without review') to run against registries in the new AWS Agent Registry service instead of the deprecated Bedrock AgentCore registry API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Reads new Agent Registry registries once the Plerion stack is updated to the latest version, which adds agent-registry read permissions.

Continuous Control Monitoring (CCM) · 2026-10-13

RegScale CLI 6.52.0 adds Acunetix XML import, CrowdStrike Spotlight enhancements, and richer SSP import logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds regscale acunetix import_acunetix command to import Acunetix XML scan exports as assets, vulnerabilities, and issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• JCAM SSP import now logs the RegScale security plan ID assigned to each newly created plan, with a count in the run summary.

MCP Servers & Tooling · 2026-10-13

Runlayer 1.28.1233 adds Terraform-managed security/team resources, new single-resource API endpoints, claw agent family detections, and Muse Code hook support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds runlayer_plugin, runlayer_agent_schedule, runlayer_team, runlayer_organization, and runlayer_policy_attribute_setting resources to the Terraform provider, along with resources to manage AI Watch enforcement settings, per-user AI Watch policies, and per-tool scanner overrides on a connector, so plugins, agent schedules, teams and organization settings, policy-referenceable attributes, and AI Watch configuration can all be defined as code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new AI Watch endpoints to read a single enforce entry by ID, to list, read, or delete a single user's scoped AI Watch policies, to return a tool's stored scanner overrides (tool name plus settable fields, now also returned when updating a tool's security settings instead of the full settings row), and to return a server's stored scanner overrides in the same shape as updating them.
• Adds new endpoints to fetch a single LLM gateway usage rule by ID (in the same shape as create/update responses), a single LLM gateway virtual key by ID (in the same shape as list and update endpoints), and a single LLM gateway routing rule by ID (in the same shape as create/update responses).

Software Supply Chain Security · 2026-10-13

API surface changed: +3 endpoints, −1 endpoint, 5 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v1/workspaces/{team_key}/invitations/{invitation_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /api/v1/workspaces/{team_key}/invitations
• New endpoint POST /api/v1/workspaces/{team_key}/invitations

Firewalls & Network Defense · 2026-10-13

Sophos Fusion gains instant config push for SFOS 23.0+ firewalls and a new AI Assistant for natural-language management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Firewall Assistant tab in Chat with an assistant — an AI-powered assistant in Sophos Fusion for natural-language firewall management and troubleshooting on firewalls running SFOS 23.0 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Sophos Fusion now pushes configuration changes immediately to firewalls running SFOS 23.0 or later, replacing the previous pull-every-minute polling model.

Reconnaissance & OSINT · 2026-10-13

subjack v3.1.0 makes SRV takeover opt-in via -srv, fixes AXFR detection, and switches availability checks to RDAP⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -srv flag to opt in to SRV record takeover detection (~28 DNS queries per domain for SIP, XMPP, LDAP, Kerberos, IMAP, CalDAV, and more)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Switches domain availability checks from the heavyweight zonedb dependency to RDAP (RFC 9083) with a whois fallback, eliminating OOM on small VPSes
• Allows -r resolver list entries in host:port format, not just bare IP addresses

SIEM · 2026-10-13

Sumo Logic adds a native OpenAI source to collect organization usage costs and audit logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Sumo Logic source for OpenAI that collects organization usage costs and audit logs, covering API spending, user activity, project changes, and API key administration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-13

syzkaller adds a syzlang-vm-testing agent skill and expands netdevsim sysfs/debugfs syscall descriptions for Linux.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds syzlang-vm-testing agent skill to guide LLM-based automated VM testing workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands GEMINI.md with syzlang and seed authoring guidance for AI-assisted development.

Detection Engineering · 2026-10-13

Tenzir v6.20.0-rc.2 introduces a new data model for faster pipelines; Platform v1.40.2 adds Explorer support for it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a new data model in Tenzir Node v6.20.0-rc.2 designed for faster pipeline execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds scrolling and error details to the Explorer in Tenzir Platform v1.40.1.

AI/LLM Security · 2026-10-13

ToolHive v0.52.0 adds TLS for Redis session storage, safer thv llm teardown defaults, and one-hour Claude Code prompt caching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds spec.sessionStorage.tls (including caCertSecretRef for a private CA) to MCPServer, MCPRemoteProxy, and VirtualMCPServer Kubernetes resources, enabling TLS-encrypted Redis session storage in the operator; a startup WARN is logged when Redis runs without TLS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables TLS for Redis session storage in the proxy runner, vMCP, and their rate limiters, with support for system roots or a private CA bundle.
• thv llm setup now configures Claude Code for one-hour prompt caching by default; pass --short-prompt-cache to opt out.

SAST / SCA / Code Security · 2026-10-13

Veracode SCA gains --appname and --show-cli flags, malicious package detection, Poetry support, and SBOM generation in the agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --appname and --show-cli flags to the SCA agent scan command: --appname (Commercial region) links scan results to an application profile and requires OAuth or HMAC authentication, while --show-cli, used with --json, saves JSON output to a file while still displaying a human-readable CLI summary in the console, returning an error if used without --json.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds malicious package detection to SCA upload and agent-based scans, reporting malicious packages found in scanned libraries with no extra configuration or agent update required.
• Adds SBOM support to SCA scans: SBOM generation during SCA agent-based scans and SBOM file scanning support as part of SCA upload scans.

Internet Services · 2026-10-12

Agents SDK gains web_fetch and web_search tools; Queues adds EU/US/FedRAMP jurisdictions; API Shield schema learning runs on demand⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds web_fetch (Agents SDK v0.28.0+, importable from agents/webfetch/pi) for reading webpages, PDFs, and supported Office documents with automatic Markdown conversion, exposing fetchWeb(), windowWebFetchPage(), and renderWebFetchPage() for direct fetching without a model or Durable Object; and web_search (Agents SDK v0.27.0+, importable from agents/websearch/pi) for querying the public web via the Cloudflare Web Search API (powered by ceramic.ai, Exa, and Linkup), exposing createAIWebSearch() and createHTTPWebSearch() for model-free search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OpenCodeHarness (experimental) to the Agents SDK, enabling OpenCode 2.0 to run inside a plain Durable Object with SQLite sessions, Lifecycle jobs, and Workers AI model binding via the agents/models/opencode provider; requires agents@latest @opencode/sdk@2 @opencode/plugin@2.
• Adds jurisdictional restrictions to Cloudflare Queues via the --jurisdiction flag (Wrangler) and jurisdiction parameter on the POST /queues API endpoint; supported values are eu (European Union), us (United States), and fedramp (FedRAMP-Moderate data centers).

Internet Services · 2026-10-12

API Shield adds on-demand schema learning; Workers AI gains Clef-omni multimodal model with audio/video input⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds on-demand, zone-wide schema learning runs in API Shield, with per-operation result review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cloudflare API MCP server now serves Cloudflare skills through the Skills over MCP extension.
• Adds R2 bandwidth analytics broken down by the Cloudflare location that served each request.

Internet Services · 2026-10-12

API Shield now supports on-demand schema learning runs, skipping the weekly schedule for faster feedback during testing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Ad-hoc learn schema option in Web Assets > Operations > More options menu, letting you trigger an API Shield schema learning run immediately instead of waiting for the weekly schedule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The Schema learning dialog shows current learning status and last completed run for the zone, while the Learned schema view shows per-operation results — both updating live so you can review individual operations while the zone-wide run continues.

Threat Intelligence · 2026-10-12

Cloudmersive Fraud AI API v1-7-0 adds settings to allow or block expired documents during validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds settings to allow or block expired documents in the Cloudmersive Cloud Fraud AI API v1-7-0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-12

Cloudsmith adds a Rego policy validate endpoint, CLI self-update, Terraform credential helper, and a new --workspace option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a validate API endpoint that returns syntax and type errors in Rego policy logic without creating or updating anything, enabling pre-submission policy checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a --workspace option to the Cloudsmith CLI to read workspace settings from the command line.
• Adds a built-in self-update capability to the Cloudsmith CLI (v1.27.0+) so the CLI can upgrade itself without external tooling.

Backup & Recovery · 2026-10-12

Commvault Cloud 11.46 adds real-time AD auditing, XenServer/Proxmox CBT, YugabyteDB on GCP, Redis/Valkey, and Azure-native integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds real-time Active Directory auditing and anomaly detection, capturing identity, group, policy, and authentication changes with automatic highlighting of privilege escalations, delegation updates, and policy modifications; supports rollback of directory changes directly from the audit event (requires Active Directory Advanced Edition license).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for new database and datastore protections: Google Cloud Memorystore for Redis and Valkey backup and recovery within Commvault, YugabyteDB protection for Google Cloud deployments covering YSQL databases and YCQL keyspaces through the unified Commvault platform, and MongoDB Atlas native snapshot onboarding and management in SaaS.
• Adds Changed Block Tracking (CBT) support for incremental VM backups on XenServer and Proxmox VE, reducing backup windows, data transfer, and resource utilization.

Third-Party & Vendor Risk (TPRM) · 2026-10-12

ConveyorAI Cmd+K now streams live reasoning steps, matched sources, and audit trail as the agent answers questions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds live step-by-step reasoning display to Cmd+K ConveyorAI agentic search, showing matched sources, narrowing logic, and answer drafting in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an How this answer was put together audit panel in Cmd+K to review which knowledge the agent used and how it reached its answer after the fact.

AI-Powered Offensive Security · 2026-10-12

Decepticon v1.4.0 adds Plan, Red, and Blue run modes to the CLI /mode command, launcher, and web dashboard, plus selectable local Ollama model IDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Plan, Red, and Blue run modes switchable via the CLI /mode command, OSS launcher, and web live view; Red mode requires one confirmed target and authorization reference, and rechecks RoE approval on start; Blue mode checks both sensor and monitor health.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Brings current production LiteLLM model routes into OSS agents and CLI.
• Adds five additional Plan document views, making all nine planning documents visible in the Plan view.

Container & Image Security · 2026-10-12

Docker 29.9.0 adds lazy-pull control for containerd image store and confirms IPv6 Swarm port support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds lazy-pull daemon feature flag to the containerd image store, controlling whether docker pull skips downloading layer content already provided by the snapshotter; enabled by default for nydus, overlaybd, soci, and stargz snapshotters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Published Swarm-service ports are now accessible at the host's IPv6 addresses when the userland proxy is enabled, confirmed as a tested and supported feature as of v29.9.0.
• Allows IPv6 Neighbour Discovery between containers on a bridge network with inter-container communication disabled, matching existing IPv4 behaviour.

SIEM · 2026-10-12

Software Supply Chain Security · 2026-10-12

Endor Labs and Bright Security integrate reachability-backed SAST with runtime DAST validation to surface only confirmed-exploitable findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a SARIF-based integration pipeline where Endor Labs' function-level reachability analysis passes a narrowed candidate list to Bright STAR for runtime exploit confirmation, replacing full-surface DAST sweeps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Endor SAST + Bright STAR as a combined CI gate, catching reachable and runtime-confirmed exploitable code before it reaches the production branch.
• Enables runtime-confirmed prioritization: findings Bright Security confirms exploitable at runtime are automatically elevated above reachable-but-unproven and unreachable findings.

Software Supply Chain Security · 2026-10-12

Endor Labs launches AI Security Code Review — multi-agent PR analysis catching auth gaps, CSRF breaks, and crypto misuse missed by SAST.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI Security Code Review, a new capability that deploys multiple AI agents (Developer, Architect, Security) to analyze every pull request for design flaws and architectural security changes missed by rule-based SAST/SCA tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Detects security-impactful PR categories including: API endpoint exposure, access control changes, authentication modifications, CI/CD workflow additions, cryptographic library swaps, database schema changes, dependency privilege escalation, input validation gaps, memory management changes, network security control modifications, payment processing integrations, and PII data handling.
• Assigns each detected change a priority level (Critical, High, Medium, Low) based on context and potential impact, and surfaces findings in a dedicated Security Review section within each project.

Security Validation (BAS & Automated Pentest) · 2026-10-12

NodeZero gains network pivoting for external tests, CrowdStrike Falcon Next-Gen SIEM integration, and new WebApp pentest controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds network pivoting for external tests, enabling NodeZero to reach additional hosts discovered during an operation beyond the originally configured scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new integration with CrowdStrike Falcon Next-Gen SIEM.
• Adds new on/off and rate-limiting options for Password Spray, credential pivoting, and post-exploitation attack configuration to minimize account lockouts.

Endpoint Management (UEM/RMM) · 2026-10-12

Mac Custom App, Printer, and Script Library Items can now be scheduled to run after Liftoff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a post-Liftoff processing option to Custom App, Custom Printer, and Custom Script Library Items for Mac, letting admins choose whether items run during or after Liftoff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-10-12

juice-shop v20.3.0 adds alternateImages config, AVIF product images, and Farsi and Tamil language support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds optional alternateImages configuration property to define alternative product image formats and densities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds responsive AVIF product images across 1x, 2x, and 3x display densities.

WAF, Bot & API Protection · 2026-10-12

Levo adds license status visibility, bulk API endpoint merging, audit-format PDF exports, and a full AI-test authoring lifecycle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds license status display in-product with expiry warnings, a grace period, and clean end-of-access enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bulk-merge for duplicate API endpoints in the API Surface view.
• Adds an audit-format output option for the Vulnerabilities PDF, suitable for handing to auditors or customer security teams.

Identity & Access Management · 2026-10-12

LoginRadius V3JS adds component-level config, RBA Email OTP challenges, and extended localization keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds componentConfig to the V3JS library to dynamically show or hide specific authentication components per flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds rba-email-otp localization keys for Risk-Based Authentication Email OTP screens.
• Extends preventVerificationEmail support to Mandatory Email Verification flows in the Registration Flow.

AI Security Posture & Discovery · 2026-10-12

Mend AI Runtime Protection expands Guardrails language coverage for multi-language runtime threat detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands runtime threat detection coverage in Mend AI Runtime Protection | Guardrails to additional languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Container & Image Security · 2026-10-12

Mend Container raises the image scan size limit from 2 GB to 4 GB, unlocking scanning of larger container images across all registry integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the image scan size limit from 2 GB to 4 GB, enabling pulling, extraction, and scanning of larger container images across all registry integrations including ECR, with a clear error message for images still exceeding the new limit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-12

Mend SAST 26.9.2 adds YAML/JSON config file support for automatic API endpoint detection and entry point taint mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports YAML and JSON configuration files for entry point detection, automatically identifying API endpoints and mapping them to implementation classes for contract-first applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Automatically marks all generated entry point parameters as tainted, eliminating the need for manual custom framework configuration for contract-first applications.
• Improves Python engine detection accuracy across 11 CWEs including CWE-022 Path Traversal, CWE-078 OS Command Injection, CWE-079 XSS, CWE-089 SQL Injection, CWE-094 Code Injection, CWE-209 Error Message Info Exposure, CWE-295 Improper Cert Validation, CWE-532 Sensitive Info in Log, CWE-601 Open Redirect, CWE-918 SSRF, and CWE-943 NoSQL Injection.

SAST / SCA / Code Security · 2026-10-12

Mend SCA adds workflow email recipient control, a new Send Email action for CVE alerts, and dedicated zero-day threat notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Send Email workflow action to notify users of new findings — such as newly published CVEs — independent of scans, with configurable delivery frequencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables workflow creators to directly select specific users or groups as recipients for scan summary emails.
• Adds dedicated zero-day alerts to provide immediate notification when the organization is vulnerable to emerging threats.

Network Analysis & Monitoring · 2026-10-12

Network Analysis & Monitoring · 2026-10-12

Vulnerability Management · 2026-10-12

OSV-Scanner v2.7.0 adds purl in JSON output, shorter --x- flag aliases, Zig extractor, and Bitnami SPDX SBOM scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds purl (package URL) fields to JSON output when available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds shorter --x- flag aliases as replacements for the deprecated --experimental- flags.
• Adds a zig/buildzigzon extractor for build.zig.zon files, available via --x-plugins, and adds support for scanning Bitnami container SPDX SBOMs via the sbom/spdx extractor.

Identity & Access Management · 2026-10-12

Passbolt 5.16.2 moves the Microsoft Edge extension to Manifest V3 ahead of Microsoft's Manifest V2 phase-out.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Migrates the Microsoft Edge browser extension to Manifest V3, preserving existing account settings and enabling automatic updates as Microsoft phases out Manifest V2 support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-12

Plerion adds 30+ new AWS checks spanning AgentCore IAM roles, Multi-AZ resilience, deletion protection, quota usage, and Route 53 failover health.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PLERION-AWS-1242: Route 53 hosted zone has a failover record without a health check (new, Medium) — finds hosted zones whose failover records lack a health check, causing Route 53 to treat the primary as always healthy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PLERION-AWS-1243: AWS service quota usage is at or above 80% (new, Medium) — covers EC2 On-Demand Standard vCPUs, Elastic IPs, VPCs per Region, and Lambda concurrent executions using 24-hour peak CloudWatch usage metrics.
• Adds PLERION-AWS-1244: EKS managed node group uses subnets in a single Availability Zone (new, Low) — flags node groups where a single AZ outage removes every node.

Secure Access (VPN / SASE / ZTNA) · 2026-10-12

Pomerium adds MCP OAuth gateway, hosted IdP, SSH session recording, incremental config diffing, and Databroker query engine in v0.32.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pomerium_additional_hosts query parameter at the route level to declare cross-origin authentication dependencies, so Pomerium sets session cookies across up to five domains during a single OAuth flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new GetOptions API on the Databroker with field-level indexing, additional filter operators, and order by support, replacing full-record scans with targeted lookups.
• Adds a hosted identity provider type so Pomerium can manage its own OIDC provider, removing the requirement to stand up an external IdP before getting started.

Detection Engineering · 2026-10-12

pySigma v2.0.1 adds alias-bomb protection and expansion limits for windash and placeholders⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds alias expansion checks to prevent YAML alias bombs in processing pipelines and validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Moves default_policy to sigma.policy to re-establish the sigma namespace package.

Vulnerability Management · 2026-10-12

InsightVM 8.63.0 adds username visibility to SSH key credential audits and improves CIS policy compliance reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Delivers more accurate CIS policy compliance reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Third-Party & Vendor Risk (TPRM) · 2026-10-12

Risk Ledger adds client-managed supplier documents, peer review sharing with permission controls, and network map density tuning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a dedicated document storage space within any supplier profile, visible only to your organisation, so desk-research files and supplier-sent packs are kept alongside the rest of your supplier records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds expiry-date tracking on uploaded documents, triggering reminders 30 days before and on the day a document expires.
• Adds a permission framework for Community Review Sharing, letting federated organisations and selected communities control which data points are shared and with which peers.

Identity & Access Management · 2026-10-12

New Oracle Access Governance SaaS connector brings OAG identities, roles, and access bundles into SailPoint Identity Security governance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Oracle Access Governance (OAG) SaaS connector for SailPoint Identity Security, enabling centralized visibility, lifecycle management, access requests, and governance over OAG-managed identities and Oracle applications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Aggregates OAG identities as accounts and OAG roles and access bundles as entitlements, including application-level and included-permission context.
• Supports access requests, grants, and revocations through the SailPoint Identity Security request center, with the connector forwarding approved requests to OAG for fulfillment — including clear provisioning results when an OAG guardrail or segregation-of-duties check prevents a request.

Identity & Access Management · 2026-10-12

SAP Concur connector updated to support Spend API V4.1 via new useSpendApiV41 config flag for controlled migration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds useSpendApiV41 application XML entry to the SAP Concur connector config, enabling administrators to opt existing sources into Spend API V4.1 on their own schedule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates the SAP Concur SaaS & VA connector to use Spend API V4.1 for Spend User retrieval, replacing the deprecated Spend API V4; sources created on or after June 1, 2026 use V4.1 by default.
• Changes customData response format from label-based field names (V4) to strict camel-case technical field names (V4.1), requiring review and update of existing jsonPathMapping entries that reference customData.

Identity & Access Management · 2026-10-12

SailPoint Identity Security Cloud extends Custom User Levels to grant Read Only access to Sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Custom User Levels to support Read Only permissions on Sources, letting admins grant scoped source visibility to operators, support, and audit users without full access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-12

Snyk Code deepens analysis across 9 languages with new import resolution, a Mass Assignment rule for Spring, and wider detection in Java, Go, Python, Ruby, JS, C#, and PHP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a suite of new detections: a Mass Assignment rule for Spring applications flagging request data that binds directly onto a database entity; path traversal detection via S3 object keys for Go projects using AWS SDK for Go v2; SQL injection detection for Go; XML external entity injection detection for Python; deserialization, XML external entity injection, and zip slip detection for JavaScript; DOM-based cross-site scripting detection for JavaScript using Bootbox and d3; path traversal detection for C#; and path traversal detection plus a new server-side request forgery rule for Ruby.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds or improves coverage for Spring Data MongoDB, AWS SDK for Java (DynamoDB), AWS SDK for Java 2.x (DynamoDB Enhanced Client), and Apache Commons FileUpload in Java analysis.
• Analyzes template files and serverless applications more accurately and with greater depth, yielding additional findings in projects using template engines or serverless frameworks.

Firewalls & Network Defense · 2026-10-12

Sophos Access Points gains 6 GHz band steering config, profile search/sort, and richer usage insight views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds 6 GHz band steering configuration for AP6 420E and AP6 840E SSIDs from Sophos Central, with options to steer devices to the 5 GHz band first, the 6 GHz band first, or balance across all frequency bands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds manual override for 6 GHz band steering settings on AP6 420E and AP6 840E.
• Adds sort and search for access point profiles by name in Sophos Fusion.

Endpoint Security (EDR/XDR) · 2026-10-12

Sophos Central adds AI agent identity visibility, Dark Web Monitoring domain verification, phishing protection in Protected Browser, and transaction re-auth for sensitive ops⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Surfaces every AI agent, blueprint, and app created by Microsoft Entra — including owner and sponsor — under Non-Human Identities in the Directory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds manual domain entry and DNS TXT record ownership verification for Dark Web Monitoring, removing the requirement to sync domains from Entra ID.
• Delivers Phishing Protection in Protected Browser to guard organizational credentials, adds direct DNS Protection independent of endpoint or network policies, provides a new MSI installer for easier Windows deployment of Protected Browser, and adds more flexible data boundary controls.

Endpoint Management (UEM/RMM) · 2026-10-12

Sophos Mobile adds managed Google domain device enrollment for Android Enterprise, letting users authenticate with Google instead of Sophos Fusion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports managed Google domain device enrollment for Android Enterprise devices, where users authenticate with Google instead of Sophos Fusion (requires all users to have an account in the managed Google domain).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-10-12

Sophos Switch Network Map phase 2 adds SVG export, persistent layouts, and richer device visibility across firewalls, switches, and APs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Improves the Network Map: export now saves in SVG format; adds zoom, pan, and fit-to-view buttons for improved navigation; no longer resets the view when refreshing device status; renders firewall connections and topology more accurately with offline firewalls clearly marked; displays switch names instead of serial numbers with the appropriate port layout for their model and marks offline switches; identifies AP6 access points in a mesh configuration as root or node and groups them to allow management of the entire mesh as a single unit; and gives managed and unmanaged devices better naming, a consolidated view, richer details, and reduced clutter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new Network Map capabilities: layout of devices can now be saved persistently, eliminating the need to re-arrange devices on every visit, and a collapsible flyout panel for a less obstructed view.

Software Supply Chain Security · 2026-10-12

StepSecurity PAT Governance gains tenant-wide exemptions, letting you exempt a token or user across every org at once.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tenant-wide exemptions in PAT Governance: select All Organizations in the org selector, open Apps & PATs > Exemptions, and click Add tenant-wide exemption to exempt a token or user across every organization in the tenant simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a unified exemptions view under All Organizations that lists every organization's exemptions in one place, with tenant-wide exemptions labeled Tenant-wide.

Software Supply Chain Security · 2026-10-12

Secure Registry adds RubyGems and Cargo support, plus custom block messages and hidden-version notices for npm.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds RubyGems support: point Bundler, the gem CLI, or an artifact repository manager at https://registry.stepsecurity.io/ruby to evaluate every gem request against your RubyGems policy, with Cooldown Period, Compromised Packages, and Custom Block List controls; integration paths cover JFrog Artifactory, Sonatype Nexus Repository, and Direct.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Cargo support: point Cargo or JFrog Artifactory at the sparse index sparse+https://registry.stepsecurity.io/rust/ to evaluate every crate request against your Cargo policy, with Cooldown Period, Compromised Packages, and Custom Block List controls; integration paths cover JFrog Artifactory and Direct, and existing Cargo.lock files keep working without being regenerated.
• Adds a Block Message setting in npm Registry Settings to include custom text (up to 500 characters) in the error developers see when a control blocks a request, supporting placeholders such as {{control}} and {{package}}; applies to every control except Cooldown Period.

SIEM · 2026-10-12

Sumo Logic adds a new source for Google Workspace Activities, enabling collection and monitoring of Google Workspace activity data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new Sumo Logic source for Google Workspace Activities to collect Google Workspace activity data and monitor user events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-10-12

Tenzir v6.20.0-rc.2 ships a new data model with heterogeneous lists, typed AI decisions via ai_decide, secrets in function arguments, and encryption functions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ai_decide operator with typed decisions, pairing with new Cloudflare Workers AI and OpenAI Decisions endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds secrets as function arguments, including secret keys for hmac and secret seeds for Crypto-PAn.
• Adds new pipeline functions: encryption functions, Luhn check digit and CRC-32 checksum functions, and functions to convert records to key-value entries and record values to a list.

SOAR · 2026-10-12

API surface changed: −162 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-11

1Password SDK gains GetVariables/getVariables/get_variables to read Environment variables with masked-field support in Go, TypeScript, and Python.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds client.Environments().GetVariables(ctx, environmentID) (Go), client.environments.getVariables(environmentId) (TypeScript), and client.environments.get_variables(environment_id) (Python) SDK methods to retrieve all variables from a named 1Password Environment, including Name, Value, and Masked fields on each returned EnvironmentVariable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes a Masked boolean field on EnvironmentVariable structs/objects that indicates whether a variable is hidden by default, with hidden variables automatically concealed in stdout and stderr output.

Exploitation & C2 · 2026-10-11

adscan v13.2.0 adds local NT hash cracking with GPU support in CI, custom-branded deliverables, headless credential dumps, and three new ADCS findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds adscan execute compliance_scope to declare an ENS scope (profile plus per-dimension security levels) so findings are scored against the client's actual regime rather than an assumed category; CCN-STIC 890A and 890C profiles use their own applicability tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ADSCAN_NO_LOCAL_CRACKING=1 to opt out of local NT hash cracking; GPU cracking now works in adscan ci and adscan execute, not only in the interactive workbench, and runs against a time budget measured on your hardware.
• Adds adscan deliver --branding {adscan,cobrand,whitelabel} together with --client-cover, --client-back, --client-logo, --theme <file.css>, and --emit data (writes report_model.json) to produce co-branded, white-label, or stylesheet-customised deliverables including an HTML edition of the Security Assessment Report.

Attack Surface & Exposure Management · 2026-10-11

Axonius adds preconfigured Dashboard Templates with preview, adapter guidance, and personal preferences to accelerate environment visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Dashboard Templates: preconfigured dashboards built around common themes (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ use-case categories), selectable from the Add Dashboard > Dashboard Templates menu entry.
• Adds a Preview mode for each template tile, showing sample chart thumbnails, adapter requirements, and per-chart descriptions before committing to a template.
• Adds a Connect Adapters prompt within template-based dashboards that surfaces missing adapter categories and links directly to the Adapters page filtered to the relevant category.

Attack Surface & Exposure Management · 2026-10-11

Axonius adds faster asset and user deletion settings for healthy connections, with per-connection or adapter-wide control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new 'Delete devices and other assets that have not been returned from the source in the last X hours' accelerated-deletion setting that removes assets sooner when a connection is fetching successfully, independently of the existing deletion threshold.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new 'Delete users that have not been returned from the source in the last X hours' accelerated-deletion setting that removes users sooner when a connection is fetching successfully, independently of the existing deletion threshold.
• Both new faster-deletion settings can be scoped per-connection or applied to all connections for an adapter, and both require a value lower than their corresponding standard deletion threshold.

Digital Forensics & Incident Response · 2026-10-11

Belkasoft X gains MTK dump acquisition: physical imaging, FBE decryption, and offline brute-force passcode recovery for 23 MediaTek chipsets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MTK dump acquisition method in Belkasoft X for physical imaging of Android devices based on 23 supported MediaTek chipsets (MT3369, MT6731, MT6737, MT6739, MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT6853, MT6873, MT6877, MT6880, MT6883, MT6885, MT6889, MT6890, MT6893, MT8765, MT8785, MT8766B, MT8768t) via BootROM (BROM) mode over USB.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds decryption of the userdata partition from acquired MTK dumps, supporting file-based encryption (FBE) protected devices by extracting cryptographic material obtained during BootROM-mode acquisition.
• Adds offline brute-force passcode recovery for MTK devices through the Brute-force options dialog, with three attack modes: built-in Belkasoft dictionary (4- and 6-digit numeric passcodes), sequential numeric brute-force (0000 through 11-digit combinations), and a custom User dictionary supplied as a .txt file (supports both numeric and alphanumeric passcodes).

Attack Surface & Exposure Management · 2026-10-11

Censys adds AI Investigations to automatically pivot across indicators, profile infrastructure, and deliver ranked findings reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI Investigations to threat hunting: an AI investigator that checks each entity's history, pivots to potentially related assets, profiles web resources, connects results, ranks findings, and produces a formatted report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-11

Censys: Service accounts are configurable with per-module role scopes, requiring at least one module role and granting only explicitly assigned permissions.

• Service account management is available under Organization Settings > Service Accounts in the Censys Platform web console, including creation, name/role editing, secret rotation, and deletion (Platform Admin role required).

Attack Surface & Exposure Management · 2026-10-11

Censys: Adds six named RBAC roles, including Platform Admin, API Access, and Global Search and ASM Analyst/Manager roles, each with distinct permission scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automatic role provisioning for SAML SSO users on first login, assigning default roles based on the products the organization has licensed (Global Search - Analyst for Platform orgs, ASM - Analyst for ASM-only orgs).
• Exposes role management through the account management API, enabling programmatic granting, editing, and revoking of user roles.

SIEM · 2026-10-11

API surface changed: +2 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /v1/organizations/{organizationId}/services/{serviceId}/replicaAwareRouting⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint PATCH /v1/organizations/{organizationId}/services/{serviceId}/replicaAwareRouting
• GET /v1/organizations: param cursor (query) added; param limit (query) added

Internet Services · 2026-10-11

API surface changed: +13 endpoints, −1 endpoint, 32 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /accounts/{account_id}/addressing/address_maps/{address_map_id}/ips⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /accounts/{account_id}/addressing/address_maps/{address_map_id}/zones
• New endpoint DELETE /accounts/{account_id}/workflows/concurrency/{key_id}

Vulnerability Management · 2026-10-11

Cloudmersive Cloud Fraud AI API v1-7-0 adds settings to allow or block expired documents during fraud checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds settings to allow or block expired documents in fraud detection checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-11

Cloudsmith OCI repository docs add ORAS-based generic artifact upload/download, referrer attachments, and key signing support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports uploading Generic artifacts to an OCI repository using ORAS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports attaching files (SBOMs, signatures, provenance files) to existing OCI artifacts via the Referrers API.
• Supports downloading/pulling Generic artifacts from OCI repositories using ORAS, for both public and private registries.

Reverse Engineering · 2026-10-11

Endpoint Management (UEM/RMM) · 2026-10-11

Identity & Access Management · 2026-10-11

Identity & Access Management · 2026-10-11

API surface changed: +1 endpoint, 9 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /v3/sessions/delete/{job_id}/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-10-11

iOS Forensic Toolkit 10.12 adds bootloader-level full file system and keychain extraction for Apple HomePod mini via usbliter8 exploit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• HomePod mini extraction is available in the macOS and Linux editions of iOS Forensic Toolkit 10.12.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-11

GitHub Copilot for JetBrains gains enterprise default-model controls, MCP startup toggle, inline Fix action, and richer chat UX.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new MCP setting to disable automatic server startup for Copilot and Claude, giving administrators control over when configured tools become active.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enterprise administrators can now select any available Copilot agent model as the organization-wide default for new conversations via managed settings.
• Adds a Switch Account action to signed-in Copilot account controls, along with clearer labels, a simpler status display, and better navigation for long account lists.

Hacking Hardware · 2026-10-11

New program-ice40-flash applet programs SPI NOR Flash on iCE40 FPGA boards with reset assertion and CDONE verification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds glasgow run program-ice40-flash applet to program 25-series SPI NOR Flash memories on iCE40 FPGA boards, asserting the FPGA --reset pin during programming and checking the --done (CDONE) pin for successful FPGA configuration readback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --dual-spi and --quad-spi flags to use dual- or quad-SPI modes when present in SFDP, -f/--frequency to set SCK frequency in kHz (default: 12000), -A/--address-bytes (choices: 3, 4; default: 3) and -P/--page-size to control addressing width and page-boundary behaviour during programming, and --opcode-erase-256, --opcode-erase-4k, --opcode-erase-8k, --opcode-erase-32k, and --opcode-erase-64k to override erase opcodes for non-standard Flash devices.
• Adds erase (erase an aligned address/length range), erase-all (erase the entire chip), identify (read JEDEC ID and SFDP parameters, with --annotate-raw-sfdp to decode known SFDP DWORDs into fields), protect (read or write Block Protection (BP) bits via a bitmask argument, e.g. 0000 to allow all, 1111 to protect all), read (read a memory range using the fastest available read command, with -f/--file to write output to a file), verify (read a memory range and compare against hex bytes via -d/--data or a file via -f/--file), and write (write a memory range via read-modify-write, no alignment required, accepting hex bytes via -d/--data or a file via -f/--file) subcommands.

Hacking Hardware · 2026-10-11

New memory-25q applet adds full SPI/dual-SPI/quad-SPI NOR Flash identify, read, write, erase, verify, and protect commands plus an offline transaction dissector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds glasgow run memory-25q identify subcommand to read JEDEC ID and Serial Flash Discoverable Parameters (SFDP), with --annotate-raw-sfdp to decode raw SFDP DWORDs field-by-field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds glasgow run memory-25q read subcommand with -f/--file <filename> to read a memory range using the fastest available read command and optionally write the output to a file.
• Adds glasgow run memory-25q verify subcommand with -d/--data <data> or -f/--file <filename> to read and byte-compare a memory range against known-good data.

SIEM · 2026-10-11

Google SecOps SIEM Search gains SQL/GoogleSQL dialect, natural-language query generation via Gemini, UDM Lookup, and data RBAC scope enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SQL (GoogleSQL) dialect to the query editor enabling BigQuery-compatible queries, multi-table joins across UDM and Entity Context Graph (ECG), and advanced aggregations; natural-language query generation via Gemini in the SIEM Search bar that converts English statements into YARA-L 2.0 queries with automatic time-range parameter adjustment; and UDM Lookup, letting analysts find UDM field names or stored string values and append results directly to a search query or copy them to the clipboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds chronicle.events.fetchEnrichedEvent, chronicle.savedSearches.update, chronicle.searchViews.update, chronicle.parsers.list, chronicle.parsers.get, chronicle.cases.get, and chronicle.cases.list as granular IAM permissions gating advanced search features.
• Enforces data RBAC scope filtering across all SIEM Search tabs, restricting UDM events, raw logs, alerts, detections, and cases to the scopes assigned to the user role.

SIEM · 2026-10-11

Google SecOps adds Terraform providers and client libraries for 14 Chronicle API resource types, and expands the roles/chronicle.restrictedDataAccessViewer IAM role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Terraform providers and Google Cloud client libraries for 14 Chronicle API resource types: Feeds, Parsers, Rules, Findings Refinements, Retrohunts, Dashboards, Data Tables, Watchlists, Custom Lists, Environments, Environment Groups, Data Export, SOAR Domains, and SOAR Networks — enabling infrastructure-as-code provisioning and custom workflow automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands the roles/chronicle.restrictedDataAccessViewer IAM role to include all read-only permissions from roles/chronicle.viewer, except chronicle.globalDataAccessScopes.permit, covering SOAR cases and playbooks, investigations, threat collections, findings, security validation, and ingestion resources within assigned data access scopes.

Secrets Detection & Management · 2026-10-11

API surface changed: +18 endpoints, 21 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v1/app-connections/hpe-ilo/{connectionId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /api/v2/secret-rotations/gcp-service-account-key/{rotationId}
• New endpoint GET /api/v1/app-connections/hpe-ilo

Web Application Security · 2026-10-11

Adds NextGen B2B API v2.0.0 at /b2b/v2 with a JSON-based POST /orders endpoint replacing legacy XML endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /b2b/v2/orders endpoint (createCustomerOrder) accepting a JSON Order body (requiring cid, optional orderLines / orderLinesData) and returning an OrderConfirmation with cid, orderNo, and paymentDue (date, 14-day terms); secured with JWT Bearer auth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the NextGen B2B API v2.0.0 at base path /b2b/v2, a JSON-based enterprise ordering API that deprecates the previously offered XML-based endpoints.

AI/LLM Security · 2026-10-11

Knostic releases Auto Patcher for OpenAnt, adding an evidence layer and Trust Report to AI-generated vulnerability patches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Auto Patcher for OpenAnt, an open-source vulnerability discovery and remediation harness that investigates a vulnerability and its repository, generates a candidate fix, challenges its own conclusions, and produces a Trust Report bundling the patch, collected evidence, and a recommendation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a Trust Report output that surfaces what was verified and what remains unknown after autonomous patch generation, providing an evidence infrastructure for AI-generated code.

Threat Intelligence · 2026-10-11

Recorded Future launches AI Infrastructure Indicator Lists — curated IP, CIDR, and domain feeds for shadow AI discovery and policy enforcement, free with Cyber Operations lic⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds two new curated indicator lists — AI Infrastructure and Chinese AI Infrastructure — containing IP addresses, CIDR ranges, and domains with Risk Scores and Comment fields (provider, verification date, association method) for identifying AI-related network traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes AI Infrastructure Indicator Lists via the List API, with daily retrieval recommended and weekly list refresh cadence.
• Each indicator's Comment field encodes service attribution, verification date, and association method (Live JSON, Official documentation, BGP/WHOIS, or Community/OSINT) to support per-vendor enforcement policies rather than flat block rules.

Threat Intelligence · 2026-10-11

Recorded Future adds company-search API endpoint to discover and triage Company entities by risk score, industry, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /company-search endpoint to search the Recorded Future Intelligence Cloud for Company entities using freetext name search and structured filters including riskScore (numeric range, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ [50,)), riskRule, industry, domicile (country entity ID), parent (parent company ID), and list (list ID).
• Supports date filters firstSeen and lastSeen, sorting via orderBy (riskscore, criticality, firstseen, lastseen) and direction (asc, desc) on the company-search endpoint.
• Returns paginated results (offset-based, limit max 1,000, limit + from cannot exceed 10,000; default limit of 10) with matching company entities, risk assessment data, and timestamps under data.results, with counts as a sibling of data.

Email Security · 2026-10-11

Email Security · 2026-10-11

Rspamd 4.2.2 adds multi-currency crypto-wallet detection and fixes metadata_exporter schema validation, known_senders TTL enforcement, and milter_headers scoping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Replaces rules/bitcoin.lua with rules/crypto.lua, adding new detection symbols CRYPTO_ADDR_CHECK, LITECOIN_ADDR, DOGECOIN_ADDR, TRON_ADDR, XRP_ADDR, ZCASH_ADDR, CARDANO_ADDR, COSMOS_ADDR, STELLAR_ADDR, TON_ADDR (checksum-verified), plus format-only symbols ETHEREUM_ADDR_MAYBE and MONERO_ADDR_MAYBE; LEAKED_PASSWORD_SCAM (score 7.0) now fires for every checksum-verifiable currency, not Bitcoin only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds schema validation on load in metadata_exporter for the built-in backends (http, send_mail, redis_pubsub, redis_stream, redis_list, json_raw_tcp): rules with unknown keys or wrong-typed values are now disabled rather than silently accepted; the module is disabled if no valid rule remains.
• Activates reply_sender_privacy, reply_sender_privacy_alg, reply_sender_privacy_prefix, and reply_sender_privacy_length in both the replies and known_senders modules, which previously read these options under the wrong config prefix and ignored them.

Email Security · 2026-10-11

Rspamd 4.2.2 adds multi-currency crypto wallet detection, richer metadata_exporter templating, and new Lua API helpers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds crypto_addresses() selector extractor to expose detected wallet addresses from the new lua_crypto_addresses scanner, which replaces bitcoin.lua.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds add_from_string to lua_crypto_addresses to feed text recovered from attachments into the bounded wallet-address scanner.
• Adds mail_from, mail_to, helo, channel, and stream_key fields plus selector expansion and custom variables to metadata_exporter rules.

Reconnaissance & OSINT · 2026-10-11

Sara v1.4.0 rewrites its audit engine over the RouterOS API with 22 structured checks and adds a CVE lookup mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sara audit <IP> <USERNAME> command that connects over the RouterOS API (api-ssl, port 8729 by default) to check MikroTik router configuration for 22 named checks (MGMT-001 through WIFI-002), each returning severity, live evidence from the router, and a RouterOS fix command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --port flag to sara audit to target a non-standard RouterOS API port.
• Adds --plaintext flag to sara audit to switch from api-ssl (port 8729) to the unencrypted api service (port 8728).

Software Supply Chain Security · 2026-10-11

Socket reachability analysis gains broader facts-file support, Python/PyTorch precision improvements, and overhauled fix engines for Maven, Gradle, sbt, NuGet, Cargo, RubyGem⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Recognises Socket facts files matching any *.socket.facts.json naming pattern (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ pom.xml.socket.facts.json).
• JVM reachability analysis now uses the per-subproject classpath from the Socket CLI's compute-artifacts sidecar when one is provided.
• Socket Fix refuses a pnpm upgrade that needs a new version of a private package, and instructs the user to run it where the registry is reachable.

Software Supply Chain Security · 2026-10-11

StepSecurity adds AI agent skill inventory for developer machines and GitHub repos, with executable-content flags and CSV export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Agent Skills page in Dev Machine Guard (under IDE & AI Agents) that inventories AI agent skills across developer machines, scanning ~/.agents/skills, ~/.claude/skills, project-level skill folders, and skills.sh lock files across 18 AI coding agents including Claude Code, Codex, GitHub Copilot, Cursor, and Gemini CLI; adds code, hooks, and shell flags per skill to surface executable content, plus a command flag for Claude Code commands, filterable via Has code, Has hooks, and Shell execution filters in both inventory views; adds Provenance tracing for skills.sh-managed skills, surfacing upstream source, ref, path, upstream folder hash, and the skills-lock.json file; supports CSV export of the full Dev Machine Guard agent skills inventory; adds notifications for new agent skills detected after a device's initial baseline, with per-device alerts; and surfaces content-hash comparison across devices so practitioners can identify installations where the same skill's SKILL.md content differs between machines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Agent Skills page under GitHub that scans the default branch of each non-archived repository in your organization daily, detecting skills in folders such as .claude/skills, .cursor/skills, .windsurf/skills, and .agents/skills; adds a Declared Behavior panel for GitHub repository skills showing frontmatter details including pre-approved tools (e.g., Read, Write, Bash), invocation restrictions (no model invocation, not user invocable), forked subagent context, and model overrides; and labels repository skills with invalid yaml when frontmatter cannot be parsed, and symlink when the skill folder is reached through a symbolic link.

Software Supply Chain Security · 2026-10-11

Harden-Runner gains GitHub Enterprise Server support, macOS deny-list egress, and namespace-scoped RBAC for ARC on Kubernetes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds customer and server-name inputs to the step-security/harden-runner Action (v2.22.0) to enable Harden-Runner on GitHub Enterprise Server environments, required for TLS inspection, policy fetching, and agent deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds deploy-on-self-hosted-vm: true input to deploy the agent directly on an ephemeral self-hosted Linux VM at workflow runtime, for cases where baking the agent into the VM image is not possible.
• Extends the denied-endpoints input to macOS runners, enabling deny-list egress policy on macOS to block specific destinations while leaving all others reachable.

Email Security · 2026-10-11

API surface changed: +4 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /v0/dlp/release-requests⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /v0/dlp/release-requests/{id}
• New endpoint POST /v0/dlp/release-requests/{id}/approve

Attack Surface & Exposure Management · 2026-10-11

syzkaller gains batch task execution for syz-aflow, multi-API-key Gemini support, and new Linux syscall descriptions for Landlock and SCTP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds batch task execution to tools/syz-aflow, allowing multiple .json task files from a directory to be run in parallel with per-task log isolation, records executed seeds as trajectory span artifacts, and collects results and executed programs into a corpus.db.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for multiple API keys in pkg/aflow/backend/gemini, enabling load distribution across Gemini API keys.
• Adds sys/linux descriptions for the Landlock no_new_privs flag (with a corresponding test in sys/linux/test), missing SCTP socket options, and rnull configfs device creation, and improves Rust binder descriptions in sys/linux.

Identity & Access Management · 2026-10-11

Compliance Automation & Trust Management · 2026-10-11

API surface changed: +3 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /groups/{groupId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /custom-assets
• New endpoint GET /risk-scenarios/{riskScenarioId}/mappings/enterprise-risk

WAF, Bot & API Protection · 2026-10-10

Arcjet adds server-side threat intel for outbound hosts and sensitive-info detection via Remote Policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds arcjet.GuardPolicyServerString, arcjet.GuardPolicyServerBoolean, arcjet.GuardPolicyServerInteger, arcjet.GuardPolicyServerNumber, arcjet.GuardPolicyServerStringList, and arcjet.GuardPolicyLocalString constructor functions in Go for defining typed Remote Policy inputs (requires arcjet-go v1.2.0 or later).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Arcjet threat intel (IP threat) as a Remote Policy input type: supply a string or string list of hosts and Arcjet scores each with the same risk assessment used for HTTP callers, writing results to signals.ip_threat.dest.risk_level with values 'high' or 'critical'.
• Adds server-side sensitive information detection in Remote Policies, screening values up to 2 KB and writing results to the 'malicious-destination' field.

WAF, Bot & API Protection · 2026-10-10

Arcjet launches Agent Guards: per-action runtime policies for AI agents covering email, refunds, DB calls, MCP servers, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @arcjet/guard (JavaScript/TypeScript) and arcjet.guard (Python) packages plus github.com/arcjet/arcjet-go (Go) to instrument agent tool calls with the guard() function, which evaluates a named Guard policy before an action runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces action labels (e.g., email.sent, refund.issued) that route each guard() call to its published Guard policy, with typed SERVER or LOCAL inputs — LOCAL inputs are evaluated entirely in-process and only a digest leaves the SDK.
• Adds prompt-injection detection over a SERVER string input and sensitive-information detection over either LOCAL or SERVER strings as declarable Guard policy detectors.

WAF, Bot & API Protection · 2026-10-10

Arcjet now secures AI agent tool calls — including Claude Code, Copilot, Codex, Cursor, and Muse Code — via their existing hooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ALLOW/DENY decision enforcement on AI agent tool calls via Arcjet SDKs, and via native hooks in Claude Code, Copilot, Codex, Cursor, and Muse Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Digital Forensics & Incident Response · 2026-10-10

General Utilities & Libraries · 2026-10-10

Axel gains smarter filename handling: RFC 8187 decoding, filename* preference, and truncation for Content-Disposition headers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports decoding of RFC 8187 extended parameters in HTTP Content-Disposition headers for accurate non-ASCII filename extraction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an internal HTTP header parameter parser to support structured Content-Disposition field handling.

Attack Surface & Exposure Management · 2026-10-10

Axonius adds a Text dashboard widget with Markdown support, rich formatting, and hyperlink navigation to internal or external URLs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Text widget for dashboards that supports Markdown syntax (headings #–######, **bold**, *italic*, ~~strikethrough~~, bullet lists with - or *, and ordered lists) with live conversion as you type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds clickable hyperlink support in Text widgets, distinguishing external paths (http:// or https://, opening in a new tab) from relative paths (interpreted against the Axonius instance URL for internal navigation).
• Adds a Text widget to display static text, titles, or section dividers on dashboards with toolbar controls for size, color, bold, italics, and alignment, plus optional transparent background and chart title visibility.

Attack Surface & Exposure Management · 2026-10-10

Axonius adds a Field Segmentation chart widget supporting histogram, pie, timeline, and table views with threshold coloring and CSV export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Field Segmentation chart widget that segments asset query results by any chosen field, displayed as a histogram, pie chart, timeline, or table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Case-sensitive segmentation toggle so that string values differing only by case (e.g. JOHN, John, JoHn) are treated as the same or distinct segment.
• Adds Set maximum segments to display option for bar charts (default 10, max 20), with an Aggregate remaining segments as 'Others' toggle to roll up overflow segments into a named bucket.

Attack Surface & Exposure Management · 2026-10-10

Axonius Asset Graph gains customizable node labels with per-adapter field selection and system-default persistence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Customize Nodes control on the Asset Graph page that lets practitioners select an adapter and field whose value becomes the node label for each asset type (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ device owner name or email address).
• Supports setting custom node-label selections as the system default via Set as system default, so all assets of that type are labeled with the chosen field value across sessions.
• Provides a Reset to system default action to clear all custom label settings and revert the graph to system defaults.

Attack Surface & Exposure Management · 2026-10-10

Axonius adds UI-based import/export of saved queries as JSON files, preserving folder structure across environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Export Queries action in the query table action menu to download one or more saved queries (plus their folder structure) as a JSON file to your local machine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Import button above the Query Table to load a previously exported query JSON file, auto-creating missing parent folders and overwriting same-named queries.
• Imported queries automatically inherit the privacy status (Private, Public, or Shared) of their destination folder, preventing accidental exposure of sensitive queries.

Attack Surface & Exposure Management · 2026-10-10

Axonius adds hierarchical query folder management with archiving, drag-and-drop moves, and permission-aware organization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a collapsible folder pane on the Queries page to organize saved queries into nested folders up to 5 levels deep.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Provides default system folders — All Queries, Shared Queries, Predefined Queries, My Private Queries, Asset Scope Queries, and Archive — each with distinct access and editability rules.
• Enables creating, renaming, and deleting custom folders via a 3-dot context menu on any user-created folder.

Privileged Access Management · 2026-10-10

BeyondTrust Pathfinder adds regional data residency for PII authentication data, with org-level, user-level, and IdP-level region controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Data Residency section under Organization Settings letting organization administrators select a PII storage region (US East, Canada, Brazil, UK, Germany, India, Singapore, or Australia) for all users, triggering a background migration of existing user records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Data residency region field in Administration > User Management > Edit User to place a single user's PII authentication data in a region that overrides the organization region.
• Adds identity provider region setting in Identity & Authentication Providers > Edit Identity Provider (and Directory Authentication > Edit Directory Provider) to control which region newly auto-provisioned SAML or directory users are stored in at first sign-in.

Privileged Access Management · 2026-10-10

BeyondTrust Pathfinder adds a PII Region selector on identity provider registration to control where user authentication data is stored.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a PII Region field to the identity provider Manual Entry tab in BeyondTrust Pathfinder, letting admins choose which data-residency region stores the PII authentication data for users created via that IdP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Privileged Access Management · 2026-10-10

BeyondTrust adds Pathfinder Authentication API for managing IP allowlists and auth settings via REST.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New https://api.beyondtrust.io/platform/auth base URL exposes the Pathfinder Authentication API for managing organization-level authentication settings via REST.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds IP allowlist API under https://api.beyondtrust.io/platform/auth to manage allowed IP addresses and ranges and toggle enforcement on or off.
• Authenticates API requests via Authorization: Bearer <token> using a personal access token (PAT) scoped to an organization administrator.

Attack Surface & Exposure Management · 2026-10-10

Censys API now supports Personal Access Tokens and Service Accounts for application authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Personal Access Token (PAT) authentication for the Censys API, enabling secure programmatic access without exposing user credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Service Accounts support to connect applications with Censys Platform APIs without using a personal user account.

Attack Surface & Exposure Management · 2026-10-10

Censys adds two CensEye pivot analysis API endpoints for hosts, web properties, and certificates⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an asynchronous CensEye pivot analysis job endpoint that extracts default pivot fields from a target host, web property, or certificate, counts matching documents per field-value pair, and returns results via a poll-then-retrieve workflow (44 credits for a host, 28 for a web property, 7 for a certificate).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a web-asset count endpoint that accepts custom field-value pair combinations — bypassing the UI defaults — and charges one credit per count condition (array of objects).

Attack Surface & Exposure Management · 2026-10-10

Censys adds AI Investigations: automated multi-indicator analysis with parallel pivoting, ranking, and formatted reports via UI or API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New Investigations: Create job API endpoint lets practitioners launch AI Investigations programmatically, subject to the same 150-per-week org limit that applies to UI-started jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports up to 100 indicators per investigation and up to 5 concurrent AI investigations per user, with a 150-investigation-per-week org-wide ceiling across UI and API.

Attack Surface & Exposure Management · 2026-10-10

Censys Platform adds organization-level service accounts with OAuth 2 client credentials flow for API integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Platform service accounts, managed at the organization level under Organization Settings > Service Accounts, enabling applications to authenticate to Platform APIs via OAuth 2 client credentials flow without consuming a user seat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Service account credit usage can be retrieved via the get user credit usage API endpoint, since it is not yet visible on the Credit Management page in the Platform web console.
• Service accounts support integration with third-party tools (e.g., SentinelOne) by configuring OAuth as the authentication type, client credentials as the grant type, and supplying the client ID, client secret, and access token URL.

Attack Surface & Exposure Management · 2026-10-10

Censys Platform introduces granular role-based access control with six named roles across platform-wide and module scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Platform Admin role covering billing, user and role management, audit log, AI privacy configuration, authentication settings, and account management APIs — does not consume a module seat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds API Access permission granting Platform API endpoint access scoped to a user's module and role combination, enabling users to generate, edit, and delete Personal Access Tokens without consuming a seat.
• Adds Global Search - Analyst module role as the default for new members, granting access to search, collections, history, Adversary Investigation, and Critical Infrastructure modules.

Attack Surface & Exposure Management · 2026-10-10

Censys Platform Admins can now enforce MFA org-wide and reset individual user MFA configurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Platform Admins to require MFA for all organization users to access the Censys Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables Platform Admins to reset the MFA configuration of individual users in their organization.

Container & Image Security · 2026-10-10

Chainguard Libraries adds direct lockfile verification via chainctl libraries verify for JavaScript projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports verifying a JavaScript lockfile directly with chainctl libraries verify package-lock.json, without installing dependencies first.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Integrated & IT Risk Management · 2026-10-10

CISO Assistant v4.1.1 adds EBIOS RM on MCP, third-party tiering, PIPL/PI and OWASP SAMM frameworks, and a visual framework aggregator.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands MCP server with asset objectives/capabilities, entity relationship, and list_objects types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds risk owner capabilities to the MCP server.
• Makes advanced EBIOS RM available on the MCP server.

Identity & Access Management · 2026-10-10

Clerk adds challenge-based blocking for sign-ups that appear automated or originate from VPNs, Tor, or proxies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Challenges suspicious sign-ups that appear automated or originate from VPNs, Tor, or proxies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-10-10

Cloudflare Workers AI adds 14 new models including Cloudflare's own Clef decision model family, Bria image/video tools, and new LLMs from Anthropic, Google, and OpenAI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds clef, clef-flash, and clef-omni — Cloudflare's own multimodal decision models (27B, 9B, and 30B-MoE 3B-active respectively) that accept text, JSON, images, audio, or video as state input and return probabilities across typed question schemas.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds fibo-edit-1.5 from Bria — edits one to four images from a natural-language or structured JSON (VGL) instruction, supporting partial edits via black-and-white mask and multi-image style transfer.
• Adds fibo-generate-1.5 from Bria — generates images from text prompts or reference images at 1MP or 4MP in nine aspect ratios, returning the seed and VGL prompt used so results can be exactly reproduced or refined.

Internet Services · 2026-10-10

Cloudflare adds cf.appsec.request.failed_detections field, @cf/cloudflare/clef-omni multimodal model, createBatch() for Workflows, and MCP skills discovery⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cf.appsec.request.failed_detections field (type Array<String>) to Custom rules, Rate limiting rules, and Request Header Transform Rules — returns detection IDs for failures from content scanning, WAF attack score, leaked credentials, and AI prompt detections (PII, prompt injection, custom/unsafe topics)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds @cf/cloudflare/clef-omni to Workers AI — a 30B-parameter MoE decision model accepting audio (WAV/MP3), videos (MP4/WebM), images, and text in a single request at $0.150 per million input tokens with a 64K context window
• Adds createBatch() options-object form to Cloudflare Workflows, creating up to 100 instances in one call via count (shared options, generated IDs) or instances (per-instance IDs and params); requires Wrangler 4.148.0 or later for local dev and wrangler types

Internet Services · 2026-10-10

Cloudflare API v7.12.0 adds Nameserver Sets, Monetization rules, D1 undelete, Basin Catalog, K2 streams, Mesh nodes, and AI Search endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Nameserver Sets CRUD endpoints at /accounts/{account_id}/dns_settings/nameserver_sets and /accounts/{account_id}/dns_settings/nameserver_sets/{nameserver_set_id} for managing custom nameserver sets per account.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Monetization API endpoints under /zones/{zone_id}/monetization/rules (and /{rule_id}) to list, deploy, update, get, and delete payment rules and rulesets.
• Adds POST /accounts/{account_id}/d1/database/{database_id}/undelete to restore a deleted D1 database.

Internet Services · 2026-10-10

Cloudflare adds MCP skills server, batch Workflow instances, R2 location bandwidth, and Clef-omni multimodal AI model⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds failed detections field in Rules to control how rules handle requests based on reported detection failures.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports creating up to 100 Workflow instances at once by count or from a list via batch API, with per-instance error reporting in the result.
• Adds R2 bandwidth analytics broken down by the Cloudflare location that served each request.

SAST / SCA / Code Security · 2026-10-10

Corridor adds Agent Steering MCP tool that injects project-specific security guidance into AI coding assistants before code generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Corridor Agent Steering MCP tool that AI coding assistants call before generating code, supplying project-specific security context from guardrails and context documents to prevent vulnerabilities at the point of code generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-10

Corridor adds a Guardrail Maintenance scheduled agent that writes and updates guardrails and builds a Repository Threat Model context item.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Guardrail Maintenance scheduled agent that writes and updates guardrails, adds coverage for new product surface, and retires true duplicates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Repository Threat Model context item written by the Guardrail Maintenance agent, used by Corridor Agent Steering and pull request review to steer coding agents toward more secure code.

SAST / SCA / Code Security · 2026-10-10

Corridor adds Agent Steering to guide AI coding agents like Claude Code and Cursor with project-specific security guardrails before code is written.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the analyzePlan tool via the Corridor MCP server, which AI coding agents call before generating code — accepting plan, cwd, branch, commit_hash, and has_unstaged_changes parameters to return project-specific security context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Claude Code, Cursor, and other MCP-compatible AI coding agents as targets for pre-generation security steering.
• Delivers relevant guardrails and context documents to the agent at plan time, so security guidance is applied before code is written rather than flagged afterward.

Web Application Security · 2026-10-10

Dalfox adds OpenAPI/Postman input modes, --min-confidence filtering, --base-url, URL allow/exclude regex flags, and SARIF output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openapi input mode supporting OpenAPI 3.x / Swagger 2.0 in JSON or YAML format, letting Dalfox drive scans directly from API specs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds postman input mode supporting Postman Collection v2.1, letting Dalfox drive scans from exported Postman collections.
• Adds --base-url flag (required for openapi and postman modes) to set the scheme, host, port, and path prefix for all requests; must be an absolute http(s) URL.

Web Application Security · 2026-10-10

Dalfox MCP integration gains OAST blind XSS, session-loss detection, confidence filtering, and scan warnings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds blind_oob parameter to the MCP scan job to enable managed OAST (interactsh) blind XSS detection — pass an empty value for the public mesh or a list of hosts such as ["oast.fun"]; Dalfox registers, correlates callbacks to payloads, and polls automatically, surfacing findings with detection_method: "oob" without a separate listener.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds blind_oob_wait parameter (default unspecified) to control how long OAST polling continues after the scan's last request.
• Adds session_check (a regex that must keep matching an authenticated response) and session_check_url (a cheap authed endpoint, must be http(s)) to enable session-loss detection in MCP scan jobs without requiring cookies; an invalid regex or non-http(s) URL is an error.

Web Application Security · 2026-10-10

Dalfox: Adds min_confidence job option to filter low-confidence results server-side, equivalent to CLI's --min-confidence flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds blind_oob job option for managed OAST (interactsh) out-of-band detection in server/MCP mode: pass true for the public mesh or a list of hosts (e.g. ["oast.fun","oast.me"]), correlating each callback to its payload and promoting it to a V finding with detection_method: 'oob'.

Web Application Security · 2026-10-10

Dalfox adds --min-confidence to filter low-confidence XSS findings before output, exit codes, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --min-confidence high CLI flag to drop low-confidence findings before output, exit codes, per-target counts in target_summary, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds min_confidence key to the config file, REST API, and MCP to apply the same confidence filter declaratively.
• Adds meta.min_confidence field reporting {level, dropped} in results, so a clean target filtered by confidence can be distinguished from one that found nothing.

Web Application Security · 2026-10-10

Dalfox 3.2.4 adds --min-confidence filtering and a per-character probe disposition field to findings output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --min-confidence high flag to drop low-confidence findings before output, exit-code evaluation, and display cutoffs, with meta.min_confidence: {"level": "high", "dropped": N} written to the JSON/JSONL envelope so filtered-clean targets are never mistaken for untested ones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a per-finding character-disposition field showing how each probed special character was treated — allowed (reflected raw), encoded (HTML entity or %HH), blocked (stripped), or escaped (backslash-escaped) — present on reflection and DOM-verification findings; omitted on AST, HPP, stored, and OOB findings.
• Emits a Warning: to stderr naming any flag that silently switches off output when passed on the command line.

Web Application Security · 2026-10-10

Dalfox adds OpenAPI 3.x, Swagger 2.0, and Postman Collection scanning via -i openapi and -i postman flags⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -i openapi flag to scan every endpoint defined in an OpenAPI 3.x (JSON or YAML) or Swagger 2.0 spec, building targets from paths, methods, query/header/cookie parameters, and request bodies (JSON, form, multipart, XML).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -i postman flag to scan every request in a Postman Collection v2.1 export, resolving {{variables}} from the collection's variable list and mapping raw, urlencoded, formdata, and graphql body modes.
• Adds --base-url flag to redirect OpenAPI or Postman scans to a different deployment (e.g. staging), replacing the spec's scheme, host, and port while preserving the server path.

Web Application Security · 2026-10-10

Dalfox: Adds openapi and postman scan modes accepting OpenAPI 3.x / Swagger 2.0 (JSON or YAML) and Postman Collection v2.1 as input targets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports loading cookies from a raw HTTP request file, replacing same-named cookies from other sources; an unreadable or missing file is fatal.

SIEM · 2026-10-10

Databricks AI Functions adds ai_decide for evaluating questions against text or structured data with probability/choice/score output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ai_decide SQL function and REST API to evaluate questions against text or structured data and return probabilities, choices, or scores.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-10

Genie One gains secure sandbox code execution for advanced analyses beyond SQL (Public Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Genie One to run code in a secure, isolated sandbox for advanced analyses beyond SQL, using the user's existing Unity Catalog permissions and data access controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-10

Databricks adds OpenJev (Qwen3.5 4B) as a faster, token-free evaluator option for LLM-as-a-judge service policies (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenJev (Qwen3.5 4B) as a selectable evaluator model service in custom LLM-as-a-judge service policies, classifying content without generating output tokens for faster responses than a chat evaluator.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-10

Unity Gateway service policies can now enforce caller-supplied request tags before model requests or MCP tool calls proceed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Unity Gateway service policies to evaluate caller-supplied request tags, allowing policies to require a tag before a model request or MCP tool call proceeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-10

Datadog Cloud Security adds CISA KEV timestamps and remediation timeline values to vulnerability findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @vulnerability.cisa.kev_added_at timestamp field to vulnerability findings, recording when a CVE was added to the CISA KEV catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Computes and attaches a remediation timeline to each vulnerability finding, with values three_days_and_forensic_triage, three_days, fourteen_days, sixty_days, or fix_on_system_upgrade, plus a due date derived from that timeline.

SIEM · 2026-10-10

Datadog Cloud SIEM adds Entity Packs for user-risk scoring and expands Content Packs with 20+ new integrations including Oracle Fusion Applications and Zscaler Internet Acces⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Entity Packs — a new Content Pack category that identifies users in your environment, enabling user context in signals and risks, risk scoring per user, and user-based investigations (at least one Entity Pack is required to detect risky users).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Zscaler Internet Access as a supported Entity Pack integration for user identity and context in Cloud SIEM.
• Adds Oracle Fusion Applications as a supported integration, auditing user activity including sign-in events, target user changes, user role assignment changes, and metadata permission checks.

SIEM · 2026-10-10

Datadog Cloud SIEM gains a User Inventory view for triaging and investigating user activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a User Inventory page under Cloud SIEM's Triage and Investigate section, giving practitioners a dedicated view of users for security investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-10

Cloud SIEM's Risk Insights is now Entity Risks, adding federated user identity grouping, rolled-up risk scores, and user-identity notification rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Renames Risk Insights to Entity Risks and adds a dedicated Entity Risks page where entities can be filtered by provider, type, name, risk score, and configuration risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Group risk by User identity mode that resolves all accounts belonging to one person (email aliases, IAM users, assumed roles, repo accounts) into a single row with a summed risk score, after configuring an Entity Pack for Okta, Google Workspace, or Microsoft Entra ID.
• Adds user-identity notification rules (Group risk by: User identity) that trigger when one person's rolled-up risk score crosses a threshold, with template variables for display name, identity provider, rolled-up score, contributing entity count, and top contributing entities.

SIEM · 2026-10-10

Vulnerability Management · 2026-10-10

DefectDojo adds POST /api/v2/assets/bulk_update/ for moving and re-parenting up to 500 Assets at once, with dry-run support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /api/v2/assets/bulk_update/ endpoint to apply org moves, parent assignments, type changes, criticality, contacts, SLA, and tags to up to 500 Assets in one atomic request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds "dry_run": true field on POST /api/v2/assets/bulk_update/ to preview all field changes, subtree moves, removed parent links, and refused Assets before writing anything.
• Adds "move_children": false field on POST /api/v2/assets/bulk_update/ to move an Asset to another Organization without carrying its subtree — children become top-level Assets in the original Organization.

Vulnerability Management · 2026-10-10

DefectDojo Pro v3.4 adds two-way Jira sync, AI workflow nodes, Remediation Center, AI Inventory, new cloud connectors, and ten new languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables DD_SANDBOX_ENABLED on self-hosted instances to activate Sandbox Mode: a practice copy of DefectDojo Pro under /sandbox/ on its own database, preloaded with sample data, with Reset and Wipe for superusers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a beta Remediation Center module (feature flag remediation_center, off by default) that groups open findings by the change that resolves them, each action carrying a due date, risk, owner, workflow status, and the findings it will close.
• Adds a beta AI Inventory module (feature flag ai_inventory, off by default, requires Locations) that inventories coding assistants, MCP servers, models, AI packages, AI service endpoints, agent skills, and provider keys per repository, with governance policies marking each as authorized, unauthorized, or needs review, and exports a CycloneDX 1.6 AIBOM per asset.

Vulnerability Management · 2026-10-10

DefectDojo API token revocation endpoint returns 204 and notifies token owners, with UI lockout guidance added.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Token revocation endpoint returns 204 on success, deletes the token, clears any per-user expiry override, and notifies the token owner to generate a new token from the API v2 Token page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• When API tokens are disabled, the API v2 Token page in DefectDojo Pro displays the reason 'API tokens are disabled.' instead of a key, making the disabled state explicit to users.
• Adds guidance that the UI remains accessible via session authentication if the API is locked out, and a new token can be issued from the API v2 Token page without losing UI access.

Vulnerability Management · 2026-10-10

DefectDojo adds granular Integration permissions and splits Connectors into Upstream/Downstream pages for Pro instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Integration: View and Integration: Edit Global Role permissions to control who can see and manage Connectors, replacing broad superuser-only access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Splits the Connect sidebar into separate Connect > Upstream and Connect > Downstream pages, each visible only when the user holds the relevant Integration permission.
• Adds Manage Mappings and Assignments action per connector tile for connectors that open tickets, surfacing mapping controls directly from the connector list.

Reverse Engineering · 2026-10-10

Reverse Engineering · 2026-10-10

Reverse Engineering · 2026-10-10

Detect It Easy documents its PE heuristic engine with malware family coverage, structural triage verdicts, and --heuristicscan --verbose CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --heuristicscan together with --verbose to expose the fullest heuristic report, with evidence separated into [HEUR/Any], [HEUR/.NET], and [HEUR/EMU] categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Generic Heuristic Analysis engine (__GenericHeuristicAnalysis_By_DosX.7.sg) for PE files, reporting structural and behavioral anomalies beyond signature matching.
• Supports three-tier corrupted-data verdicts — Uncritical, Degraded, and Critical — describing the structural impact of image damage rather than only flagging a file as broken.

Reverse Engineering · 2026-10-10

Exploitation & C2 · 2026-10-10

DHCPig gains machine-readable CSV/verdict report output for lab and red-team workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds machine-readable verdicts to the report module for lab and red-team use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a dhcpig-web(1) man page alongside the existing dhcpig(1) entry.

Web Application Security · 2026-10-10

dirsearch wordlist docs surface template placeholders, --wordlist-categories, --wordlist-status, --wordlist-max-size, and backend selection⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --wordlist-categories flag to select bundled wordlist sets stored in db/categories/, including extensions, conf, vcs, backups, db, logs, keys, web, common, and the opt-in aggressive category (also reachable via the all selector).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --wordlist-status flag to preview resolved wordlist files and generated entry count before a scan runs.
• Adds --wordlist-max-size flag to cap the number of generated wordlist entries.

Web Application Security · 2026-10-10

dirsearch exposes a Python API (DirsearchFuzzer, FuzzerConfig, FuzzerResult, Wordlist*) and adds a --wordlist-status inspection mode⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exports DirsearchFuzzer, FuzzerConfig, FuzzerResult, Wordlist, WordlistState, and WordlistTemplate from lib.core.api for programmatic use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enforces Python 3.11 as the minimum required runtime, rejecting older interpreters at startup.

Reconnaissance & OSINT · 2026-10-10

dnsrecon now reads RT exchange fields and converts binary rdata to text for zone transfer records in JSON output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Reads RT (Route Through) exchange field in DNS records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-10

dnsrecon adds Shodan netblock expansion via --shodan, --shodan-active, --shodan-key flags and a REST API with DNSRECON_WORDLIST_DIRS wordlist control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --shodan, --shodan-active, and --shodan-key CLI flags to expand netblocks discovered via SPF (-s) and WHOIS (-w) using Shodan during standard enumeration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SHODAN_API_KEY environment variable as an alternative to passing the key via --shodan-key on the command line.
• Adds DNSRECON_WORDLIST_DIRS environment variable to specify additional directories (colon-separated on POSIX) from which REST API wordlist parameters may reference files.

Hacking Hardware · 2026-10-10

• Marauder v8 (marauder-v8) sold out at justcallmekokollc.com on 9 Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-10-10

evil-winrm gains a quit command, Ctrl+D exit support, Ruby 4.0 compatibility, and keepalive for idle WinRM shells.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds quit command and Ctrl+D exit support for cleanly leaving a WinRM session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Ruby 4.0 support.

SAST / SCA / Code Security · 2026-10-10

Copilot gains Claude Haiku 5.5, local sandboxing GA, multi-account app support, and /model discovery in CLI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /model command in GitHub Copilot CLI to discover and select supported models from a running local Ollama instance alongside configured and cloud models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces local sandboxing — now generally available in Copilot CLI, the Copilot app, and VS Code sessions using Agent Host — to limit agents' access to files, networks, and credentials at no extra cost.
• Enables use of separate GitHub accounts for a Copilot license and repository access in the Copilot app (e.g. enterprise-provided license paired with a personal repository account).

SAST / SCA / Code Security · 2026-10-10

CodeQL 2.27.2 adds a C++ regex parser, Rust extractor classes, new sink/flow models, and a macOS 27 build-mode restriction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --dil-constants flag to codeql query compile (used with --dump-dil) to include optimized constant tuple sets in emitted DIL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds !-prefixed entries (e.g. !github) to the trusted-owner set of the actions/unpinned-tag query so first-party unpinned tags are reportable.
• Adds ControlFlow::EntryNode, ControlFlow::ExitNode, and SwitchStmt.getExpr to the Go control-flow graph via the shared CFG library.

SAST / SCA / Code Security · 2026-10-10

GitHub Copilot code review gains org-level billing controls and an external-license gating toggle for review requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Choose how members with a Copilot license are billed setting under organization Copilot -> Policies, with options Member (default, bills member's own entitlement) and Organization (bills the repository-owning org via AI Credits paid usage, with optional budget).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Only allow Copilot code review to be triggered by authorized users toggle at the organization and repository level to block review requests made with external (e.g. personal) Copilot licenses.

Reconnaissance & OSINT · 2026-10-10

gowitness 3.2.1 adds arm64 Docker image targets for Linux, macOS, and Windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds arm64 targets to the official Docker images, enabling native container deployments on ARM64 hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Wireless & RF · 2026-10-10

hcxtools adds hcxeiutool, a new CLI for splitting wordlists into digit, hex-digit, alpha, and case-sensitive sub-lists via -i/-d/-x/-c/-s flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds hcxeiutool with -i <wordlist> to ingest a wordlist and split its entries into up to four character-class output files: -d (digits only), -x (hex digits only, deduped against digit-only and full-word lists), -c (alpha characters only), and -s (case-sensitive words, one per whitespace boundary).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Skips $HEX[…]-encoded entries automatically during wordlist processing, keeping output lists clean for downstream cracking tools.

Wireless & RF · 2026-10-10

hcxtools adds FT-PSK support via hashcat hash mode 2200x and gains hashcat hash-copy format conversion in hcoutin⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The new 22000 hash file format is not backwards compatible with hashcat builds before commit 6847f7793f9cf76a5f01dde85894e5645800a30f.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Wireless & RF · 2026-10-10

hcxtools: Adds support for FT-PSK (hash mode 2200x) in hcxtools, with all FT-PSK handling moved to this mode⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Increases AUTHLEN to 512 bytes, raising the authentication field size limit

Security Validation (BAS & Automated Pentest) · 2026-10-10

NodeZero WebApp Internal tests now require AWS Bedrock Runtime endpoints in us-east-1, us-east-2, and eu-central-1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bedrock-runtime.us-east-1.amazonaws.com, bedrock-runtime.us-east-2.amazonaws.com, and bedrock-runtime.eu-central-1.amazonaws.com to the required allowlist for WebApp Internal tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Deprecates *.docker.com, *.docker.io, and docker-images-prod.6aa30f8b08e16409b46e0173d6de2f56.r2.cloudflarestorage.com from the network requirements allowlist.

Web Application Security · 2026-10-10

humble 1.67 adds 7 new insecure checks, 1 fingerprint header, improved XML export, and 7 total new detection/feature items.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds 7 new insecure header checks, expanding deprecated/insecure-value detection coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds 1 new fingerprint header to the fingerprint detection database.
• Significantly improves XML export output.

Compliance Automation & Trust Management · 2026-10-10

Post-Exploitation · 2026-10-10

impacket gains LSA dump relay, LDAPS support for GetUserSPNs, MS-FSRVP/MS-SCMR protocols, MS-NEGOEX Phase 3, and trust-key improvements in secretsdump.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -ldaps flag to GetUserSPNs.py to query SPNs over LDAPS instead of plain LDAP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds LSA dump capability to the ntlmrelayx SMB attack module.
• Adds secretsdump output of trust keys to a dedicated .ntds.trustkeys file instead of mixing them with regular NTDS output.

Post-Exploitation · 2026-10-10

Impacket gains CES relay for ADCS, FAST armoring in getTGT.py, LSA dump in ntlmrelayx SMB attack, and MIT Kerberos interop⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds getTGT.py Kerberos FAST armoring support for Authentication Policy Silos⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds CES Relay support to the ADCS endpoint
• Adds MIT Kerberos AS reply and TGS request checksum handling in the krb5 layer for cross-realm interoperability

WAF, Bot & API Protection · 2026-10-10

Levo 1.2.135.7 adds in-product license status with expiry warnings and enforces web scan test budgets while capturing all distinct findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Surfaces license status — including expiry warnings, a grace period, and end-of-access enforcement — inside the product UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enforces a test budget for web application scans, ensuring scans finish within budget while recording every distinct finding.

Integrated & IT Risk Management · 2026-10-10

LogicGate launches a purpose-built Provision 29 compliance application with PwC, unifying risk taxonomy, control testing, and board reporting in one workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Provision 29 compliance application on the LogicGate AI GRC Platform, built in partnership with PwC, providing a unified workspace for risk taxonomy, assurance plans, and board-ready control-effectiveness reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports standalone deployment or integration on top of existing Enterprise Risk Management and Internal Audit Management applications, letting teams import existing risks and controls and flag them as material without reworking data.
• Provides a single board dashboard showing control effectiveness by domain (financial, operational, reporting, and compliance), open remediation, and testing coverage across all three lines of defense.

Digital Forensics & Incident Response · 2026-10-10

mac_apt v1.36.2 adds CALCULATOR and AKD plugins, new wifiagent.plist parsing, new XPdb location, and Safari tags support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CALCULATOR plugin to read calculator history from macOS artifacts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AKD plugin to read device and email alias info from Authkit daemon (com.apple.akd) databases.
• Adds parsing of wifiagent.plist for wifi artifact collection.

Wireless & RF · 2026-10-10

Adds --different flag to macchanger to guarantee a MAC address actually changes on randomization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --different option that retries MAC randomization if the newly selected address matches the current one, ensuring the address always changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exits with an error code if a requested MAC address change did not result in an actual change, using a post-change read as a double-check.

AI Security Posture & Discovery · 2026-10-10

Mend AI: Merges mergeable env options with RENOVATE_CONFIG, enabling environment-variable-based config to compose cleanly with the main config object.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a strong type for Containerbase's known tools in util/exec, improving type safety for tool execution.

Container & Image Security · 2026-10-10

Renovate now merges mergeable env options with RENOVATE_CONFIG and removes the Containerbase Sidecar image from the build process.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Merges mergeable env options with RENOVATE_CONFIG via new config behaviour (config: merge mergeable env options with RENOVATE_CONFIG)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Removes the Containerbase Sidecar image from the Docker build process (docker-build-process: remove Containerbase Sidecar image)

SAST / SCA / Code Security · 2026-10-10

Mend Platform adds zero-day alerts, a centralized Activity Log, account-level workflows, Invicti Platform DAST integration, and IDE-based suppression via Agentic Integrations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dedicated zero-day alerts for immediate awareness when your organization is vulnerable to emerging threats, toggleable per organization via My Profile → Email Notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enhances Automation Workflows email notifications to allow workflow creators to select specific users or groups as recipients for scan summary emails.
• Introduces a suppression tool in Agentic Integrations enabling single and bulk suppression or unsuppression of findings across SAST and SCA engines directly within IDE or AI agent workflows, with UI updates reflected within seconds.

SAST / SCA / Code Security · 2026-10-10

Mend Renovate now merges mergeable env options with RENOVATE_CONFIG and removes the Containerbase Sidecar image from the Docker build process.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Removes the Containerbase Sidecar image from the Docker build process, simplifying the container build pipeline.
• Adds a strong type for Containerbase's known tools in util/exec, improving type safety for tool invocations.

Threat Intelligence · 2026-10-10

MISP 2.5.50 adds phishunt.io feed, object-relation usage stats, Overmind UI overhaul, and migrates legacy discussions/templates to modern replacements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds objectRelationUsage statistics operation reporting how frequently relations are populated across MISP objects, grouped by the latest version of each object template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MISP.redis_host, Plugin.ZeroMQ_redis_host, and SimpleBackgroundJobs.redis_host settings as CLI-only — these can no longer be changed through the web interface or API, reducing risk from a compromised admin session.
• Restricts download_attachments_on_load setting to CLI-only configuration, removing it from the web interface and API.

Network Analysis & Monitoring · 2026-10-10

Netcap v0.13.0 adds cross-protocol evidence linking and capture-time DNS context with new CLI flags and a /api/evidence/related endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --evidence-links flag (env NC_EVIDENCE_LINKS) to enable/disable cross-protocol evidence linking in the web UI and via /api/evidence/related.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --dns-resolution-context flag (env NC_DNS_RESOLUTION_CONTEXT) to snapshot matched UDP DNS answers onto Connection records for use in capture-time detection rules.
• Adds --evidence-links-window flag (env NC_EVIDENCE_LINKS_WINDOW, default 1 h) to bound the maximum time between a DNS answer and a connection when linking evidence.

SAST / SCA / Code Security · 2026-10-10

Noir AI analyzer gains dry-run, scope control, sensitive-file opt-in, proxy/CA support, and an automatic endpoint optimizer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --ai-dry-run flag to list candidate files, request count, and token estimate without sending anything to the LLM — safe for CI auditing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --ai-scope flag accepting all (default) or unmatched to restrict AI analysis to files the static analyzer did not already cover.
• Adds --ai-include-sensitive flag to opt in to sending credentials files (.env*, *.pem, *.key, id_rsa*, .npmrc, *.tfvars, etc.) that are withheld by default.

SAST / SCA / Code Security · 2026-10-10

Noir adds --ai-key-file PATH for secure AI key injection and exposes NOIR_CONCURRENCY to tune worker count.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds NOIR_CONCURRENCY environment variable to control the worker count (default: CPU count, clamped to 4–32).
• Filtered exports retain cross-bucket context by keeping signals linked to their supporting evidence, with priority roll-up included when signals are selected explicitly.

SAST / SCA / Code Security · 2026-10-10

Noir's --ai-context flag now documents bucket cross-linking, an untrusted-field contract, and a published JSON Schema at schemas/ai-context.schema.json.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --ai-context=guards,sinks flag usage showing that derived signals (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ authz_absence) stay linked to their supporting buckets, and that selecting a signal keeps its evidence (e.g. ssrf keeps outbound_http sinks).
• Publishes the --ai-context output shape as a JSON Schema at schemas/ai-context.schema.json, with "x-noir-untrusted": true on untrusted fields and an open vocabulary for entry values.
• Every non-empty --ai-context output now carries "untrusted_fields": ["name", "path", "snippet"] to signal which fields come from the scanned repository and must be fenced from LLM instructions.

SAST / SCA / Code Security · 2026-10-10

noir: Adds --ai-provider flag to select the AI backend (openai, xai, github, anthropic, gemini, or any OpenAI-compatible URL) for endpoint analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --ai-model flag to specify the model name sent to the chosen provider (e.g. gpt-5.5).
• Adds NOIR_AI_KEY environment variable as an alternative way to supply the API key.

SAST / SCA / Code Security · 2026-10-10

SAST / SCA / Code Security · 2026-10-10

Noir adds support for Apache Thrift, Apigee, HAProxy, Hoppscotch, Hurl, KrakenD, Ocelot, Spring Cloud Gateway, Thunder Client, Tyk, and YARP specification formats⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Apache Thrift (THRIFT) as a supported API specification format for endpoint discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Apigee proxy bundle (CS) as a supported API specification format for endpoint discovery.
• Adds Spring Cloud Gateway config (PROPERTIES) as a supported API specification format for endpoint discovery.

SAST / SCA / Code Security · 2026-10-10

Noir adds framework and language detection for 60+ new targets including Apex, C web servers, Rust, Scala, and serverless platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Apex / Salesforce (REST, Aura, SOAP) as a supported language and framework target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ASP.NET Razor Pages / Blazor, ABP Framework, HotChocolate, WCF (WebGet/WebInvoke), and Wolverine.Http as .NET framework targets.
• Adds Absinthe (Elixir) as a supported framework target.

SAST / SCA / Code Security · 2026-10-10

SAST / SCA / Code Security · 2026-10-10

SAST / SCA / Code Security · 2026-10-10

Openlayer: Adds Export test configs from the table header overflow menu to export every test at once.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Copies carry over thresholds, cadence, and data settings; data-source selections and tags are not transferred, and column-specific settings are copied as-is but skipped at run time if target columns are missing.

Reconnaissance & OSINT · 2026-10-10

OpenOSINT v2.33.0 makes passive mode the default, adds a tool-call cap, and introduces per-tool noise labels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Switches the MCP server to passive mode by default, exposing 20 passive tools without --allow-active; all 25 tools require --allow-active to enable active investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a tool-call cap to limit the number of tool invocations per investigation session.
• Introduces per-tool noise labels so practitioners can identify which tools generate high-noise output.

Reconnaissance & OSINT · 2026-10-10

OpenOSINT v2.32.0 adds keyless geolocated news ingestion via the GDELT GKG feed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds keyless geolocated news ingestion from the GDELT GKG feed, requiring no API key to retrieve globally geolocated news events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Runtime Security · 2026-10-10

OpenSandbox 1.1.1 adds identity-bound filesystem ops, multi-overlay mounts, upstream proxy config, and tenant isolation across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds identity-bound filesystem operations via /v1/filesystem/{uid}/{gid} execd routes — backed by a per-request worker running with explicit Linux UID/GID credentials — exposed as files_with_identity (Python), filesWithIdentity (JavaScript, Kotlin, Go, C#) across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds [egress.upstream_proxy] config section (URL + optional authorization) that injects a chained upstream CONNECT proxy for both Docker and Kubernetes backends, with ca_cert_path (Docker) and ca_secret_name (Kubernetes) to trust private-CA https:// proxies without replacing the system trust store.
• Adds [docker] publish_host config key to bind bridge-mode sandbox ports to a specific host address (default 0.0.0.0), preventing the tokenless execd port from appearing on public interfaces when set to 127.0.0.1 or the Docker bridge gateway.

Runtime Security · 2026-10-10

OpenSandbox: Adds [egress.upstream_proxy] config section to chain sandbox egress through a corporate CONNECT proxy on Docker and Kubernetes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OPENSANDBOX_EGRESS_UPSTREAM_PROXY / _AUTH environment variables to route transparent-proxy egress through an upstream CONNECT proxy with SNI/Host-consistent authority and fail-closed startup validation.
• Adds osb template create|get|list|delete and osb snapshot ... CLI subcommands, plus --template and --snapshot-id flags on sandbox create, for template and snapshot management.
• Adds kubectl-style -f/--file flag to sandbox create and template create for full wire-format request files with strict unknown-field rejection.

AI/LLM Security · 2026-10-10

OpenShell v0.1.3 adds OCI provider, OCSF JSONL audit events, bearer passthrough, OTLP sandbox traces, Ctrl-D detach, and gateway capacity metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds feat(sandbox): add main restart policy — configure a restart policy for the primary sandbox process.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds feat(cli): detach sandbox sessions with Ctrl-D — press Ctrl-D to detach from a running sandbox session without terminating it.
• Adds feat(server): write gateway OCSF events to JSONL — the gateway now emits structured audit events in OCSF JSONL format.

Post-Exploitation · 2026-10-10

peirates adds hostpid-ptrace-breakout command to run a bounded host command via ptrace through a hostPID container⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds hostpid-ptrace-breakout command to run one operator-supplied command (/bin/sh -c) in the namespaces, credentials, and filesystem context of an explicitly selected disposable root process visible from a hostPID: true container, using PTRACE_SEIZE and PTRACE_INTERRUPT on Linux AMD64.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds hostpid-ptrace-breakout detection to container-escape-scan, checking for effective UID 0, matching visible-PID-1 PID and user namespaces, and effective CAP_SYS_PTRACE and CAP_SYS_ADMIN; reports as [blocked] or [candidate] in scan output.
• Supports piping input to hostpid-ptrace-breakout in direct module mode via peirates -c -m hostpid-ptrace-breakout, accepting PID, command, and PID-specific confirmation phrase (TRACE-DISPOSABLE-HOST-PROCESS-<PID>) from stdin.

Post-Exploitation · 2026-10-10

Peirates adds a ptrace-based container escape technique as a single-command execution primitive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a container escape technique using ptrace that executes a single command on the host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-10-10

peirates v1.1.33 adds nodes/proxy exec functionality for Kubernetes lateral movement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds nodes-proxy-exec functionality to execute commands through the Kubernetes nodes/proxy API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-10-10

peirates docs add eight new commands covering ConfigMap credential scanning and multiple container/host escape techniques⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scan-configmaps command to scan ConfigMaps for misplaced credentials⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds hostpid-breakout command to enter a node from a privileged hostPID container
• Adds container-escape-scan command to scan for container escape prerequisites

Post-Exploitation · 2026-10-10

Peirates gains container-escape modules, hostPID ptrace shell, core_pattern breakout, and ConfigMap identity scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds container escape assessment and breakout modules covering privileged hostPID, ptrace, and Docker socket techniques.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an interactive hostPID ptrace shell for container escape without requiring SYS_ADMIN.
• Adds a hostproc core_pattern breakout module for escaping containers via /proc/sys/kernel/core_pattern.

Identity & Access Management · 2026-10-10

DaVinci MFA Use Case Connector gains PingID Workforce auth capabilities including YubiKey, PingID Desktop, OATH token resync, and backup authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds extraOtpRequired error output to the Finish Device Registration capability's new OATH Token Resync toggle, prompting users for an additional verification code during time-drift resync of OATH hardware tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Update Device Nickname capability to the MFA Use Case Connector, enabling device renaming after registration when allowed by MFA policy.
• Adds YubiKey support to the MFA Use Case Connector with a dedicated device type for registration and dedicated outcome paths for authentication.

Digital Forensics & Incident Response · 2026-10-10

Plaso gains WinHTTP API error log parsing, granular SSH/syslog event data classes, and new storage/tagging APIs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds WinHTTPAPIErrorTextPlugin and WinHTTPAPIErrorEventData in plaso.parsers.text_plugins.winhttp_api_error to parse Windows HTTP API error logs, exposing fields including fault_code, extended_fault_code, extended_stream_identifier, stream_identifier, queue_name, requested_uri, and site_identifier.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SyslogSSHClosedConnectionEventData with is_authenticated and is_invalid_user attributes for richer SSH session close telemetry in syslog parsing.
• Adds SyslogSSHInvalidUserEventData class to plaso.parsers.text_plugins.syslog for dedicated tracking of invalid SSH user attempts.

Malware Analysis · 2026-10-10

Threat Intelligence · 2026-10-10

Recorded Future adds a GET endpoint that returns the full catalog of ~90 IP risk rules with criticality, descriptions, and live IP counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the IP Risk Rules endpoint that returns the complete catalog of ~90 IP risk rules — including rule name (the riskRule filter value), criticality level, description, and current count of IPs triggering each rule — with no parameters required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes riskRule filter values discoverable via the new endpoint for use with IP Address: Search and IP risk list downloads.
• Returns live IP counts per rule (ranging from zero to over 100 million) so practitioners can estimate result set sizes before downloading filtered risk lists.

Threat Intelligence · 2026-10-10

Recorded Future documents the IP Lookup endpoint with field-level control over enrichment categories including risk, AI insights, and scanner behavior.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v2/ip/{id} IP Lookup endpoint returning enrichment data for a single IP, controlled by a fields parameter; the IP entity ID format is ip: followed by the address (e.g., ip:1.2.3.4).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports entity,risk,aiInsights,links,intelCard,location as core triage fields, returning risk score (0-99), criticality label, triggered rule evidence with source citations, AI-generated analysis, MITRE ATT&CK techniques, threat actors, malware relationships, an Intelligence Card URL, and geolocation with ASN and network ownership.
• Supports dnsPortCert field for DNS resolutions and open ports, scanner field for scanning behavior verdicts and targeted countries, and riskyCIDRIPs field for other risky IPs in the same CIDR block.

Threat Intelligence · 2026-10-10

Recorded Future adds IP Search API endpoint with CIDR range, geolocation, risk-rule filtering, and optional enrichment fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /ip-search endpoint to search IP addresses by risk score range, riskRule, first/last seen dates, range (CIDR block or IP range, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ 64.227.176.0/20), and location (geography), returning up to 1,000 results per page.
• Adds fields parameter to control enrichment sections returned per IP result — including entity, risk, location, links, and aiInsights — defaulting to basic entity identification only when omitted.
• Adds orderBy and direction parameters (e.g. orderBy=riskscore&direction=desc) to sort results by risk score, recency, or hit counts.

Threat Intelligence · 2026-10-10

New POST /sources/publish-reports endpoint lets practitioners push threat intel reports into Recorded Future for async enrichment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a POST /sources/publish-reports endpoint to publish one or more threat intelligence reports to a custom source for asynchronous processing and enrichment by Recorded Future.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Requires at least one observable per report using Recorded Future's prefixed entity format: ip:, idn:, hash:, or url: prefixes for IPs, domains, hashes, and URLs respectively.
• Supports optional mitre: prefix for MITRE ATT&CK technique references, TLP classification for sharing controls, and malware / threatActor entity ID fields per report.

Threat Intelligence · 2026-10-10

Recorded Future adds sources-update API endpoint to update metadata on custom intelligence sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Returns the full updated source object including updatedAt timestamp; responds with 404 if the source UUID does not exist.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MCP Servers & Tooling · 2026-10-10

Runlayer 1.28.1158 adds MCP server autoscaling, agent-account API keys, Office add-in Shadow AI detection, and signed support-access encryption.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds infrastructure.scaling to the infrastructure module for scaling deployed MCP servers at a fixed replica count or autoscaled on CPU and network use, with each MCP session pinned to one replica.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds long-lived API keys for agent accounts, creatable from the Manage API keys menu, usable on the MCP gateway in place of the client credentials flow; unavailable when Require DPoP, Strict mode, or Enforce audience is on.
• Adds DEBUG_OPS_REQUEST_SIGNING_JWKS (Kubernetes Secret) and debug_ops_request_signing_jwks Terraform input (ECS) to supply trusted public signing keys for signed, encrypted support-access diagnostic requests; missing or unusable keys disable diagnostic access entirely.

Attack Surface & Exposure Management · 2026-10-10

Attack Surface & Exposure Management · 2026-10-10

Identity & Access Management · 2026-10-10

ServiceNow Service Catalog v5.4 replaces polling with ISC event triggers for real-time approval and access request status sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds five ISC event trigger subscriptions via https://{instance_name}.service-now.com/api/x_sap_intidn/isc_event_processor to push real-time state changes from Identity Security Cloud to ServiceNow, replacing timer-based polling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an ISC Backup Utility scheduled job to reconcile missed events during connectivity or event-delivery failures.
• Adds an ISC Event Processing Table Cleaner job to purge old event records, with a default retention period of 7 days configurable via the Data Management Policy.

Identity & Access Management · 2026-10-10

SailPoint Non-Employee Risk Management adds a Login Lookup Mode setting for collaboration portal SSO, enabling SAML assertion attribute matching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Login Lookup Mode setting on the collaboration portal SSO tab, letting administrators choose between NameID (default) and Assertion attribute matching to resolve SSO identity mapping failures when an IdP transforms or hashes the user identifier.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports assertion-attribute matching (for example, email) for both pre-provisioned (non-JIT) and JIT user flows, configurable through the admin UI and API.

Identity & Access Management · 2026-10-10

SailPoint adds a disconnected applications connector that automates provisioning and aggregation for web apps with no APIs via browser-extension recording.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the SailPoint connectivity browser extension to record administrator UI workflows once and replay them for automated provisioning, deprovisioning, and aggregation against web apps that expose no API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the disconnected applications connector as a new source type in Identity Security Cloud, bringing legacy web apps, custom internal tools, and API-less systems under centralized SailPoint governance.
• Enables zero-code connectivity by letting administrators map recorded UI inputs to SailPoint identity attributes (such as name or email) without writing custom scripts.

Identity & Access Management · 2026-10-10

SailPoint ARM adds SAP Fiori app tracking — Fiori IDs, usage, and risk rules now sit alongside transactions in reviews and reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Include Fiori Metadata on the SAP connection in the ARM agent (on by default for new connections) to activate Fiori app tracking via the ZARM_FIORI_META dictionary and ZARM_UTIL_DATA Launchpad plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Fiori intents with the [FAPP] prefix and OData services with the [SVC] prefix in rulebook risk definitions, alongside existing transaction codes.
• Adds a new Fiori report listing which roles and catalogs grant which Fiori apps and OData services, with or without usage, filterable by Fiori Application ID as a dedicated field.

SAST / SCA / Code Security · 2026-10-10

Semgrep adds Cursor Origin SCM support, AWS CodeArtifact private beta, scms broker config, and SLSA Level 3 Guardian binaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scms configuration field to Network Broker source code manager instances (GitHub, GitLab, Bitbucket, Azure DevOps) so private instances can be listed once instead of maintaining per-instance custom allowlists; requires Network Broker v0.47.0 or later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SEMGREP_GUARDIAN_AUTO_UPDATE=0 environment variable and auto_update: false key in guardian.yaml to opt out of Semgrep Guardian's new automatic self-update behavior.
• Adds Cursor Origin support: sync repositories, run Managed Scans, and see scan checks and finding comments directly in Cursor pull requests, configured from Semgrep onboarding or the Cursor app installation flow.

Reconnaissance & OSINT · 2026-10-10

sipsak gains -X continuous monitoring mode that runs until a SIP device failure is detected⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -X flag for continuous monitoring mode: keeps sending SIP messages until a failure occurs, ignoring RFC 3261 retransmission timers in favour of constant intervals — pair with -Z (interval in ms) and -D (max retries) for controlled polling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-10

Socket: Supports components that attribute dependencies to their subprojects' build files.

• Socket Fix for Python upgrades now regenerates uv, pip-compile and uv pip compile locks with the tool itself, and adds support for Poetry and Pipenv projects.

SIEM · 2026-10-10

Sumo Logic dashboards now auto-recalculate timeslice resolution when you zoom into a log panel time range.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dynamic timeslice drilldown to dashboard log panels: click and drag to zoom into a time range and Sumo Logic automatically recalculates the query's timeslice and re-fetches the panel at finer resolution, enabling spike and anomaly investigation without editing the underlying query.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-10

Endpoint Security (EDR/XDR) · 2026-10-10

Trend Vision One AI Scanner adds OWASP AISVS 1.0 scoring with per-level pass rates across all 27 testable requirements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new AISVS attack preset in the TrendAI Artifact Scanner wizard to exercise all 27 testable OWASP AISVS 1.0 requirements spanning prompt injection, output safety, memory, orchestration, and adversarial robustness.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Scores AI application scans against OWASP AISVS 1.0 at three ascending levels — Level 1 (baseline), Level 2 (sensitive data), and Level 3 (high-risk/critical) — each reporting a pass rate and a verdict of PASS, PASS (partially assessed), NOT ASSESSED, or FAIL.
• Surfaces AISVS scores in the dashboard, executive summary, and exported reports, with drill-down from each level to the individual requirement, a link to the standard, and a direct jump to the failed attack in the results table.

Endpoint Security (EDR/XDR) · 2026-10-10

AI Scanner gains time-series charts, per-scan timestamps, and a 180-day results retention window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Results over time and Attack success rate over time charts to the AI Scanner dashboard, showing distinct successful attacks broken down by severity across a selected target.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-day and per-scan view toggle to the AI Scanner dashboard time-series charts, letting you plot aggregated per-day or per-month series or drill into individual scan runs.
• Deduplicates successful attacks when multiple scans share a data point, filtering down to distinct results in the time-series view.

Endpoint Security (EDR/XDR) · 2026-10-10

AI Scanner gains mTLS client-certificate auth for custom AI endpoints, configured via target.custom.tls with cert_env, key_env, and ca_env.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds target.custom.tls config block with cert_env, key_env, and ca_env fields to supply client certificate and private key (PEM, via environment variables) for mTLS-authenticated custom AI endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports mTLS client-certificate authentication for custom AI endpoints, usable alone or combined with existing API key or cookie authentication.

SAST / SCA / Code Security · 2026-10-10

Veracode integrations gain IaC policy controls, Git metadata in scans, Veracode Fix for SCA in GitHub, and new platform-based install/schedule workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Java API wrapper v26.10.20.1 changes Git metadata collection so the repository URL in the Veracode application profile is updated only when -repourl is explicitly specified.

UNCATEGORIZED · 2026-10-10

vigolium v0.5.3 adds agent budgets, OAuth2 sessions, multi-tab crawling, finding lifecycle commands, and a new REST API v2 opt-in across 80+ new surfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --max-commands, --token-budget, and --max-cost-usd flags to cap agent run budgets (exit code 5 when exhausted).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --auth-file to agent swarm and agent autopilot for supplying credentials to agentic runs.
• Adds --preflight-timeout and --no-preflight flags to control agent provider ping behaviour.

Digital Forensics & Incident Response · 2026-10-10

Vinetto 0.9.15 parses Windows Thumbs.db and Thumbcache_*.db files across four operating modes with ESEDB cross-referencing and HTML reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -m [{f,d,r,a}] / --mode flag to select operating mode: f (single file), d (directory), r (recursive directory), or a (automatic Windows partition processing via well-known paths like Users/*/AppData/Local/Microsoft/Windows/Explorer/)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -e EDBFILE / --edb flag to cross-reference Thumb Cache IDs against a Windows.edb (ESEDB) file to recover original filenames; running -e without INFILE explores the ESEDB directly
• Adds -H / --htmlrep flag to write an HTML report to the directory specified by -o

Digital Forensics & Incident Response · 2026-10-10

Digital Forensics & Incident Response · 2026-10-10

vinetto: Adds -m/--mode flag accepting f, d, r, or a to control processing mode for files, directories, recursive trees, or automatic Windows partitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports automatic mode (-m a) that resolves Thumbcache_*.db files from BASE/Users/*/AppData/Local/Microsoft/Windows/Explorer/ and Windows.edb from BASE/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb without manual path specification.

Digital Forensics & Incident Response · 2026-10-10

Vinetto gains -i/--invert flag for color-negative Type 1 thumbnails and now prefers system-installed pyesedb over its bundled copy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -i/--invert flag to color-invert Type 1 thumbnail images (useful when Thumbs.db stores color negatives).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• ESEDB library loading now checks for a system-installed pyesedb before falling back to Vinetto's bundled version.
• Requires Python 3.7 or later and Pillow 9.0.0 or later; Python 2 compatibility code has been removed.

General Utilities & Libraries · 2026-10-10

xclip 0.14 PR adds -c for clipboard, -T for TARGETS, tab completion, and chunk-size fixes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -c as shorthand for -selection clipboard and -T as shorthand for -t TARGETS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tab completion for available targets when using -t TAB.
• Raises chunk sizes up to nearly the maximum the X display can handle (previously capped at 6%).

Exploitation & C2 · 2026-10-10

Yersinia gains cross-compilation support with custom libpcap and libnet paths for arm64 and mips64 targets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports cross-compiling yersinia out-of-the-box by specifying custom libpcap and libnet paths, enabling native arm64 and mips64 cross-compiled binary builds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-10-10

Yersinia re-enables DHCP Decline message support, verified via packet capture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports sending DHCP Decline messages, re-enabling previously disabled functionality verified with packet capture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-09

Aembit adds MCP credential injection, ES256 token validation, 2026-07-28 MCP spec support, and Ubuntu 26.04 LTS agent installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds upstream_call_timeout and matching list timeout config names to AEMBIT_MCP_GATEWAY_TIMEOUT; six previously accepted names (initialize, notifications_initialized, proactive_tools_list, reinit_initialize, reinit_notifications_initialized, reinit_tools_list) no longer take effect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends AEMBIT_MCP_GATEWAY_TIMEOUT with seven additional timeout names that tune prompts/list fanout, the fan-out cap, upstream calls, upstream session caching, and Multi Round-Trip Request backoff.
• MCP Identity Gateway (1.34.6034) validates access tokens signed with ES256 in addition to RS256.

Identity & Access Management · 2026-10-09

Auth0 Actions gain GA-level access token scope customization with Post Login support and read/write scope interfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes event.transaction.target_scopes in Actions to read the live target scope list, reflecting every change across chained Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds api.accessToken.addScope() restriction for third-party applications, where it is no longer available to prevent consent bypass.
• Promotes Access Token Scope Customization for Actions — including Add, Remove, Set, and Clear scope interfaces — to General Availability for Credentials Exchange Actions.

Attack Surface & Exposure Management · 2026-10-09

Axonius adds saved filters for dashboards, enabling per-user sticky filter views and system-default filters across all charts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Saved Filters to dashboards, letting users create named filters scoped to an asset type that apply automatically to every chart in the dashboard simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the ability to set a System Default saved filter per dashboard via the 3-dot menu > Set as System Default, giving teams a consistent starting view without overriding individual user selections.
• Saved filters are sticky per user — a selected filter persists across navigation sessions without requiring re-configuration each visit.

Attack Surface & Exposure Management · 2026-10-09

Axonius adds a Dashboard Manager page for centralized dashboard administration, folder organization, bulk export, and Data Scope Defaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Dashboard Manager page, a centralized table for creating, editing, deleting, searching, and filtering all dashboards across the system.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Organizes dashboards into permission-based folders: All Dashboards, Favorites, Data Scope Defaults, Public, Shared, Private, and Managed by Axonius, with support for subfolders under Public, Shared, and Private.
• Adds per-dashboard role permission controls with four levels: No Access, System Access, Viewer, and Editor.

Attack Surface & Exposure Management · 2026-10-09

Axonius: Supports exporting one or more Asset Graphs simultaneously to a single JSON file, saveable to any local or network location.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports importing one or more Asset Graphs from a JSON file, with each graph created individually in the Graphs list.

Attack Surface & Exposure Management · 2026-10-09

Axonius adds an Asset Graph Manager page for saving, organizing, duplicating, and managing asset graphs across folders and roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Asset Graph Manager page, accessible via Manage Asset Graphs in the upper-right corner of the Asset Graph page, for centralized management of all saved asset graphs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Folders pane to the Asset Graph Manager with built-in folders (All Graphs, Favorites, Public, Private) plus support for creating, renaming, deleting, and nesting custom folders under Public or Private (requires Manage dashboard folders permission).
• Adds a Graphs table displaying per-graph metadata: Name, Description, Investigation Steps (with hover-popup of steps), Tags, Access, Role Permissions, Module, Created By, Date Created, Last Updated, and Last Used By.

Attack Surface & Exposure Management · 2026-10-09

Axonius adds faster asset and user deletion settings for active connections, with per-connection or per-adapter granularity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new 'Delete devices and other assets that have not been returned from the source in the last X hours' fast-cutoff setting that deletes devices sooner when a connection is fetching successfully, independently of the standard deletion window.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new 'Delete users that have not been returned from the source in the last X hours' fast-cutoff setting that deletes users sooner when a connection is fetching successfully, independently of the standard user deletion window.
• Both fast-cutoff settings can be configured globally for all connections on an adapter or overridden per individual connection, and each must be set to a value lower than its corresponding standard deletion threshold.

Attack Surface & Exposure Management · 2026-10-09

Axonius Asset Graph now displays risk level indicators for SaaS applications, viewable via the Layers panel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds risk level indicators (low, medium, high) for SaaS applications displayed as icons on nodes in the Asset Graph, with visibility toggled from the Layers panel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-09

Axonius Asset Graph gains Organic and Hierarchical layout options to clarify relationship visualization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds two selectable layout modes to the Asset Graph — Organic (default, for complex non-hierarchical relationships) and Hierarchical (for parent-child and tiered structures) — accessible via the layout button in the lower-left corner of the Asset Graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-09

Axonius Asset Graph gains Explore Relationships drawer, unrelated-asset filtering, and custom relationship creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Explore Relationships drawer in the Asset Graph to show assets with specific relationships to a selected node, supporting asset types such as devices, software, tickets, and users, and relationships such as Relates to, Used by, Has, and Last used by.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Advanced Options section in the Explore Relationships drawer with a Select a relationship control, letting practitioners choose non-default relationships — including custom ones — for graph exploration.
• Adds an Unrelated option (alongside the default Related) under Advanced Options to surface assets that have no connection to the selected asset, enabling discovery of unmanaged assets.

Post-Exploitation · 2026-10-09

Attack Surface & Exposure Management · 2026-10-09

Censys ASM gains screenshots, redirect chains, network logs, and expanded software fingerprints for web entities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds screenshots for every web entity in inventory, captured at the time of the most recent scan and timestamped by Last Updated, enabling rapid identification of exposed login pages, admin panels, and potentially compromised infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds full redirect chain visibility on web entities to detect domain takeovers or incorrect redirect destinations.
• Adds network log view on web entities listing all resources loaded during a full DOM evaluation, including JS libraries, scripts, images, and stylesheets.

Attack Surface & Exposure Management · 2026-10-09

Censys adds AI Investigations: an AI-powered investigator that pivots across indicator history, related assets, and web profiles to produce a ranked findings report.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI Investigations, which analyzes indicators, pivots to related infrastructure, profiles web resources, checks entity history, and produces a ranked, formatted findings report — accessible from the threat-hunting page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-10-09

Cloudflare: Adds createBatch() to Cloudflare Workflows to create up to 100 Workflow instances in a single call with per-entry error reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Updates the set of unsafe topic detection categories in AI Security for Apps; values available in cf.llm.prompt.unsafe_topic_categories have changed — existing WAF custom rules referencing removed or renamed categories will no longer match.

Compliance Automation & Trust Management · 2026-10-09

Compliance Automation & Trust Management · 2026-10-09

AWS integration gains six new evidence areas including Config rules, CloudTrail, Backup, IAM credential reports, Access Analyzer, and Organizations SCPs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Staggers overnight integration syncs to start gradually instead of all at once, reducing database load during high-volume sync windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-09

Corellium 7.14 adds cluster-hosted MCP server for AI agent access, Mirror as a purchasable add-on, iPhone 18 support, and iOS/iPadOS 27 coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cluster-hosted Corellium MCP server — cloud customers get AI agent access immediately on login with no setup; self-hosted (SA/DA) customers get it bundled with their existing deployment, using existing Corellium credentials with full tenant isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds rate limiter on the MCP server keyed by authenticated caller rather than proxy address, and credential redaction from default conversational MCP results.
• Adds support for larger HTTP file uploads via the MCP server.

OT / ICS Security · 2026-10-09

CSET v13 adds EVCI assessment, CPG v2.0 with OT+IT split answers and heatmaps, light/dark mode, and a redesigned assessment gallery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the new EV Charging Infrastructure Assessment & Evaluation (EVCI) to the assessment gallery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds CPG v2.0 with a Technology Domain setting (IT, OT, or OT+IT) that lets each question be answered separately for IT and OT, plus answer heatmaps in the CPG report; sector-specific goals for Chemical and Information Technology sectors are retained.
• Adds light and dark theme support throughout the UI.

Web Application Security · 2026-10-09

Dalfox adds OpenAPI/Postman input modes, --min-confidence filtering, and --base-url for spec-driven scans⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openapi input mode supporting OpenAPI 3.x / Swagger 2.0 (JSON or YAML) as a scan target source⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds postman input mode supporting Postman Collection v2.1 as a scan target source
• Adds --base-url flag for openapi and postman modes to set the scheme, host, port, and path prefix for all requests in a spec (must be an absolute http(s) URL)

Web Application Security · 2026-10-09

Dalfox MCP integration gains OAST blind XSS via blind_oob, session-loss detection via session_check/session_check_url, confidence filtering via min_confidence, and a⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds blind_oob parameter to the MCP scan job to enable managed OAST (interactsh) blind XSS detection — pass an empty value for the public mesh or a list such as ["oast.fun"] for self-hosted hosts; Dalfox registers, correlates each callback to its payload, and polls automatically, surfacing results as findings with detection_method: "oob" without requiring a separate listener.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds blind_oob_wait parameter (default unspecified) to control how long OAST polling continues after the scan's last request, giving tunable dwell time for late callbacks.
• Adds session_check (a regex that must keep matching an authenticated response) and session_check_url (a cheap authenticated endpoint to probe instead of the target) parameters to the MCP scan job to enable session-loss detection without requiring cookies; an invalid regex or a non-http(s) URL is an error.

Web Application Security · 2026-10-09

Dalfox: Adds min_confidence job option to filter findings by confidence level, equivalent to CLI's --min-confidence flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds blind_oob job option (server/MCP equivalent of --blind-oob) to enable managed OAST via interactsh — accepts true for the public mesh or a list of hosts such as ["oast.fun","oast.me"]; callbacks are correlated to their triggering payload and surfaced as V findings with detection_method: "oob".

Web Application Security · 2026-10-09

Dalfox adds --min-confidence to filter low-confidence XSS findings before output, exit code, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --min-confidence high CLI flag to drop every finding Dalfox cannot stand behind before output, exit code, per-target counts in target_summary, and deduplication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds min_confidence key to the config file, REST API, and MCP to set the confidence threshold globally.
• Adds meta.min_confidence field reporting {level, dropped} so a target filtered to zero findings can be distinguished from one that found nothing.

Web Application Security · 2026-10-09

Dalfox: Adds --min-confidence flag to filter output by detection confidence level.

• Adds a URL-allow regex flag that restricts scanning to URLs matching at least one supplied pattern (partial match; repeatable; invalid regex is a startup error).
• Adds a URL-skip regex flag that skips URLs matching any supplied pattern (partial match; repeatable; invalid regex is a startup error).

Web Application Security · 2026-10-09

Dalfox adds OpenAPI 3.x, Swagger 2.0, and Postman Collection scanning via -i openapi / -i postman⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dalfox scan -i openapi to scan every endpoint defined in an OpenAPI 3.x (JSON or YAML) or Swagger 2.0 spec, automatically building URLs, path/query/header/cookie parameters, and request bodies (JSON, form, multipart, XML) as injection targets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds dalfox scan -i postman to scan every request in a Postman Collection v2.1 export, resolving {{variables}} from the collection's variable list and mapping raw, urlencoded, formdata, and graphql body modes.
• Deduplicates scan targets across HAR, raw HTTP, OpenAPI, and Postman modes by URL + method + body, so two POSTs to the same URL with different bodies are both scanned while entries differing only in headers or cookies collapse.

Endpoint Security (EDR/XDR) · 2026-10-09

Software Supply Chain Security · 2026-10-09

Endor Labs integrates with SpaceXAI's Grok Build to secure agentic software delivery via AURI, Agent Kit, Coding Agent Governance, and Package Firewall.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Endor Labs Agent Kit for Grok Build, installable via /add-plugin endorlabs in the agent chat or from the marketplace, bringing specialized AURI remediation agents directly into the IDE and CI/cloud runs through the Grok Build SDK.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Coding Agent Governance hooks that record every MCP tool call, shell command, and file operation, enforcing policies deterministically before each action runs — blocking unapproved agents, MCP servers, models, and skills.
• Adds Endor Scores rating system for MCP servers and skills, mapped to the OWASP Top 10 for LLM Applications, giving security teams a trust signal for every agent component in use.

WAF, Bot & API Protection · 2026-10-09

Fastly product enablement API adds support for the AI Runtime Control product via ai_runtime_control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ai_runtime_control as a supported product identifier in the Fastly product enablement API, enabling programmatic enable/disable of the AI Runtime Control product.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-09

Fastly launches AI Runtime Control API to route, rate-limit, failover, and monitor AI model traffic through a managed gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the AI Runtime Control API gateway — point existing SDKs at Fastly by changing only the base URL and credentials to gain per-key controls and usage reporting without rewriting application code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds provider connection management to supply credentials (API key or, for Amazon Bedrock, an AWS IAM role) that AI Runtime Control uses to reach a provider on your behalf; also exposes endpoints to look up supported providers and models and retrieve Bedrock IAM setup information.
• Adds virtual key management with per-key request-per-minute and token-per-minute limits to control how each application authenticates to and consumes the gateway.

Data Security & DLP · 2026-10-09

fhEVM v0.14.3 adds environment-variable-driven e2e coprocessor config generation for the test suite.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Generates e2e coprocessor configuration from environment variables in the test suite, enabling automated and CI-friendly stack setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Hacking Hardware · 2026-10-09

Flipper OS now supports six RK3576-based boards including Armsom Sige5, FireFly ROC-RK3576-PC, Luckfox Omni3576, Radxa ROCK 4D, NanoPi M5, and Rockchip EVB1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Flipper OS support for the Flipper One prototype (target flipper-one) with UFS flash → SD card → USB boot priority and MaskROM mode accessible via Settings → MaskROM on the MCU home screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Flipper OS support for the Armsom Sige5 / Banana Pi BPI-M5 Pro (target sige5) with eMMC flash → SD card → USB boot priority and MaskROM mode via MASKROM button.
• Adds Flipper OS support for the FireFly ROC-RK3576-PC (target rock-pc) with eMMC flash → SD card → USB boot priority and MaskROM mode via MASKROM button.

Hacking Hardware · 2026-10-09

Flipper One: Adds rockusb list command to enumerate devices currently in MaskROM mode during the installation workflow.

• Supports installing from four OS release branches in Flipper OS Installer: Release, Release candidate, Nightly, and Dev.
• Supports two target storage devices in Flipper OS Installer: /dev/mmcblk0 [eMMC] (microSD card) and /dev/sda [UFS].
• Adds two image fetch modes in Flipper OS Installer: Download & verify (full image download then integrity check) and Stream (write while downloading with per-block verification).

Hacking Hardware · 2026-10-09

Secrets Detection & Management · 2026-10-09

GitGuardian adds Harbor registry scanning, per-secret environment classification, PR comment notes, and a new presence-check API endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v1/incidents/secrets/{id}/check-presence and POST /v1/public-incidents/secrets/{id}/check-presence endpoints to trigger an asynchronous presence check on a secret incident.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds source_monitoring_status__all operator to the public API, exposing the new is all of filter so you can isolate incidents whose sources are ALL deleted or archived.
• Adds per-secret environment classification in NHI Governance, reading environment from secret paths, tags, and labels (recognising prod, prd, stg, qa, uat, dev, and more) before falling back to the source-level env setting.

Secrets Detection & Management · 2026-10-09

GitGuardian adds Harbor container registry scanning, bringing secrets detection to a seventh registry with full layer and metadata coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Harbor container registry as a new secrets-scanning source, covering all layers of tagged images (including multi-architecture platforms), Dockerfiles, and environment variables in image metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports scanning Harbor instances not reachable from the internet via GitGuardian Bridge.
• Uses a Harbor robot account with Repository (List, Pull) and Artifact (List, Read) permissions only — read-only, scoped, and revocable at any time.

Secrets Detection & Management · 2026-10-09

GitGuardian adds incident playbook multi-user assignment and GitHub team auto-creation for direct-access members⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds playbook auto-assign to multiple users for incident routing, enabling a single playbook to assign incidents to more than one user simultaneously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds opt-in GitHub team sync option to auto-create GitGuardian teams for GitHub users who belong to no GitHub team, grouped by the repositories they access directly, enabling 100% team coverage.

SAST / SCA / Code Security · 2026-10-09

GitHub expands pull request archiving to triage-role users and makes archived PRs fully read-only for everyone.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends pull request archive and unarchive permissions to users with the triage, write, maintain, or admin role — previously only admins could archive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Archiving a pull request now makes its conversation fully read-only: new comments, reactions, and automated comments are blocked for all users, including admins.
• Archived pull requests are hidden from public view but remain visible to repository administrators.

Container & Image Security · 2026-10-09

Container & Image Security · 2026-10-09

Container & Image Security · 2026-10-09

Secrets Detection & Management · 2026-10-09

Infisical v0.166.3 adds UltraDNS and Google Cloud DNS ACME providers, Ed25519 sign/verify KMS keys, GCP service account key rotation, HPE iLO Redfish integration, and multi-c⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds UltraDNS as an ACME DNS-01 challenge provider for PKI certificate automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Google Cloud DNS as an ACME DNS-01 challenge provider for PKI certificate automation.
• Adds Ed25519 sign/verify key support in KMS, enabling elliptic-curve signing operations.

Web Application Security · 2026-10-09

Invicti adds shared saved filters, Trend Matrix, DAST retest from Core, HTML/Markdown/JSON report exports, and an Agentic Pentesting credit ledger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a credit transaction ledger under the AI Credit Usage section in the Pentests nav, showing every credit addition, deduction, pending reservation, and current available balance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds credit usage display to the Summary tab, updating in real time as an assessment runs, with failed assessments consuming no credits and canceled assessments showing only credits used to point of cancellation.
• Adds HTML format as a downloadable assessment report option, ready to open in any browser or share with stakeholders.

Detection Engineering · 2026-10-09

Kunai 0.6.0 adds IoC scanning with set-lookup efficiency, JSON-per-line config format, and a .detection section on matched events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces IoC scanning via a JSON-per-line config file with uuid, source, value, and optional severity fields, configurable through the Kunai configuration file or a command-line flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Appends a .detection section to matched events containing iocs (the matching indicators) and a stacking severity score capped at 10.
• Supports IoC matching against paths (absolute), hashes (md5, sha1, sha256, sha512), domains/FQDNs, and IPv4/IPv6 addresses via an in-memory set lookup — dramatically cheaper than detection rules for large indicator lists.

Detection Engineering · 2026-10-09

Kunai 0.6.0 adds detection/filtering rules, rule composition with dependency type, and triggered actions (kill, scan-files) on matched events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sudo kunai -r <rule_file> CLI flag to load detection or filtering rules at runtime, showing only matched events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds kunai config --list-actions subcommand to enumerate all available rule actions and their descriptions.
• Adds kunai run -r <rule_file> with --include <event_type> flag to run Kunai with specific event types enabled alongside a rule file.

Detection Engineering · 2026-10-09

Kunai 0.6.0 documents 30+ event types covering process, memory, network, file, BPF, and kernel-module activity on Linux.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds File Scan event (.data.sourceevent field) triggered by a scan-files action, cross-referencing the originating event for file-scan workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds IO Uring SQE event to capture asynchronous I/O submission queue entries from the iouring subsystem.
• Adds Bpf Prog Load event generated every time a BPF program is loaded into the kernel.

Detection Engineering · 2026-10-09

Kunai delivers rich eBPF-based Linux security events with built-in YAML detection rules, YARA scanning, IoC matching, and container awareness.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports YAML detection rules matching any event field, with name, type, meta, tags, attack, match-on, matches, and condition keys, enabling MITRE ATT&CK tagging and severity assignment directly on the host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Captures rich Linux security events including process execution, file activity, network connections, DNS queries, BPF program loads, module loading, mmap, and mprotect with exec rights.
• Enriches every event out of the box with process ancestry, parent command line, executable hashes, and container information — no post-processing needed.