The week in full · Oct 16–22

Identity & Access Management · 2026-10-22

1Password for Android beta adds post-quantum passkey support and Watchtower UX improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports saving and signing in with post-quantum passkeys on sites that support them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Renames the Watchtower multi-factor authentication card to 2FA available to match the passkeys card naming convention.
• Renames the Scan QR code option to Scan 2FA QR code for clearer intent.

Identity & Access Management · 2026-10-22

1Password: Renames the 1Password MCP server tools list_variables and append_variables to list_secrets and append_secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automatic connection between the 1Password browser extension and the 1Password app when set up in Zen Browser.
• Adds a new Autofill setup step explaining how to disable the Touch ID prompt that appears on each fill.

Identity & Access Management · 2026-10-22

1Password: Shows Enter a title as a placeholder in the title field when creating a new item, instead of the category name.

• Improves performance when 1Password loads autofill suggestions.
• Improves the search field when moving an item to another vault.
• Updates the SSO migration prompt link to read Learn more about single sign-on, opening end-user rather than administrator documentation.

Identity & Access Management · 2026-10-22

1Password: Adds Hide generated passwords toggle in Settings > Security to keep suggested passwords hidden in the inline menu, password generator, and extension popup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an X button and Escape key shortcut to clear the search field in the sign-in prompt.
• Improves security of passkeys on sites that allow use of the same passkey across related websites.

AI Red Teaming & Testing · 2026-10-22

Agent-Scan gains AG-UI (CopilotKit) protocol stream support, a cheaper inference provider preset, and daily AI CVE advisories plus astron-agent fingerprinting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds astron-agent fingerprint to the data layer for AI infrastructure detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Cheaper Inference provider preset to Agent-Scan for cost-sensitive scan configurations.
• Agent-Scan now forwards the prompt and selected skills to the scanner, giving operators direct control over scan inputs.

SAST / SCA / Code Security · 2026-10-22

Aikido launches Noon, a new workforce security platform covering email security, device protection, AI governance, and phishing simulations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Noon, a new workforce security platform separate from Aikido's existing developer-focused tooling, combining email security, device protection, AI governance, and phishing training in one product.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Noon's email security module autonomously detects and removes inbox threats and malicious emails that traditional filters miss.
• Noon's device protection module covers employee devices against malicious packages, installs, extensions, agent skills, AI tools, risky websites, and apps.

SAST / SCA / Code Security · 2026-10-22

Aikido AI Pentest findings and fix evidence now sync automatically into Drata, with 6 months of unlimited retesting included.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Aikido AI Pentest findings and compliance evidence sync directly into Drata, eliminating manual spreadsheet exports for audit prep.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-22

Akto is now a native LiteLLM guardrail provider, adding model-based PII detection for contextual and paraphrased PII in prompts and responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds guardrail: akto as a native LiteLLM guardrail provider, configured via guardrail_name, akto_base_url (os.environ/AKTO_GUARDRAIL_API_BASE), and akto_api_key (os.environ/AKTO_API_KEY) in config.yaml.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports mode: pre_call and mode: post_call guardrail entries for Akto, covering PII scanning on both inbound user prompts and outbound model responses independently.
• Enables default_on: true on individual Akto guardrail entries in config.yaml to enforce PII scanning across all traffic without per-request opt-in.

Malware Analysis · 2026-10-22

APKiD v3.2.0 adds tracker scanning (-st), match printing with rule filtering (-m, --print-filter), and Dart >=3.13 AOT detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -st / --scan-trackers flag to enable scanning APKs for embedded third-party trackers (generated from the Exodus Privacy tracker database).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -m / --print-matches flag to print matched YARA rules and strings to stdout.
• Adds --print-filter RULES option to filter printed matches by rule name: comma-separated names to include (with + or no prefix) or exclude (with - prefix); implies --print-matches.

UNCATEGORIZED · 2026-10-22

Arcade now lets you register external MCP servers and govern their tools alongside native Arcade tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports registering an existing or vendor-supplied MCP server with Arcade to govern its tools alongside Arcade's own.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-22

Auth0 CLI gains Agent Mode: structured JSON output, full CLI discovery, schema-validated payloads, and one-command AI assistant setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --agent-mode flag (or AUTH0_AGENT_MODE=true env var) to enable structured JSON output, disable prompts and color, and guarantee non-zero exit codes on failure — auto-detected for recognized agent clients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds auth0 commands --flat subcommand for full CLI discovery in one call; append --detailed for complete invocation shapes.
• Adds --schema flag to print the exact payload a command expects, sourced live from the OpenAPI spec.

Identity & Access Management · 2026-10-22

Auth0: Adds auth0 commands --flat to list every runnable CLI command one per line, and auth0 commands --detailed for full invocation shapes in one call.

• Adds structured JSON error responses carrying stable codes (usage, auth, validation, not_found, rate_limit), a reason sub-field (e.g. local_validation), a details array of per-field failures, and an HTTP status field for API-originated errors.
• Adds auth0 docs search command to query Auth0 public documentation directly from the CLI with no login required (returning raw-markdown URLs in agent mode), and auth0 agent skills install command to pre-load Auth0 CLI conventions into a coding assistant before first use.
• Adds AUTH0_CLI_AUTH_MODE=env environment variable (combined with AUTH0_DOMAIN and either AUTH0_API_TOKEN or client credentials) to run the CLI without touching the OS keychain or writing to disk, for CI runners and sandboxes.

AI/LLM Security · 2026-10-22

SAST / SCA / Code Security · 2026-10-22

Polaris adds AI framework static analysis, per-type fix PR control, container scan automation, and GitHub Enterprise Cloud data residency support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds specialized static security analysis for AI frameworks — the Anthropic SDK, OpenAI SDK, and LangChain — catching dangerous tool enablement, agent configuration risks, and AI prompt injection issues via Rapid Scan Static (Sigma 2026.9.1).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends Rapid Scan Static language coverage to Go 1.27, expands detection across Groovy (including Grails and Gradle), JavaScript, and Python environments, improves detection accuracy for CORS and TLS misconfigurations in Groovy/Grails applications, and reduces false positives in JavaScript unit test files.
• Adds per-assessment-type fix PR control in the CLI and Polaris UI, letting teams enable automated remediation for SCA only, Static only, or both independently, and extends Static AI fix PRs to the Jenkins plug-in and Black Duck Security Setup workflows, which previously supported SCA fix PRs only; enabling fix PRs in these surfaces turns them on for both SCA and Static issues together.

Container & Image Security · 2026-10-22

Buildah v1.46.0 adds --umask, --keep-git-dir, --include, --required-path flags and CDI visibility to buildah info⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --umask flag to buildah run to set the umask for the container process.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Implements --keep-git-dir flag on buildah add (ADD instruction) for Docker-compatible preservation of the .git directory when adding a Git source.
• Adds --include flag to buildah add and buildah copy to filter which files are copied from a source.

WAF, Bot & API Protection · 2026-10-22

BunkerWeb 1.6.17 adds IP-address TLS certificates, new database timeout settings, bad-behavior report size controls, and a shared-memory zone size knob for dynamic upstreams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds BAD_BEHAVIOR_REPORT_MAX_EVENTS config key to cap the number of new events copied as ban evidence into bad-behavior reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds BAD_BEHAVIOR_REPORT_MAX_STRING_SIZE config key to cap the maximum byte length of each URL or method string stored in bad-behavior reports.
• Adds DATABASE_CONNECT_TIMEOUT config key to set the maximum wait time when opening a connection to a MySQL, MariaDB, or PostgreSQL server; accepts a time suffix (ms, s, m, h, d, w, M, y).

WAF, Bot & API Protection · 2026-10-22

BunkerWeb v1.6.17 adds configurable database timeouts and expands the default Permissions-Policy to block unbounded-element.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands the default PERMISSIONS_POLICY header to also deny unbounded-element.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-22

Cato adds a Custom HTTP Push Connector and XOps to stream SASE telemetry into any SIEM, storage, or analytics destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Custom HTTP Push Connector to stream selected Cato Events and Flows to any compatible HTTP destination, including AWS S3 and custom analytics platforms, with control over source, destination, filters, and context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a data dictionary within the connector to translate Cato telemetry field names into human-readable labels for easier SIEM mapping.
• Adds Cato XOps to correlate raw events into consolidated, context-rich stories before forwarding to a SIEM, reducing ingestion volume (demonstrated at 37 million daily events compressed to 94 stories).

Container & Image Security · 2026-10-22

API surface changed: +1 endpoint, 5 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /iam/v1/scimGroups⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-22

Clerk MCP server gains account access, native Expo components split into a separate package, and Dashboard masks Secret keys after creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Splits Clerk's native Expo components (<AuthView />, <UserButton />, <UserProfileView />) into a dedicated @clerk/expo-native-components package, imported from @clerk/expo/native-components, so apps not using native components no longer bundle the iOS and Android SDKs — available in @clerk/expo 4.11.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Connects the Clerk MCP server to your Clerk account, enabling agents to create applications, configure authentication, manage users, and set up production instances via your MCP client's sign-in flow.
• Updates the API keys page in the Clerk Dashboard to reveal a Secret key's full value only at creation time, showing only a partial value thereafter to reduce the risk of key leakage.

SIEM · 2026-10-22

API surface changed: +1 endpoint, 25 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint POST /v1/organizations/{organizationId}/services/{serviceId}/clickstack/webhooks/validate⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-22

Cloudmersive: Expands supported document classes in the Private Cloud Fraud AI API (v2-2-0 and v2-3-0).

• Adds remote management support for Install Updates in the Private Cloud Installer v3-73 for Virus Scan API, Convert API, Validate API, and NLP API.

Software Supply Chain Security · 2026-10-22

Cloudsmith adds Hugging Face repository support for hosting and managing AI models, datasets, and spaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Hugging Face repository format support, enabling practitioners to host, share, and deploy AI models, datasets, and spaces — including commit-based snapshot tracking for reproducible AI builds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-22

Cloudsmith replaces imprecise sliders with exact numerical inputs for workspace usage limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables typing exact numerical values for usage limits in the workspace Settings tab under Usage limits, replacing the former slider controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-10-22

Compyl adds V2 Flat File Integration APIs with key/JWT auth, Axonius/SentinelOne expansions, and saved views in Tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds V2 Flat File Integration APIs supporting replace, append, parse, update, and delete operations, with API key and JWT authentication; failed parses return an error without saving partial data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The API Keys page now displays the environment's API base URL for quick endpoint discovery.
• Adds saved views and filter persistence across the Board, List, and Approvals views in Tasks.

Identity & Access Management · 2026-10-22

ConductorOne: Adds a new Browse page consolidating all requestable access in one place, including a tab for AI tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Bookmarks and links to old tabs redirect automatically to their new locations.

Identity & Access Management · 2026-10-22

ConductorOne adds a dedicated Browse page with tabs for Apps, Profiles, AI tools, and Actions — centralising all requestable access in one place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Moves app accounts to My resources > Accounts, out of the Requests page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Refocuses the Requests page to task queues only: Assigned to me, My requests, and Temporary, opening by default on Assigned to me.
• Managers can still browse on behalf of another user via the existing Manage view.

Security Data Pipeline · 2026-10-22

Cribl Search's Lakehouse Engine adds optional OCSF v1.8 schema mapping, letting analysts query security data with consistent field names across sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OCSF v1.8 field mapping to Cribl Search's Lakehouse Engine, configurable via a dataset rule (GDI Step 3), so analysts can query security data using consistent OCSF field names instead of vendor-specific ones like src_ip, source_ip, or srcaddr.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports two mapping modes: add mapped OCSF fields alongside original source fields, or replace source fields with OCSF names — configurable per dataset rule.
• Allows creation and cloning of custom Datatypes in Cribl Search to extend or override built-in OCSF Schema Mappings for any desired schema.

AI/LLM Security · 2026-10-22

Falcon Guardian AIDR integrates with NVIDIA OpenShell to connect agent prompts, model interactions, and runtime activity with Falcon platform security context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Plans in-silicon enforcement by integrating Falcon Guardian AIDR with NVIDIA Sentry on BlueField-4 DPUs for out-of-band monitoring and hardware-level policy enforcement to detect and contain unsafe agent behavior beyond the software runtime.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-22

Adds PR-scoped delta comments via GitHub Action delta input and enriches --json output with version, timestamp, and effective options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds delta input to the GitHub Action so pull requests receive a single upserted comment listing only the findings that PR introduced, not the full tree; fork PRs fall back to the job summary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• SARIF rule help markdown now leads with a link to the project so a triaging analyst can identify which tool produced each Code Scanning alert.

Software Supply Chain Security · 2026-10-22

Cycode adds real-time Workstation Protection with cooldown policies and threat-intel blocking to stop malicious packages at install time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Cycode Workstation Protection (early access), deployable via MDM, which intercepts package installs on developer and CI machines in real time and applies a configurable cooldown policy to hold back recently published versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a threat intelligence feed check to Workstation Protection that blocks known-malicious package versions independently of the cooldown window.
• Extends SBOM and AIBOM generation to cover AI/LLM dependencies (AIBOMs), surfacing transitive pulls like LiteLLM from agent frameworks such as DSPy and CrewAI.

SIEM · 2026-10-22

Unity Gateway gains jailbreak and prompt injection screening for MCP tool calls and results (Beta).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Jailbreak guardrail support in Unity Gateway to screen MCP tool calls and their results for jailbreak and prompt injection attempts, applicable on input, output, or both.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-22

DataDome adds full server-side and client-side bot-protection integration for the Azion edge platform⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds serverSideKey, endpoint, timeout, urlPatternExclusion, urlPatternInclusion, staticAssetExclusion, encodedCharInclusion, removeMatrixParams, ipExclusion, logEnrichedHeaders, enableDebugging, customFieldString1-3, customFieldInteger1-2, customFieldFloat1, userID, and productID server-side arguments to the firewall.js Azion firewall function for fine-grained bot-protection control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds enableGraphQLSupport and graphQLEndpoint server-side arguments to extract GraphQL operation name and type on requests to a GraphQL endpoint, improving protection for GraphQL APIs.
• Adds enableMCPSupport and mcpEndpoint server-side arguments to enable Model Context Protocol support and extract MCP information at a configurable endpoint.

WAF, Bot & API Protection · 2026-10-22

DataDome launches its first native Fastly Compute Rust crate, bringing bot-protection to Fastly edge deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the datadome-fastly-compute Rust crate, adding DataDome bot-protection support to Fastly Compute edge services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-22

DataDome launches its Azion module 1.0.0, bringing bot and fraud protection to the Azion edge network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds native DataDome bot and fraud protection integration for the Azion edge platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-22

Fraud SDK Java 3.1.0 adds optional eventDate field to supply the effective event time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds optional eventDate field to specify the effective event time when submitting fraud events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-22

DefectDojo v3.4.202 adds OpenVEX export, Locations in Findings export, and expanded users API configuration-permission writes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenVEX as a VEX export format alongside CycloneDX on the Asset page Export dialog and in the API, enabling pairing of an SPDX SBOM with a matching VEX document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Locations field to the Findings export dialog and a Locations column in the Report Builder (when the Locations feature flag is on), replacing Endpoints with each Finding's Locations.
• Extends the users API to accept and return configuration permissions on writes, and to remove configuration permissions when an empty list is sent.

Identity & Access Management · 2026-10-22

API surface changed: 14 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GET /v3/transactions/: param travel_rule_status (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-10-22

Adds proxy.sshDirect config setting to bypass the upstream proxy for cloud SSH connections in Docker Sandboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds proxy.sshDirect config setting to skip the upstream proxy entirely for cloud SSH connections, leaving other host CLI requests on the proxy; set to false to re-enable the proxy for SSH.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-10-22

Docker Sandboxes gains browser-blocking, daemon log rotation controls, and a per-connection SSH proxy bypass setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds browser.enabled config key to prevent sandboxed processes from opening URLs in the host browser and block in-sandbox OAuth logins that redirect to localhost.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds daemon.log.maxSizeMB config key to set the MB threshold at which the daemon log rotates (minimum enforced).
• Adds daemon.log.maxBackups config key to cap the number of rotated daemon logs kept; a value of 0 removes the count limit while the age limit still applies.

AI/LLM Security · 2026-10-22

Docker Sandboxes gains a BAND AI kit (docker.io/bandhq/band-python-kit) letting sandboxed agents join multi-agent rooms via a single sbx create command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds docker.io/bandhq/band-python-kit:latest (current published tag 6.0.0) as a Docker Sandbox kit, enabling sandboxed agents to connect to BAND AI rooms via outbound WebSocket with one sbx create command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports band.yaml config file in the sandbox workspace to declare which agent entrypoint (agent.id, Python file) the BAND kit launches on sbx run.
• Adds sbx secret set-custom with --sandbox, --host, --env, and --placeholder flags to scope per-sandbox credentials (e.g. BAND_API_KEY, ANTHROPIC_PROXY_KEY) to specific outbound hosts without exposing real keys inside the microVM.

Vulnerability Management · 2026-10-22

Edgescan adds sitemap filters for unmatched scope directives, manual sitemap upload for pentested assets, and inline scanner IP documentation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a filter on the sitemap view to show only URLs not yet matched to a scope directive, making it easier to identify unscoped requests during target selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables manual upload of sitemap files (crawled and tested URL lists) for manually pentested assets, giving pen-tests full sitemap coverage and visibility in the customer portal.
• Surfaces scanner source IP documentation directly on the asset page, so users can allowlist scan traffic without opening the create-asset form.

SIEM · 2026-10-22

SIEM · 2026-10-22

SIEM · 2026-10-22

SIEM · 2026-10-22

SIEM · 2026-10-22

SIEM · 2026-10-22

SIEM · 2026-10-22

Software Supply Chain Security · 2026-10-22

Endor Labs integrates with SpaceXSI's Grok Build to secure agentic coding via AURI, Agent Kit, Coding Agent Governance hooks, and Package Firewall.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Endor Labs Agent Kit for Grok Build, installable via the marketplace or by typing /add-plugin endorlabs in agent chat, enabling in-session scanning, triage, and remediation through specialized remediation agents (including an AI SAST Remediation agent and an SCA Remediation agent) that can open pull requests for approved fixes, and supporting Agent Kit workflows outside the IDE — in CI or cloud runs — via the Grok Build SDK.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Coding Agent Governance hooks that record every MCP tool call, shell command, and file operation and enforce security policies deterministically before each action runs — without depending on a model's judgment.
• Adds Endor Scores for each MCP server and skill, mapped to the OWASP Top 10 for LLM Applications, giving security teams a trust rating for approved and unapproved agent tooling.

Software Supply Chain Security · 2026-10-22

Hacking Hardware · 2026-10-22

ESP32 Marauder v1.19.1 adds M5Stack Core2 for AWS and Waveshare ESP32-C5-Touch-LCD-3.5 hardware ports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Reduces no-PSRAM memory usage during wardriving on devices without PSRAM.

WAF, Bot & API Protection · 2026-10-22

Fastly Terraform Provider 10.0.0 adds multi-service monitoring in a single alert resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for monitoring multiple services using a single alert resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-10-22

GitGuardian SaaS: Adds GET /v1/check-runs to list check runs by incident and retrieve their IDs.

• Adds Docker Hub monitoring to GitGuardian Public Monitoring, checking newly published public images daily against your perimeter and surfacing leaked secrets as incidents with publishing account, image repository, and layer context.

Secrets Detection & Management · 2026-10-22

GitGuardian v2.174.0 adds 10 new detectors, 2 new analyzers, and a new SMTP validity checker across dozens of credential types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sftp_credentials_assignment detector for SFTP credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables validity checker for SMTP credentials.
• Adds aws_ses_keys checker timeout to reduce kills by apikey-checker.

Secrets Detection & Management · 2026-10-22

GitGuardian Public Monitoring now scans newly published Docker Hub images daily, matching secrets to your perimeter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Surfaces Docker Hub-specific context on every incident — publishing account, image and repository name, and the layer the secret was found in — instead of commit and author.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Routes Docker Hub incidents through existing notifications, integrations, and agents analysis, matching the workflow for GitHub incidents.
• Enriches findings pushed to Wiz with GitGuardian incident, occurrence, and source IDs in the finding's originalObject field, enabling use in Wiz workflows and via the Wiz API.

SAST / SCA / Code Security · 2026-10-22

GitHub CLI v2.103.0 adds opt-in expiring, auto-refreshing OAuth tokens via --expiring flag and expiring_credentials config key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --expiring flag to gh auth login to request short-lived, automatically rotating OAuth tokens that become useless within hours if leaked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds expiring_credentials enabled to gh config set so every future sign-in uses expiring tokens without passing --expiring each time.
• Extends gh auth status to show the expiration time of the current access token when expiring credentials are active.

General Utilities & Libraries · 2026-10-22

GitHub CLI adds opt-in expiring/refreshable tokens via --expiring flag and expiring_credentials config setting, plus --no-refresh and --json on gh auth status⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --expiring flag to gh auth login to request short-lived access tokens paired with rotating refresh tokens, reducing leaked-token risk (requires GitHub CLI v2.103.0 or later), and adds gh config set expiring_credentials enabled to opt in to expiring credentials for every sign-in without passing --expiring each time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --no-refresh flag to gh auth token to print the current token without triggering a refresh.
• Adds --json flag to gh auth status for machine-readable output, combinable with --show-token, and adds a --no-refresh flag to gh auth status to report current authentication state without refreshing the token.

General Utilities & Libraries · 2026-10-22

GitHub CLI v2.103.0 adds expiring auto-refreshing OAuth tokens and a new gh issue artifact command group for managing issue artifacts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --expiring flag to gh auth login to sign in with short-lived, auto-refreshing OAuth credentials that rotate without requiring re-authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds expiring_credentials enabled setting to gh config set to prefer expiring credentials for every sign-in globally.
• gh auth status now shows whether a credential is refreshable and the relative time until the current access token expires.

AI-Powered Offensive Security · 2026-10-22

Hacktron adds stable finding IDs, an activity timeline, command palette actions, multi-ID search, and a whitebox retest wizard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds human-readable, stable finding IDs (shown in the row, panel, full page, and URL, with click-to-copy), an Activity tab in the finding detail panel showing the full detection and edit history with actor and changed fields per entry (switch to a Comments view to see only the thread), finding-scoped actions in the command palette (change status, change severity, mark/unmark duplicate, create ticket, start remediation, copy ID, copy link, open full page) when a finding is open, and multi-ID search that lets you paste two or more finding IDs into the search box to filter to exactly those findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Source, Reopened, and Date range filters to the findings list, each saved in the URL, and a CWE name tooltip on the CWE badge so the full weakness name is visible without leaving the page.
• Adds a whitebox retest wizard to request a retest for a completed scan directly from the scans list or scan detail page, covering all reported findings except false positives and accepted risk, and shows retest status and results on the scan detail page once a retest is complete.

Compliance Automation & Trust Management · 2026-10-22

AI Red Teaming & Testing · 2026-10-22

iFixAi v4.2.1 adds V11 Guilt Tripping inspection for companion-chat harm detection, with jailbreak-pattern simulation across vulnerable-user scenarios.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new V11 inspection, runnable via --full-run, --suite extended|all|compliance, or -b V11, that tests companion-chat agents against guilt-tripping and self-harm facilitation across 40 four-turn scenarios including appearance contempt, restrictive eating, self-harm, and suicidal ideation — with half the simulated users aged 13–15.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• V11 JSON output carries findings_only: true and a findings array in place of score, threshold, passing, and confidence interval fields, reflecting its report-only status.
• Report-only findings now appear at the top of markdown, HTML, JSON, and terminal output.

Secrets Detection & Management · 2026-10-22

Secrets Detection & Management · 2026-10-22

API surface changed: +3 endpoints, 9 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /api/v1/cert-manager/hsm-connectors/{connectorId}/keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint POST /api/v1/cert-manager/certificates/{id}/pkcs12
• New endpoint POST /api/v1/cert-manager/signers/{signerId}/certificate/import

Secrets Detection & Management · 2026-10-22

Infisical v0.167.0 adds DigiCert HSM-backed code signing, Copy ID for cert policies, and last-edited timestamps on secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports using an existing DigiCert certificate and its HSM key as a signer in the code-signing workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Copy ID to alert and approval policy row menus in the certificate manager.
• Shows last-edited time for secrets in the single-environment overview.

Endpoint Management (UEM/RMM) · 2026-10-22

Iru adds AI-built BitLocker/Android Library Items, 30 GB Mac Custom App installers, FileVault auto-rotation, Platform SSO OpenID for macOS 27, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Automatically rotate keys after viewing setting in the FileVault Library Item to rotate FileVault recovery keys automatically after an administrator views them, with configurable rotation timing; key views remain recorded in the device activity timeline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OpenID sign-in support and web login settings to the Single Sign-On Library Item for macOS 27 and later, enabling identity-provider web sign-in (including MFA) at the login window, Lock Screen, and FileVault unlock, with options to sync the web login password to the local account and set a web login URL allow list.
• Iru AI now builds Library Items for BitLocker on Windows and Android Restrictions from a plain-language description.

Endpoint Management (UEM/RMM) · 2026-10-22

Iru's Managed OS Library Item gains rollout delays, phased windows, beta enforcement, split schedules, and hardware-aware compatibility checks for Apple devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Rolling Enforcement option that delays sending a new target version declaration to Apple devices by up to 90 days, giving admins time to verify a release before fleet deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds phased rollout schedules with a configurable window of 1 to 7 days (set in hours), spreading OS declaration delivery gradually to reduce network spikes.
• Supports enforcing beta OS versions via AppleSeed for IT beta tokens from Apple Business inside Managed OS Library Items, with automatic token sync when Automated Device Enrollment (ADE) integrations are configured.

Endpoint Management (UEM/RMM) · 2026-10-22

Identity & Access Management · 2026-10-22

Browser discovery now starts from JumpCloud-managed devices or third-party MDM, expanding SaaS visibility without requiring full JumpCloud device management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Browser Discovery in AI & SaaS Management to start when a user signs in to a JumpCloud-managed device, or when the JumpCloud Go extension is deployed via a third-party MDM provider using a Client ID and Client secret added to the JumpCloud Go extension distribution policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Refreshes the Customize Email and Automation Variables tabs in Settings with shorter labels and improved helper text for easier navigation.

Identity & Access Management · 2026-10-22

JumpCloud adds Agent Uninstall Protection with maintenance tokens, third-party MDM browser discovery, and a macOS 27 blocker policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Block macOS Golden Gate Installer policy to prevent the macOS 27 Golden Gate installer from launching on MDM-enrolled Macs, automatically terminating the installer on launch.

Identity & Access Management · 2026-10-22

LoginRadius adds DPoP token binding, per-IP rate limiting, passkey registration controls, and default Advanced Audit Logging V2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DPoP (RFC 9449) support to bind Access Tokens and Refresh Tokens to the client's private key, preventing reuse of stolen tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-IP rate limiting for SSO (OAuth 2.0, OIDC, and SAML), Account Management, and Partner IAM APIs.
• Adds server-side checks to block duplicate Passkey registrations and enforce a per-account Passkey count limit.

Software Supply Chain Security · 2026-10-22

Manifest Foreign Risk now runs in self-hosted and air-gapped environments, checking contributors against a local 20-billion-record dataset across 18 risk categories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Manifest Foreign Risk to self-hosted and air-gapped deployments, running all contributor-level foreign risk scans against a local copy of the dataset — no data leaves the network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Delivers contributor-level detection of sanctioned-jurisdiction contributors, foreign military/intelligence/state-lab affiliations, and unverifiable contributor identities inside disconnected environments.
• Supports export of findings as audit evidence mapped to NIST 800-53 SR-3 and SR-4 and Cybersecurity Maturity Model Certification (CMMC) supply chain controls.

Endpoint Security (EDR/XDR) · 2026-10-22

Identity & Access Management · 2026-10-22

Microsoft Entra adds Agent ID identity types for unmanaged/local agents and Dynamic Conditional Access with graduated risk-driven enforcement for agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents discovered through security sensors, so unmanaged agents become policy targets even without prior Microsoft Security integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Dynamic Conditional Access for agents, enabling risk-driven, graduated policy responses — reducing permissions, blocking writes while preserving reads, narrowing data/resource scope, restricting network paths, shortening or revoking time-bound access, requiring human approval, or isolating/stopping agent runtimes — coordinated across multiple enforcement points.

Web Application Security · 2026-10-22

mitmproxy 12.3.0 adds eMudhra CA signing options and a dark theme to mitmweb.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds status and method badges to the mitmweb flow table for faster at-a-glance triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SVG icons for flow table resource types in mitmweb.

Reconnaissance & OSINT · 2026-10-22

Nerva v1.77.0 adds detection of anonymous, NULL, and EXPORT TLS cipher suites as security misconfigurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Detects anonymous/NULL/EXPORT TLS cipher suites as part of misconfiguration scanning (enabled with --misconfigs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-22

Nerva v1.76.0 adds detection of MSSQL sa accounts with blank default passwords via --misconfigs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Detects MSSQL sa accounts configured with a blank default password as part of --misconfigs scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-22

OpenCTI 7.261021.1 adds Ask Ariane deck/report/video downloads, a config-preset export module, and graph surface upgrades.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ability to view and download decks, reports, and videos generated by XTM One directly inside the Ask Ariane chatbot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a config-preset module with an export configuration drawer (in the Filigran Experience UI) that bundles and stores configuration as a downloadable ZIP, backed by a bypass-only storage root and an exportable types query.
• Adds a parameter to XTM Hub browser messages for additional control over hub interactions.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.13.0 adds convention-file binding, per-phase timings, full scan trails, and reviewer usage tracking to reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds review.instructions_files config key so repository owners can specify convention files that are quoted in review briefs, recorded for presence or absence, and bound to finalize; the default reads no convention files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds rounds.json saved beside the report after each correction round, containing the checks the earlier answer failed, that answer, and the changed line ranges sent, with reviewChange also returning these as result.rounds; adds result.scan to reviewChange's return value carrying the full scan record (candidates, each scanner's summary and rule packs, selection and trail) redacted like the report and without secrets' fingerprints; and adds result.timings to reviewChange so server hosts can read timings from the result instead of a file.
• Adds a timings object to report.json recording millisecond durations for change_ms, scan_ms, graph_ms, brief_ms, reviewer_ms, finalize_ms, and total_ms per review run (and change_ms, scan_ms, total_ms per scan), and exports the RunTimings type from the library; also adds selection and trail fields to scan.json recording which scanners the change called for and why and the disposition of every scanner finding (dropped reason or candidate it became), with each scanner entry gaining stages, resolveMs, and files fields.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.12.0 adds a full library API with reviewChange, preinstallScanners, createToolResolver, and a new openqodex doctor --install --all-scanners --require-all⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds preinstallScanners({ installRoot, require }) library function and openqodex doctor --install --all-scanners --require-all CLI command to install pinned scanners and verify each is installed at its pinned version with its runtime, printing one line per scanner that is not ready, with the CLI exiting with code 2 when any scanner is missing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds createToolResolver (accepts installRoot) and extends runScanners with a scratchRoot parameter so concurrent server runs write only inside their own folder and share nothing.
• Adds reviewChange(input, reviewer, options) library function to review a change using the host's model in server profile, running five read tools over a head-commit snapshot and returning findings, coverage, a model completion record (contract openqodex-model-review-1), and a report in markdown, SARIF, and JSON.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.11.0 adds interface-aware call graphs, an openqodex graph command, MCP server integration, and Django/Rails/Express/React/Next.js/FastAPI/Go route awareness.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openqodex graph as a menu command answering questions about callers, callees, importers, implementers, overrides, value/type uses, connection paths, reachability walks, file/folder definitions, project dependencies, and import cycles (with openqodex graph help listing all questions), adds --budget-ms (default 1 second), --limit (default 50 items), --cursor, and --tokens flags to control its per-question time budget and pagination, and adds openqodex mcp to serve the same code-graph questions to coding agents as MCP tools over stdio, including graph_refresh to trigger a new build when files change and cursor-based pagination for graph_changes and graph_impact comparisons.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds init registration of the openqodex MCP server into ~/.claude.json (Claude Code), ~/.cursor/mcp.json (Cursor), ~/.codex/config.toml (Codex), and the Cline CLI settings file, with --project writing .mcp.json, .cursor/mcp.json, and .codex/config.toml in the repository; init --no-mcp omits the MCP server and removes previously added registrations, init --mcp restores that choice, and init --uninstall removes only the entry it added.
• Adds implementers/ and references/ pages per touched symbol in the review packet, including per-caller level counts, and extends the packet's unknowns.json to list framework gaps alongside the code graph's gaps, with causes such as computed mount prefixes, per-file fact caps, and budget exhaustion.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.10.0 ships a persistent cross-package code graph with caller confidence levels, manifest-change tracking, and hidden graph CLI commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cross-package caller resolution across pnpm, npm, and yarn workspaces, using each file's nearest tsconfig.json and Python src roots so callers in one package are found when a function in another changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds caller confidence levels to the review brief — certain, likely, or possible — each with a named cause (e.g. workspace package reached through built dist with no tsconfig paths, or a call on a value typed any, unknown, or object).
• Adds a persistent graph cache at .openqodex/graph/ (ignored via its own .gitignore) that holds parsed file facts between reviews so unchanged files are never re-parsed (disabled when --report-dir is set), controlled via new graph.max_cache_mb (default 512 MB) and graph.max_heap_mb config keys, with graph.max_files now counting only new parses rather than cached files, and kept reachable via a local git ref refs/openqodex/graph/<tree> for each kept build using git show <tree>:<path>, automatically deleted with the build and never sent by git push.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.9.0 overhauls init, review, and scanner downloads with smarter agent detection, per-project scanner targeting, and a new findings command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openqodex findings 1,3 command to print named findings from the last review in full.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• init gains --hook none and --no-repo flags (suppressing the git pre-push hook and team review section respectively), follows CLAUDE_CONFIG_DIR and CODEX_HOME environment variables to locate Claude Code and Codex config directories, consolidates its prompts to a single 'Write these files?' question after showing a full plan, auto-detects when running inside Cursor, Claude Code, or Codex CLI agents to skip the terminal requirement, and checks all reviewers simultaneously after writing, reporting Reviewer ready or No reviewer can start yet with per-reviewer reasons.
• Adds init --project flag to write agent files inside the repository instead of global scope, and init --dry-run flag that prints which scanners would be downloaded and why without downloading.

SAST / SCA / Code Security · 2026-10-22

openqodex 0.7.0 adds Claude Code AI review to the GitHub Action, new review command flags, and hardened sandbox controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GitHub Action support for AI code review: the ANTHROPIC_API_KEY secret enables a full Claude Code review alongside the scanners, with findings posted to code scanning and a report in the job summary; a new review input (auto default, off, or required) controls whether it runs and whether its absence fails the job; a new claude-code-version input pins the exact Claude Code version installed; and new reviewed, review-status, and reviewer outputs report what reviewer ran and its outcome.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --block-on-severity, --instructions <file>, --reviewer-web on|off, and --report-dir <folder> flags to openqodex review, and a --report-dir <folder> flag to openqodex scan to redirect all run files away from .openqodex/.
• Adds reviewer.json output (written by --report-dir) recording whether a reviewer started and which one.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.6.1 adds Codex and Cursor plugin support and a new openqodex guide privacy command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openqodex guide privacy command that prints the tool's privacy policy, listing every network call it makes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new Codex plugin in plugins/codex/ carrying the skill for the OpenAI plugin directory.
• Adds .cursor-plugin/plugin.json making the repository a Cursor plugin.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.6.0 adds Codex as a reviewer via --reviewer codex and enables web search for reviewers by default, controlled by reviewer_web in config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --reviewer codex to openqodex review to run the full review with codex exec inside a read-only, network-isolated sandbox; --reviewer auto selects Codex automatically when running inside Codex or when it is the only reviewer installed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables web search and page fetching for reviewers by default; set reviewer_web: off in ~/.openqodex/config.yaml to disable the web tools.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.5.0 unifies review into one command, adds config-from, fail-on-tool-error, block-on-severity, reviewer:, and reviewer_web controls⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds config-from: head, fail-on-tool-error: true, and block-on-severity inputs to the GitHub Action (to read the pull request's own config, fail the job on scanner tool failure, and set a severity gate the pull request's own config cannot weaken), plus a status output set to tool-failed when a scanner tool exits 2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds scan --block-on-severity <severity> flag that overrides the config's review.block_on_severity.
• Adds reviewer: key (auto, claude, codex, or cursor) and reviewer_web: on key (off by default) in ~/.openqodex/config.yaml to set the reviewer for every review and give Claude Code web tools during a review.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.4.0 adds branch/PR review, --finalize --run <id>, scanner config change detection, and deletion-point findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openqodex review <branch> and openqodex review '<PR link>' to review a branch or pull request outside your current work — fetched and checked out in a temporary folder, using your own settings and approvals, never the target's.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds review --finalize --run <id> to finalize a specific run by name, as printed in the brief of a branch or pull request review.
• Raises changes to a scanner's own settings or ignore files (such as .gitleaksignore or ruff.toml) as reviewer-clearable candidates, shown as a note that never counts toward the verdict.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.3.0 adds a persistent launcher, auto-update engine, guide skill command, and Claude Code unattended-review rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --no-repo flag to init to skip injecting the review section into CLAUDE.md and AGENTS.md, and --uninstall to remove exactly that section.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds guide skill command that prints the review procedure of the running version, with commands written for the launcher when the launcher started it.
• Adds openqodex update command with --now, --rollback, --off, --on, and --status subflags to control the new auto-update engine.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.2.0 adds repo-wide review, a code-graph for impact analysis, structured config at .openqodex/config.yaml, and a built-in issue reporter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openqodex review --all to scan every file in the repository and have the agent review on top of scanner results, prioritising the most-called functions and files with the most scanner hits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --no-graph flag and graph.enabled config key to control the new code-graph feature; graph settings graph.budget_ms, graph.max_files, and graph.max_file_bytes bound its resource use, with results cached per file under .openqodex/graph/.
• Moves config to .openqodex/config.yaml (created on first run with all keys and defaults); adds new keys review.severity_threshold (default minor), review.default_base, graph.enabled, graph.budget_ms, graph.max_files, and graph.max_file_bytes; accepts pr_review as an alias for review.

SAST / SCA / Code Security · 2026-10-22

OpenQodex 0.1.0 debuts as an open-source coding-agent code review tool with 13 built-in scanners, SARIF/JSON/Markdown output, and deep IDE integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openqodex review --agent to analyse a change, select relevant scanners, and print a review brief for the coding agent, and openqodex review --finalize to validate agent findings without a model and write the report as Markdown, JSON, and SARIF.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds openqodex scan for running scanners standalone in git hooks, pre-commit, and CI; adds openqodex hook install to add an optional git pre-push hook; and provides a GitHub Action and a pre-commit hook for running scans in CI.
• Adds openqodex init to install the skill and push gate into Claude Code, Codex CLI, Cursor, and Cline; --uninstall removes them.

Runtime Security · 2026-10-22

OpenSandbox 1.2.0-rc.1 adds auto-pause/wake-on-access for fast sandboxes, an experimental egress sidecar, OOM kill reporting, and sandbox-scoped CPU/memory metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds lifecycle.idlePolicy create field (with idleTimeoutSeconds 30–86400, onIdle: pause, wakeOnAccess, and optional activeProbe) to opt fast sandboxes into server-side auto-pause and wake-on-access (OSEP-0024); the policy persists as the sandbox.opensandbox.io/idle-policy Sandbox CR annotation and is off by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Moves idle-pause configuration from [idle_pause] to [automation.idle_pause], removes the redundant redis.enabled gate, and requires redis.dsn (validated at load) when enabled = true.
• Adds the OpenSandbox-Skip-Activity: skip request header sentinel to suppress ingress activity observation for a single request (stripped at both gateway and server-proxy hops).

Identity & Access Management · 2026-10-22

Ory Network v26.4.4 adds external-ID matching for identity and session event stream events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables matching event stream events — identity, login, registration, recovery, settings, verification, and session — to users by external ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-22

Ory Network rolls out a redesigned Console with a new layout and navigation for all workspaces and projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Rolls out a new Ory Console layout and navigation across all Ory Network workspaces and projects, with no opt-in or migration required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-10-22

ZAP Browser Extension 0.3.0 adds a Script Viewer to inspect, edit, and replay Zest recordings without leaving the browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a View Script button to the ZAP Browser Extension popup that opens the recorded Zest script in its own tab, updating statement-by-statement while recording.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables in-browser editing of recorded Zest script statements — including changing locator types (id, cssSelector, xpath, className, name, linkText, partialLinkText, tagName), reordering, deleting, and adding new statements — with Undo/Redo support.
• Adds Run in New Window and Run in New Tab replay options to execute a Zest script directly in the browser, with a step-through mode (Step / Next) for statement-by-statement inspection.

Software Supply Chain Security · 2026-10-22

OX Security detects and blocks malicious LiteLLM 1.107.0 (RAT + infostealer) via VibeSec pipeline scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds litellm 1.107.0 to the OX Security malware database, blocking installation for VibeSec customers and redirecting them to the safe version 1.106.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• OX platform pipeline scan now blocks code pushes that include the compromised litellm 1.107.0 as a dependency.

SAST / SCA / Code Security · 2026-10-22

Phoenix Security adds a Microsoft Azure connector for AKS, Container Apps, Container Registry, and Entra ID team sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Microsoft Azure connector under Integrations > Connectors that authenticates via a customer-managed Microsoft Entra service principal using Tenant ID, Client ID, and Client Secret.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports independently enabled capabilities for Azure Kubernetes Service runtime, Azure Container Apps runtime, and Azure Container Registry image inventory — each validated, enabled, renamed, or removed without deleting the base connection.
• Adds optional team synchronisation from Microsoft Entra ID groups using Microsoft Graph application permissions GroupMember.Read.All and User.Read.All with tenant admin consent.

Identity & Access Management · 2026-10-22

PingOne adds session token cookie persistence control and module-based authorization resource grouping in Authorize⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per-environment control over whether PingOne uses a persistent or non-persistent session token (ST) cookie, configurable in Authentication Settings — non-persistent cookies are discarded on browser close, useful for kiosk and shared workstation deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces modules in PingOne Authorize to group authorization resources by application team, enabling teams to manage their own module contents while administrators retain centralized governance.
• PingOne Forms now renders JSON-formatted values in dynamic text as plain text on end-user forms, enabling use of JSON outputs in flow development nodes.

Identity & Access Management · 2026-10-22

Ping Identity launches an opt-in Remote MCP Server in sandbox, letting AI agents administer Advanced Identity Cloud via natural-language prompts over OAuth 2.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes tenant-scoped MCP tools covering journey and script configuration, application and identity provider management, user administration, policy settings, and audit log analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-22

Plerion adds Lambda Web Function inventory, four new Lambda checks, workload scanning, Sumo Logic integration, and APEC CBPR compliance mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds four new Lambda web function checks: PLERION-AWS-1246 (High) detects ApplicationManaged authentication-type Lambda web function endpoints that accept unauthenticated internet requests, naming the endpoints and domains, with failing web functions appearing in exposure views and attack paths; PLERION-AWS-1247 detects Lambda web functions whose resource policy grants external AWS principals (outside your Organization) invoke or management access, raising High for unrecognized accounts and Medium for trusted or conditional grants, showing principal, actions, and granting statement in Access Grants; PLERION-AWS-1248 (Medium) flags Lambda web function execution roles that allow every action on every resource with no condition, naming the role and policy statements; and PLERION-AWS-1249 (Low) flags Lambda web function execution roles with wildcard service-level permissions such as s3:* and no condition, naming the role and policy statements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Lambda Web Functions to asset inventory, showing each function's endpoints with authentication type and domain, revisions, execution roles, resource policy, and tags.
• Adds a Sumo Logic workflow integration that posts findings as they open, change, and resolve (with a weekly full resend), supports Send tenant audit logs to stream audit events in real time, and provides a Sync now option for immediate delivery.

Email Security · 2026-10-22

Rspamd patch release adds ARC trust fixes, browser-accurate HTML parsing, merged RBL queries, and force_actions priorities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces browser-accurate HTML parsing for more faithful rendering fidelity in spam analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds merged RBL queries to consolidate DNS-based blocklist lookups.
• Adds priority support for force_actions to control action precedence.

Email Security · 2026-10-22

Rspamd adds detection rules for cryptocurrency wallet addresses via new symbols, selectors, and scam rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection of cryptocurrency wallet addresses using dedicated symbols, selectors, and scam rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Email Security · 2026-10-22

Rspamd 4.2.3 adds RBL check merging, fixes force_actions composite ordering, and upgrades Lua pre-result APIs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds default_merge_checks = true to RBL config, deduplicating DNS queries when multiple checks resolve the same name and merging their labels into one comma-separated option (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ example.com:dkim,url).
• Adds per-rule merge_checks = false override in local.d/rbl.conf to restore one symbol insertion per check for specific RBL rules.
• Adds priority setting to force_actions rules, accepting low, normal, high, and critical values to control which rule wins when multiple rules match.

Email Security · 2026-10-22

Rspamd 4.2.3 adds priority-ranked force_actions postfilters, unix_time metadata export, and a richer Lua task API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds priority setting to force_actions rules that depend on composites, promoting them to postfilters and exposing the rank as a priority:N symbol option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds merge_checks = false config key to RBL to retain one symbol insertion per check instead of merging duplicate DNS queries into a single result.
• Adds unix_time field to general metadata in metadata_exporter.

MCP Servers & Tooling · 2026-10-22

Runlayer 1.32.0 adds a Sharing API, MCP session stop/clear tools, and Terraform resources for team members and group bindings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds stop_session and clear_session_stop tools to the Runlayer MCP so agents and automation (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ SOAR playbooks) can stop a session and clear a stop; requires the same permission as the API, a reason is mandatory, and the audit log records whether the action came from the API or the MCP.
• Adds runlayer_team_member and runlayer_team_group_binding resources to Terraform provider 1.8.1, enabling role and directory-group membership to be managed as code; applying either resource adopts an already-existing membership or binding.
• Adds a Sharing API that reads, sets, or removes one principal's access to an agent, skill, or plugin with a single idempotent call keyed by principal.

MCP Servers & Tooling · 2026-10-22

Runlayer 1.31.0 adds Go deliverable generation, session layer tags, bulk artifact deletion, and Kubernetes session materialization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds layer-capture tags to each prompt, response, and tool card in Sessions, showing which layer (Agent runtime, LLM gateway, or Client hook) captured a turn when more than one layer recorded it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bulk delete to the Artifacts library, letting you select multiple artifacts and remove them in one step.
• Adds the exact build commit with a copy button to Settings → General next to the version number.

MCP Servers & Tooling · 2026-10-22

Runlayer 1.30.0 adds Terraform resources for detections and smart rules, eval replay, AI dictation app inventory, and smarter Go follow-through.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds runlayer_detection_rule_setting, runlayer_detection_outbound_entry, runlayer_smart_rule, and runlayer_smart_rule_test_case Terraform resources (provider 1.8.1) to manage detection rule settings, the Outbound list, smart rules, and their test cases as code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Replay recorded results option under Tool mocking in agent evals, feeding each matching call its original recorded result so every replay sees identical data while remaining side-effect free.
• Adds an OAuth connector workflow for agent accounts so admins can attach a connector without linking their own credentials — each user then grants access with their own account.

MCP Servers & Tooling · 2026-10-22

Runlayer agents can now be defined and scheduled as code via a Terraform provider with runlayer_agent and runlayer_agent_schedule resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the runlayer_agent Terraform resource (with name, prompt, model, servers using per-connector tool_names, egress_policy, env, tags, example_prompts, and is_disabled, installable from downloads.runlayer.com/runlayer/runlayer version ~> 1.5), the runlayer_agent_schedule resource (since provider 1.5.0) for attaching a cron schedule via agent_id, cron_expression, schedule_semantics, and timezone, the runlayer_server and runlayer_policy resources for managing connectors and policies as code, and egress_policy support on runlayer_agent with default_action and allow fields for per-agent network access policy in version control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the runlayer_server Terraform data source to look up an existing connector by server_id for use in agent definitions, and the runlayer_agent Terraform data source exposing tool_count, skill_count, and env_keys for CI checks against existing agents.
• Supports terraform import runlayer_agent.<name> <uuid> to bring existing agents under Terraform management.

Data Security & DLP · 2026-10-22

SAST / SCA / Code Security · 2026-10-22

Semgrep: Agentic Workflows runs can now take up to five hours instead of failing at two hours.

• The Total credits used column on the workflow scheduling page now counts runs from every trigger, including pull-request-initiated runs, not only scheduled runs.

Endpoint Security (EDR/XDR) · 2026-10-22

SentinelOne launches Singularity ASOC, bundling AI SIEM, Agentic Investigation, Hyperautomation, and AI Data Pipelines with 50+ third-party connectors into one SOC suite.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Singularity ASOC, a new integrated suite combining AI SIEM, Agentic Investigation, Hyperautomation, AI Data Pipelines, threat intelligence and IOC management, and case management in a single offering on the Singularity Platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI Data Pipelines with more than 50 out-of-the-box connectors to third-party sources spanning cloud, identity, email, network, SaaS, data platforms, and vulnerability management — including AWS, Google Cloud, Microsoft, Okta, Cisco, Proofpoint, Netskope, Snowflake, Atlassian, Oracle, Tenable, Microsoft Defender XDR, Palo Alto Networks Prisma, Wiz, Darktrace, Sophos Central, and Check Point; supports ingestion via syslog and Kafka today, with OpenTelemetry and generic API collection on the way for on-premises and custom source connectivity; and can filter and route data to third-party SIEMs and storage destinations in addition to Singularity Data Lake, giving teams control over where their data lives.
• Introduces Singularity Credits, a unified consumption currency for AI-powered actions across the Singularity Platform, with administrator-configurable guardrails on AI investigation and automated response usage.

Endpoint Security (EDR/XDR) · 2026-10-22

SentinelOne Prompt Security joins Lenovo ThinkShield, adding AI governance and shadow AI visibility to endpoint security.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SentinelOne Prompt Security to the Lenovo ThinkShield security portfolio, extending existing EDR coverage into AI governance for ThinkShield endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables security teams to identify sanctioned and shadow AI services in use across the workforce via SentinelOne Prompt Security.
• Supports detection and response against prompt injection and AI misuse on Lenovo endpoints through SentinelOne Prompt Security.

Endpoint Security (EDR/XDR) · 2026-10-22

SentinelOne launches Singularity ADR to discover, govern, and stop rogue or malicious AI agents at runtime across endpoints, cloud, and SaaS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds agent and MCP inventory: discovers every AI agent, tool, skill, connector, and MCP server across endpoints, SaaS, and cloud providers — sanctioned or not — along with the permissions each holds and the employees behind it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds multi-platform agent coverage across Salesforce Agentforce, Microsoft Copilot Studio, OpenAI ChatGPT workspace agents, and Anthropic Claude managed agents, going beyond MCP gateway coverage.
• Adds Agent Traces: every agentic event is monitored and sent to Singularity Data Lake for visualization, retention, search, and use in dashboards or detection rules.

Endpoint Security (EDR/XDR) · 2026-10-22

SentinelOne: Adds AI Data Pipelines with 50+ out-of-the-box connectors to third-party sources for cross-stack investigation and response.

• Introduces Singularity Credits with administrator-set guardrails to bound the scope of every automated action to customer-defined limits.
• Adds Singularity ADR early access program, open to certified PartnerOne partners today.
• Introduces AI Recon Assessment Service for partners to lead AI security conversations with prospects.

SAST / SCA / Code Security · 2026-10-22

skill-scanner findings now carry Cisco AI Security and Safety Taxonomy 2.0.0 codes (AITech/AISubtech) with OWASP, MITRE ATLAS, and NIST AML crosswalks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cisco AI Security and Safety Taxonomy 2.0.0 codes (AITech and AISubtech) to every finding, with built-in crosswalks to OWASP, MITRE ATLAS, and NIST AML.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports runtime override of the bundled taxonomy snapshot for custom organizational classifications.

SAST / SCA / Code Security · 2026-10-22

Skill Scanner 2.3.1 ships full AITech taxonomy definitions via get_aitech_definition() and updates stale LLM provider defaults.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds get_aitech_definition() and get_aisubtech_definition() functions to look up the bundled definition for any AITech objective, technique, or sub-technique code directly from the snapshot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates the --llm-provider openrouter default model to openrouter/openai/gpt-5.6-sol and the gcp-vertex default to vertex_ai/gemini-3.8-flash to replace retired models.
• Ships a generated taxonomy reference covering all 19 objectives, 44 techniques, and 130 sub-techniques, with each entry in threats.py carrying a full description and AI Defense labels.

IDS / IPS · 2026-10-22

Snort3 3.12.4.0 adds brotli decompression, JSON stats export, RST_STREAM rate limiting, configurable response pages, and TCP sequence tracing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a trace_seq_relative option to stream_tcp to toggle between relative and absolute TCP sequence numbers in traces, and adds asymmetric-specific sequence span normalization checks to stream_tcp.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds http2_inspect configurable RST_STREAM rate threshold to cap RST_STREAM abuse.
• Adds brotli decompression support to http_inspect.

SAST / SCA / Code Security · 2026-10-22

snyk test --source-dir now validates that --reachability=true is set, preventing silent misconfiguration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds validation to snyk test --source-dir that returns a clear error when --reachability=true is not also set, instead of silently ignoring the flag or misinterpreting the path.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Firewalls & Network Defense · 2026-10-22

Sophos DNS Protection 2026.44 adds automated Firewall onboarding via SFOS 23.0 and new DNS widgets on the Sophos Fusion dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Automates Sophos Firewall onboarding and DNS over HTTPS (DoH) configuration in SFOS 23.0, eliminating manual location creation in Sophos Fusion and manual Sophos DNS Protection IP address configuration on the firewall.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Sophos DNS Protection widgets to the Sophos Fusion global dashboard — including DNS Protection summary, Top domain queries, and DNS usage from protected computers — reachable via Dashboards > Manage dashboards > Create new using the Product filter (select DNS Protection) or Category filter (select Threat).

Secure Access (VPN / SASE / ZTNA) · 2026-10-22

Sophos Protected Browser 2026.44 integrates with Sophos DNS Protection for browser-level DNS threat policy control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates with Sophos DNS Protection to apply a dedicated DNS Protection policy to browser DNS requests independently of device-level DNS settings, enabling separate threat controls for browser and device activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-10-22

Splunk Security Content v6.9.0 adds 15 new detections spanning Cisco AI Defense, AWS, Zeek, and Braodo Stealer, plus a new GenAI analytic story and alpha threat ops dashboard⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds three new Cisco AI Defense detections: Cisco AI Defense Allowed Sensitive Prompt, Cisco AI Defense Allowed Sensitive Response, and Cisco AI Defense Repeated High Risk Activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a new Abuse of GenAI Systems and Applications analytic story covering GenAI abuse surface.
• Introduces the Cisco AI Defense Threat Operations dashboard (alpha) for reviewing runtime activity, enforcement outcomes, risky behavior, sensitive data matches, and activity by application and model.

AI/LLM Security · 2026-10-22

Email Security · 2026-10-22

Sublime Security adds Prompt Injection Detection (public beta) to catch hidden AI-agent instructions in inbound email.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds beta.prompt_injection_detection() MQL function callable from detection rules to score inbound email for prompt injection attempts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a machine learning model that detects potential prompt injection content hidden in inbound email targeting AI agents such as Copilot and Gemini.
• Adds Core feed detection rules covering known prompt injection evasion techniques, including hidden text and obfuscated instructions.

SIEM · 2026-10-22

Sumo Logic in-app tabs now support Dashboards and Metrics alongside Log Search in the New UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends in-app tabs in the New UI to support Dashboard and Metrics tabs alongside Log Search, enabling all three to stay open in a single browser window without losing context — requires the Enable in-app tabs preference to be turned on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-22

Metrics transformation rules now support 400-day retention and Do Not Store, replacing the previous 15-day option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Metrics transformation rules now offer Do Not Store or 400 days as retention options for matching metrics, and standardize aggregate retention for aggregated metrics to 400 days.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-22

syzkaller extracts differential fuzzing logic into a reusable pkg/fuzz package with a public ErrSkipFuzzing sentinel⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes fuzz.ErrSkipFuzzing as a public sentinel in the new syz-cluster/pkg/fuzz package, allowing callers to detect and skip fuzzing sessions when base and patched kernel binaries are identical.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extracts differential kernel fuzzing orchestration into a standalone syz-cluster/pkg/fuzz package (fuzz.go) reusable by syz-cluster workflows and local tools.
• Extracts kernel build logic into syz-cluster/pkg/build for reuse across syz-cluster components.

Attack Surface & Exposure Management · 2026-10-22

syzkaller gains a linux-config-update agent skill and disables sandboxing for make configs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Disables sandboxing when running make configs targets via the Makefile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-22

Tailscale launches MagicRoute (beta) for Premium/Enterprise: location-based connector selection via Settings > General > Route Selection > Configure⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MagicRoute option under Settings > General > Route Selection > Configure in the admin console, giving each client automatic selection of the nearest healthy subnet router, app connector, or Tailscale Service host without relying on DERP regions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds three additional route-selection modes alongside MagicRoute in the admin console Configure section: Active-passive failover, Regional routing, and Regional routing with in-region failover.
• MagicRoute supports tailnets with custom DERP servers, which were previously excluded from regional routing.

Vulnerability Management · 2026-10-22

Detection Engineering · 2026-10-22

Tenzir v6.20.0-rc.4 ships a new heterogeneous-list data model, ai_decide typed decisions, encryption functions, and a wave of new source/sink integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ai_decide operator with typed decisions and a dedicated Decisions endpoints configuration, plus Default ai_prompt input without earlier AI results behavior change.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds type_kind function for inspecting value types in pipelines.
• Adds encryption functions and support for secrets as function arguments, including Secret keys for hmac and Parquet encryption with a shared AES key.

SAST / SCA / Code Security · 2026-10-22

Terraform v1.17 ships GA Policy enforcement, a new -minimal-refresh flag, and variables/locals in provider requirements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -minimal-refresh planning flag to plan and apply, refreshing only resources that have proposed changes rather than the full state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Promotes -policies flag on plan, apply, and query to GA — no longer requires an experimental build or -allow-experimental-features; query policies evaluate resources found by list blocks and return human-readable or JSON results.
• Supports variables and locals in provider required_providers blocks, enabling dynamic provider version and source constraints.

Threat Intelligence · 2026-10-22

pytx gains api fb_threatexchange query for server-side filtered ThreatExchange search; HMA adds fetch-enabled state reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Reports the enabled state of exchanges in HMA fetch status, making it visible whether a given exchange is active.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-22

Upwind adds Story Replay: a visual MITRE-mapped timeline letting analysts watch multi-stage attacks unfold step by step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Upwind Story Replay, a visual timeline inside the Upwind console that renders every detection contributing to a threat in chronological order, annotated with MITRE tactics and associated resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Story Replay surfaces the order, timing, and blast radius of multi-stage attacks across workloads and identities, replacing manual alert-list reconstruction with a single visual attack path.

Data Security & DLP · 2026-10-22

Varonis now integrates with Collibra to push continuously updated sensitive data classifications into Collibra's data catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Varonis integration with Collibra that sends sensitive data classifications — including PII, PHI, financial information, credentials, secrets, and regulated data — directly into the Collibra data catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Backup & Recovery · 2026-10-22

Veeam iResOps expands to Okta identity resilience (Private Preview) and opens Private Previews for Veeam Data Platform, GitHub, Azure DevOps, and Google IAM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Veeam iResOps for Okta (Private Preview): creates immutable restore points across 29 Okta object types — users, groups, applications, policies, and admin roles — each verified as restorable against the live Okta API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables granular Okta comparison against a known-good state down to the individual property level, then restores objects and their relationships (memberships, app assignments, federation, roles) in the correct sequence.
• Extends Veeam iResOps identity resilience — already available for Active Directory and Microsoft Entra ID — to Okta, delivered as a fully managed service.

Backup & Recovery · 2026-10-22

Veeam iResOps extends to Veeam Data Platform with a unified DataAI Command Platform console, AI agents, and global search — Private Preview.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the DataAI Command Platform cloud console to Veeam Data Platform, connecting existing backup servers in minutes with no data migration or re-architecture required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the DataAI Command Graph, mapping protected infrastructure, workloads, and indexed files in a single console for cross-estate visibility.
• Adds global search across protected and production data with full restore-point context for precise file and infrastructure recovery.

Backup & Recovery · 2026-10-22

Veeam Intelligent ResOps for Microsoft 365 GA adds AI agent visibility, ROT data discovery, and precision recovery to Veeam Data Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Veeam Intelligent ResOps (iResOps) for Microsoft 365 as a generally available add-on to Veeam Data Cloud for Microsoft 365, available in Foundation and Advanced editions and through Veeam Cloud & Service Providers (VCSPs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Veeam Intelligent ResOps for Microsoft 365 connects to the DataAI Command Graph, linking production Microsoft 365 data to backup context for unified visibility across data, access, AI agents, and backup protection; discovers known and unknown AI agents (including Microsoft Copilot) operating in the Microsoft 365 environment, maps which sensitive data each agent can reach, and identifies oversharing gaps; tracks AI-driven file changes file by file so teams can identify what an agent modified or deleted and undo those changes precisely; continuously discovers and classifies sensitive and regulated data across SharePoint, OneDrive, Teams, and Exchange, with visibility into who and what can access it; identifies Redundant, Obsolete, and Trivial (ROT) data and enables quarantine of that data while teams decide what to archive or delete, reducing both blast radius and storage costs; exposes backup coverage gaps for business-critical data before an incident occurs and pinpoints data locations to support minimum viable recovery; and provides built-in plain-language agents that let authorized team members query data, access patterns, AI agent activity, and backup protection status.
• Opens Private Previews of Veeam Intelligent ResOps for Veeam Data Platform and Okta.

CNAPP · 2026-10-22

Endpoint Security (EDR/XDR) · 2026-10-22

Wiz Sensor is now a native GKE add-on (Preview), enabling 1-click eBPF runtime protection on GKE Standard and Autopilot clusters via --addons=WizSensor=ENABLED.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the Wiz Runtime Sensor as a first-party GKE add-on (Preview) via --addons=WizSensor=ENABLED on the gcloud CLI, covering both GKE Standard and GKE Autopilot clusters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports fleet-wide enforcement through custom Google Cloud Organization Policies that automatically block unprotected cluster creation across projects, folders, or entire organizations.
• Integrates with GKE's native Secret Manager and Workload Identity Federation so API keys and pull tokens are vaulted off-cluster and rotate automatically without cluster restarts.

Identity & Access Management · 2026-10-21

1Password for Linux 8.12.42 adds SSO-user data export and raises the local .env file destination limit to 25.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the 1Password Environments limit to 25 local .env file destinations per computer, up from the previous cap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables data export for users signed in via Unlock with SSO when an administrator permits it.
• Returns users to the Environments overview screen automatically after adding an environment variable or importing a .env file.

Identity & Access Management · 2026-10-21

1Password in the browser 8.12.42 adds Firefox diagnostics reports, passkey auto-offer, and sign-in prompt search.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a diagnostics report creator for 1Password in Firefox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a search field to the sign-in prompt so users can type to filter relevant Login items.
• Automatically offers passkeys instead of passwords in the sign-in prompt when a Login item has a passkey saved.

UNCATEGORIZED · 2026-10-21

ArmorCode Zero introduces an agentic remediation workflow that auto-triages findings, groups them into fixes, drafts pull requests, and rescans to verify results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces ArmorCode Zero, an agentic exposure-management layer that reads every finding, writes a triage recommendation, and groups findings by the single change that resolves them — reducing one tenant's 28,600 findings to ~8,900 actionable fixes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a conversational chart-building interface where security teams can describe a visualization in plain language and Zero generates it.
• Introduces the ArmorCode Context Risk Graph as the shared knowledge layer connecting findings to assets, code, owners, business context, services, and controls to drive prioritization inference.

Identity & Access Management · 2026-10-21

Auth0 CLI gains Agent Mode for unattended AI-driven automation with structured JSON output and reliable exit codes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Agent Mode activates automatically when the CLI detects a non-interactive terminal, requiring no configuration for most coding agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-21

Secure Access (VPN / SASE / ZTNA) · 2026-10-21

Cato DEM gains Root Cause Analysis with Network Adapter Metrics and Client Traceroute to pinpoint digital-experience fault domains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Root Cause Analysis (RCA) to Cato DEM, correlating endpoint, network, application, and historical path evidence in a single investigation to identify the likely fault domain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Network Adapter Metrics to the RCA workflow, surfacing adapter type, BSSID, channel, noise, and signal strength to assess local Wi-Fi conditions contributing to poor experience.
• Adds Client Traceroute to the RCA workflow, providing historical hop-by-hop path evidence from the client to capture latency, loss, and path behavior — especially useful for intermittent and remote-user issues.

Container & Image Security · 2026-10-21

Chainguard: Adds Chainguard Harness (Beta), an AI-powered runtime vulnerability finder that surfaces only exploitable findings reproducible in a running application.

• Promotes Chainguard Actions to general availability, now covering more than 1,000 hardened GitHub Actions replacements with transitive dependency hardening/pinning, a Hardening.md vulnerability report per action, self-serve requests with a one-business-day SLA, and automated migration via the Chainguard App.
• Promotes the Chainguard Compliance Dashboard to general availability in the Chainguard Console, showing OpenSCAP results against the DISA GPOS SRG, FIPS 140-3 validation details, and downloadable XCCDF reports per architecture for FedRAMP audit packages.
• Adds Guardener (Early Access), an AI-native adoption agent that continuously scans Dockerfiles, Helm charts, and Kubernetes manifests and opens automated YAML-configured pull requests to migrate images to hardened equivalents.

Internet Services · 2026-10-21

API surface changed: +1 endpoint, 14 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint POST /accounts/{account_id}/managed-defense/vulnerability-discovery/repos/{repo_id}/token⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GET /accounts/{account_id}/pipelines/v1/sinks: param direction (query) added; param order_by (query) added
• GET /accounts/{account_id}/pipelines/v1/streams: param direction (query) added; param order_by (query) added

Internet Services · 2026-10-21

Cloudflare Workers AI adds Clairic (typed forecasting model) and DeepSeek-V4.1-Flash (552B MoE multimodal) to its model catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds clairic to Workers AI — a System One-style model that extracts, computes, estimates, and forecasts strongly typed values with confidence scores and probabilities; currently in preview.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds deepseek-v4.1-flash-1017 to Workers AI — a multimodal Mixture-of-Experts model with 552B backbone parameters, up to one million token context, supporting native image and text input with autoregressive text generation.

Internet Services · 2026-10-21

Cloudflare feature flags now support attribute-based targeting rules with 13 comparison operators and AND/OR logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds attribute-based targeting rules for feature flags, supporting 13 comparison operators, logical AND/OR grouping, and sequential evaluation to serve different flag values per user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-10-21

Cloudflare adds Clairic extraction model, DeepSeek V4.1 Flash 1017, step-up MCP auth, and default source map uploads⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @cf/cloudflare/clairic to Workers AI (preview): an extraction model that reads a state string and returns typed values per field — text, number, date, datetime, duration, list, estimate, forecast — with p_null and confidence scores; set options.include_quantiles for all 99 percentiles; priced at $0.10 per million input tokens with no output token charge.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• wrangler deploy, wrangler versions upload, and wrangler preview now upload source maps by default as of Wrangler 4.150.0; cf deploy does the same; remapped stack traces appear in Workers Logs, real-time logs, and Tail Workers.
• Set upload_source_maps = false in Wrangler config, or build.sourcemap = false in the Cloudflare Vite plugin, to opt out of automatic source map uploads.

Internet Services · 2026-10-21

Cloudflare Workers source maps now upload by default; API MCP server gains step-up authorization support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Wrangler and cf now upload source maps by default, pointing Workers stack traces at original source without any configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cloudflare API MCP server now supports step-up authorization, allowing agents to grant only required scopes at connect time and authorize additional scopes on demand.
• Think and Agent Skills now use @cloudflare/computer for their workspace; @cloudflare/shell is deprecated.

Internet Services · 2026-10-21

Internet Services · 2026-10-21

Threat Intelligence · 2026-10-21

Cloudmersive Private Cloud Fraud AI API v2-2-0 adds support for additional document classes in fraud detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends fraud detection coverage to additional document classes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SOAR · 2026-10-21

Cortex 4.2.0 adds PKCE support for OAuth2 and a new job.kubernetes.imagePullSecrets configuration option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PKCE support in OAuth2 authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Sets backoffLimit to 0 for analyzer and responder jobs in Kubernetes.

Software Supply Chain Security · 2026-10-21

cosign v3.1.4 adds cosign bundle create-from-container and shell completion for --slot.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cosign bundle create-from-container subcommand to create a Sigstore bundle directly from a container image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds shell completion for the --slot option argument.

SIEM · 2026-10-21

Lakeflow Connect adds a managed Asana connector (Beta) for ingesting work management data into Databricks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a managed Asana connector in Lakeflow Connect (Beta) to ingest Asana work management data — workspaces, teams, projects, tasks, portfolios, and goals — into Databricks using OAuth U2M authentication; workspace admins enable it from the Previews page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-21

Databricks: Adds a managed Oracle Eloqua connector to Lakeflow Connect (Beta) for ingesting Eloqua data into Databricks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports OAuth user-to-machine (U2M) authentication, incremental ingestion, UI-based pipeline authoring, Declarative Automation Bundles, and API-based pipeline authoring for the Oracle Eloqua connector.
• Workspace admins can enable or disable the Oracle Eloqua connector from the Previews page.

SIEM · 2026-10-21

SIEM · 2026-10-21

DeepSeek V4.1 Flash (1017) now available on Unity Gateway via Foundation Model APIs with text and image inputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DeepSeek V4.1 Flash (1017) model to Unity Gateway, accessible via Foundation Model APIs, supporting text and image inputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-21

Databricks lets you embed custom identity claims in OAuth tokens to filter rows per end user via dynamic views or ABAC policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds custom identity claims to a service principal's OAuth token, usable in dynamic views or ABAC policies to filter rows per end user — enabling one service principal to serve many users while each sees only their own data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-21

Lakebase Insights moves to per-project Settings with on-demand runs, replacing the old observability configuration workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Lakebase Insights configuration directly in each project's Settings for users with CAN MANAGE, removing the need to create a separate observability configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports on-demand Insights runs at any time, with or without a scheduled analysis frequency set in Settings.
• Reads telemetry from system.lakebase system tables to diagnose issues and recommend next steps.

SIEM · 2026-10-21

Databricks Genie budgets now support ACLs, letting admins delegate Budget Manager or Budget Viewer roles to users, groups, or service principals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds access control lists (ACLs) to Genie budgets, enabling account and workspace admins to grant Budget Manager or Budget Viewer roles to specific users, groups, or Databricks service principals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-21

File upload in Genie One and Genie Agents is now GA, enabling natural-language analysis of uploaded files alongside workspace data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds file upload capability to Genie One and Genie Agents conversations, allowing natural-language analysis of uploaded files alongside existing workspace data — no longer requires a preview toggle from workspace admins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-21

File upload in Genie One and Genie Agents becomes available by default for compliance security profile workspaces starting November 15, 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables file upload in Genie One and Genie Agents by default for workspaces with the compliance security profile enabled and a supporting compliance standard, allowing natural-language analysis of uploaded files alongside other data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-21

DataDome Android SDK 3.1.0 adds predictive back support with configurable BackBehaviour on Android 13+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for Android predictive back gesture via BackBehaviour enum (BLOCKED, GO_BACKGROUND, GO_BACK), honoured on Android 13+ when the app sets android:enableOnBackInvokedCallback="true" or targets API 36+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Requires androidx.activity 1.6.1 and compileSdk 33 or higher.

Vulnerability Management · 2026-10-21

DefectDojo v3.4.201 adds Keyboard Triage, Linux Kernel CVE feed, CRA Article 14 reporting, and a new internal CA management command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Imports Follow Renames and Moves feature flag (on by default) so imports that name an Asset or Organization by a former or moved-out-of name resolve to the current Asset instead of failing or creating a duplicate; disable the flag to revert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Asset Identity feature flag (off by default) to control Asset Identity in place of the former deployment setting; instances that previously set the deployment setting to true keep it on.
• Adds django.uwsgi.startupProbe.enabled (on by default) as a TCP check on the uwsgi port allowing 5 minutes to start, with django.uwsgi.startupProbe.path available to revert to the earlier HTTP check.

Vulnerability Management · 2026-10-21

DefectDojo 3.4.201 reports Qualys VMDR asset names as host locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Reports the Qualys VMDR asset name as a host location for findings imported from Qualys VMDR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-21

Didit adds digital-ID wallets, KYB data tiers, AML/monitoring APIs, Face Search toggle, iGaming TM presets, and new MCP tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v3/users/aml-monitoring/ and POST /v3/businesses/aml-monitoring/ to toggle ongoing AML monitoring on or off for up to 1,000 profiles at a time, with a dry-run estimate and async job support for large batches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST /v3/kyb/shareholders/ and POST /v3/kyb/ubo/ endpoints and three selectable KYB registry data tiers (Lite, Shareholders, UBOs) in the KYB Registry Check step, with per-response tier confirmation, Lite billing when ownership data is absent, per-country tier pricing shown before selection, and a flat $0.75 fee for manually entered companies.
• Adds GET /v3/users/{vendor_data}/generate-pdf/ to return a branded PDF of a user's 20 most recent completed sessions via API.

Container & Image Security · 2026-10-21

Distroless blocks compromised CA roots and switches Node.js images to system CA trust store⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Blocks two compromised CA roots (AAA Certificate Services and 'emSign ECC Root CA - G3') from the ca-certificates.crt bundle, matched by SHA-256 SPKI hash to catch renames and re-issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a TestBlockedRoots test in common/cacerts_test.go that validates every image archive against a blockedSPKIs denylist, covering both the PEM bundle at etc/ssl/certs/ca-certificates.crt and the Java trust store at etc/ssl/certs/java/cacerts.
• Allows skipping the mandatory 1-day soak time for image updates, enabling faster emergency pushes.

AI/LLM Security · 2026-10-21

Docker Sandboxes v0.49.1 adds offline kit validation, proxy-aware cloud commands, richer CLI diagnostics, and new daemon log settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• sbx kit validate and sbx kit inspect now accept --offline to check a local directory or ZIP kit without starting the daemon or signing in; sandboxes created from local or Git v3 kits now honor build-time --kit-arg values, including scoped overrides; sbx kit sign warns when Git would change the signed file contents and invalidate signatures for git+ references; and sbx settings set rejects incorrectly structured values for kit.allowedSources and kit.trustedSigners before saving them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds daemon.log.maxSizeMB, daemon.log.maxBackups, and daemon.log.maxAgeDays keys to sbx settings set for controlling daemon log size and retention, the browser.enabled setting to control whether sandboxes can open the host browser, and the proxy.sshDirect setting (set to true) to connect cloud SSH directly on networks that permit direct SSH connections.
• sbx policy ls, sbx settings ls, and sbx policy approval ls now accept -q to print only rule IDs, setting keys, or approval IDs.

Data Security & DLP · 2026-10-21

Duality Secure Query enables encrypted watchlist screening across agencies without exposing passenger data or intelligence sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Duality Secure Query, enabling authorized organizations to screen passenger manifests against multiple intelligence-agency watchlists using encrypted queries — without exposing passenger names to the queried agencies or sharing underlying watchlist data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports source-attribution concealment in configured screening workflows, returning an authorized match alert without revealing which participating agency holds the relevant intelligence.
• Extends encrypted query collaboration beyond aviation to border screening, financial sanctions checks, cross-border law-enforcement investigation, and allied-defense threat identification across national and classification boundaries.

Software Supply Chain Security · 2026-10-21

Endor Labs AI SAST gains BYOK support for OpenAI, Azure OpenAI, Gemini, and Vertex AI accounts, with encrypted key store and provider allowlist controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds BYOK (bring your own key) support for AI SAST and AI Chat in the Endor Labs AURI platform, routing all model requests through your own OpenAI, Azure OpenAI, Gemini, or Vertex AI account instead of Endor Labs' credentials — with no fallback to Endor Labs if a key is configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports passing provider API keys as environment variables during AI SAST scans so keys are never stored with Endor Labs.
• Adds an Endor Labs AI Gateway that enforces an encrypted key store, a provider allowlist, and tenant isolation for all BYOK model requests.

Hacking Hardware · 2026-10-21

ESP32 Marauder v1.19.0 adds Seeed XIAO ESP32-C5 support, CSI motion monitor, display censoring, and WiGLE 1.6 wardrive logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Seeed XIAO ESP32-C5 as a supported hardware target with firmware binary _xiao_esp32c5.bin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Upgrades wardrive logs to WiGLE 1.6 format.
• Supports IP5306 and MAX17048 battery fuel gauge ICs on V4/V6/V6.1 hardware.

WAF, Bot & API Protection · 2026-10-21

Extends the beta testing guide with an explicit resource family workflow using terraform query and service-scoped discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends the beta testing guide with an explicit resource family workflow using terraform query and service-scoped discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-10-21

Giskard Core v1.0.3 adds an opt-in strict template policy for agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an opt-in strict template policy to giskard.agents, controlling how prompt templates are enforced during agent runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-10-21

GitGuardian Self-Hosted 2026.10 adds Wiz integration, source-status filtering, AI Hook coverage for Kiro/Junie, and richer vault metadata via ggscout 0.33.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds beat.metricsPort Helm value to configure the port on which the task scheduler exposes Prometheus metrics, with automatic ServiceMonitor creation when ServiceMonitors are enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Wiz integration that syncs active secret incidents from version control sources to Wiz daily as native secret findings, including detection context and a link back to GitGuardian but never the secret value — requires outbound HTTPS to your Wiz tenant.
• Adds source-status visibility: every source now displays one of Monitored, Unmonitored, Unreachable, Archived, or Deleted states, filterable from the perimeter page and incident list, with an is all of operator, and saveable as a named view.

SAST / SCA / Code Security · 2026-10-21

GitHub Copilot CLI gains MCP server support, tool allow/deny controls, agent skills, and enterprise administration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP (Model Context Protocol) server integration to Copilot CLI, enabling additional tools and context to be connected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds allow/deny controls for Copilot CLI tool use, letting users restrict which tools Copilot CLI can invoke.
• Adds agent skills to Copilot CLI, supporting repeatable workflows with task-specific instructions, scripts, and resources.

SAST / SCA / Code Security · 2026-10-21

GitHub now lets you bulk-convert all branch protection rules in a repository to rulesets in a single action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bulk import of all branch protection rules to rulesets via Settings → Rulesets → Import branch protection rules, with preview, enforcement-status selection (Active, Evaluate, or Disabled), and a choice to keep or delete the original rules after conversion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-21

GitHub secret scanning: business audit-log field changes to enterprise slug on Nov 12; dismissal webhooks gain exemption_request.number⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Dismissal-request webhook payloads now include exemption_request.number, the repository-scoped request number also available in the REST API, enabling correlation of bypass requests across integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Custom pattern API now returns 422 instead of 500 for requests rejected due to invalid arguments, letting integrations distinguish input errors from server failures.
• Expands base64-encoded token revocation (public preview) in private and internal repositories on github.com to support encoded personal access tokens (classic), fine-grained personal access tokens, OAuth access tokens, and GitHub App user access tokens — GitHub automatically decodes the value.

SAST / SCA / Code Security · 2026-10-21

Dependabot alert REST API responses now include a version_requirement field with the vulnerable dependency's recorded version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds version_requirement field to Dependabot alert dependency objects in REST API responses — returns the resolved version (lockfiles, Dependency submission API) or declared constraint (manifests without a lockfile), eliminating the need to parse lockfiles or make a separate GraphQL vulnerableRequirements request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The version_requirement field is present in individual alert responses, repository/organization/enterprise alert list responses, and dependabot_alert webhook payloads.

SAST / SCA / Code Security · 2026-10-21

GitHub package firewall (public preview) intercepts npm package requests on CI/CD and coding agents, blocking malicious downloads for Enterprise Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces GitHub package firewall for GitHub Enterprise Cloud, sitting between endpoints (Actions runners, coding agents) and upstream package registries to inspect metadata requests and package downloads for malicious activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Checks packages against the GitHub Advisory Database for malware or vulnerability alerts as a policy control.
• Performs supply-chain checks including attestation downgrades as a policy control.

SAST / SCA / Code Security · 2026-10-21

Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4 for automated dependency updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for npm 12, pnpm 11, pnpm 12, and Bun 1.4 in Dependabot, enabling automated dependency update PRs for projects using these package manager versions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-21

GitLab launches AI Governance Dashboard (beta) to audit agent activity across GitLab Duo and external agents like Claude Code, Cursor, and Codex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds glab govern setup subcommand (requires glab CLI 1.122.0+) to install Claude Code hooks and capture sessions for the AI Governance Dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds glab govern setup --agents codex,cursor to capture Cursor and Codex sessions via a background job that sends sessions every 30 minutes.
• Adds glab govern doctor subcommand to verify that agent-capture setup is working correctly.

SAST / SCA / Code Security · 2026-10-21

GitLab debuts Business Logic Security Analyzer in early access, catching BOLA, missing auth, and mass assignment flaws SAST misses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Business Logic Security Analyzer to GitLab Duo Agent Platform, enabling whole-repository SAST scans targeting broken object-level authorization (CWE-639), missing or improper authorization, and mass assignment — vulnerability classes that pattern-based scanners cannot detect.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports triggering whole-repository scans via GitLab Duo Chat or through the API, and attaching a Business Logic scan profile to a project for automatic merge-request scanning after pipelines pass.
• Reports findings — including CWE ID, severity (e.g. Critical), and file location — as first-class SAST results in the Vulnerability Report and the merge request security widget.

AI/LLM Security · 2026-10-21

h5i v0.5.1 adds zstd decoding in the browser proxy, a blind-oracle websec workflow, and nudges unauthenticated replays toward --as⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds h5i browser open, h5i browser snapshot, h5i browser requests, and h5i browser audit commands to drive a Chromium session through a built-in policy-checking proxy that logs every request before it moves.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds h5i plugin install websec --from <path> to install the h5i-websec workbench, enabling HTTP capture, modification, replay, and comparison for vulnerability investigation.
• Adds h5i plugin install recon --from <path> to install h5i-recon, which records endpoints, parameters, and candidate URLs discovered through crawling and JavaScript analysis.

Endpoint Security (EDR/XDR) · 2026-10-21

Huntress launches on-demand Identity Posture Assessment for Microsoft 365, available via portal and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Huntress API endpoint to retrieve the Identity Posture Assessment report programmatically for integration into existing workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the Identity Posture Assessment, an on-demand report that evaluates a Microsoft 365 tenant against the Huntress Identity Security Framework, scoring only licensed controls and ranking gaps by severity.
• Generates a co-branded, shareable PDF report from the ISPM dashboard via the Quick Assessment card to support client onboarding, QBRs, and prospect conversations.

Endpoint Security (EDR/XDR) · 2026-10-21

Huntress Managed ITDR gains Lookback: automatic 180-day Microsoft 365 login-history analysis at tenant onboarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Managed ITDR Lookback, which automatically runs Huntress Unwanted Access detections across up to 180 days of Microsoft 365 login history when an eligible tenant onboards, surfacing pre-existing compromises from day one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Lookback findings appear as a dedicated section of the Identity Security Assessment, delivered by email and visible in the Huntress portal within 48 hours of onboarding.
• Active compromises discovered by Lookback trigger SOC investigation, a critical Incident Report, and active session revocation; previously remediated activity surfaces as historical findings without triggering a new incident.

Secrets Detection & Management · 2026-10-21

Infisical v0.166.9 adds S3-backed PAM session recordings, AWS KMS signing for internal CAs, Agent Vault variable scoping, and a revamped findings/data-store UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AWS KMS-backed signing keys for internal CAs in the PKI module, enabling hardware-protected certificate issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds S3-compatible storage backend for PAM session recordings.
• Moves variables from access bundles to Agent Vault scope as a whole, broadening where vault-level variables apply.

Endpoint Management (UEM/RMM) · 2026-10-21

Iru Mac Custom App Library Items now support installers up to 30 GB, with background downloads and auto-resume.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the Mac Custom App Library Item installer size limit to 30 GB, with background downloading in the Iru Agent so other Library Items are not blocked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds auto-resume for interrupted Mac Custom App downloads caused by network hiccups or devices sleeping.

Software Supply Chain Security · 2026-10-21

JFrog Curation adds Compliant Version Selection, Curation Federation, and On-Demand Curation for broader OSS governance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Compliant Version Selection, which automatically returns the highest package version that passes all policies when a requested version is blocked, so developers avoid failed builds without manual intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Curation Federation, which synchronizes policies, conditions, and JFrog Catalog labels from a central controller site to all connected JFrog Platform Deployment sites, eliminating manual policy replication.
• Adds On-Demand Curation, which extends policy enforcement to packages from internal, private, or ecosystem-specific repositories not covered by the JFrog Public Catalog, applying real-time vulnerability, license, immaturity, and malicious code evaluation before a package reaches the developer.

Software Supply Chain Security · 2026-10-21

JFrog AI Security extends Shadow AI detection to developer workstations via the JFrog Agent Plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the JFrog Agent Plugin installable on developer workstations to discover and locally scan AI assets — skills, MCP servers, plugins, hooks, commands, and monitors — that bypass central repository controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a three-step local detection pipeline: Discover (enumerate AI assets on the workstation), Scan Locally (deterministic rules-based scan), and Report (sends metadata, findings, and risk analysis to the JFrog Platform).
• Adds a unified AI asset inventory in JFrog AI Security showing each asset's name, type, reporting harness (Claude Code, Cursor, etc.), workstation count, local risk analysis, JFrog origin, and detection timestamp.

Software Supply Chain Security · 2026-10-21

JFrog adds intent-based AI asset scanning for SKILL.md files, agent plugins, and APM packages via JFrog AI Security and Agent Guard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds JFrog AI Security scanner that performs semantic (intent-based) analysis of agent skill files (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ SKILL.md), agent plugins, and APM manifest packages to detect prompt injection, hidden instructions, obfuscated payloads, and credential-exfiltration instructions that SCA and SAST cannot reach.
• Adds JFrog Agent Guard enforcement component that applies deterministic-plus-semantic policy at the agent harness — the point an agent actually invokes the asset — not only at download time, so a skill reclassified after initial approval is blocked on machines that already have it.
• Returns one of three scan classifications — Not Malicious, Suspicious, or Malicious — for each AI asset, with policy controls that route outcomes to block, review queue, or allow.

Identity & Access Management · 2026-10-21

JumpCloud App Catalog gains per-app update notification control and user-initiated Required app updates in Self Service.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Disable end user update notifications setting when adding or editing an App Catalog application, applying to Auto and Self Service delivery (existing apps keep notifications enabled; Auto-Update still forces updates after seven days).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables users to start available updates for Required applications directly from the Updates section in the Self Service App Catalog, regardless of the Auto-Update setting.

Identity & Access Management · 2026-10-21

JumpCloud adds MFA Frequency Controls to Conditional Access Policies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MFA Frequency Controls configuration to Conditional Access Policies, letting admins define how often users must re-authenticate with MFA.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-21

JumpCloud AI Gateway gains three new integrations: DocuSign, Google Maps Grounding Lite, and Salesforce.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DocuSign integration support for the AI Gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Google Maps Grounding Lite integration support for the AI Gateway.
• Adds Salesforce integration support for the AI Gateway.

Identity & Access Management · 2026-10-21

JumpCloud adds Agent Uninstall Protection, MCP Server for Users, Custom Risk Policies, Patch Management Dashboards, and Custom Banned Password Lists in Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Disable Agent Uninstall Protection policy for macOS, Windows, and Linux to exempt specific devices from the maintenance-token requirement during maintenance, troubleshooting, or imaging, and enables Agent Uninstall Protection on by default for all devices running JumpCloud agent v2.179.2 or later, requiring a per-device maintenance token to uninstall via standard methods on macOS, Windows, and Linux.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds REST APIs for managing AI Agents and Agent Groups — register, retrieve, update, suspend, activate, and delete agent identities, credentials, groups, memberships, and application assignments programmatically.
• Adds MCP Server for Users toggle under Settings > JumpCloud AI, letting users connect AI clients to User Portal capabilities via OAuth sessions, with admin controls to review and revoke active sessions.

Container & Image Security · 2026-10-21

Kata 4.3.0 adds rootless SEV-SNP/TDX, GPU driver repo support, guest-extension VMM expansion, and deeper webhook memory enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables rootless SEV-SNP and TDX in runtime-rs/QEMU, allowing confidential VMs to run without root privileges.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ability to enforce a minimum memory limit in the kata-webhook.
• Adds support for a dedicated driver userspace repository for NVIDIA GPUs via driver.url in nvgpu.

Secure Access (VPN / SASE / ZTNA) · 2026-10-21

Knocknoc adds Predefined IP sources, letting admins grant access based on fixed IPs rather than the user's login address.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Predefined IP sources to knocs, allowing access grants to be tied to fixed IP addresses instead of the IP the user logged in from.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Exploitation & C2 · 2026-10-21

Metasploit Pro 5.1.0-2026101901 adds 20 new modules targeting AI/LLM platforms, snap-confine, MongoDB, and Windows AArch64 fetch adapters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds mongodb_version, mongodb_login, mongodb_schemadump, and mongodb_hashdump auxiliary modules for MongoDB enumeration and credential harvesting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Windows AArch64 fetch adapters, extending payload delivery to ARM64 Windows targets.
• Updates post/linux/gather/enum_protections to detect AV/EDR software present on the target system.

Reconnaissance & OSINT · 2026-10-21

nerva: Adds Zabbix detection to the fingerprinter, enabling identification of Zabbix monitoring services during network reconnaissance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-21

Nerva v1.74.0 adds CUPS service fingerprinting to its 170+ protocol detection library.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CUPS (Common Unix Printing System) detection to the fingerprinter, expanding protocol coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-21

Nerva v1.73.0 adds SHOUTcast DNAS fingerprinting to its service detection plugin set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SHOUTcast DNAS detection to the fingerprinter plugin set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-21

Nudge Security adds SSO support for Microsoft Entra ID (OIDC) with a dedicated app registration flow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports signing in to Nudge Security via OpenID Connect (OIDC) using Microsoft Entra ID (formerly Azure Active Directory), configured through a dedicated app registration separate from the existing Entra ID discovery integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Redirect URI https://oidc-auth.nudgesecurity.io/oauth2/idpresponse must be registered as a Web platform in the Entra app registration to enable SSO.
• Requires only the standard OIDC delegated permissions (openid, profile, email) under Microsoft Graph — no broader data access.

Identity & Access Management · 2026-10-21

Nudge Security adds native ServiceNow integration for ticket creation, field mapping, and auto-close on finding resolution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a ServiceNow integration configurable at Settings > Ticketing > Connect ServiceNow, supporting simultaneous use alongside an existing Jira connection with per-ticket destination selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds default field mapping under Settings > Ticketing > ServiceNow to pre-populate ServiceNow ticket fields (Table, Urgency, Assigned to, Assignment group, Caller, Short description, Description) when creating tickets from findings.
• Auto-closes the linked ServiceNow ticket when a finding is resolved in Nudge, setting the ticket to the mapped state and adding a work note with the finding name, resolution date, and a link back to Nudge; if the finding re-emerges, a new ticket is created while the original remains closed as a historical record.

Identity & Access Management · 2026-10-21

Nudge Security adds Jira Cloud integration with auto-close on resolution and deep-link ticket tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Jira Cloud integration, configurable at Settings > Ticketing, to create and track tickets directly from findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Create Jira ticket action on the Fix tab of any finding, pre-populating Summary, Description, Project, Work Type, Priority, Assignee, and Reporter from default field mappings set at Settings > Ticketing > Jira.
• Stores the Jira ticket key and URL on the finding and logs a Jira ticket created event with an inline link in the finding Timeline.

Identity & Access Management · 2026-10-21

Nudge Security adds Microsoft Teams integration for sending nudges and notifications directly in Teams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Microsoft Teams integration via Settings → ChatOps → Teams, enabling nudges to be sent to and responded to directly inside the Teams app instead of email.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Teams-based notification workflows so admins can receive Teams messages when events occur, such as a new supply-chain breach or a user signing up for a new application.
• Requires the Nudge Security Teams app installed from the Teams apps marketplace (search nudge), with admin consent granted from the Microsoft Teams Admin Center.

Identity & Access Management · 2026-10-21

Nudge Security exposes a REST API with endpoints for events, fields, OAuth grants, and label/field management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Authorization: Bearer <token> authenticated REST API access, with API tokens created under Settings > API Tokens and a rate limit of 1200 requests per 5-minute period.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds events endpoint to retrieve all events generated by Nudge Security for export to external systems such as a data lake, SIEM, or IT ticketing system.
• Adds notifications endpoint to retrieve only events that have been configured to trigger a notification.

Identity & Access Management · 2026-10-21

Nudge Security adds Slack integration to deliver nudges and channel notifications directly inside Slack workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Slack integration via Settings > Notifications > Connect Slack so admins can send nudges to employees and receive their responses without leaving Slack.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports /invite @Nudge Security to add the Nudge Security bot to any Slack channel for event-driven notifications.
• Supports /remove Nudge Security to remove the Nudge Security bot from a Slack channel.

Identity & Access Management · 2026-10-21

Nudge Security adds Okta SSO support with both SP-initiated and IdP-initiated authentication flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports SP-initiated and IdP-initiated SSO flows via Okta, configured by contacting Nudge Security support with your Okta domain, Client ID, and Client Secret.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-21

Nudge Security adds Okta SSO analysis integration to monitor SaaS SSO enrollment status and trigger enrollment workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Okta integration via read-only and application administrator API token, requiring access to /api/v1/apps, /api/v1/apps/{application_id}/groups, /api/v1/apps/{application_id}/users, /api/v1/org/contacts/technical, /api/v1/users/, /api/v1/groups, and /api/v1/groups/{group_id}/users endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables monitoring of SSO enrollment status across the full SaaS estate by connecting an Okta tenant to Nudge Security.
• Supports automatic initiation of SSO enrollment workflows via the Things to do > Onboard apps to Okta playbook inside Nudge Security.

Identity & Access Management · 2026-10-21

Nudge Security adds an Okta connected app integration, configured via API token from a least-privilege Okta user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Okta connected app integration, configured under Settings > Integrations in Nudge Security by supplying an Okta domain and API token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports least-privilege Okta API token setup by creating a custom Read-Only Okta role scoped to All Authorization Servers and All Identity and Access Management Resources before generating the token.

Identity & Access Management · 2026-10-21

Nudge Security now discovers AI agents built on Notion, surfacing creator, components, and risk insights in the AI agents inventory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the Notion AI agents connected app in Nudge Security to automatically discover and inventory AI agents your team builds on Notion, including creator, components, and risk insights, via the AI Agents tab under Identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-21

Openlayer gateway documents error formats, check ordering, 503 causes, and X-Request-ID tracing across all endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds X-Request-ID request header support so operators can trace exact gateway requests in logs and as the Openlayer trace ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Documents error format per endpoint: /v1/messages returns Anthropic shape; /v1/responses and /v1/embeddings return OpenAI shape; /v1/models returns shape based on path (/anthropic/v1/models or /openai/v1/models) or SDK headers on bare /v1/models.
• Adds error type mapping from HTTP status code: invalid_request_error (400/422), authentication_error (401), permission_error (403), not_found_error (404), rate_limit_error (429), api_error (5xx).

SAST / SCA / Code Security · 2026-10-21

Openlayer adds governance lifecycle stages, bias/fairness tests, 8 new integrations, Gateway routing, and a public governance API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds evaluationScope: step config field for per-step evaluation — run tests on each individual trace step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds openlayer tests delete CLI command — archives tests by default; --force flag permanently deletes them.
• Extends openlayer init to support Copilot CLI and Gemini CLI, custom CA bundles, a 'debug with an agent' option, and .openlayerignore for smaller uploads.

AI/LLM Security · 2026-10-21

OpenShell v0.1.5 adds push-based config delivery (~100 ms), OCSF-over-OTLP export, virtiofs host mounts, per-sandbox mutation locks, and new CLI flags --annotation and --e⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds config_delivery_mode = "push" supervisor setting to receive configuration changes pushed over the gateway session in ~100 ms instead of up to 10 seconds; polling remains the default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds [openshell.gateway.otlp.ocsf] config block with enabled = true to export OCSF events as OTLP log records, and allows traces and OCSF events to be sent to separate OTLP endpoints.
• Adds --annotation KEY=VALUE repeatable flag to openshell sandbox create for setting sandbox annotations from the CLI.

Identity & Access Management · 2026-10-21

Passbolt 5.17.0 adds phishing-resistant passkey MFA and extends QuickAccess and Offline Mode to PIN codes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds phishing-resistant passkey MFA as a new multi-factor authentication option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Confirms permission changes when resources are moved, surfacing a review step before the move completes.
• Improves autofill detection across modern websites.

CNAPP · 2026-10-21

Plerion workload scanning now covers Lambda web function revisions, including code, secrets, environment variables, and SBOM generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Lambda workload scanning to cover every Lambda web function revision that an endpoint sends traffic to, scanning for vulnerabilities, secrets (including environment variables), and generating an SBOM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Raises Lambda workload checks on web functions automatically when the existing Lambda toggle is enabled — no new setting required.
• Surfaces the S3 bucket name on any web function that cannot yet be scanned, guiding operators to share that bucket with Plerion the same way as for an AgentCore runtime deployed from a code zip.

Cloud Security Posture · 2026-10-21

Plexicus v1.2.55 adds C#/.NET and Razor AI-SAST coverage and rebuilds the PlexiFlow automation editor with undo, visual conditions, and a schedule builder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends AI SAST scanning to cover C# and .NET projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Razor template support to AI SAST scanning.
• Adds visual conditions to the PlexiFlow automation editor for building conditional logic without hand-editing.

CNAPP · 2026-10-21

InsightCloudSec 26.10.20 adds four database security Insights, a new Query Filter, and expanded RDS security group evaluation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Database Instance Without Security Group Query Filter to identify database instances and clusters lacking an attached security group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Database Instance Without Security Group Insight to flag database instances and clusters with no attached security group configured.
• Adds Distributed Table Using Provider Default Encryption Key (DynamoDB) Insight to detect DynamoDB tables using the AWS-owned default key instead of an AWS-managed or customer-managed KMS key.

MCP Servers & Tooling · 2026-10-21

Runlayer 1.29.0 adds iMessage agent channels, AI meeting-recorder detection, and GitHub repository access for agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds iMessage channel for agents: users can text an agent from Messages on iPhone, iPad, or Mac after linking their number to their Runlayer account; admins choose which agent answers the linked number.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI Watch Detect inventory of AI meeting recorders and ambient notetakers — including Granola, Otter, Fathom, Fireflies, tl;dv, Read AI, Circleback, Plaud, Jamie, Cluely, Interview Coder, Final Round AI, Screenpipe, Rewind, Limitless, Run It Back, LUCI, and Alter — surfaced as presence-only clients in Shadow AI; Detect never reads recordings, transcripts, or notes.
• Adds GitHub App integration for agents: workspace admins can connect a GitHub App and grant agents access to selected repositories via short-lived tokens.

MCP Servers & Tooling · 2026-10-21

Runlayer 1.28.1575 adds computer-use agent detection, session stop controls, scoped token enforcement, and a Microsoft 365 Work IQ connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds FF_DISABLE=agent-token-audience-enforcement (self-hosted) and FF_ENABLE=agent-token-audience-enforcement (WorkOS feature-flag deployments) to control whether scoped agent tokens are rejected with 403 invalid_target on out-of-scope servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Scoped agent or on-behalf-of tokens (requested with resource) now return 403 invalid_target on any server outside their scope, and exchanging a scoped token for an on-behalf-of token without a resource inside that scope returns 400 invalid_target.
• AI Watch Detect now inventories additional AI clients as presence-only entries: desktop computer-use agents Manus (Studio My Computer mode), UI-TARS Desktop, Highlight, Agent! (AgentiLoop), Fazm, Peekaboo, and the rabbit OS3 agent, detected via app bundle, Store package, install path, or per-user state directory; pip- and npm-installed computer-use tools Browser Use, Skyvern, Cua (cua-driver), Agent S, and OpenAdapt, detected via package metadata, command-line binaries, and per-user state directories, with projects embedding Browser Use as a library classified as agent definitions; and Google's native Gemini desktop app.

Attack Surface & Exposure Management · 2026-10-21

runZero: Improves fingerprint detection for BrightSign, Mitel, Emerson DeltaV, OPC UA devices, Beckhoff Automation, and Loytec.

Attack Surface & Exposure Management · 2026-10-21

runZero 5.1.261020.0 adds LonTalk protocol support and makes AI tool-call limits configurable via env vars and API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN and RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN environment variables for self-hosted operators to set platform-wide AI tool-call limits (defaults: 8 and 20).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes AI tool-call limits for accounts and organizations using their own AI provider via the AI configuration pages and through the API.
• Adds LonTalk protocol support for asset discovery.

SOAR · 2026-10-21

Shuffle v2.3.1-rc1 adds graceful worker stop for AI Agent actions in hybrid deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Improves app name resolution and workflow execution validation when the executor is an AI Agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-21

Snyk AppRisk adds Secrets scan scheduling (Daily/Weekly/Never) and Secrets visibility in the Inventory All Assets view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Repo Monitor Configuration to Inventory -> repository -> Settings to set Secrets scan frequency to Daily, Weekly, or Never for a single repository.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bulk Secrets scan frequency configuration via Inventory -> Configure Monitoring to apply Daily, Weekly, or Never across many repositories at once.
• Adds Secrets coverage to the All Assets view in Inventory, showing each repository's Secrets coverage control, associated Snyk Projects with Secrets results, and Secrets issues found.

Software Supply Chain Security · 2026-10-21

Socket: Adds token_prefix and token_last4 fields to token-list API responses, allowing key identification without parsing the masked display string.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Async endpoints for starting a fix computation and polling for results are now documented in the Fixes API, supporting supported parameters and result format to avoid timeouts on large projects or first runs.
• Adds repository access checks before computing or returning fixes for user OAuth sessions governed by repository or workspace policies, returning 403 for unfiltered repository endpoints.
• Adds current-role checks for OAuth requests so that role changes take effect on the next request, including for linked service-account requests.

Endpoint Security (EDR/XDR) · 2026-10-21

Sophos Endpoint UI and Sophos Self Help Tool merged into a single unified Sophos Endpoint UI component.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Merges the Sophos Endpoint UI and Sophos Self Help Tool into a single unified component called Sophos Endpoint UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-21

Sophos Core Agent 2026.3.0.2090 merges the Endpoint UI and Self Help Tool into a single unified component.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Merges Sophos Endpoint UI and Sophos Self Help Tool into a single unified component called Sophos Endpoint UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-10-21

Sysdig Secure adds SIEM forwarding rules to filter by data type, severity, and policy name before sending to downstream platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SIEM forwarding rules to replace the Data to Send field, letting you attach one or more rules to each integration with a data type and optional filters — such as severity or policy name for Runtime Policy Events, or type for Activity Audit — so only matching data is forwarded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Rules column to the integrations list showing the number of forwarding rules configured per integration.

Attack Surface & Exposure Management · 2026-10-21

syzkaller gains Linux device-mapper and MD RAID syscall descriptions, plus bluetooth and USB fuzzing focus in syz-cluster⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds exclude_path_regexps support in syz-cluster fuzz targets to exclude specific paths from fuzzing scope⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds syscall descriptions for the Linux device mapper control interface (sys/linux)
• Adds syscall descriptions for Linux MD software RAID interfaces (sys/linux)

Secure Access (VPN / SASE / ZTNA) · 2026-10-21

Tailscale adds MagicRoute (beta) for redundant-path selection across subnet routers, app connectors, exit nodes, and Service hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MagicRoute (beta) to automatically choose between redundant subnet routers, app connectors, exit nodes, and Tailscale Service hosts for resilient routing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Replaces the Regional Routing toggle in the admin console with a new Route selection configuration surface for tailnet-wide route policy.

Detection Engineering · 2026-10-21

Tenzir Test v2.3.1 adds automatic package loading for Python tests, matching existing TQL test behavior.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Python tests now automatically load their enclosing package and configured package directories, matching the behavior already available in TQL tests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Python executors now capture package settings at construction time, so explicit environment mappings reliably select packages.

Endpoint Security (EDR/XDR) · 2026-10-21

Cloud Email Gateway Protection gains directory sync via TrendAI Vision One™ IAM, supporting AD, Entra ID, Google Cloud Identity, Okta, and OpenLDAP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Existing Directory Synchronization Tool users can review migration eligibility and the migration report in the IAM Connection tab before switching, after which TrendAI Vision One™ IAM automatically cleans up legacy synchronized data and configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Malware Analysis · 2026-10-21

YARA-X v1.22.0 adds 64-bit integer built-ins, pe.offset_to_rva, zip module support in yr dump, and xor_key in C/Go APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds int64, int64be, uint64, and uint64be built-in functions with support for unsigned 64-bit integers and integer literals greater than i64::MAX.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds pe.offset_to_rva function to the pe module for converting file offsets to RVAs.
• Exposes xor_key for matching patterns in the C and Go APIs.

Identity & Access Management · 2026-10-20

SaaS Manager adds CSV consumption exports, multi-budget support, GitHub Copilot AI tracking, and OpenAI Platform SCIM provisioning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CSV export for AI consumption data from the spend explorer and application AI consumption tab, respecting active filters, date range, and optional monthly grouping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports creating multiple budgets for the same application with overlapping date ranges, tracking spend, threshold alerts, and runway calculations independently per budget.
• Adds AI Consumption support for GitHub Copilot, enabling import of user-level credits, token usage, and application-level credits by model.

Non-Human & Agent Identity · 2026-10-20

Aembit adds MCP session management, change-notification relay, tool-output validation, named-header credentials, and parity across Edge SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds access.registration event type to Access Authorization Events, recording each Dynamic Client Registration (DCR) request an MCP client sends — successful registrations log client ID, client name, redirect URIs, grant types, and response types at severity Info; failed registrations log at severity Error with a reason and the failing attribute (and its supplied value when present).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds subscriptions_workload_refresh_interval timeout setting (default: 30 seconds) to MCP Identity Gateway, controlling how often it checks for assignment and rule changes, and extends it to relay subscriptions/listen change notifications to MCP clients using the 2026-07-28 MCP specification revision, including notifications triggered by Server Workload assignment or MCP Tool Access Control rule changes and on reconnection.
• Adds tool-output validation to MCP Identity Gateway: when a tool publishes an output schema, completed results are checked against it and the MCP client receives an error in place of any result that does not match.

Cloud Security Posture · 2026-10-20

Identity & Access Management · 2026-10-20

Auth0 adds phone-country controls and a guided ACL rule builder to Universal Login and Tenant Access Control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tenant-level include/exclude lists via tenant settings to configure which phone countries are supported in Universal Login.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds theme API controls for identifier presentation (type-specific Continue with buttons vs. unified field) in Universal Login.
• Adds updated Universal Login phone entry UI with country selection, regional formatting, numeric keyboard, and phone number suggestions on supported devices — available in Early Access on all plans.

Patch Management · 2026-10-20

Automox MCP Server 3.0 customer setup guide now available in the developer documentation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Automox MCP Server 3.0 customer setup guide to the developer documentation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-10-20

Backslash adds Local Model Discovery to surface shadow AI from Ollama, LM Studio, llama.cpp, and six other local runtimes on macOS and Windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Local Model Discovery to detect AI models installed on macOS and Windows endpoints via Ollama, LM Studio, Jan, GPT4All, the Hugging Face cache, MLX, LocalAI, and llama.cpp — with no developer setup required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces local models in the existing AI inventory alongside remote models, enabling the same allow and deny list controls to be applied to endpoint-resident models.
• Reports a permission gap when a model directory cannot be read, letting security teams distinguish an access limitation from an inspected directory that contained no models.

Exploitation & C2 · 2026-10-20

Bugcrowd adds API support for triggering Savant Pathseeker Tests programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables triggering Savant Pathseeker Tests via the API, allowing automated or pipeline-driven test execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-20

Censys adds a Threat Hunting MCP Server, enabling AI agents to query Censys data via the Model Context Protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Censys Threat Hunting MCP Server, allowing AI assistants and agents to interact with Censys threat intelligence data through the Model Context Protocol (MCP).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-20

Censys adds an in-app feedback portal, reorganized UI navigation, 10 new platform fingerprints, and hundreds of new ASM CVE risks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an in-app Censys Platform Feedback Portal for submitting feedback and tracking feature requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Reorganizes the Censys Platform UI and search actions into three sections: Investigate, Defend, and Intelligence.
• Moves search history to its own tab on the upper right corner of the search results page.

Container & Image Security · 2026-10-20

Chainguard adds Custom Assembly Overlays, Libraries for .NET and Go, AI-powered Harness, hardened CI Checks, and agent Workspaces in beta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds image_overlay Terraform resource to manage Custom Assembly Overlays and bindings for per-tag image customizations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds version templates (e.g., py{{major}}.{{minor}}-cryptography) in Custom Assembly Overlays so each tag resolves package names to its own version automatically.
• Introduces Custom Assembly Overlays (Early Access) to apply packages, environment variables, annotations, certificates, and user accounts to specific image tags, variants, or entire organizations via chainctl or Terraform — without affecting unrelated versions.

Identity & Access Management · 2026-10-20

Clerk iOS/macOS setup now supports a Clerk CLI agent workflow with npx clerk@latest init, doctor, and whoami commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds npx -y clerk@latest init --app <application_id> --yes --json to scaffold Clerk into an Xcode project, downloading the SDK, configuring capabilities, enabling the Native API, and registering the native app on the development instance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds npx -y clerk@latest doctor --json to validate project and Clerk settings after setup, usable with --xcode-project, --xcode-target, and --xcode-configuration selectors.
• Adds npx -y clerk@latest whoami and npx -y clerk@latest auth login for CLI authentication during agent-driven setup.

Identity & Access Management · 2026-10-20

Clerk CLI gains native iOS/macOS SwiftUI setup, auto-detecting Xcode projects and configuring Sign in with Apple.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports framework auto-detection for Next.js, React, Vue, Nuxt, Astro, React Router, TanStack Start, iOS, macOS, and more, with SDK installation and authentication scaffolding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds environment variable management for projects that use environment files via the CLI.

Internet Services · 2026-10-20

Cloudflare: Adds Workers AI models @cf/cloudflare/clairic (extraction, $0.10/M input tokens) and @cf/deepseek-ai/deepseek-v4.1-flash-1017 (552B multimodal MoE).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds step-up authorization to the Cloudflare API MCP server: connect with minimal scopes and approve additional scopes on demand; the server returns an insufficient_scope challenge naming the required scope when a tool call needs one not yet granted; choose Minimal on the consent page to start with least access.
• Improves Precursor (bot detection): the Status dropdown in Settings now offers Off, Monitor, and Arm modes, where Monitor runs Precursor detections without affecting bot score or Challenge clearance and Arm enables full enforcement; also adds a Show Interstitial site-wide default and Interstitial Rules per-request overrides, decoupling the Precursor Interstitial from the detection mode.
• Adds Local Explorer support for Cron Triggers: a POST /cdn-cgi/local/explorer/api/local/scheduled?worker=<worker-name> API endpoint accepting a JSON body with cron and optional scheduled_time (epoch ms), available via wrangler dev, cf dev, or the Cloudflare Vite plugin; and a Cron Triggers panel in the Local Explorer UI at /cdn-cgi/local/explorer supporting ad hoc cron expression building, configured expression invocation, reusable scheduled time presets, and noRetry() outcome inspection, without modifying cloudflare.config.ts or deployed triggers.

Threat Intelligence · 2026-10-20

Cloudmersive Cloud Fraud AI API v2-1-0 adds country code and document class input parameters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds country code and document class input parameters to the Fraud Detection AI API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-20

Cloudsmith adds ActiveState upstream proxying, Buildkite/GCP OIDC auth, package listing from connected repos, and Ruby cooldown policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ActiveState Curated Catalog upstream support, configurable via the Libraries tab, so teams can proxy and cache packages from the ActiveState catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OIDC authentication for Buildkite pipelines and Google Cloud workloads in CLI v1.29.0, eliminating the need to store Cloudsmith API keys on build hosts.
• Adds the ability to list packages from connected repositories alongside your own packages in CLI v1.29.0.

SAST / SCA / Code Security · 2026-10-20

API surface changed: 1 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-20

ConductorOne adds AI-driven finding remediation, custom campaign selectors, local policies, Slack-native C1AI, and a new secure secrets-sharing feature.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DELETE /api/v1/apps/{app_id}/resource_types/{resource_type_id}/resources/{id} now returns an error for connector-synced resources and exposes a read-only isManuallyManaged field on app resources returned by the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds batch Add template entitlements and Remove template entitlements API calls, each accepting up to 200 entitlements, so campaign template selections can be built incrementally without overwriting earlier choices.
• Adds a Remediate with AI button on findings that opens C1AI with the finding's type and target pre-filled and follows a built-in remediation playbook for unowned service accounts, non-human identities, shadow apps, and connector sync failures, plus a new Findings tab on application detail pages listing open and in-progress findings with target, assignee, and filters for severity, type, and assignee.

Vulnerability Management · 2026-10-20

DefectDojo Pro adds four built-in Asset relationship types including deploys_to, which propagates exposure from host clusters to deployed services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds deploys_to built-in Asset relationship type that exposes Asset Exposure propagation: a service deployed onto an internet-facing cluster inherits the cluster's effective exposure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ships four Asset relationship types by default, with deploys_to intentionally excluded from Finding roll-up so a cluster's Findings are not attributed to every service it hosts.

Vulnerability Management · 2026-10-20

DefectDojo Pro v3.4.200 adds StackHawk and Qualys TotalAppSec connectors, a Findings grid view, On Dedupe Match trigger, and in-app walkthroughs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DD_LICENSE requirement to the initializer, which refuses to migrate without a valid license in DD_LICENSE, the mounted license file, or the database.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds DD_SCHEMA_DUMP_PATH config key to override the schema file path for fresh installs (empty value disables schema pre-load).
• Adds lifecycle.preStop.waitSeconds.mcpServer config key to set the preStop wait during zero-downtime mcp-server rollouts.

Vulnerability Management · 2026-10-20

DefectDojo 3.4.200 adds per-release schema snapshots for empty databases and a caller-configurable batch dedupe match action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Loads a per-release schema snapshot into empty databases on first start, speeding up fresh deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Lets a caller decide what a batch dedupe match does, giving API consumers control over deduplication behaviour.

Public Key Infrastructure (PKI) · 2026-10-20

CertCentral adds a DigiCert default (recommended) option to the Default intermediate chain menu and cleans up Apache download bundles ahead of G5 migration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DigiCert default (recommended) option to the Default intermediate chain product menu so operators can distinguish a DigiCert-chosen chain from one they explicitly selected; the ca_cert_id API parameter continues to override this setting per-request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Apache download (DigiCertCA.crt) for G5 and G2 TLS certificates will no longer include the unneeded self-signed root — only the cross-signed root remains, removing the need for manual post-download cleanup scripts.
• The disable_ct parameter on certificate order requests (including Order Basic OV) is deprecated; CertCentral now ignores it and always logs issued TLS certificates to CT logs regardless of the value passed.

Secure Access (VPN / SASE / ZTNA) · 2026-10-20

DNSFilter adds multilingual unblock request forms in Spanish, French, and German, and migrates branded subdomains to app.dnsfilter.io.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports Spanish, French, and German on the Request Access form on block pages, auto-detecting the user's browser language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Migrates managed branded subdomains from app.dnsfilter.app to app.dnsfilter.io automatically with no admin action required.

Vulnerability Management · 2026-10-20

faraday-cli gains multi-session auth management, cloud-agent scanners group, and a full FaradAI pentest/triage command surface⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds auth list subcommand to display all saved connection sessions, marking the active one, with columns ID, ACTIVE, NAME, KIND, SERVER, USER, WORKSPACE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds auth use <id|name|user> subcommand to switch the active connection to any saved session by ID number, name, or user/email.
• Adds auth rm <id|name|user> subcommand to remove a saved session and clear the active connection if it was the active one.

Vulnerability Management · 2026-10-20

faraday-cli gains a pentest command (alias for faradai scan) to launch AI-driven pentests via the FaradAI cloud agent⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pentest command (shortcut for faradai scan) to launch an AI-driven pentest against a target using the FaradAI cloud agent, with --target to specify the URL, --watch to tail the run to completion, and --advanced to enable a deeper 80-round audit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-20

faraday-cli 2.3.0 adds FaradAI cloud agent commands for scanning, triage, and SaaS onboarding without a Faraday server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds faraday-cli scanners with list, get, and run subcommands to manage FaradAI cloud agents from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds faraday-cli faradai scan and faraday-cli faradai triage shortcuts (with pentest/triage modes) to launch FaradAI cloud scans and triage workflows.
• Adds faraday-cli auth list, auth use, and auth rm to manage named connection sessions for multiple Faraday environments.

WAF, Bot & API Protection · 2026-10-20

Fastly adds Platform Metrics V2 API endpoints with cursor-based pagination, predefined metric sets, and flexible grouping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new Platform Metrics API endpoints for retrieving historical metrics data with cursor-based pagination for large datasets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports predefined metric sets that bundle related metrics for simpler querying.
• Enables grouping of historical metrics by point of presence or datacenter.

Reverse Engineering · 2026-10-20

Finite State Platform now shows Finding history and complete declared license details to Project/Folder viewers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes Finding history — including status updates and comments — to any user who has view access to the Project or Folder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-20

Binary scans now detect nanoMODBUS, nanoprintf, cifra, TinyCrypt, and MPLAB Harmony libraries in firmware.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds component detection for nanoMODBUS, nanoprintf, cifra, TinyCrypt, and MPLAB Harmony libraries in binary firmware scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-10-20

GitGuardian adds API endpoints to list and skip GitHub Check Runs that block pull requests⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v1/check-runs endpoint to list GitHub check runs GitGuardian ran on pull requests, filterable by incident_id to surface runs that reported a specific secret incident.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST /v1/check-runs/{check_run_id}/skip endpoint to programmatically skip a blocking GitHub check run, tagging its incidents and occurrences with CHECK_RUN_SKIP_* and logging activity — even when the Skip buttons are disabled in workspace settings.
• Exposes check run response fields including repository_full_name, commit_sha, pull_requests, github_status, github_conclusion, head_branch, and base_branch for rich filtering and automation.

Secrets Detection & Management · 2026-10-20

ggscout 0.34.1 adds in-network validity checks and permissions analysis for vaulted secrets, plus a new POST /v1/check-runs/{check_run_id}/skip API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds in-network validity checks and permissions analysis to ggscout (requires v0.34.1 or later), running after classification and before hashing so internal vaults, VPN-gated databases, and provider-restricted endpoints are reachable without allowlisting GitGuardian IPs, with a new [check] enabled = false config key to opt out of these checks per deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces validity results in the NHI inventory as a Validity column and filter with Valid and Invalid values, exposes token permission scopes (e.g. repo, admin:org on GitHub; api on GitLab) per credential in the NHI identity detail, adds owner account, expiry date, and provider metadata to NHI identity detail via ggscout, and merges validity verdicts from vaulted or Kubernetes secrets with any matching secret incident, keeping the most recent verdict across both surfaces.
• Adds a built-in Valid saved view to the Endpoint Protection discovered secrets page, listing all secrets currently checked as valid.

SAST / SCA / Code Security · 2026-10-20

New REST API endpoints let you GET and PATCH Copilot model policies at enterprise, team, app, and org levels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET and PATCH endpoints at /enterprises/{enterprise}/copilot/model-policies to retrieve and update Copilot model policies at the enterprise level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET and PATCH endpoints at /enterprises/{enterprise}/teams/{team_slug}/copilot/model-policies to manage Copilot model policies per enterprise team.
• Adds GET and PATCH endpoints at /enterprises/{enterprise}/copilot/apps/model-policies to manage Copilot model policies for enterprise apps.

SAST / SCA / Code Security · 2026-10-20

GitLab Runner 19.5 adds CPU model logging at job start and clearer Kubernetes OOM-kill error messages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Logs the CPU model of the job execution environment at job start for better observability of runner hardware.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces a clearer Kubernetes executor error message when the helper container is OOM-killed.

SAST / SCA / Code Security · 2026-10-20

GitLab Duo Agent Platform launches Code Review Flow, Fix CI/CD Pipeline Flow, and Agentic Chat for free-tier groups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Allow flow execution and Allow foundational flows under Settings > GitLab Duo > Change configuration > Flow execution to activate the GitLab Duo Agent Platform for a group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Code Review Flow: assign @GitLabDuo as a reviewer or comment /assign_reviewer @GitLabDuo on a merge request to get automated diff, description, and related-file review comments posted inline.
• Adds an automatic reviews option for Code Review Flow so every new merge request receives a first-pass review without manual assignment.

SIEM · 2026-10-20

Google SecOps adds 18 new log type ingestion targets and migrates ATI curated rules to the GTI_IOC feed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Updates parsers for FORTINET_SANDBOX, PURE_STORAGE, RSA_NETWITNESS, and UPTYCS_EDR log types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates Applied Threat Intelligence (ATI) curated detection rules to match against the GTI_IOC feed, replacing the legacy feeds; custom rules referencing legacy feeds must be manually migrated to GTI_IOC.

Container & Image Security · 2026-10-20

Grype v0.121.0 adds OS SUPPORT_END date fallback for end-of-life warnings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Falls back to the SUPPORT_END date from OS release information when generating end-of-life warnings, so distros that publish a support-end date but no explicit EOL date are now flagged correctly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-20

iDenfy adds MCP-based AI assistant access, standalone Bank Card Verification in PCI-DSS v4.0.1 environment, and Persian (Farsi) RTL support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds marital name field to KYC results for ID documents that carry a second surname.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Original language data section to KYC CSV reports, exporting document field values in their native script as separate columns.
• Enables AI assistants (starting with Claude and Claude Code) to connect to iDenfy accounts over MCP, with a consent screen to control which data areas they can view or edit.

Endpoint Management (UEM/RMM) · 2026-10-20

Iru adds Windows 11 26H2 managed upgrades, policy access improvements, and background downloads up to 30 GB for custom app installers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports upgrading managed devices to Windows 11 26H2 via Managed OS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables easier access to corporate policies for end users.
• Supports background downloads of custom app installers up to 30 GB.

Endpoint Management (UEM/RMM) · 2026-10-20

Iru adds an Auditor Engagement Hub, 500 Auto Apps milestone, new Mac restrictions, and a centralized Identity activity view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Auditor Engagement Hub inside Compliance Automation to enable direct collaboration with external auditors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces new Mac device restrictions and increased Mac device visibility for improved endpoint control.
• Reaches 500 Auto Apps, expanding the automated application library.

Backup & Recovery · 2026-10-20

Kasten K10 9.0.8 adds per-service log-level overrides, restartless log config, image-pull-secret propagation, and new timeout/limiter Helm keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds logLevelOverrides Helm map to set per-service log level (info or debug), overriding the global logLevel for named K10 services without restarting pods (requires features.restartlessLogLevelChange=true); remove an override with --set-string logLevelOverrides.<service>=⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds features.restartlessLogLevelChange Helm key so services follow the loglevel key of the k10-config ConfigMap at runtime — level changes take effect within seconds without pod restarts; set to false to revert to read-once-at-startup behaviour
• Adds global.copyImagePullSecretsToAppNamespaces Helm key to copy image pull secrets to application namespaces during Blueprint actions and Generic Storage Backup, required for private registries on Kubernetes 1.35 and later

Backup & Recovery · 2026-10-20

Kasten K10 9.0.8 adds global.copyImagePullSecretsToAppNamespaces to auto-distribute image pull secrets during offline operations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds global.copyImagePullSecretsToAppNamespaces=true Helm flag to automatically copy image pull secrets (specified via global.imagePullSecrets) into application namespaces during backup/restore operations, with automatic cleanup when the operation finishes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ironbank image list and ironbank image copy --dst-registry subcommands to k10tools for managing IronBank image variants in air-gapped registries.

Backup & Recovery · 2026-10-20

Kasten K10 9.0.8 ships SBOM and OpenVEX bundles with grype/Trivy integration to suppress false-positive CVEs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sboms-9.0.8.tar.gz SBOM bundle (SPDX format) covering all Veeam Kasten images, consumable by scanners like grype and Trivy for vulnerability scanning and license compliance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports passing --vex vex-9.0.8.openvex.json to grype (v0.68.0+) or trivy image to automatically suppress VEX-marked findings; --show-suppressed (table output only) lists suppressed results alongside remaining ones.

Backup & Recovery · 2026-10-20

Kasten K10 9.0.8 adds per-policy phase timeout annotations, restartless log-level overrides, KubeVirt filesystem disk backup, and OpenVEX SBOM publishing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds logLevelOverrides Helm value to set the log level (info or debug) of individual Veeam Kasten services without restarting them, controlled by features.restartlessLogLevelChange (enabled by default on new installs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds limiter.repositoryOperationsPerCluster Helm value (default: 3) to cap concurrent background repository maintenance runs and storage usage scans.
• Adds per-policy action phase timeout overrides via annotations k10.kasten.io/backup-timeout, k10.kasten.io/restore-timeout, k10.kasten.io/retire-timeout, and k10.kasten.io/blueprint-resource-hooks-timeout on the policy object.

AI/LLM Security · 2026-10-20

WAF, Bot & API Protection · 2026-10-20

Levo 1.3.x adds multi-GitHub-account linking, bulk AI triage, and a gateway path-bypass auth test⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI-assisted triage to bulk vulnerability selections, letting teams assess many findings at once.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an authentication-bypass test targeting gateway path-handling weaknesses.
• Introduces Streamable HTTP transport support for the MCP server.

SAST / SCA / Code Security · 2026-10-20

Bun package manager support is now generally available in Mend CLI and repository integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds general availability support for the Bun package manager in Mend CLI and repository integrations, enabling automatic detection and reporting of direct and transitive dependencies in projects using package.json alongside bun.lock or bun.lockb files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-20

Mend Platform: Adds GitHub repository-level security advisories as an import source, surfacing maintainer-published vulnerabilities before the global GitHub Advisory

SAST / SCA / Code Security · 2026-10-20

Mend SAST rolls out the Gen 2 detection engine for Swift and PHP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Gen 2 detection engine for Swift and PHP, expanding the newer analysis engine beyond previously supported languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-20

Mend Platform 26.9.3 adds GA Custom Roles and aggregated multi-project SBOM export in CycloneDX and SPDX formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds aggregated SBOM export for application and multi-project scopes, consolidating and deduplicating components across projects into a single CycloneDX or SPDX document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Promotes Custom Roles from closed beta to general availability, with an enhanced role breakdown view and Create Role wizard for intuitive role management.
• Introduces an organizational setting, Include Proprietary Libraries in Workflows, to exclude in-house components from Empty License automation workflow evaluations by default.

SAST / SCA / Code Security · 2026-10-20

Bun package manager support is now generally available in Mend CLI and repository integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds general availability of Bun package manager support in Mend CLI and repository integrations, enabling automatic detection and reporting of direct and transitive dependencies in projects using package.json alongside bun.lock or bun.lockb files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-20

Mend SAST extends its Gen 2 detection engine to Swift and PHP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Gen 2 detection engine for Swift and PHP, bringing next-generation analysis to both languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-20

Mend SAST 26.9.3 introduces the Gen 2 detection engine for Swift and PHP with improved CWE and framework coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Gen 2 detection engine for Swift and PHP, with improved CWE and framework coverage for accurate, scalable scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-20

Mend SCA 26.9.3 adds aggregated SBOM exports, GitHub repo-level advisory imports, and GA Bun package manager support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces an option to generate a single aggregated SBOM file for application and multi-project scopes, consolidating multiple project-level files into one document with deduplication and merged occurrence data; supports CycloneDX and SPDX standards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for GitHub repository-level security advisories as an import source, enabling detection of vulnerabilities published by project maintainers before they appear in the global GitHub Advisory Database (covering projects such as Keycloak, Next.js, n8n, Envoy, Argo CD, Traefik, vLLM, LangChain, and Open WebUI).
• Adds the Include Proprietary Libraries in Workflows organizational setting to control whether proprietary (in-house) components are included in automation workflows for Empty License conditions.

Reconnaissance & OSINT · 2026-10-20

Nerva v1.72.0 adds fingerprinting for Azure App Service Kudu SCM endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection for Azure App Service Kudu SCM to the HTTP fingerprinter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-10-20

CapLoader 2.2 adds abuse-risk alerts for services/infrastructure, improved flow transcript navigation, and smarter BPF filter feedback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds built-in detections for services and infrastructure that may be abused, expanding CapLoader's alerting engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Improves flow transcripts to be easier to navigate.
• Improves alert-based coloring for traffic visualization.

Network Analysis & Monitoring · 2026-10-20

Network Analysis & Monitoring · 2026-10-20

NETRESEC: Improves flow transcript navigation to make it easier to move through captured sessions.

Network Analysis & Monitoring · 2026-10-20

CapLoader 2.2 adds abuse-detection alerts for IPFS, VPNs, and blocklists, plus AlertSeverity row coloring and transcript keyboard navigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the AlertSeverity row color scheme, coloring each flow, service, and host by the highest-severity alert associated with it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands built-in detections to cover IPFS services and gateways, port forwarding services, abused web hosting and cloud storage, VPN/proxy/tunnel protocols, blockchain RPC nodes, paste bin domains, and bulletproof/scanner/VPN ASNs.
• Adds support for external blocklists from IFIN, GAYINT, and Spamhaus as alert sources.

Identity & Access Management · 2026-10-20

Nudge Security adds custom SSO domain tracking to surface SSO coverage and enable auto-approval of apps signed into via those domains.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds custom SSO domain configuration under Settings > Browser extension, letting the browser extension recognise logins through those domains and auto-fill the SSO provider in the app inventory — no IdP connected-app required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables filtering the app inventory to show which apps use SSO, based on logins detected through configured custom SSO domains.
• Enables auto-approval of apps that users sign into through configured custom SSO domains.

AI Observability & Evals · 2026-10-20

numbat v0.3.0 adds Muse Code monitoring/scanning, rules test --json output, retained tool I/O for rules, and opt-in compound-command enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds rules test --json flag to numbat rules test for machine-readable rule-test output suitable for automation pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --content full --content-scope messages flags to scope full-content exports to message bodies only, now that --content full also captures redacted tool arguments and results.
• Adds Muse Code live-hook monitoring, opt-in enforcement, and forensic at-rest session scanning via numbat hook install --agent muse-code and numbat scan --agent muse-code.

Non-Human & Agent Identity · 2026-10-20

Okta 2026.41.0 adds NFC badge auth, AI agent imports from Snowflake/Workato/Cursor, PowerShell-on-AD, and self-service registration fraud controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new System Log events: system.sms.receive_status and system.voice.receive_status when custom telephony providers report SMS/voice delivery status, and certification.campaign.stage.start/certification.campaign.stage.end for Access Certification campaign staging, with outcome.result reporting SUCCESS or FAILURE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables PowerShell script execution in on-premises Active Directory environments via the Active Directory agent, invocable through Okta Workflows using the Okta public API.
• Adds NFC authenticator support for orgs with Adaptive MFA, allowing frontline workers to tap an NFC badge and enter a PIN to sign in on shared Windows workstations.

Threat Intelligence · 2026-10-20

OpenCTI 7.261019.0 adds dashboard variables management UI and XTM One chatbot content proxying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dashboard variables management UI and usage in widget filters for dynamic dashboard customization.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Proxies decks, reports, and videos from XTM One into the embedded chatbot interface.

Identity & Access Management · 2026-10-20

Ping Identity adds multi-value node properties, telephone user fields, Entra ID/SMTP email config, navigation profiles, and SAML metadata import controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for skipping XML signature verification when importing remote SAML 2.0 provider metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds telephone number as a user property format with optional server-side validation, providing separate country code and phone number fields in hosted pages and the admin console.
• Adds ability to configure Microsoft Entra ID or custom SMTP email providers and send test emails from the Advanced Identity Cloud admin console.

CNAPP · 2026-10-20

Plerion adds check PLERION-AWS-1246 to flag Lambda web function endpoints using ApplicationManaged auth instead of IamAuth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-20

InsightVM 8.64.0 adds CIS Ubuntu 26.04 policy content and opens the Bulk Export API to all API key access levels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Bulk Export API now accepts any API key and honors that key's access level, removing the previous requirement for an organization-level or platform administrator key.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds built-in policy content for CIS Ubuntu 26.04 Benchmark v1.0.0, enabling assessment of Ubuntu 26.04 systems against the latest CIS hardening guidance.
• Stronger access controls for site alerts make alert settings visible only to users with access to the site the alert belongs to.

Continuous Control Monitoring (CCM) · 2026-10-20

RegScale CLI 6.54.0 adds run duration and peak memory to JSON output and a new scannerPrefetch background-fetch setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scannerPrefetch setting that fetches vendor findings and assets in the background while earlier ones are processed, speeding up scans against slow vendor APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The --output json run summary now reports run duration and CLI peak memory use.

Detection Engineering · 2026-10-20

rsigma v0.25.0 adds max_inhibit_sources cap, engine eval -o file output, custom logsource extractors, and OTLP fuzz harness alongside secure-by-default daemon and MCP ser⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds max_inhibit_sources top-level key (default 100000) to alert pipeline config to cap tracked inhibit sources, with a new rsigma_inhibit_sources_refused_total{rule} counter and AlertPipelineFile.max_inhibit_sources / MetricsHook.on_inhibit_source_refused for library users.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds engine eval -o to write eval results to a file instead of stdout.
• Adds Engine::set_retain_hir(true) opt-in method to control whether loaded rule HIR is retained; must be called before rules are loaded.

Attack Surface & Exposure Management · 2026-10-20

SAST / SCA / Code Security · 2026-10-20

Semgrep's findings API now surfaces Autofix PR and failure data; Multimodal gains Automatic AI provider mode and Codex support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The GET /api/v1/deployments/{deploymentSlug}/findings endpoint now returns click_to_fix_prs (pull requests created by Autofix) and click_to_fix_failures (failed Autofix attempts) on all Semgrep Code and AI-powered detection findings for every deployment, not only Autofix-beta deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Semgrep Multimodal AI provider settings now offer Automatic mode, which lets Semgrep manage and update the provider list (currently Amazon Bedrock, Cloudflare Workers AI, and OpenAI) without manual configuration; Automatic mode is the default when Semgrep Multimodal is first enabled.
• Semgrep Guardian now supports Codex, enabling it to scan with Semgrep Code and Supply Chain via a Semgrep-hosted server (no Semgrep CLI required) using the fixed guardian-default ruleset.

Software Supply Chain Security · 2026-10-20

Socket adds bulk ticket creation for manifest alerts across Jira, Linear, Asana, and ClickUp, with shift-click range selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Bulk-create Jira, Linear, Asana, and ClickUp tickets for manifest alerts (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Missing lockfile), one ticket per repository and manifest file, scoped to the selected repository and branch.
• Shift-click to select a range of alerts for bulk actions.

Software Supply Chain Security · 2026-10-20

Socket OAuth access now enforces current role permissions on every request, so role changes take effect immediately.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• For organizations with current-role checks enabled, OAuth token requests now validate both the token's granted scopes and the user's current role permissions, with role changes taking effect on the next request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Linked service-account OAuth requests now check current service-account permissions alongside granted token scopes.

Firewalls & Network Defense · 2026-10-20

Sophos Access Points gains 6 GHz band steering configuration support via Sophos Fusion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds 6 GHz band steering configuration support manageable from Sophos Fusion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-20

StepSecurity adds an Agent Plugins inventory page that tracks Claude Code and Codex plugins published from GitHub repositories.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Agent Plugins page under GitHub > AI Agents that inventories Claude Code and Codex plugins detected from .claude-plugin/plugin.json or .codex-plugin/plugin.json manifests at the repository root or in subfolders.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Displays per-plugin metadata — declared version, description, author, license, homepage, and repository — alongside the actual repository, branch, and commit StepSecurity scanned, with a direct link to each manifest.
• Surfaces a Used by view showing which repositories in an organization enable a given plugin in their settings, making it available to all contributors in those repos.

Email Security · 2026-10-20

Threat Log views gain adjustable State and Verdict filters plus a count badge on Needs Review.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a message count badge to the Needs Review Threat Log view so unreviewed messages are always visible at a glance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Makes the State filter in Needs Remediation adjustable, letting analysts switch to states like auto-remediated or mixed without leaving the view.
• Makes the Verdict filter in Needs Review adjustable, letting analysts find messages with any verdict inside the same view.

Email Security · 2026-10-20

Attack Score Flash (public beta) adds beta.attack_score_flash() ML detections to all inbound mail with high-precision verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds beta.attack_score_flash() MQL function (Enterprise-only for malicious/potentially_malicious verdict; all tiers for spam) to evaluate all inbound mail and return verdicts of malicious, potentially_malicious, spam, or graymail — enabling detections that can catch messages Attack Score alone may miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables Attack Score Flash beta via custom Detection Rules: use type.inbound and beta.attack_score_flash().verdict in (malicious, potentially_malicious) for the Potentially Malicious rule (Enterprise) and type.inbound and beta.attack_score_flash().verdict == "spam" for the Spam rule.
• Integrates Attack Score Flash verdicts into the existing Attack Score pipeline — potentially_malicious flags produce Suspicious or Malicious Attack Score verdicts, spam flags produce Spam verdicts, and graymail flags produce Graymail verdicts, with ASA automatically reviewing Suspicious messages.

Software Supply Chain Security · 2026-10-20

Syft v1.55.0 adds IPK package scanning via the deb-archive-cataloger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for scanning IPK packages using the deb-archive-cataloger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-20

syzkaller adds nested KVM state pages mutation and resource modeling for x86, plus VM environment tracking on build entities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SYZOS_API_NESTED_SET_STATE_PAGES (API ID 320) to the executor, enabling mutation of nested state pages (APIC-access, virtual-APIC, MSR bitmap, I/O bitmaps, posted-interrupt descriptor, page-modification log) referenced by nested VMCS/VMCB on x86.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Models saved KVM nested state as a resource in sys/linux, making it a first-class fuzzing target for KVM nested virtualization on Linux/x86.
• Records VM environment (BuildEnv, including VMType and MachineType) on dashboard Build entities, enabling syz-agent to match target configurations by VMType.

Secure Access (VPN / SASE / ZTNA) · 2026-10-20

Tailscale Kubernetes operator gains PeerRelay custom UDP ports, image pull secrets for all ServiceAccounts, and per-tailnet Let's Encrypt account keys.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TS_SERVE_ALLOW_ALL_INTERFACES environment variable set by the operator on proxies for Ingress resources annotated with tailscale.com/experimental-forward-cluster-traffic-via-ingress, keeping those Ingress resources reachable from inside the cluster after Tailscale Serve on Linux was scoped to the Tailscale interface only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds nameOverride and fullnameOverride Helm values to customize the names of resources the operator installs.
• Adds custom UDP port support for PeerRelay resources so peers that cannot reach the relay at its load balancer address have an alternative path.

SOAR · 2026-10-20

Tines 43.7.0 adds MCP-based Records CRUD, Claude Sonnet 5.5, Records API v2, and SSO group app restrictions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Records API v2 with fewer calls per read and faster searches.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Tines MCP support for Records, enabling creating, updating, and deleting Records as well as discovering, reading, and searching Records.
• Adds Claude Sonnet 5.5 as an available model in Tines.

AI/LLM Security · 2026-10-20

AI/LLM Security · 2026-10-20

ToolHive v0.55.0 adds TLS/SPIFFE listener config, group-based vMCP upstream filtering, Pi LLM gateway support, and a Claude Desktop connector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dcrConfig.rotationKey to re-register upstream DCR clients that have been evicted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes group-based upstream filter via the vMCP CRD, letting operators scope which upstreams a virtual MCP session can reach.
• Adds TLS listener config and SPIFFE X.509 authority capability for securing MCP server endpoints.

Secrets Detection & Management · 2026-10-20

TruffleHog v3.99.3 adds a SonarQube Server token detector and per-logger debug level overrides for source logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SonarQubeDetectorEnabled feature flag, enabling detection of SonarQube Server tokens via the new SonarQube detector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-logger debug level override for source logging, allowing fine-grained debug verbosity control per source.

Secure Access (VPN / SASE / ZTNA) · 2026-10-20

Twingate Privileged Access for Web Apps now supports HTTPS, eliminating browser warnings and second sign-ins for internal web apps.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Privileged Access for Web Apps to support HTTPS, covering every leg of the user path to internal web apps — including public and private CAs — without per-app certificate management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

CNAPP · 2026-10-20

Upwind adds a Kubernetes Agentless Scanner and a three-layer security model for clusters where a node sensor cannot be deployed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Kubernetes Agentless Scanner — connects to a cluster without a DaemonSet or node install, builds a full inventory (Deployments, DaemonSets, StatefulSets, services), extracts SBOMs from deployed images, and surfaces vulnerabilities on the workload that runs each image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Agentless image scans also detect exposed secrets and malicious files in image contents, surfaced in Threats alongside other detections.
• Surfaces Kubernetes agentless inventory under dedicated resource kinds in Inventory (Deployments, DaemonSets, StatefulSets, services) alongside the rest of the estate, covering both public and private clusters from a single view.

CNAPP · 2026-10-20

Upwind launches Databricks Security, adding lakehouse asset inventory, posture checks, and graph coverage across Unity Catalog and cloud resources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Databricks Security integration via Components > Integrations, covering asset inventory for workspaces, metastores, catalogs, schemas, grants, storage credentials, external locations, Delta Sharing shares and recipients, model serving endpoints, vector search indexes, and registered models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Connects Databricks Unity Catalog grants to underlying cloud resources — mapping storage credentials to IAM roles, clusters to compute resources, network configuration to VPCs and security groups, and encryption configuration to KMS keys — in a single traversable graph.
• Surfaces Databricks-specific security findings (overly broad data grants, non-expiring access tokens, publicly exposed workspaces and clusters, universally readable secrets, long-lived Delta Sharing credentials) in the same severity queue, framework reports, and workflows as existing cloud findings.

SAST / SCA / Code Security · 2026-10-20

Veracode CLI v2.53.0 adds veracode scan static and veracode findings static commands plus a --csharp-source flag for source-based C# scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --csharp-source flag to the Veracode CLI to package C# source code directly for Static Analysis without compiling it into binaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds veracode scan static command to run static scans and review security findings within a Git workflow.
• Adds veracode findings static command to access cached static scan findings in the local Veracode directory.

Threat Intelligence · 2026-10-20

Watcher v3.7.0 adds bulk create and bulk actions across all modules, with new REST endpoints and configurable item limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds BULK_CREATE_MAX_ITEMS and BULK_ACTION_MAX_ITEMS env vars to .env to cap bulk request sizes (both default to 200; requests above the limit are rejected wholesale).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST <endpoint>/bulk_create/, bulk_update/, and bulk_delete/ endpoints to every module's API, each returning a per-item report of created / skipped / errors.
• Adds bulk_export_legitimate/ and bulk_export_misp/ endpoints on /api/site_monitoring/site/ to export selected suspicious domains to Legitimate Domains or MISP (one MISP event per site).

AI-Powered Offensive Security · 2026-10-20

LiteLLM proxy gains Kubernetes pod discovery for direct per-pod routing with session-affinity and a new Admin UI pods card.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds kubernetes_pod_discovery: true config key to enable direct per-pod round-robin routing when the model base URL is a Kubernetes headless service, refreshing pod IPs on the interval set by KUBERNETES_POD_DISCOVERY_REFRESH_INTERVAL_SECONDS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds session-affinity to Kubernetes pod discovery: requests carrying litellm_session_id or session_id in metadata are pinned to one pod so the inference server can reuse its prompt cache; pod IPs unused for KUBERNETES_POD_DISCOVERY_IDLE_EVICTION_SECONDS are evicted from the cache.
• Adds GET /model/{model_id}/kubernetes_pods endpoint (admin-only) to retrieve the pod IPs a model currently resolves to.

AI-Powered Offensive Security · 2026-10-20

LiteLLM proxy gains self-serve budget policy and route-allowlist defaults for virtual keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds general_settings.self_serve_budget_policy in config.yaml (or via POST /config/update) with three values — disabled (default), lower_only, and ceiling — letting key owners adjust their own budget_limits on POST /key/update without requiring an admin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a route-allowlist default for new virtual keys, configured via llm_api_routes (e.g. ["llm_api_routes", "/key/spend/report"]), so proxy admins can grant specific route groups to newly created keys regardless of the owner's role.

AI-Powered Offensive Security · 2026-10-20

Backup & Recovery · 2026-10-19

Acronis adds 10 new ecosystem integrations covering AI automation, remote access, password mgmt, hardware, and security visibility for MSPs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds nine new integrations to Acronis Cyber Platform: Discern Security for coordinated remediation across identity, email, vulnerability management, SASE and compliance tools; Flowgear for AI-assisted workflow automation with audited actions and role-scoped access; Iperius Remote Desktop for multiplatform remote access with attended and unattended sessions, mobile endpoint support and file transfer; IT Glue for automatic sync of customer and device data (backup, protection and device details) as flexible assets; MSP Skills, an open-source Model Context Protocol (MCP) server, skill and CLI for querying backup health, stale agents, SLA breaches and usage across all tenants in plain language; NordLayer for deploying and managing its network security agent for Zero Trust and SASE delivery across multiple client tenants; RoboForm for centralized password management with secure vaults, access controls and customer/user management; ScalePad Lifecycle Manager for surfacing device data for lifecycle planning, aging-asset identification, QBR reporting and technology roadmaps; and ThreatAware for agentless visibility into devices and endpoints outside Acronis protection coverage via continuous inventory validation across identity, endpoint and management platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SourceCode as an Acronis-certified hardware vendor for Acronis Cyber Frame Local, offering validated appliance configurations with multiple hardware tiers and scalable node-based architecture.

UNCATEGORIZED · 2026-10-19

Arcade launches Tool Recommendation, dynamically fetching only needed tools via Arcade_SelectTools and Arcade_UseTool MCP built-ins, cutting input tokens by up to 91%.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Arcade_ListApps, Arcade_SelectTools, and Arcade_UseTool as built-in tools exposed through the Arcade gateway, replacing full catalog loading with on-demand tool retrieval over MCP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Tool Recommendation, a new capability that uses purpose-built embedding and ranking models to match an agent's plain-language task description against the full tool catalog and return only the relevant tool schemas.
• Enables Tool Recommendation per Arcade gateway with no SDK changes, framework-specific integration, or agent-side rebuilds — works with any MCP client or framework.

SIEM · 2026-10-19

Artemis Detection as Code is now GA: detections live in GitHub, GitLab, Bitbucket Cloud, or Cursor Origin as pull requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Detection as Code via Settings → Detectors → Detection as Code to connect a repository and manage detections as pull requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports GitHub (including GitHub Enterprise Server), GitLab, Bitbucket Cloud, and Cursor Origin as detection repository hosts.
• Pushes every new or tuned detection — adaptive, intelligence, user-created, and AI Mode detectors — to your repository as a pull request with an explanation and a link back to the detection in Artemis.

Malware Analysis · 2026-10-19

CAPEv2 gains structured JSON logging with json_logs = on, TTY-aware ANSI colors, and main_task_id propagation across all analysis logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds StructuredJsonFormatter and init_json_file_handler in lib/cuckoo/core/log.py to emit side-by-side single-line JSON log files (*.json.log) compatible with Google Cloud Logging / Fluentd, enabled via json_logs = on in logging.conf or the CAPE_JSON_LOGS=1 environment variable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds color_logs = auto/on/off setting and NO_COLOR environment variable support to gate ANSI color sequences in ConsoleHandler and ColoredFormatter based on TTY detection, preventing raw escape sequences in systemd/syslog logs.
• Adds contextvars-based task/machine/correlation context propagation via set_log_task_context, log_task_context, and TaskContextFilter across AnalysisManager, utils/process.py, and utils/gcp_pubsub_service.py.

Identity & Access Management · 2026-10-19

Clerk's MCP server gains account management tools — list, create, and configure apps, instances, users, and domains via AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds https://mcp.clerk.com/mcp as a remote MCP server endpoint, enabling AI clients to authenticate with a Clerk account and manage apps, instances, users, and domains without leaving the agent session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds account sign-in to the Clerk MCP server so agents can read and modify workspace apps and instances from the same authenticated session after a one-time consent approval.
• Adds MCP tools to read and create Clerk applications and to read or change instance settings (with sensitive values redacted).

SIEM · 2026-10-19

API surface changed: +1 endpoint, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /v1/organizations/{organizationId}/notifications⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-10-19

Cloudflare Workers AI adds seven new models: FLUX 3 Klein, Krea 3, Recraft V4.1 Flash, Ember-1, Beam-1.0-501B, Jev 1.14, and Ad Delayer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds flux-3-image-klein (Black Forest Labs, 5.6B params) for text-to-image, image editing, and multi-reference generation with up to 10 reference images, native 4K output, and bounding-box layout control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds krea-3 (Krea, beta) for image generation and editing from text prompts or up to 8 reference images passed as HTTP(S) URLs in image_urls, with outputs up to 2K and optional thinking_mode, aspect_ratio, seed, and regional_edit controls.
• Adds recraftv4-1-flash (Recraft), generating a 1K raster image in ~1.3 seconds; built for high-volume generation of photography, portraits, and logo concepts — raster output only, no styles support.

Internet Services · 2026-10-19

Cloudflare adds Cloud Workload Security beta, Precursor Monitor mode, Cron Trigger local testing, CJK keyword search, cf docs search, and 50k Tunnel routes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cf docs search subcommand in Cloudflare CLI 1.0.0-beta.16 to search live Cloudflare documentation from the terminal or a coding agent, returning up to five ranked JSON results (title, description, URL) per query.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds keyword_tokenizer: trigram support to AI Search keyword search, enabling Japanese, Chinese, and Korean natural-language queries; changing the tokenizer triggers a full reindex.
• Adds cf docs search shell integration with jq and Accept: text/markdown header to fetch full documentation pages as Markdown from agent-parsed search results.

Internet Services · 2026-10-19

Cloudflare API adds DLP validator endpoints and a new pub/sub-style Data streaming API with subscriptions and batch management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /accounts/{account_id}/dlp/validators and GET /accounts/{account_id}/dlp/validators/{validator_id} endpoints to list and retrieve DLP validators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds full CRUD API for proximity word validators under GET|POST /accounts/{account_id}/dlp/validators/proximity_words and GET|PUT|DELETE /accounts/{account_id}/dlp/validators/proximity_words/{validator_id}.
• Adds POST /produce endpoint to publish records to the new Data streaming API.

Internet Services · 2026-10-19

Cloudflare adds Cloud Workload Security for applying request-level policies to cloud API traffic via an in-environment proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cloud Workload Security, enabling request-level policy enforcement on cloud API traffic through a proxy deployed in your environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-10-19

Cloudflare: Adds cf docs search in Cloudflare CLI 1.0.0-beta.16 to find Cloudflare guides and examples from the terminal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises the default route limit for Cloudflare Tunnel and Cloudflare Mesh to 50,000 per account, and enables purchasing more than 1,000 tunnels per account via Tunnels for Platforms.
• Enables Local Explorer to invoke configured or ad hoc Cron Triggers with custom scheduled times during local development.

Internet Services · 2026-10-19

Cloudflare: Supports custom applications in the Application Library, referenceable in Gateway DNS, Network, and HTTP policies.

• Enables Cloudflare Workers to validate data loss prevention matches by adjusting confidence or rejecting matches from custom pattern entries.

Internet Services · 2026-10-19

Cloudflare Precursor gains Monitor mode and a decoupled Interstitial Rules system for safer bot-score testing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Monitor option to the Precursor Status dropdown (under Security > Settings), letting traffic run through Precursor detections without affecting bot score or Challenge clearance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Arm option to the Precursor Status dropdown so that Precursor detections actively affect bot score and Challenge clearance when ready for production.
• Decouples the Precursor Interstitial from the Precursor mode: set a sitewide default with Show Interstitial, then override per-path with Interstitial Rules (e.g. enforce an interstitial Challenge on /checkout while leaving it off elsewhere).

Privileged Access Management · 2026-10-19

Threat Intelligence · 2026-10-19

Cyberbro's OpenCTI integration now documents exact-match behavior, pagination limits, results_truncated flag, and deployment-path base URL support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes a results_truncated field (and a corresponding UI warning) when the 100-per-page / 20-page pagination cap or the 100-linked-indicators-per-observable limit is reached, so callers know counts and the latest indicator may be incomplete.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports OpenCTI base URLs that include a deployment path (e.g. https://cti.example/opencti), enabling installations not hosted at a domain root.
• Uses equality filters instead of OpenCTI's global full-text search: host extracted from URLs (subdomains included, path/port/query/fragment stripped), domains lowercased and IDNA-converted, IPs canonicalized, and hashes lowercased before matching.

AI-Powered Offensive Security · 2026-10-19

Decepticon v1.5.2 lets new CLI engagements auto-generate RoE and jump straight into Red by supplying a name and target URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New CLI engagement creation prompts for an engagement name and target web URL, then automatically generates the RoE and its matching approval and opens Red for the first request — no scope JSON file, manual import/approval command, or Soundwave planning session required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates via decepticon update --channel latest now include a shipped-image version check to detect mismatched CLI image metadata at install time.

Identity & Access Management · 2026-10-19

API surface changed: +18 endpoints, 16 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /v3/travel-rule/vasps/{vasp_id}/decision/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /v3/session/{sessionId}/signatures/{nodeId}/documents/{documentId}/file/
• New endpoint GET /v3/session/{sessionId}/signatures/{nodeId}/evidence/

SIEM · 2026-10-19

Elastic Security embeds SIEM and EDR natively into Google Distributed Cloud air-gapped infrastructure for sovereign environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds native Elastic Security integration with Google Distributed Cloud (GDC) air-gapped, embedding unified SIEM and EDR directly into the platform without custom log forwarders or external connectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Delivers SIEMv2 on Google Distributed Cloud air-gapped, ingesting and correlating infrastructure, network, and audit telemetry with pre-built MITRE ATT&CK-mapped detection rules and behavioral analytics in a fully disconnected environment.
• Delivers EDRv2 on Google Distributed Cloud air-gapped, providing kernel-level behavioral protection via a single unified agent to detect memory exploits, polymorphic malware, and lateral movement without external network access.

Software Supply Chain Security · 2026-10-19

Software Supply Chain Security · 2026-10-19

Endor Labs adds CI/CD Security with pipeline discovery, repository security posture management, and artifact signing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Pipeline Discovery to map tools and workflows across all repositories, surfacing shadow engineering, security coverage gaps, and policy violations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Repository Security Posture Management (RSPM) with over 50 out-of-the-box policies to detect misconfigurations such as unprotected branches, missing MFA, and overprivileged developer accounts, with CIS benchmark alignment.
• Adds Build Integrity Verification via artifact signing, attaching provenance information (source repository, branch, commit, and repository owner) to packages and containers to confirm they were produced by CI/CD pipelines and have not been tampered with.

Secure Access (VPN / SASE / ZTNA) · 2026-10-19

Android 1.5.16 brings a unified Compose-based settings UI, device pool grouping in the resource list, and multiple packet-processing performance improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Shows device pools in the resource list instead of a flat view of all connected devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Improves packet-processing performance when flow logging is enabled.
• Improves packet-processing performance by speeding up peer and route lookups.

Endpoint Management (UEM/RMM) · 2026-10-19

Fleet login API now returns token_expires_at and available_fleets fields in the authentication response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds token_expires_at field to the login API response, showing when the session token expires based on the server's session duration setting (default: 5 days).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds available_fleets field to the login API response.
• Documents that API-only users receive token_expires_at in the response but their tokens remain valid after the indicated expiry time.

Security Validation (BAS & Automated Pentest) · 2026-10-19

NodeZero gains a Torq integration with GraphQL API access, scheduled verification tests, and automated remediation workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Torq integration that retrieves pentests, weaknesses, attack paths, hosts, and credentials from NodeZero via a Horizon3 API key and gateway URL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes a GraphQL query step in Torq that opens the full Horizon3 API to workflow builders beyond the pre-built action steps.
• Supports two API key permission levels: a User role key that can both retrieve results and schedule NodeZero verification tests, and a Read-only key that can retrieve results but cannot start tests.

Web Application Security · 2026-10-19

ImmuniWeb Q3 2026 adds AI training data leak monitoring, CREST AI-pentest accreditation, Ping Identity SSO, and major speed/coverage gains across all products.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Ping Identity SSO to the existing DevSecOps and other integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a new dedicated Third-Party Risk Management (TPRM) dashboard in ImmuniWeb® Discovery.
• Adds customizable alerts for the Cyber Threat Intelligence (CTI) dashboard in ImmuniWeb® Discovery.

Secrets Detection & Management · 2026-10-19

API surface changed: +30 endpoints, −5 endpoints, 12 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agent Vault variable management endpoints: GET /api/v1/agent-vault/variables, POST /api/v1/agent-vault/variables, GET /api/v1/agent-vault/variables/{variableId}/value, PATCH /api/v1/agent-vault/variables/{variableId}, and DELETE /api/v1/agent-vault/variables/{variableId}.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Portainer app connection endpoints: GET /api/v1/app-connections/portainer, GET /api/v1/app-connections/portainer/available, GET /api/v1/app-connections/portainer/connection-name/{connectionName}, GET /api/v1/app-connections/portainer/{connectionId}, POST /api/v1/app-connections/portainer, PATCH /api/v1/app-connections/portainer/{connectionId}, DELETE /api/v1/app-connections/portainer/{connectionId}, and POST /api/v1/app-connections/portainer/{connectionId}/rotate-credentials.
• Adds S3-compatible app connection endpoints: GET /api/v1/app-connections/s3-compatible, GET /api/v1/app-connections/s3-compatible/available, GET /api/v1/app-connections/s3-compatible/connection-name/{connectionName}, GET /api/v1/app-connections/s3-compatible/{connectionId}, POST /api/v1/app-connections/s3-compatible, PATCH /api/v1/app-connections/s3-compatible/{connectionId}, DELETE /api/v1/app-connections/s3-compatible/{connectionId}, and POST /api/v1/app-connections/s3-compatible/{connectionId}/rotate-credentials.

Software Supply Chain Security · 2026-10-19

JFrog Business Value Center adds a real-time ROI and security-coverage dashboard inside MyJFrog for SaaS customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the JFrog Business Value Center dashboard inside MyJFrog, surfacing real-time ROI, developer hours reclaimed, cost savings, storage avoided, and vulnerability-scan coverage across the software supply chain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Tracks what share of repositories are actively scanned by JFrog Xray and what share of incoming open-source packages are blocked by JFrog Curation policies, giving security teams auditable coverage metrics on demand.

AI Runtime Defense & Guardrails · 2026-10-19

Lasso adds an AI-BOM that inventories agentic components and maps each vulnerable component to every agent that depends on it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an AI-BOM that inventories AI building blocks — models, MCP servers and tools, vector databases, frameworks, and AI services — discovered from code, cloud, and runtime sources, with first-seen and last-seen timestamps per component.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces a Used by count per component showing how many agents depend on it, and links each vulnerable component through to the AI-SPM graph with the full exposure path highlighted.
• Categorizes component vulnerabilities against the OWASP Top 10 for Agentic Applications (e.g. ASI05 Unexpected Code Execution, ASI04 Agentic Supply Chain Vulnerabilities), with each finding naming the responsible code or configuration.

SAST / SCA / Code Security · 2026-10-19

Mend Guardrails SBX Kit adds AI content inspection to Docker Sandboxes via docker.io/sbx/mend-guardrails-kit⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds docker.io/sbx/mend-guardrails-kit mixin kit that routes OpenAI-compatible agent traffic through mend-guardrails-server inside a Codex Docker Sandbox using OPENAI_BASE_URL, enabling AI Guardrails policy enforcement without rebuilding the agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --kit-arg mend-guardrails.interceptTui=true flag to extend Guardrails interception to Codex TUI model traffic (requires a host OpenAI Platform API key with Responses write permission).
• Adds mend-guard-text command to explicitly evaluate MCP and tool-result text content against Mend AI Guardrails policy inside the sandbox.

AI Runtime Defense & Guardrails · 2026-10-19

Operant Agent Protector adds Agentic Commerce Defense to block dollar exfiltration across x402, MPP, and AP2 payment protocols in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Agentic Commerce Defense to Operant Agent Protector, providing real-time transaction-level policy evaluation for agentic payments over x402, MPP, and AP2 protocols before money is forwarded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Operant Semantic Firewall to evaluate paid tool activity against the session's original task, flagging behavior consistent with prompt injection, task drift, or payment loops even when payments are properly authorized and under budget.
• Supports commercial scope policies that restrict which MCP servers, payment networks, assets, and wallet destinations an agent may use, blocking payments to unapproved destinations regardless of credential validity or budget.

Identity & Access Management · 2026-10-19

Ory Network v26.4.3 lets you configure the length and character set of one-time codes in Ory Kratos.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports configuring the length and characters of one-time codes issued by Ory Kratos Identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-10-19

PDQ adds remote shell and live file explorer for background, non-disruptive admin access to Windows and macOS devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Remote Shell: an interactive terminal inside PDQ for running commands and reviewing output in real time on managed Windows and macOS devices without taking over the user's screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Live File Explorer: lets administrators browse, search, upload, download, and delete files on a live device file system without launching a remote desktop session.
• Expands the AI assistant (open early access) to use package, deployment, and device context to explain deployment results, break down output, and suggest targeted diagnostics — with admin approval required before any action runs on a device.

CNAPP · 2026-10-19

Plerion now inventories AWS Lambda Web Functions, surfacing endpoints, auth types, revisions, execution roles, and resource policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds inventory support for AWS Lambda Web Functions, displaying each function's HTTPS endpoints with authentication type and domain name, the revisions receiving traffic, the execution role per revision, resource policies, and tags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Security Posture & Discovery · 2026-10-19

QuilrAI now publishes an API — 1 endpoint across 1 area: Api⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Api (1 endpoint) — read⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-19

Trend Vision One adds VDI type condition (Persistent/Non-persistent) for automated tagging rules in Tag Management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds VDI type condition to automated tagging rules in Tag Management, supporting Persistent and Non-persistent values for the Devices asset type to identify and tag VDI devices by persistence state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Restricts VDI type condition combinations to Asset Group and CREM exception list platform tags only, preventing duplicate-tag rule creation.

Backup & Recovery · 2026-10-19

Backup & Recovery · 2026-10-19

Veeam iResOps for Microsoft 365 is now generally available as an add-on to Veeam Data Cloud for Microsoft 365, adding AI-agent tracking, sensitive-data classification, ROT cl⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Launches Veeam iResOps for Microsoft 365 as a generally available add-on to Veeam Data Cloud for Microsoft 365, powered by the DataAI Command Graph intelligence layer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI Undo capability to automatically roll back AI-driven file modifications and deletions in Microsoft 365, identifying exactly which files an AI agent changed even across millions of files.
• Adds continuous discovery and classification of AI agents (including Microsoft Copilot) operating in a Microsoft 365 environment, with visibility into which data each agent can access.

UNCATEGORIZED · 2026-10-19

Adds oast.fallback_to_default config key to auto-re-register against oast.pro when a custom OAST server is unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds oast.fallback_to_default config key (default true) that automatically re-registers against oast.pro when the configured server_url does not respond, without forwarding the token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-19

XFA launches a free plan with no time limit, enabling device security checks and warnings at every sign-in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a free, no-time-limit plan at dashboard.xfa.tech/signup that delivers device security warnings at every sign-in without requiring a paid subscription.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Security Posture & Discovery · 2026-10-19

Zenity: Adds pre-execution enforcement via Anthropic's tool_call Inference Hooks event, holding every Claude tool call for an allow-or-deny verdict.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Validate tool calls configuration to route supported Claude tool calls to the organization's Zenity security server for policy evaluation before Anthropic executes them.
• Extends Zenity Boundaries to classify tool calls as reads vs. writes/deletes/executes, allowing policies such as permitting CRM reads while blocking deletions — without relying on connector or tool names.
• Adds tool-provenance controls using tool-call metadata to restrict access by provider type (platform, Claude application, third-party MCP server, or client tools such as bash and local MCP servers in Claude Code), with the ability to allow only Anthropic-verified servers.

Secure Access (VPN / SASE / ZTNA) · 2026-10-19

UNCATEGORIZED · 2026-10-18

Arcade adds Outlook Calendar management, rebuilds Google Calendar as 5.0.0, and gains workload-identity and Postgres URL support for the engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sslmode: verify-full Postgres connection verification against the system trust store, plus support for a single Postgres connection URL as an alternative to individual config values.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds deployments.resourceQuota.enabled and deployments.sizing.* Helm chart values to control resource quotas and pod sizing, plus a values schema that documents and type-validates every chart value.
• Adds workload-identity support for the engine pod (EKS IRSA, Azure Workload Identity, GKE Workload Identity, or a mounted GCP key) via service account annotations, pod labels/annotations, and extra volumes/mounts.

Integrated & IT Risk Management · 2026-10-18

Adds Dominican Republic cybersecurity regulation JM 181101-02 to the CISO Assistant library.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-10-18

API surface changed: +21 endpoints, −3 endpoints, 45 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /accounts/{account_id}/dlp/validators/proximity_words/{validator_id}
• New endpoint DELETE /accounts/{account_id}/dlp/validators/worker/{validator_id}

Threat Intelligence · 2026-10-18

Private Cloud Installer v3-73 adds remote management support for Install Updates across Virus Scan, Convert, Validate, and NLP APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds remote management support for Install Updates in the Private Cloud Installer for Virus Scan API, Convert API, Validate API, and NLP API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-10-18

Decepticon v1.5.0 adds session resume, Blue monitoring, scoped Red approval, and OpenAI-compatible gateway support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --resume / --continue flags to restore scoped conversations and pending questions across sessions, with failed runs retaining pending input and cross-session queue isolation, plus a /queue command to manage waiting instructions between sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds /scope import <file> --confirm command to import reviewed scope, requiring explicit /mode red approve before granting execution authority.
• Adds /alerts and /status commands for Blue Cell investigation details and connectivity monitoring during Red conversations, plus an independent Blue monitoring state with compact notifications during Red conversations.

Reverse Engineering · 2026-10-18

Finite State Platform: Adds GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId} to compare two Project Versions by Findings and Components changed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Loads Project details and permissions together on GET /api/public/v0/projects, eliminating the serial wait between the two fetches.
• Opens Policy Overview severity and exploit rows by clicking anywhere on the row.
• Opens License Violations and License Warnings from Policy Overview on the components for that specific license policy, not every policy finding.

General Utilities & Libraries · 2026-10-18

pipx gains PIPX_COOLDOWN env var, parallel multi-venv operations, lazy imports on Python 3.15, and pipx upgrade-shared command⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PIPX_COOLDOWN environment variable as a default --cooldown value for install, install-all, inject, upgrade, upgrade-all, and run, so a single release-age policy covers every command; --cooldown 0 opts a single command out.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds pipx upgrade-shared command to manually refresh shared pip ahead of the 30-day automatic refresh cycle.
• Defers every import, including dependencies, on Python 3.15 for faster startup; set PYTHON_LAZY_IMPORTS=normal to opt out.

General Utilities & Libraries · 2026-10-18

pipx now documents private index, proxy, and offline install support via --index-url, --pip-args, and PIP_* env vars⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports --index-url directly on any pipx install command to pull packages from a private or self-hosted PyPI index.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Forwards arbitrary pip flags via --pip-args on pipx install, including --extra-index-url, --trusted-host, --no-index, and --find-links for offline wheel directories.
• Forwards PIP_* environment variables (e.g. PIP_INDEX_URL, PIP_TRUSTED_HOST) to every pip invocation, including shared-library upgrades, when using the pip backend.

General Utilities & Libraries · 2026-10-18

pipx gains dependency cooldown via --cooldown and PIPX_COOLDOWN to skip index artifacts uploaded too recently⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --cooldown DAYS flag to install, install-all, inject, upgrade, upgrade-all, and run to skip index artifacts uploaded within the given number of days, giving compromised or broken releases time to be yanked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PIPX_COOLDOWN environment variable to apply a machine-wide cooldown to all supported commands without passing the flag each time.
• Translates the cooldown policy for both pip (via --uploaded-prior-to P7D) and uv (via --exclude-newer P7D) automatically.

General Utilities & Libraries · 2026-10-18

pipx gains --fetch-python and PIPX_FETCH_PYTHON to auto-download standalone Python builds when the system interpreter is missing or broken.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --fetch-python flag (values: never, missing, always) to pipx install to control whether a standalone Python build is downloaded from python-build-standalone when no local interpreter satisfies the app's requires-python.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PIPX_FETCH_PYTHON environment variable accepting the same never/missing/always values to set the fetch policy for an entire shell session.
• Adds pipx interpreter list, pipx interpreter prune, and pipx interpreter upgrade subcommands to manage cached standalone Python interpreters.

General Utilities & Libraries · 2026-10-18

pipx now auto-links shell completions for installed apps via PIPX_COMPLETION_DIR, covering bash, fish, and zsh⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PIPX_COMPLETION_DIR (default ~/.local/share) to control where pipx links completion scripts shipped by installed packages, with subdirectories for bash (bash-completion/completions/), fish (fish/vendor_completions.d/), and zsh (zsh/site-functions/).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds pipx completions command to print shell-specific setup instructions for enabling pipx tab completion.
• Adds pipx environment --value PIPX_COMPLETION_DIR to retrieve the active completion directory path, needed for zsh fpath configuration.

General Utilities & Libraries · 2026-10-18

pipx gains --global, --prepend, --dry-run, --skip-maintenance, and --value flags plus new env-var overrides for system-wide and custom-path installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a --global flag that can follow any subcommand (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ pipx install --global, pipx list --global) to operate on the system-wide installation at /opt/pipx, /usr/local/bin, /usr/local/share/man, and /usr/local/share; adds PIPX_GLOBAL_HOME, PIPX_GLOBAL_BIN_DIR, PIPX_GLOBAL_MAN_DIR, and PIPX_GLOBAL_COMPLETION_DIR environment variables to override those default global paths; and adds sudo pipx ensurepath --global to write the global binary directory to PATH system-wide, creating /etc/profile.d/pipx.sh on Linux or /etc/paths.d/pipx on macOS.
• Adds PIPX_MAN_DIR and PIPX_COMPLETION_DIR environment variables (defaulting to ~/.local/share/man and ~/.local/share) alongside the existing PIPX_HOME and PIPX_BIN_DIR to control per-user install locations.
• Adds --value argument to pipx environment (e.g. pipx environment --value PIPX_HOME) to print the resolved path for a single variable, reflecting any active override.

General Utilities & Libraries · 2026-10-18

pipx gains a pipx manifest command and pipx.toml file for declarative, lock-file-backed tool management⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pipx manifest subcommand to install, upgrade, or prune a declared set of tools as a unit from a pipx.toml manifest file, including pipx manifest lock ./pipx.toml to resolve each locked dependency group into a PEP 751 lock file via nab, and pipx manifest sync ./pipx.toml to install, upgrade, or downgrade every declared tool, resolving unlocked specs or installing from named PEP 751 lock files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --prune flag to pipx manifest sync to uninstall pipx environments absent from the manifest, plus --global and --backend options to select the pipx store or installation backend.
• Adds pipx.toml manifest format using [dependency-groups] for PEP 508 package requirements and [tool.pipx.tools.<name>] tables for per-tool policy including suffix, apps, include-dependencies, include-resources-from, expose, and lock keys; the lock key declares a relative PEP 751 lock file path, seeding existing locks into replacements and writing atomically only after all resolutions succeed; the suffix key installs multiple versions of the same tool side-by-side using the normalized package name plus suffix as the environment name; and the include-resources-from key selects dependency resources from a named package without combining with include-dependencies.

General Utilities & Libraries · 2026-10-18

pipx gains expose, unexpose, and --include-resources-from to control which apps, man pages, and completions reach PATH.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pipx unexpose <app> to hide an app, manual pages, and shell completions from PATH without rebuilding the environment; the hidden state survives upgrades, reinstalls, and injected packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds pipx expose <app> to restore missing symlinks for apps, manual pages, and shell completions without rebuilding the environment, leaving files pipx does not own in place.
• Adds --include-resources-from <PACKAGE> flag to pipx install and pipx inject to selectively expose apps, manual pages, and shell completions from a single named dependency; repeatable for multiple packages.

General Utilities & Libraries · 2026-10-18

pipx gains pin/unpin commands to hold environments at fixed versions and skip them during upgrades.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pipx pin PACKAGE command to pin the main package and all injected packages in an environment, causing pipx upgrade and pipx upgrade-all to skip it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds pipx pin PACKAGE --injected-only to leave the main package upgradable while pinning every injected package.
• Adds pipx pin PACKAGE --skip PKG_A PKG_B to pin injected packages except the listed ones (implies --injected-only).

General Utilities & Libraries · 2026-10-18

python-pipx: Adds --output json flag to pipx inject and pipx uninject to return a versioned result envelope in JSON.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -r <file> flag to pipx inject to inject packages from a requirements file (e.g. pipx inject ipython -r useful-packages.txt).
• Adds --with-suffix flag to pipx inject to give injected package apps the host environment's suffix (e.g. injecting black into ipython_3.11 exposes black_3.11).
• Adds --editable / -e flag to pipx inject to install a package in editable (development) mode.

Patch Management · 2026-10-18

TruRisk Eliminate 2.0 debuts TruConfidence AI orchestration engine and Agent Sara for autonomous, ring-based patch remediation at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces TruRisk Eliminate 2.0, an Autonomous RemOps platform that replaces ticket-driven patching with a continuous Decide → Execute → Prove cycle across the full attack surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces TruConfidence, an AI-powered Remediation and Orchestration Intelligence engine that selects the safest remediation action — patch, mitigation, uninstall, or existing control — per validated exposure.
• Introduces Agent Sara, Qualys' autonomous AI agent, which executes TruConfidence remediation plans in customer-defined waves and progressive rings with automatic rollback on anomaly detection.

AI/LLM Security · 2026-10-18

Reality Defender social media link import now supports TikTok and Threads short links and mobile links.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends social media link import to accept TikTok standard links (tiktok.com/t/<code>), TikTok short links, TikTok mobile links, and Threads links.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MCP Servers & Tooling · 2026-10-18

Runlayer 1.28.1480 adds a Slack stop button for agents and Google ADK session telemetry via a native Python plugin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Slack stop button for agents that have their own Slack app, letting any authorized user halt all in-progress replies in a thread.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Google ADK session telemetry for Python agents via a native plugin (see Hooks SDK) that captures prompts, assistant responses, and tool activity in one conversation, with local tool enforcement and correlation to Runlayer MCP audits.
• Adds connector search highlighting in Manage connectors, including surfacing the matching description excerpt under the connector name when the match is in the description.

SOAR · 2026-10-18

Torq dashboards gain section separators and numeric-value filtering for Cases Dashboard widgets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds separator support to dashboards, letting you group related widgets under titled sections for cleaner reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cases Dashboard widgets can now filter by numeric values — Less Than, More Than, and Range — to focus any widget on cases meeting a specific threshold or event count.

Identity & Access Management · 2026-10-17

Auth0 Universal Login gains type-specific Continue with buttons and tenant-level phone country include/exclude controls in Early Access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tenant-level include/exclude lists for supported phone countries, configurable via the PATCH /api/v2/tenants/settings endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds identifier presentation controls (type-specific Continue with buttons vs. unified field) configurable via the PATCH /api/v2/branding/theme endpoint.
• Adds an updated phone entry UI for Universal Login with country selection, regional formatting, numeric keyboard, and phone number suggestions on supported devices.

Runtime Security · 2026-10-17

Aya gains multi-uprobe attach, RingBuf::create(), perf counter reads, ksym program loading, and CgroupSockAddr link support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds RingBuf::create() to construct a ring buffer map programmatically from userspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds set_tc_classid method to TcContext and SkBuff for setting TC class IDs from eBPF programs.
• Adds attach_to_link for CgroupSockAddr programs.

Data Security & DLP · 2026-10-17

API surface changed: +1 endpoint, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /v1/projects/{project}/issues/{issue}/reviewRuns/{reviewRun}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Malware Analysis · 2026-10-17

capa v10.0.0 adds --reproducible freeze flag, hardens vivisect workspace loading behind CAPA_LOAD_VIV_WORKSPACE, and ships 12 new detection rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --reproducible flag to the freeze subcommand that zeros dynamic header metadata for deterministic output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds CAPA_LOAD_VIV_WORKSPACE=1 environment variable to opt in to loading existing <sample>.viv vivisect workspace files, which are no longer loaded by default due to pickle deserialization risk.
• Adds 12 new detection rules including WebSocket communication in .NET (nursery/connect-to-websocket-server-in-dotnet, nursery/receive-data-on-websocket-in-dotnet, nursery/send-data-on-websocket-in-dotnet), Dropbox file transfer (nursery/upload-or-download-file-via-dropbox), Crystal and Odin compiler identification, IPv6-encoded payload decryption, UUID-encoded PE decoding, .NET assembly loading via RuntimeAssemblyNLoadImage, anti-debugging time-delay detection in .NET, internet connectivity checks in .NET, and WinAPI file search.

Integrated & IT Risk Management · 2026-10-17

CISO Assistant v4.1.2 adds DPIA/GDPR screening, MCP incident tools, OAuth log forwarding, metric-to-control linking, and new Hungarian/Costa Rica frameworks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MAILERS service config to route all outbound mail through a single mail service, replacing per-feature mail settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds create_evidence, add incident and add timeline entry MCP tools for uploading local files as evidence and managing incidents and timeline entries from the MCP layer.
• Adds MCP support for linking task templates to incidents via create_incident and update_incident calls.

AI/LLM Security · 2026-10-17

coi v0.15.0 runs AI coding agents (Claude Code, Codex, opencode, pi, omp) in isolated Incus containers with kernel-level threat monitoring and network egress control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds coi shell to drop into an interactive AI coding session inside a full-OS Incus container, with the project mounted at /workspace and host credentials excluded by default; coi run -- <cmd> to execute any command in the sandbox with streamed output and propagated exit codes, plus coi run --prompt-name <name> for headless agent runs from predefined prompts; and coi build (with a coi build sandbox variant) to construct the base container image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds coi monitor for a real-time security dashboard with kernel-level detection of reverse shells, C2, exfiltration, and DNS tunneling, auto-pausing on HIGH and auto-killing on CRITICAL severity; coi audit to stream the JSONL threat-event log for piping into a SIEM or jq; coi top for per-container CPU, memory, and IO metrics resolved to workspace and alias; and coi health to diagnose the coi setup.
• Adds coi profile create <name> and coi profile list to scaffold and manage reusable named container profiles stored as ~/.coi/profiles/<name>/config.toml; coi schema profile and coi validate profile for JSON-schema validation of profile configs; and a --profile <name> flag on coi shell to apply a named profile (image, tool, limits, network mode, build scripts, agent instructions) in one flag, with support for inherits to build on another profile.

Identity & Access Management · 2026-10-17

ConductorOne adds local policies — scope-limited policies bound to a single app or entitlement, invisible in the global policy library.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds local policies that bind to a single app or entitlement setting (request policy, revoke policy, or preferred review policy) and never appear in the global policy library — creatable via Create new local policy from the policy menu on any app or entitlement setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Local policies cannot be reused, their scope cannot be changed after creation, and only Super Administrators can create or manage them.

Identity & Access Management · 2026-10-17

ConductorOne adds AI-assisted remediation and a per-application findings tab to the admin findings workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Remediate with AI action (available from a finding's row menu and the finding details drawer) that opens C1AI with the finding's details pre-filled for step-by-step remediation guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-17

ConductorOne now includes unlinked accounts in high-risk role grant queries and CSV exports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Includes accounts not linked to an identity user in high-risk role grant results for permanent grants, with blank User and email cells.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Includes accounts not linked to an identity user in high-risk role grant results for time-limited grants, with blank User and email cells.
• Includes unlinked accounts with high-risk role grants in CSV exports, with blank User and email cells for those rows.

Identity & Access Management · 2026-10-17

ConductorOne: Adds the C1AI assistant natively in Slack, with buttons, forms, and pickers so users can complete access tasks without leaving Slack.

• App catalog search now matches entitlement descriptions, so users can find access by describing what it does rather than knowing the exact name.

Identity & Access Management · 2026-10-17

ConductorOne adds a C1AI assistant to the product.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the C1AI assistant to ConductorOne for in-product AI-assisted guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-17

ConductorOne lets users discover and request access actions directly from the C1AI assistant in Slack, without opening the Actions catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the ability to ask the C1AI assistant in the C1 app for Slack what actions are available and request them directly, without navigating to the Actions catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-17

ConductorOne adds AI-guided finding remediation, custom campaign scoping, local approval policies, and batch API for campaign templates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Add template entitlements and Remove template entitlements API calls, each accepting up to 200 entitlements per call, to build or trim campaign template selections in batches without overwriting earlier choices, and introduces custom selectors for access review campaign scoping — filtering by app, resource type, risk level, and compliance framework — so new matching entitlements are pulled in automatically when a campaign is prepared.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The DELETE /api/v1/apps/{app_id}/resource_types/{resource_type_id}/resources/{id} endpoint now returns an error for connector-synced resources instead of silently deleting them, and app resources returned by the API now include a read-only isManuallyManaged field.
• Adds Remediate with AI on findings, opening C1AI with the finding's type and target pre-filled and following built-in playbooks for unowned service accounts, non-human identities, shadow apps, and connector sync failures.

Data Security & DLP · 2026-10-17

Cyera's Agent Guardian is now available in the Claude Marketplace, giving security teams real-time visibility and policy controls over Claude agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cyera to the Claude Marketplace, allowing Anthropic customers to apply committed Anthropic spend toward Cyera licensing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Agent Guardian provides continuous, real-time visibility into every Claude agent in use — including sanctioned and shadow agents — covering tools, dependencies, and data connections.
• Enables interception of out-of-policy commands, unapproved database changes, and unauthorized data transfers before they execute inside Claude environments.

Hacking Hardware · 2026-10-17

• Cynthion without enclosure (cynthion-board) sold out at shop.hak5.org on 15 Oct 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-17

TypeSafe AI Jev 1.14.0 is now available on Unity Gateway as an externally-hosted model preview.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TypeSafe AI Jev 1.14.0 as an externally-hosted model on Unity Gateway, requiring an account admin to enable the Externally-hosted TypeSafe AI Models preview.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-17

Consumer access to Unity Gateway services is now GA — no account-admin preview toggle required to query shared model and MCP services.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Account admins can set budgets and rate limits, or disable direct model access, for consumer access users to control increased model traffic to external providers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-17

AI/BI dashboards gain Lakehouse Real-Time warehouse support, Genie-powered Dashboard Insights, and Power BI .tmdl file import in Beta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /importBI Genie Code skill support for uploading Power BI .tmdl files to create metric views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Lakehouse Real-Time SQL warehouses as a data source for AI/BI dashboards (Beta).
• Adds Dashboard Insights (Beta): Genie analyzes charts on a published dashboard page and surfaces trends and outliers as insight cards for viewers.

SIEM · 2026-10-17

Genie Agent mode gains Flash (Beta) for speed-first responses and upgraded models for long-context tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Flash (Beta) option to Agent mode, prioritizing response speed over depth for simpler, everyday tasks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Upgrades Agent mode underlying models for better long-context handling and faster responses.

SIEM · 2026-10-17

Genie One gains collaborative editing, group-membership context, and conversation recall for faster repeated investigations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables collaborative document editing in Genie One — users with CAN EDIT permission can now edit shared documents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Genie One now returns a user's group memberships alongside user info, letting workspace instructions and table descriptions tailor responses per group.
• Genie One can now reuse context from past investigations to answer similar questions faster.

SIEM · 2026-10-17

lakebase_tokenizer 0.2.0 adds CJK full-text search via tokenizer_chinese, tokenizer_japanese, and tokenizer_korean built-in configurations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the tokenizer_morph template to lakebase_tokenizer 0.2.0, which uses morphological analysis with bundled language dictionaries to segment CJK text — supporting compound-word modes (whole, split, or both), Japanese particle/function-word filtering and base-form conversion, and Korean particle/ending filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• CJK tokenizer output is compatible with GIN indexes, the lakebase_text index, and the lakebase_bm25 index for BM25 ranking, so existing index infrastructure works unchanged.

SIEM · 2026-10-17

Databricks integrated CDC pipeline for MySQL is now generally available, eliminating the need for a separate ingestion gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds generally available integrated CDC pipeline for MySQL that ingests change data into Databricks in a single pipeline, combining extraction and application without a separate ingestion gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-17

Lakebase now supports native Postgres logical replication to stream changes in and out of the database.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports publishing changes from Lakebase to external Postgres databases via logical replication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-17

Databricks agentic code converter is GA for SQL, converting T-SQL, Snowflake, Redshift, Oracle, BigQuery, and Teradata dialects into Databricks SQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GA support for the agentic code converter for the SQL target framework, converting dialects including T-SQL, Snowflake, Redshift, Oracle, BigQuery, and Teradata into Databricks SQL queries, organized within a migration project that validates output and writes results to a workspace folder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-17

Databricks now generally supports external Apache Spark clients writing to Unity Catalog managed Delta tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables external Apache Spark clients to create and write to Unity Catalog managed Delta tables (GA), requiring catalog commits to be enabled on the target tables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-17

fcaptcha v1.46.0 adds pointer-movement-v1 observation and aligns /recaptcha/api/siteverify scores with reCAPTCHA v3 semantics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pointer-movement-v1 to experimental.observations: reports whether pointer moves ever show zero movement (as real mice and trackpads do); observe-only and does not affect the score or token decision.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The score field on /recaptcha/api/siteverify now follows reCAPTCHA v3 convention (higher = more human, 1 - score), so existing score >= threshold checks work; FCaptcha's original score is returned alongside as fcaptcha_score. Turnstile and hCaptcha paths are unchanged.

WAF, Bot & API Protection · 2026-10-17

FCaptcha v1.45.0 adds automatic hidden-field injection for forms and drop-in Turnstile/hCaptcha/reCAPTCHA API compatibility paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• A checkbox widget inside a <form> now automatically injects a hidden fcaptcha_token input, filled on success and cleared on reset or expiry — rename it with responseFieldName / data-response-field-name, or disable it with responseField: false / data-response-field="false".⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The widget is now also served at /turnstile/v0/api.js, /1/api.js, and /recaptcha/api.js, each exposing that provider's JS API (render, getResponse, reset, remove, execute, ready) and form-field behaviour, enabling drop-in replacement of Turnstile, hCaptcha, or reCAPTCHA by swapping only the script URL and siteverify endpoint.

WAF, Bot & API Protection · 2026-10-17

fcaptcha v1.43.0 ships a Go client package with Client.Verify and Client.Middleware for server-side token redemption.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Go client package (go get github.com/WebDecoy/FCaptcha) with Client.Verify to redeem a CAPTCHA token and Client.Middleware to guard an http.Handler, supporting optional action, hostname, and score checks; uses only the standard library and fails closed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-17

Finite State adds 503 COMPARISON_BUSY with Retry-After on version compare, Policy Overview row navigation, and re-scan conflict signaling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds 503 COMPARISON_BUSY with Retry-After: 2 header from GET /api/public/v0/versions/{baseVersionId}/compare/{targetVersionId} when too many Version comparisons are running at once, enabling retry logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds 409 SCAN_CONFIG_CONFLICT from POST /api/public/v0/versions/{projectVersionId}/rescan when a basic scan and Quick scan are combined before a Version is renamed, making a refused re-scan distinguishable from one that started.
• Loads a page of 10,000 components from GET /api/public/v0/components within the request time limit.

Malware Analysis · 2026-10-17

FLOSS v3.2.0 adds basic ELF support, a PyGhidra import script, and a new env var to safely control vivisect workspace loading.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds FLOSS_LOAD_VIV_WORKSPACE=1 environment variable to explicitly opt in to loading <sample>.viv workspace files, replacing the previous unsafe auto-load behaviour.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds basic ELF binary support, enabling string extraction from ELF samples alongside the existing PE support.
• Migrates the Ghidra import script to PyGhidra.

AI Red Teaming & Testing · 2026-10-17

garak v0.17.1 adds a hit@k attack success rate metric to probe/detector reporting and gains Python 3.14 support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds hit@k attack success rate metric, exposed as terminal output and per probe/detector pair in the final digest entry of report.jsonl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-10-17

Detection Engine 2.174 adds 10 new detectors, 2 new analyzers, and a new SMTP validity checker across dozens of credential types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new detectors for SFTP credentials (sftp_credentials_assignment), Lago API keys, Composio project API keys, Composio organization API keys, Codex API keys, CARTO Basemaps API keys, Google Chat incoming webhook URLs, HubSpot CLI personal access keys, AmneziaWG VPN private keys, and Kubernetes bearer tokens stored in kubeconfig files; adds new analyzers for GoCardless API access tokens and Adobe refresh tokens; and enables a validity checker for SMTP credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands snyk_key_v2 checker to support the SNYK-US-02 region, snowpark_api_credentials checker to support short account identifiers, hostnames, and full Snowflake URLs, and algolia_monitoring checker to validate all Algolia keys with more permissions than the default search key.
• Extends azure_entra_app_secret detector to detect credentials declared against Microsoft national cloud sign-in hosts, GitHub Server-to-server token (ghs_<app id>_<JWT>) detection to any number of scopes including longer tokens previously missed, docker_credentials detector to support the new Docker credential format, ssh_password detector to detect passwords sent in expect scripts after an SSH password prompt, mssql_assignment detector to detect MSSQL credentials assigned without a port, ftp_credentials_assignment checker to handle secrets without a port, and Gemfury detectors to detect credentials outside Gemfury repository URLs.

SAST / SCA / Code Security · 2026-10-17

GitHub Enterprise Cloud adds GA open-source license compliance with rulesets, API endpoints, and a new Enterprise Open-Source License Manager role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new API endpoints for downloading, updating, and replacing the enterprise license policy, plus a separate endpoint for checking whether individual packages comply with policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a Require license compliance results before merging ruleset condition that enforces an enterprise-wide license policy on pull requests adding or modifying dependencies.
• Adds a new predefined enterprise role, Enterprise Open-Source License Manager, for individuals or teams who review and approve license closure requests.

SAST / SCA / Code Security · 2026-10-17

GitHub Actions gains GA Xcode 27 runner image on macOS 27 with xcode-27 and xcode-27-xlarge labels for Apple Silicon runners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds xcode-27 and xcode-27-xlarge as runs-on: labels for GitHub-hosted Apple Silicon (arm64) runners shipping macOS 27 with the Xcode 27 toolchain and Apple SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-17

GitHub: Work across multiple repositories in one @GitHub conversation in Slack or Teams, creating issues, opening PRs, and investigating bugs without switching contexts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for shared Slack messages and threads as context for @GitHub, reducing the need to copy and paste discussion details.
• Improves repository switching so users can move between repositories more easily mid-conversation.

AI/LLM Security · 2026-10-17

h5i v0.5.0 ships a self-contained browser engine plus four installable plugins: websec, recon, test, and a formal-verification app framework.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds h5i browser open, h5i browser snapshot, h5i browser requests, and h5i browser audit subcommands powered by an embedded rendering engine — no separate archive needed — plus h5i __engine to reach the embedded browser engine's own CLI directly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds h5i plugin install websec --from <path> to install the h5i-websec HTTP security workbench (request capture, replay, and manipulation via h5i websec), h5i plugin install recon --from <path> to install the h5i-recon discovery plugin, which records exposed endpoints and confirms candidates only when a live request answers for them, h5i plugin install test --from <path> to install h5i-test, which replays repository-owned attack flows and writes results as JSON and JUnit, and h5i plugin list to display currently installed plugins.
• Supports --min-coverage on h5i test to enforce OpenAPI coverage thresholds (report-only without it), and --in on h5i test to record a witness outside the browser for each request on a sandboxed host.

AI/LLM Security · 2026-10-17

h5i: Adds h5i app subcommand for building and formally verifying Axum-based Rust web applications using Lean 4.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds h5i plugin install test --from ./h5i-test and h5i test <dir> --target <url> for replaying repository-owned attack flows as security regression tests in CI/CD, with JSON and JUnit output and optional --min-coverage enforcement.
• Adds h5i plugin install websec --from ./h5i-websec for a web security workbench that runs browser verbs through the same policy, budget, and receipts as manual sessions.
• Bundles the browser rendering engine directly into the h5i binary — previously a separate h5i-browser-light archive — accessible via h5i browser or h5i __engine for direct CLI access.

AI Red Teaming & Testing · 2026-10-17

ifixai v4.2.0 adds ifixai trajectory, ifixai policy-lab, and Vercel/Cloudflare AI Gateway provider support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --provider vercel and --provider cloudflare to ifixai run for routing inspections through Vercel AI Gateway and Cloudflare AI Gateway respectively.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ifixai trajectory command to check a recorded sequence of agent actions against a business policy (double-used approvals, out-of-scope delegations, overspent budgets, wrong citations); reads JSONL or OTLP and supports offline replay.
• Adds ifixai policy-lab command to find harmful action sequences composed of individually permitted tools, then suggest the smallest permission removal that keeps legitimate goals reachable; runs entirely offline.

AI Red Teaming & Testing · 2026-10-17

v4.1.0 adds --no-promo and IFIXAI_NO_PROMO=1 to suppress the new interactive audit prompt on first run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The one-time interactive prompt is never shown in CI, non-TTY environments, or on --dry-run, keeping scripted and agent-driven runs unblocked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-10-17

Invicti adds bulk vulnerability retest, API key auth for CI/CD Source Scan, gRPC support, and SCIM bulk user removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a scan failure mode triggered by authentication problems, so scans that never ran authenticated are flagged rather than silently returning incomplete results.
• Adds target name and URL display and filtering, plus per-source discovery icons and a discovery-source column, to the API catalog so each API's origin is immediately visible.
• Adds gRPC compatibility by sending the trailers header and an empty gRPC frame for parameterless RPCs.

IDS / IPS · 2026-10-17

Maltrail 3.5 cuts sensor RAM from 153 MB to 32 MB, adds 32-bit ARMv6 builds, a Windows installer, and NetBSD/OpenBSD support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds static ARMv6 binary (arm-unknown-linux-musleabihf) so the sensor runs on every 32-bit Raspberry Pi — Pi 1 and Zero included — under Raspberry Pi OS, DietPi, or Alpine; install.sh selects it automatically, including on a 64-bit kernel with a 32-bit userland.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds install.ps1 Windows installer for the sensor.
• Adds NetBSD and OpenBSD to the tested platform matrix.

Agentic Infrastructure · 2026-10-17

microsandbox v0.7.8 adds runtime-owned detached jobs, --mount-disk on restore, port ranges, filesystem state limits, and a TLS certificate trust helper.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --mount-disk flag to msb restore to attach a disk image when restoring a sandbox from a snapshot archive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for port ranges in msb published ports, so a span of guest ports can be exposed on the host in a single declaration.
• Adds runtime-owned detached jobs, enabling the execution runtime to manage long-running jobs independently of the calling client.

Agentic Infrastructure · 2026-10-17

microsandbox v0.7.7 adds HTTP CONNECT outbound proxy, DAX filesystem support, guest clock sync control, cache cleanup with usage reports, and CLI tree display controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds HTTP CONNECT outbound proxy support for sandbox network egress.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an option to disable guest clock synchronization at runtime.
• Adds cache cleanup, usage reports, and CLI polish to storage management.

General Utilities & Libraries · 2026-10-17

Process Explorer 17.2 adds efficiency mode, live kernel dumps, memory map explorer, NPU monitoring, and persistent activity history; Sigcheck 2.93 adds UTF-8 output encoding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds UTF-8 encoding option for file output in Sigcheck v2.93.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds live kernel memory dump creation to Process Explorer v17.2.
• Adds a Devices page to the System Information view in Process Explorer v17.2.

Reconnaissance & OSINT · 2026-10-17

Nerva v1.71.0 adds fingerprinting support for the InterSystems IRIS portal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection of the InterSystems IRIS portal to the HTTP fingerprinter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-17

Nerva v1.70.9 adds .NET Remoting HTTP channel detection with a dotnet-remoting-http-exposed misconfiguration finding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dotnet-remoting-http-exposed (High severity) misconfiguration finding to detect exposed .NET Remoting HTTP channels (deserialization risk) via --misconfigs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-17

Reconnaissance & OSINT · 2026-10-17

Reconnaissance & OSINT · 2026-10-17

Identity & Access Management · 2026-10-17

System Heartbeats widget now shows instance ID next to each worker, making dual-CAG environments easier to monitor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The System Heartbeats widget in the Operations dashboard now displays the instance ID next to each worker service, letting operators distinguish between customer-hosted and Omada-hosted Cloud Application Gateway instances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Observability & Evals · 2026-10-17

ongrid v0.18.2 adds a collapsible chat sidebar and OpenTelemetry observability for agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenTelemetry observability for the ongrid agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a dedicated collapsible chat sidebar to the web UI.

AI Observability & Evals · 2026-10-17

ongrid v0.18.0 adds a built-in GPU device role and unifies Kubernetes pod metrics with SDK ingestion and automatic capture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a built-in GPU device role for classifying and managing GPU-equipped devices in the fleet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Scopes Kubernetes pod metrics to capture selections in the APM view.
• Unifies SDK ingestion and automatic capture under a single APM pipeline.

Threat Intelligence · 2026-10-17

OpenCTI adds APP__ARTIFACT_ZIP_MAX_EXTRACTED_SIZE to cap the extracted size of archive artifacts on upload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds app:artifact_zip_max_extracted_size / APP__ARTIFACT_ZIP_MAX_EXTRACTED_SIZE config key to set the maximum extracted size (in bytes) of an archive uploaded as an artifact; archives exceeding the limit are imported as-is rather than extracted.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-17

OpenCTI 7.261016.0 adds entity merging in knowledge view, Attack Pattern Matrix expand/collapse, defanged search, and conditional Fintel HTML generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports defanged as a search term in global search filters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Allows merging entities directly from the knowledge view.
• Enables automatic removal of HTML sections in generated Fintel reports when template variables are empty.

Identity & Access Management · 2026-10-17

Ory v26.4.x adds FIPS 140-3 container images, TraceID correlation in event streams, and finer latency histogram buckets⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TraceID key in eventAttributes for events delivered through a live event stream, enabling correlation of all events from a single request⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-17

osctrl v0.6.0 adds opt-in vulnerability monitoring, SSE live updates across all workflows, a generic HTTP log sink, and 20 UI languages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds opt-in vulnerability monitoring (backend and frontend) with NVD CPE matching, posture evidence, vulnerability alerts, escalation alerts, feed health, hardening, and metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds read_max flag to raise osquery's read buffer to 1 GB.
• Adds a generic HTTP log sink for forwarding osctrl logs to any HTTP endpoint.

Identity & Access Management · 2026-10-17

Passbolt snapshot-20261017 adds Offline Mode (beta), Safari extension GA, SMTP OAuth for Exchange Online, PingOne SSO, SCIM GA, secret history, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Moves the Microsoft Edge browser extension to Manifest V3, preserving existing account settings and ensuring continued credential access as Microsoft phases out Manifest V2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Offline Mode (beta) giving users secure read-only access and autofill for selected credentials when the Passbolt server cannot be reached.
• Makes the Safari browser extension generally available.

AI Runtime Defense & Guardrails · 2026-10-17

pipelock v3.7.0 adds parallel signed receipt chains, filesystem containment grants, pipelock exec, kernel-observed MCP identities, and per-request TLS-interception timing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds flight_recorder.receipt_chains (accepts 1–32, defaults to 1) to enable parallel signed receipt chains, with group verification via chain --dir --group ID (TypeScript/Rust verifiers 0.6.5) and group --group-id ID; pipelock-verify 0.4.1 (PyPI) verifies individual shards but not the whole group.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds containment.filesystem.mode: enforce to hide other home directories and signing material, mount unexpired workspace grants, and refuse launch unless a canary proves the containment profile took effect.
• Adds pipelock exec -- COMMAND to check a running proxy's health, forwarding, and kill switch, then launch cooperative clients with shared proxy and CA environment settings.

Detection Engineering · 2026-10-17

RSigma v0.24.0 adds parse-time semantic validation, encoding modifier expansion, and corrected PostgreSQL/LynxDB/Fibratus query generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds rsigma_parser::validate module with parse-time semantic validation that rejects unusable logsources, invalid modifier/value combinations, malformed regexes and CIDRs, empty detections, and unresolved condition selectors before compilation; adds deprecated_detection_timeframe lint that warns when a Sigma v1.x timeframe: key inside detection: has no effect; and adds SigmaParserError::InvalidModifiers variant for library users catching parse errors on conflicting modifier combinations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends rule validate to accept a single rule file in addition to a directory.
• Adds RegexFlags::inline_prefix to render inline regex flag groups (e.g. (?i)) for custom backends, and adds rsigma_ir::encoding module so eval and all native backends share encoding-modifier expansion, converting windash, wide, utf16le, utf16be, utf16, base64, and base64offset into an OR of one plain match per encoded variant instead of failing with UnsupportedModifier.

MCP Servers & Tooling · 2026-10-17

Runlayer 1.28.1446 adds full client visibility for AI Watch policy pickers and connector request approvals via existing shared connectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The View supported clients dialog under Manage → Endpoints now lists every client AI Watch hooks can protect and enforce, including each client's minimum version and whether it blocks before the tool runs only.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The Enforce and Protect built-in policy pickers now offer the full AI Watch supported client list.
• Approve a new connector request using a connector you already built and shared; existing connectors the requester can already access show as Has access and approve the request without adding another policy.

Endpoint Security (EDR/XDR) · 2026-10-17

rustinel v1.10.0 adds sensor event-loss alerts, stable host/agent identity on all alert types, and more honest sigma doctor verdicts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds telemetry.loss_alert_interval_secs config key (default 60, 0 disables) to emit an agent::loss::sensor_events alert per event category that drops events in the last window, including channel, category, and dropped count; loss alerts bypass deduplication and never trigger active response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds [agent] directory config option and persists agent.id as a random UUID in <agent.directory>/agent-id; Sigma, YARA, IOC, and correlation alerts now carry host.id, host.name, agent.id, agent.type, and agent.version in both NDJSON output and webhook bodies.
• sigma doctor gains summary.can_fire_with_caveats in --json output and now exits 0 when every rule can fire (with or without caveats), reporting reliably-populated process_creation fields as caveats instead of marking rules degraded.

Endpoint Security (EDR/XDR) · 2026-10-17

rustinel v1.9.1 adds local rule overlays, unprivileged integration access, and richer Windows/macOS capture context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scanner.sigma_local_rules_paths and scanner.yara_local_rules_paths config keys to load local rule directories alongside a managed pack, with local rules taking precedence over pack rules of the same Sigma id or YARA name.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds security.integration_group config key to let an unprivileged integration edit configuration and read logs via Unix group or Windows service account, without requiring root.
• Adds security.integration_rules_directory config key to delegate control of a single rules directory to the same unprivileged group or account.

Endpoint Security (EDR/XDR) · 2026-10-17

rustinel v1.9.0 adds YARA file/memory scans across all platforms, all-matches Sigma mode, and four new Windows event sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scanner.sigma_match_mode = "all" to emit every matching Sigma detection rule instead of the first, and adds per-rule Sigma compatibility diagnostics to identify unsupported fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds rustinel doctor warnings when dropped written-file jobs create a YARA and hash IOC detection gap.
• YARA now scans qualifying written files on Linux, macOS, and Windows, using an 8,192-job queue and 8,192-target settling table.

Container & Image Security · 2026-10-17

v1.1.1 hardens the supply chain with SLSA Build L3 provenance, reproducible per-arch images, and signed/attested OCI artifacts for spoc and the Helm chart.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Generates SLSA Build L3 provenance for all release assets via GitHub Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Publishes spoc and the Helm chart as OCI artifacts to registry.k8s.io/security-profiles-operator with GitHub provenance.
• Signs and attests platform images in the manifest list repository, including signed SLSA verification summaries from the image promoter.

SAST / SCA / Code Security · 2026-10-17

SAST / SCA / Code Security · 2026-10-17

Reconnaissance & OSINT · 2026-10-17

SharpHound v2.17.1 now collects Azure VM IDs from Windows computers during AD enumeration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Collects Azure VM IDs from Windows computers during enumeration, enabling BloodHound to correlate on-premises AD objects with Azure infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-10-17

SkillSpector v2.13.0 hardens MCP access, expands Python/TypeScript/binary detection, and fixes baseline and batch-scan integrity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Restricts MCP HTTP listeners to loopback; remote deployments require an authenticating proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds detection for bundled settings that use the short -r flag to load and run extra code, and flags bundled settings that run commands, redirect AI traffic, or automatically approve connected tool servers.
• Detects encoded shell payloads that are decoded and executed.

SAST / SCA / Code Security · 2026-10-17

Skylos v4.50.0 bundles native Go engines in PyPI wheels and adds --no-upload with agent-run upload consent controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --no-upload flag to suppress telemetry uploads; takes precedence over all other upload settings and omits the OS username from run summaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Bundles native Go dead-code and security engines directly in PyPI wheels for Linux, macOS, and Windows (x86_64 and arm64), the container image, and the GitHub Action — eliminating the need to build from source on supported platforms.
• Adds SKYLOS_GO_BIN environment variable to point Skylos at a separately built Go engine on unsupported platforms.

SAST / SCA / Code Security · 2026-10-17

SAST / SCA / Code Security · 2026-10-17

Skylos v4.49.0 adds human approval gates for risky PRs, AI-agent guardrail rules, hook v2, and failure-origin/orphan tracking in skylos done.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds human approval gating for risky PRs in the skylos done agent workflow, requiring a person to unblock the risk-review check before merge.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces guardrail and AI-agent workflow rules to the agents subsystem, enforcing deployment and behavior policies on agent-generated branches.
• Adds failure-origin tracking and orphan detection to skylos done, surfacing which changes caused a done-check failure and identifying orphaned work.

SAST / SCA / Code Security · 2026-10-17

Skylos v4.48.0 adds secret-printing shell blockers, AI-code critical gating, provenance tracking, and clearer scan assessments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds hooks that block shell commands which print secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Gate now fails on critical AI-code issues by default and always prints the verdict.
• Records agent edits and preserves commit associations in provenance tracking.

SAST / SCA / Code Security · 2026-10-17

skylos agent now reports silenced checks and cuts false done-gate blocks in v4.47.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds reporting of silenced checks in skylos agent output and removes false blocking in the done gate caused by silenced checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-17

Skylos v4.46.0 adds agent test-special-case blocking and a skylos cicd init command to generate gated-PR workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds skylos cicd init subcommand to generate a working gated-PR CI/CD workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables the agent done-gate to block code that special-cases tests (e.g. bypassing checks only when tests are running).

SAST / SCA / Code Security · 2026-10-17

skylos done gate now checks JS and TS tests, not just Python, before approving a branch for merge.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends skylos done done-gate to check JavaScript and TypeScript tests, broadening its branch-readiness verification beyond Python.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-17

Skylos v4.44.0 adds --require-trusted-upload flag and upload trust visibility to the cloud command.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --require-trusted-upload flag to the cloud command to gate uploads on trust status, with upload trust now shown in the output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds session-stop verification and changed-line test checks to skylos agent verify.

Firewalls & Network Defense · 2026-10-17

Sophos Firewall 22.0 MR3 adds a CLI command to disable strict IPsec SA policy checks for third-party VPN peers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a command to turn off strict policy checks for site-to-site IPsec VPN tunnels when third-party peers share Security Associations (SAs) across multiple subnet pairs, preventing incoming IPsec traffic from being dropped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-17

StepSecurity Secure Registry adds Packagist (PHP) support in Beta, with policy enforcement via https://registry.stepsecurity.io/php⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Packagist (PHP) registry support in Beta at https://registry.stepsecurity.io/php; point Composer or JFrog Artifactory at this URL to evaluate every packagist.org package request against your Packagist policy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Cooldown Period, Compromised Packages, and Custom Block List policy controls for Packagist packages.
• Adds Dist URL Rewriting setting to route package zip downloads through Secure Registry so every archive is checked against your policy.

AI/LLM Security · 2026-10-17

Straiker's Ascend AI red-teaming platform integrates with Workday Agent Passport to deliver cryptographically signed adversarial-test Stamps for AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Integrates Ascend AI with Workday Agent Passport so that red-team assessment results are submitted through Workday's partner interfaces and surface as cryptographically signed Stamps in the Agent System of Record before an agent is installed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Adversarial Resilience Trust Category to Workday Agent Passport, covering prompt injection, tool misuse, and data leakage tested against OWASP LLM Top 10, the OWASP Agentic Security Initiative, and MITRE ATLAS.
• Issues version-pinned Stamps — each recording the risk tested, the tester identity, and the specific agent version — so that a Stamp is automatically invalidated when the agent changes.

Attack Surface & Exposure Management · 2026-10-17

syzkaller adds a patch-planner agent to its AI-assisted patching flow and expands Linux syscall descriptions for UFS BSG, GPIO, and binder.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds patch-planner agent to the pkg/aflow/flow/patching pipeline, backed by the deep-reasoning model, to plan patches before code edits are generated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds grepper.Tool and gitlog.Tools to the code-access tool set available to patching-flow agents (alongside the existing codesearcher.Tools), exposed as the codeAccessTools bundle in pkg/aflow/flow/patching.
• Switches history-explorer agent from DeepReasoningModel to CoreModel in the patching flow, reducing deep-reasoning quota consumption.

Endpoint Security (EDR/XDR) · 2026-10-17

Helm Chart 3.5.5 adds unsupported-chart-version warnings on helm install/upgrade and upgrades the falco gRPC dependency to v1.67.1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a warning during helm install or helm upgrade when an unsupported chart version is detected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Upgrades the falco gRPC dependency from v1.44.0 to v1.67.1.

Secure Access (VPN / SASE / ZTNA) · 2026-10-17

Twingate Privileged Access for Web Apps now supports HTTPS, enabling end-to-end encrypted access to internal web apps without certificate warnings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Privileged Access for Web Apps to support HTTPS-served internal web apps, covering every leg of the user's path including the final hop to the origin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Eliminates browser Not Secure warnings and secondary sign-in prompts for internal HTTPS web apps accessed through the Twingate tunnel.
• Supports both public and private CAs for internal HTTPS web apps, with group-driven access control and no per-app certificate management required.

SAST / SCA / Code Security · 2026-10-17

Veracode CLI v2.53.0 adds veracode scan static and veracode findings static commands plus --csharp-source flag for C# source packaging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new packaging support to veracode package: the --csharp-source flag to package C# source code directly for Static Analysis without compiling it into binaries, and generic packager support for Apex.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the veracode scan static command to run static scans and review security findings within a Git workflow, and the veracode findings static command to access cached static scan findings in the local Veracode directory.
• Adds multiple packaging improvements to veracode package: the --skip-packagers flag to exclude specific artifacts (e.g. unsupported SQL) from packaging without affecting other languages; support for requirements-dev.txt in Python packaging workflows; exit codes 5, 6, and 7 to improve CI/CD automation and error handling; the --exclude flag to prevent specified Java packages or JAR files from being scanned; the VERACODE_PACKAGE_JAVA_SOURCE=true environment variable and --java-source flag for Java source code packaging; the VERACODE_PACKAGE_GOLANG_GENERATE environment variable to enable client-side CGO code generation for Go applications; the SRCLR_MAKE_WINDOWS environment variable to enable preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler; automatic inclusion of .yaml, .yml, and .properties files when packaging Java source code; support for the Poetry package management tool for Python autopackaging; support for the MSBuild .NET framework; and support for Go v1.24.

Non-Human & Agent Identity · 2026-10-17

Warden v0.21.0 adds a one-command dev playground, keyless federation for Anthropic/OpenAI/Cloudflare, and structured role discovery with read_skill.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds warden server -dev-playground to spin up a self-contained Warden instance with its own identity provider, a mock bank with MCP and REST faces, and GitHub's MCP server (no upstream key or Compose stack required), plus warden dev jwt | scenarios | audit subcommands and a nine-scenario tour for seven agents (Claude Code, Codex, Cursor, Gemini CLI, opencode, VS Code, or any MCP client), runnable via warden dev scenarios -client for an interactive walkthrough.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds warden cred source|spec keyless-plan to describe the keyless replacement for a specific credential source or spec, plus a keyless_enforcement_level config key to warn or refuse when a write would leave a secret stored in Warden, and a stored_secrets field on every source and spec.
• Adds assertion_profile config key accepting default, minimal, or aws and a per-spec assertion_ttl to control the shape and lifetime of federated assertions.

Digital Forensics & Incident Response · 2026-10-17

witr v0.3.4 adds Apple container runtime support, LoongArch (loong64) builds, and an interactive browser playground.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Apple container runtime support, enabling witr to trace processes inside Apple-native containers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports the LoongArch (loong64) architecture on Linux, with loong64 detection added to the install script.
• Adds an interactive browser playground with a guided tutorial at https://pranshuparmar.github.io/witr/ — no install required.

AI-Powered Offensive Security · 2026-10-17

v4.6.147 adds plain-text endpoint list uploads to scanner context and improves token-usage tracking across scan sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Accepts plain-text endpoint lists in uploaded scanner context, enabling practitioners to feed raw target lists directly into a scan session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Records and reconciles token usage at session boundaries for more accurate scan totals.
• Reduces repeated agent context while preserving tool schemas and required guidance, lowering noise in long autonomous scans.

AI-Powered Offensive Security · 2026-10-17

Xalgorix v4.6.145 adds bounded ReDoS testing to assessments and improves parameterized route coverage in route discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a bounded regex denial-of-service (ReDoS) task to assessments when the relevant testing phase is selected, requiring a returned probe before marking it complete.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Route discovery now filters probe artifacts and combines observations for relative and parameterized routes so coverage reflects application inputs.

AI Security Posture & Discovery · 2026-10-17

Zenity adds Universal Runtime Control for Claude Enterprise via Anthropic's Inference Hooks to validate tool calls before execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports Anthropic's Inference Hooks to validate Claude Enterprise tool calls at runtime before they execute.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-17

ZeroPath: Issue search now accepts presentation: true and knownVulnerableVersion fields, and can filter by lane and sort by priority.

• Adds scans.list returning issue counts that include dependency findings.
• listTags now returns tag ids and names; tag create/update requests take explicit include, exclude, and release changes.

Non-Human & Agent Identity · 2026-10-16

Aembit adds MCP Tool Access Control — per-tool allow/block policies with glob patterns and fail-closed audit logging for AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds application.mcp.contentSecurity.toolFilter audit event that records which rule matched and why for every filtered tools/list response or blocked tools/call request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces MCP Tool Access Control in the Aembit MCP Identity Gateway, enabling per-tool allow/block rules inside an access policy — controlling both tools/list discovery visibility and tools/call invocation independently.
• Supports exact tool names and glob patterns (e.g., get_user*, admin_*, list_*, delete_*) in tool-filtering policies so new tools inherit rules automatically without manual allow-list updates.

Firewalls & Network Defense · 2026-10-16

CoPilot 4.38.0 adds login banner configuration, route approval email alerts, and Site2Cloud hostname group links in notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds login banner configuration in CoPilot for customizing the authentication screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds route approval email alerts to notify administrators when routes require approval.
• Delivers upgrade experience enhancements for the gateway upgrade workflow.

Attack Surface & Exposure Management · 2026-10-16

Axonius 10.0.0 ships Axonius AI (Companion, Workforce, MCP Server), asset-correlation investigation, AI attribute fields for software/SaaS, and expanded exposure management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Auto Approve Managed SaaS Applications setting in Settings → Enrichment to control whether managed SaaS applications receive automatic approval status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Status Resolver option in Global Settings → Security Findings Data → Status Resolver to automatically remove security findings closed for more than a configurable number of days (default 14 days for new customers, off for existing).
• Adds Preferred: Device Type preferred field, calculated post-correlation, usable across Query Wizard, reports, dashboards, and Enforcement Sets — replacing the legacy Device Type identifier field.

WAF, Bot & API Protection · 2026-10-16

BunkerWeb 1.6.16 adds ban removal API supporting CrowdSec decision deletion via remove_crowdsec_decisions and decision_keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ban removal endpoint supporting kind: "crowdsec_lease" with remove_crowdsec_decisions: true, confirmed: true, and decision_keys to delete underlying CrowdSec decisions globally or per service.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI Red Teaming & Testing · 2026-10-16

API surface changed: +2 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /backend/v1/campaign-runs/{campaignRunId}/results⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint POST /backend/v1/tokens/bulk-delete
• GET /backend/v1/projects/{project}: param includeAdded (query) added

Identity & Access Management · 2026-10-16

Clerk launches a revamped MCP server for managing applications, users, and configuration directly from an AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New Clerk MCP server enables managing Clerk applications, users, configuration, and production setup directly from an AI agent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-16

Clevis v24 adds optional mTLS support to the tang pin and drops the TPM1 network dependency from dracut.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds optional mutual TLS (mTLS) support to the tang pin for authenticated tang server connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Drops the network dependency from the TPM1 dracut module, so TPM1 unlocking no longer requires network availability at boot.
• Includes libpcsclite_real.so in the dracut initrd PKCS#11 module to enable PKCS#11 token access during early boot on distributions that ship the library.

Software Supply Chain Security · 2026-10-16

Cloudsmith adds ActiveState Curated Catalog upstream support, configurable from the Libraries tab.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ActiveState Curated Catalog as a supported upstream source, with configuration available in the Libraries tab, enabling proxy and caching of curated packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-16

READ METADATA privilege now available by default across all Databricks compliance security profile standards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the READ METADATA privilege by default for workspaces with the compliance security profile enabled, covering all supported compliance standards.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-16

ADBC driver for the Databricks connector in Power BI is now generally available and set as the default for new connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Promotes the Arrow Database Connectivity (ADBC) driver for the Databricks connector for Power BI to general availability, replacing ODBC as the default driver for new connections in Power BI Desktop and the Power BI service.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Public Key Infrastructure (PKI) · 2026-10-16

CertCentral Apache download drops unneeded self-signed G5/G2 roots; Default intermediate chain menu gains a DigiCert default (recommended) option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The Default intermediate chain menu in Settings > Product Settings now shows a DigiCert default (recommended) option so you can distinguish DigiCert's default chain from a chain you explicitly selected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Apache .crt download files for G5 and G2 TLS certificates will contain only the intermediate CA and cross-signed root — the self-signed G5 and G2 roots are removed from DigiCertCA.crt.

Software Supply Chain Security · 2026-10-16

Endor Labs adds container image scanning — covering OS and application packages — integrated with SCA across Code, Build, Deploy, and Respond stages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds container image scanning for both base OS and application packages, with pre-deployment scans to catch risks before images ship to production.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Groups vulnerability findings (e.g. GHSA-xh6m-7cr7-xx66, GO-2022-0523) across libraries and containers in a unified view, reducing alert noise without a separate ASPM tool.
• Includes container vulnerability findings in pull-request comments alongside application dependency findings, so developers see all impacted packages in one place.

Software Supply Chain Security · 2026-10-16

Endor Labs adds CI/CD security: pipeline discovery, repository posture management, and artifact signing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Pipeline Discovery to map every tool touching code across repositories and CI/CD workflows, surfacing shadow engineering, security coverage gaps, and policy violations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Repository Security Posture Management (RSPM) with over 50 out-of-the-box policies to continuously monitor repo misconfigurations — including unprotected branches, missing MFA, and overprivileged accounts — aligned to CIS benchmarks.
• Adds Build Integrity Verification via artifact signing, attaching provenance information (source repository, branch, commit, repository owner) to signed packages and containers.

Software Supply Chain Security · 2026-10-16

Endor Labs integrates with SpaceXSI's Grok Build to secure agentic coding via AURI, Agent Kit, and Coding Agent Governance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Install the Endor Labs Agent Kit for Grok Build via the marketplace or by typing /add-plugin endorlabs in the agent chat to bring AI SAST, SCA, and remediation agents into the IDE session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Coding Agent Governance hooks that record every MCP tool call, shell command, and file operation and enforce policies deterministically before each action runs — without relying on a model's judgment.
• Endor Scores rate each MCP server and skill for trust, mapped to the OWASP Top 10 for LLM Applications, giving security teams a basis to approve or block agents and skills.

WAF, Bot & API Protection · 2026-10-16

Fastly CLI v16.2.0 adds routing-config support, GCS public-key logging flag, and a short -h help flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CLI support for routing configs via the new routing-config subcommand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --public-key flag to GCS logging commands (service/logging).
• Adds -h as a short alias for --help across all commands.

Secrets Detection & Management · 2026-10-16

Secrets Detection & Management · 2026-10-16

GitGuardian adds NHI identity owner management endpoints for reading and updating ownership of non-human identities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /v1/nhi/identities/{identity_id}/owners endpoint to list owners of a non-human identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds POST /v1/nhi/identities/{identity_id}/owners endpoint to assign owners to a non-human identity.
• Adds POST /v1/nhi/identities/{identity_id}/owners/update endpoint to update ownership records for a non-human identity.

Secrets Detection & Management · 2026-10-16

ggscout 0.34.1 checks validity and permissions of vaulted secrets in-network, surfacing live verdicts in the NHI inventory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds [check] enabled = false config key to opt out of in-network validity and permissions checks per ggscout deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Validity column and filter (Valid, Invalid, Unknown) for all secrets collected by ggscout, surfaces token permission scopes (e.g. repo, admin:org on GitHub; api on GitLab) alongside each identity, and reports credential owner, expiry date, and provider metadata in the identity detail view, sourced directly from the provider during each ggscout run, in the NHI Governance → Identities inventory.
• Merges validity verdicts from vaulted or Kubernetes secrets with any matching secret incident, always keeping the most recent verdict.

SAST / SCA / Code Security · 2026-10-16

GitHub Copilot in Slack and Teams gains multi-repo conversation support and richer Slack thread context.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports querying across multiple repositories in a single Copilot conversation in Slack and Microsoft Teams, enabling PR tracking, issue investigation, and activity summaries without switching conversations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Allows @GitHub to be mentioned anywhere in a message, not just at the beginning.
• Uses shared Slack messages and threads as context so Copilot can reference discussions without manual copy-paste.

SAST / SCA / Code Security · 2026-10-16

GitHub now lets org and enterprise admins download a CSV of Code Quality license usage for reconciliation and cost management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CSV download of GitHub Code Quality license usage from the Licensing section of the Billing and licensing page, available on GitHub Team and GitHub Enterprise Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• CSV report includes each active committer consuming a Code Quality license, the repositories receiving their commits in the last 90 days, and whether each committer is unique to a single repository or organization.

SAST / SCA / Code Security · 2026-10-16

GitHub AI Scan for pull requests is GA, extending code scanning to PHP, Shell/Bash, Terraform (HCL), Dockerfiles, JSP, and Blazor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI Scan for pull requests as a generally available capability that finds vulnerabilities in PR changes for languages and frameworks CodeQL does not currently cover, including PHP, Shell/Bash, Terraform configuration (HCL), Dockerfiles, JSP for Java, and Blazor for C#.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• AI Scan findings appear alongside CodeQL results on the Conversation and Files changed tabs with an AI indicator, and can include an explanation of the security risk and a suggested autofix.
• AI Scan runs automatically on pull requests when code scanning and the repository's effective AI Scan setting are enabled — no GitHub Copilot license required.

SAST / SCA / Code Security · 2026-10-16

GitHub's agentic autofix for code scanning alerts is now GA, using Copilot to explore, fix, validate, and PR-open remediations autonomously.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables agentic autofix via the Update a Code Scanning Alert REST API by setting assignees to ["copilot-swe-agent[bot]"] on alerts on the default branch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Agentic autofix policy under Advanced Security policies for enterprise administrators to control access.
• Introduces the Assign to Copilot button on individual code scanning alerts, replacing the previous Generate Fix option for eligible customers.

SAST / SCA / Code Security · 2026-10-16

GitLab MCP server is now GA in GitLab 19.5, connecting external MCP-compatible agents to code, pipelines, merge requests, and Duo Agent Platform flows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds add_branch (to start a feature branch from an agent), get_repository_file (to read a file at any ref without extra API calls), semantic_search (to find code by meaning without knowing the file or symbol name), list_groups (to browse the group hierarchy instead of guessing identifiers), and list_wiki_pages (an opt-in tool to surface runbooks and docs before answering a how-to question) tools to the GitLab MCP server.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds get_pipeline (returns a pipeline's status, jobs, downstream pipelines, and artifacts on request), list_pipelines (to surface patterns across recent pipeline runs), and get_artifact_file (to read a single file from a job's artifacts—log, report, or test fixture—without downloading the whole archive) tools.
• Adds list_duo_agents_and_flows (to discover available Duo Agent Platform flows in a project), start_duo_session (to start a GitLab Duo Agent Platform flow from plain-language goals without leaving the MCP client), get_duo_session and list_duo_sessions (to check the progress of running Duo Agent Platform sessions), and send_duo_session_input (to approve, reject, or answer an agent's proposed action mid-session, keeping humans in the loop) tools.

SAST / SCA / Code Security · 2026-10-16

GitLab 19.5 adds Recommend Reviewers Flow to automatically suggest the best reviewer by workload, time zone, and expertise at merge request creation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Triggers reviewer suggestions automatically when a merge request is created, whether in draft or ready state, surfacing recommendations in a dedicated panel with one-click assignment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Explains the reasoning behind each reviewer recommendation so authors can approve or override suggestions with full context.
• Adds Security Review Flow to check merge request changes for business logic vulnerabilities before they merge.

SAST / SCA / Code Security · 2026-10-16

GitLab Secrets Manager is GA in GitLab 19.5, scoping build-time secrets per job via OpenBao with full audit trails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Declares secrets in .gitlab-ci.yml using the secrets: keyword, injecting values only into jobs that declare them and fall within scope (branch, protected-branch flag, production/* environment wildcards), and allows projects to inherit secrets defined in parent groups so a shared credential can be defined once and accessed via existing project membership.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new integrations for secrets access: Kubernetes secret sync via External Secrets Operator (ESO) that re-fetches on a set interval and updates the Kubernetes Secret in-place without a pipeline run, Terraform and OpenTofu support as a data source at plan or apply time (keeping credentials out of .tfvars files and CI/CD variables), and a Vault-compatible API so OpenBao and Vault CLIs can point existing scripts at Secrets Manager without modification.
• Provides a Secrets Manager API for runtime tools to authenticate with a service account or access token and receive a separate five-minute-valid token per fetch, and issues short-lived tokens bound to each job's identity so jobs fetch values directly from OpenBao.

SAST / SCA / Code Security · 2026-10-16

GitLab Code Review Flow brings governed agentic code review to every merge request via CI/CD, with automatic reviewer suggestions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables automatic Code Review Flow at the project, group, or instance level so every merge request is reviewed without manual assignment, with settings that cascade down the hierarchy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Runs Code Review Flow as a CI/CD job on GitLab-hosted or self-managed runners, integrating agentic review into the same pipeline environment as the rest of delivery.
• Supports custom review instructions — covering language conventions, security practices, and path-specific rules — pointing Code Review Flow at a template project so standards travel with the work across a group.

SIEM · 2026-10-16

ATI curated detection rules now match against the GTI_IOC feed, replacing three deprecated legacy feeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Applied Threat Intelligence (ATI) curated detection rules now match against the GTI_IOC feed instead of the deprecated MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and OPEN_SOURCE_INTEL_IOC feeds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-16

API surface changed: 7 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GET /lookalikes: param domain (query) added; param company_list_id (query) now optional⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-16

Tag-driven domain updates now async (202 Accepted); SAML drops SHA-1 and OpenID Connect drops unsigned none JWT algorithm.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New and updated SAML IAM configurations no longer support SHA-1; supported signature and digest algorithm values are now SHA-256 and SHA-512.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The unsigned JWT algorithm (none) is no longer available as a supported ID token signing algorithm in OpenID Connect configurations.

Secrets Detection & Management · 2026-10-16

Infisical v0.166.8 adds Portainer secret sync, webhook authentication with custom headers, and audit-log-stream drop alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds authentication and custom headers support to webhook alert channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an alert when an audit log stream starts dropping logs.
• Adds Portainer as a supported secret sync app connection target.

Web Application Security · 2026-10-16

Invicti adds bulk vulnerability retesting, API key auth for Source Scan, scan-on-auth-failure, and HAR export from login recordings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Retest found vulnerabilities option in the Scan again dropdown on the scan summary to retest every vulnerability from a scan in one action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds API key authentication for Source Scan in CI/CD pipelines, with expiry date support on the Profile API key page, so pipelines no longer depend on short-lived tokens.
• Adds a setting to fail a scan when authentication problems occur, preventing unauthenticated results from being silently accepted.

Endpoint Management (UEM/RMM) · 2026-10-16

Iru now auto-rotates FileVault recovery keys after an admin views them, with configurable rotation timing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables automatic FileVault recovery key rotation after an administrator views the current key, configurable via Automatically rotate keys after viewing in the FileVault Library Item.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Key view events continue to be recorded in the device activity timeline.

Endpoint Management (UEM/RMM) · 2026-10-16

Iru AI can now generate BitLocker and Android Restrictions Library Items from plain-language descriptions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Iru AI-assisted Library Item creation for BitLocker disk encryption policies on Windows from a plain-language description.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Iru AI-assisted Library Item creation for Android Restrictions from a plain-language description.

Endpoint Management (UEM/RMM) · 2026-10-16

Iru Single Sign-On Library Item gains OpenID web sign-in and password-sync settings for macOS 27.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenID sign-in support to the Single Sign-On Library Item for macOS 27 and later, enabling identity provider web sign-in pages (including MFA) at the login window, Lock Screen, and FileVault unlock.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New setting to sync the web login password to the local macOS account.
• New setting to configure a web login URL allow list.

Endpoint Management (UEM/RMM) · 2026-10-16

Automated Device Enrollment gains an Update to target OS version setting alongside the existing minimum OS floor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Update to setting in Automated Device Enrollment, letting admins define a separate target OS version that devices upgrade to before enrolling, independent of the minimum required OS version floor — supported for macOS, iOS, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-10-16

Admins can now upgrade Android Enterprise from managed Google Play to a managed Google domain without re-enrolling devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Upgrade to managed Google domain button in the Iru web app, letting admins upgrade an Android Enterprise integration from a managed Google Play account to their organization's managed Google domain without re-enrolling any devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-16

isMalicious adds CVE intelligence pages, STIX/TAXII 2.1 feeds, DNS history, ransomware victim tracking, and webhook retry logging.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands ransomware victim post coverage via RansomLook and Ransomfeed, each entry carrying group, publication time, and correlated indicators.
• Adds a searchable glossary of 50+ terms spanning threat intelligence, malware, network, vulnerability, and API security, including an AI agent security category.
• Publishes long-form explanations and worked examples for 16 top terms, plus 14 new terms.

Software Supply Chain Security · 2026-10-16

JFrog Business Value Center adds a real-time ROI and supply chain coverage dashboard inside MyJFrog for SaaS customers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the JFrog Business Value Center inside MyJFrog — a real-time dashboard that quantifies platform ROI, developer hours reclaimed, storage saved via deduplication, and the percentage of repositories actively scanned by JFrog Xray.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Surfaces an Optimization panel showing what share of the software supply chain is scanned for vulnerabilities and what fraction of incoming open-source packages are blocked by JFrog Curation policies before reaching developers.

Integrated & IT Risk Management · 2026-10-16

LogicGate launches Cyber Risk Management Agentic Application with three built-in AI agents for triage, assessment, and insights.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Cyber Risk Triage Agent, which evaluates incoming risk records against your governance definitions, separates true cyber risks from routine issues or policy exceptions, and routes invalid submissions back to the original submitter with guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Cyber Risk Assessment Agent, which synthesizes linked threat data, evaluates mitigating IT controls, and proposes justified risk scores with auto-filled remediation plans aligned to your organization's framework (including NIST Cybersecurity Framework and ISO/IEC 27001).
• Adds the Insights Agent, which transforms complex risk data into a plain-language chat interface, generates executive-ready reports, and dynamically flags escalating technical threats requiring immediate attention.

Reconnaissance & OSINT · 2026-10-16

Nmap 7.992 adds a libfuzzer fuzzing framework, SAP HANA service probe, DHX2 AFP auth, and NSE memory/CPU guardrails.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a libfuzzer-based fuzzing framework covering internal functions of Nmap, Ncat, and Nping, with 10 functions instrumented so far.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enforces --script-timeout and --host-timeout for previously uninterruptible NSE script loops in rdp.lua, tn3270.lua, and ospf.lua, and limits the NSE Lua interpreter to 400 MB memory while killing script threads that exceed 5 seconds of execution without yielding.
• Adds a SAP HANA database service probe for fingerprinting SAP HANA instances.

Identity & Access Management · 2026-10-16

Ory v26.4.2 refines request latency histogram buckets for http_requests_duration_seconds and http_response_time_seconds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds finer-grained latency histogram buckets to the http_requests_duration_seconds and http_response_time_seconds metrics in Ory Hydra.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-16

Advanced Reporting gains optional parameters and human-readable usernames in entitlement review items.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• In Advanced Reporting, parameters such as status, journeys, and roles are now optional in several out-of-the-box reports, so you can run them without selecting values you don't need.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• In Advanced Reporting, the Completed By field in entitlement review items now returns usernames instead of GUIDs.

AI / LLM Gateways · 2026-10-16

Portkey adds Decisions API, MCP guardrails, startHooks lifecycle stage, and Meta/ElevenLabs provider support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds startHooks lifecycle stage to screen and normalize traffic before authentication, routing, or other hooks run — including two new checks: Header Check (allow/block by header key-value pairs) and Header Transform (remove, set, or rewrite headers before routing; x-portkey-* headers are protected); existing checks allowedRequestTypes, webhook, and JWT header lookup can also now run as startHooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Decisions API endpoint for typed-judgment models: send a question with structured state and receive a typed judgment (boolean, choice, or score) with probabilities and a calibrated confidence score, routing through the full gateway stack (auth, routing, retries, caching, logging, cost tracking); initial support covers TypeSafe's Jev model family.
• Extends MCP Gateway guardrails so MCP tool calls pass through the same pre- and post-execution checks available for LLM requests; denied calls return a structured error with the guardrail and check ID.

General Utilities & Libraries · 2026-10-16

pipx 1.18.2 adds support for absolute file URLs when installing local packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports absolute file URLs (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ file:///path/to/package) for local package installs via pipx install.

MCP Servers & Tooling · 2026-10-16

Runlayer Detect now inventories IDE-native AI agents and their MCP servers, and connector policies gain per-tool granularity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Detects IDE-native AI agents that were previously invisible — including Claude and Codex agents in Xcode 26.3+ (from its own CodingAssistant folder), Visual Studio Copilot agent mode, JetBrains AI Assistant, Gemini in Android Studio, GitHub Copilot for Xcode and Eclipse, Firebender, Positron, and PearAI — because none of these read the standalone Claude Code, Codex, or VS Code config files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Recognizes Codex for VS Code, CodeGPT, Qoder CN, Bito, Zencoder, Tabby, twinny, Verdent, Pieces, and the Firebender JetBrains plugin as AI extensions in the Detect inventory.

MCP Servers & Tooling · 2026-10-16

Runlayer 1.28.1396 adds session stop API, LLM Gateway spend tracking, AI Watch detections for 22 coding harnesses, and Looker/LaunchDarkly connectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Session stop API for Security, IT, and Super Admins to halt a live agent session with a reason; subsequent MCP tool calls carrying that session's id are denied until an admin clears the stop, with each stop, first denied call, and clear recorded in the audit log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Settings → LLM Gateway → Spend tab listing every LLM call the gateway reported, with cost, tokens, and charged usage rule, and totals spend by agent run, device, or model over a chosen time range; calls the gateway cannot price show as unpriced rather than $0.
• Adds Looker and LaunchDarkly MCP connectors to general availability (no longer Beta).

MCP Servers & Tooling · 2026-10-16

Runlayer 1.28.1381 adds secret stores, agent eval scoring, Terraform-managed scanner defaults, and expanded AI Watch detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PATCH /ai-watch/policy-rules/{id} to edit the organization-wide AI Watch policy, now an editable default (Monitor with Sessions off) rather than a computed value; the rule list shows which deployments differ from it.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds components.extendDB opt-in to Kubernetes operator deployments to provision DynamoDB-compatible token storage via ExtendDB on the instance Postgres (Preview; requires botocore >= 1.31 / boto3 >= 1.28 or JS v3 / Java 2 / Go v2 and AWS_ENDPOINT_URL_DYNAMODB injection).
• Adds runlayer_security_scanner_settings Terraform resource to manage organization-wide security scanner defaults as code (self-hosted deployments require backend 1.28.1220 or later), and runlayer_ai_watch_enforce_entry Terraform resource to manage each AI Watch Enforce allowlist or Protect denylist entry (remote MCP URL, stdio package, or built-in) as code (self-hosted deployments require backend 1.28.1171 or later).

Non-Human & Agent Identity · 2026-10-16

SPIRE v1.15.4 adds configurable TLS policies for TLS listeners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports configuring TLS policies to be applied to TLS listeners.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-16

StackHawk: Adds Windows CLI installers: irm https://download.stackhawk.com/hawk/install.ps1 | iex for PowerShell, installing to %USERPROFILE%\.hawk\bin.

• HawkScan now reads the declared servers[] base path (or basePath in Swagger 2.0) from an OpenAPI spec and automatically prefixes every operation request, so specs no longer return empty scans when the base path is not duplicated in app.url.
• Removes the default per-rule alert cap so every matching alert is reported; existing scanner.maxAlertsPerRule / pscans.maxAlertsPerRule values set via hawk.config continue to apply.

Attack Surface & Exposure Management · 2026-10-16

Attack Surface & Exposure Management · 2026-10-16

Detection Engineering · 2026-10-16

Tenzir v6.20.0-rc.3 ships a new data model, typed AI decisions, encryption/secret functions, and a wave of new source/sink integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ai_decide operator with typed decisions and dedicated Decisions endpoints, so pipelines can branch on structured AI-evaluated results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds secrets as function arguments and Secret keys for hmac, enabling secret-backed HMAC signing inside pipeline expressions.
• Adds Luhn check digits, CRC-32 checksums, OCSF functions, and Encryption functions as new built-in functions for pipeline expressions.

SOAR · 2026-10-16

Tines now supports keyless cloud credentials via workload identity federation for AWS, Google Cloud, Microsoft Entra, and Oracle Cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports workload identity federation for keyless authentication with AWS, Google Cloud, Microsoft Entra, and Oracle Cloud credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-16

Private Access Connector 3.11.0.2190 adds TCP MSS clamping and CIS-benchmark image hardening.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Applies additional image hardening settings recommended by CIS benchmarks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-16

Trend Vision One lets admins prompt email recipients for attachment passwords so protected files get scanned instead of skipped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an action in Email and Collaboration Security → Cloud Email and Collaboration Protection to request password-protected attachment passwords directly from recipients when the password is absent from the email, enabling scanning of previously unscannable attachments without administrator intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-16

Varonis adds AI classification scope controls, Databricks data masking automation, Snowflake DB sizing, and configurable collector scan ratios.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports migration of existing Salesforce integrations to Salesforce's External Client App framework, preserving existing configurations.

SIEM · 2026-10-16

Wazuh v4.14.9 raises active response command capacity to 1024, expands FIM eBPF whodata to older kernels, and adds a configurable API auth-context payload size limit.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds auth_context_max_payload_size option to configure the API run_as authentication-context payload size limit (raised from 8 KB to 64 KB by default), improving support for AD/LDAP/SSO logins with large group-membership contexts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Raises from 64 to 1024 the number of active response commands that wazuh-execd can load from etc/shared/ar.conf.
• Allows FIM eBPF whodata on capable kernels older than 5.8, such as RHEL 8.10.

Endpoint Security (EDR/XDR) · 2026-10-16

AI Security Posture & Discovery · 2026-10-16

Zenity adds pre-execution tool-call enforcement for Claude Enterprise via Anthropic's Inference Hooks, covering all Claude surfaces with no endpoint agent required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables pre-execution allow-or-deny verdicts on Claude tool calls via Anthropic's tool_call Inference Hooks event, blocking prohibited operations before they run across claude.ai (web, desktop, mobile), Cowork, Claude Code, Claude for Microsoft 365, Claude in Chrome, Claude's built-in browser, and Claude Tag in Slack — with no endpoint agent or browser extension required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Zenity Boundaries read/write classification for supported tool calls, letting policy allow reads while blocking deletes, bulk updates, external shares, shell commands, or form submissions that violate policy — without depending on tool names that vary across connectors.
• Adds tool provenance enforcement: Boundaries can restrict tool calls to verified MCP servers and connectors, or block calls from unverified or local origins, using provider metadata supplied with each tool_call event.

SAST / SCA / Code Security · 2026-10-16

ZeroPath adds exploit-evidence priority lanes, a lifecycle board with expiring accepted risk, an Audit log, and expanded Issue search API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Priority lanes on the Issues page, grouping open findings into Fix now, Needs decision, and Lower priority lanes (with Fix now requiring High/Critical CVSS severity plus at least one exploit-evidence chip: Runtime Validation verdict, known exploited advisory, reachable dependency, Wiz internet exposure, or verified live secret), and an Issues scan source menu offering All, Full Scans, and Latest PR Scans for code scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Board view (lifecycle board) where findings move through Needs review, Backlog, Reviewing, and Patching stages by drag-and-drop, with a required close-reason dialog, an Undo window of 6 seconds, and Accepted risk expiry that automatically reopens a finding once its accepted-until date passes unless it was closed by other evidence.
• Adds the Audit log page under Reporting for organization admins, filterable by actor, source, and level up to 90 days, with per-event endpoint and argument detail and Export CSV up to 100,000 events.

1Password 7 changes

• 1Password for Android beta 8.12.44-24 (2026-10-21) · Feature · 2026-10-22
• 1Password for Mac beta 8.12.44-24 (2026-10-21) · Feature · 2026-10-22
• 1Password for iOS beta 8.12.44-24 (2026-10-21) · Feature · 2026-10-22
• 1Password in the browser 8.12.44-24 (2026-10-21) · Feature · 2026-10-22
• 1Password for Linux 8.12.42 (2026-10-20) · Feature · 2026-10-21
• 1Password in the browser 8.12.42 (2026-10-20) · Feature · 2026-10-21
• 1Password SaaS Manager #2075 (2026-10-14) · Feature · 2026-10-20

Acronis Cyber Protect Cloud 1 changes

• changelog · Oct 15, 2026 · Feature · 2026-10-19

Aembit 2 changes

• changelog · Oct 20, 2026 · Feature · 2026-10-20
• Introducing MCP Tool Filtering: Fine-Grained, Least-Privilege Authorization for AI Agents (2026-10-15) · Feature · 2026-10-16

AI-Infra-Guard 1 changes

• v4.6.7 · Feature · 2026-10-22

Aikido Security 2 changes

• announced · Oct 20, 2026 · Product launch · 2026-10-22
• announced · Oct 19, 2026 · Feature · 2026-10-22

Akto 1 changes

• announced · Oct 22, 2026 · Feature · 2026-10-22

APKiD 1 changes

• v3.2.0 · Feature · 2026-10-22

AppOmni 1 changes

• ConnectWise Cloud Backup Compromise in Microsoft 365: What Happened and What to Do Now (2026-10-19) · Feature · 2026-10-20

Arcade 3 changes

• docs update · Docs · 2026-10-22
• announced · Oct 15, 2026 · Feature · 2026-10-19
• changelog · Oct 18, 2026 · Feature · 2026-10-18

ArmorCode 1 changes

• announced · Oct 21, 2026 · Product launch · 2026-10-21

Artemis Security 1 changes

• announced · Oct 15, 2026 · Feature · 2026-10-19

Auth0 6 changes

• Agent Mode for the Auth0 CLI (2026-10-21) · Feature · 2026-10-22
• announced · Oct 20, 2026 · Feature · 2026-10-22
• docs update · Docs · 2026-10-21
• Improved Bot Detection: Enhanced IPv6 Signal Analysis (2026-10-20) · Feature · 2026-10-21
• changelog · Oct 20, 2026 · Feature · 2026-10-20
• Universal Login identifier and phone country controls in Early Access (2026-10-16) · Feature · 2026-10-17

Automox 1 changes

• api-docs-4a042873b954 · API · 2026-10-20

Aviatrix CoPilot 1 changes

• New and Enhanced Features in 4.38.0 · Feature · 2026-10-16

Axonius 1 changes

• Axonius Release Notes 10.0.0 (2026-10-11) · Feature · 2026-10-16

aya 1 changes

• aya-build-v0.2.1 · Feature · 2026-10-17

Backslash 2 changes

• announced · Oct 19, 2026 · Feature · 2026-10-22
• Local Model Discovery: Govern Shadow AI | Backslash - Backslash (2026-10-19) · Feature · 2026-10-20

Black Duck 1 changes

• Polaris release update: Deeper detection, remediation you control, scanning wherever you work (2026-10-21) · Feature · 2026-10-22

Bugcrowd 1 changes

• changelog · Oct 20, 2026 · Feature · 2026-10-20

Buildah 1 changes

• v1.46.0 · Feature · 2026-10-22

BunkerWeb 3 changes

• docs update · Docs · 2026-10-22
• v1.6.17 · Feature · 2026-10-22
• api-docs-9bb6ac79a8c8 · API · 2026-10-16

bytebase 1 changes

• 1.0.0 · API · 2026-10-17

CalypsoAI 1 changes

• 1.0.0 · API · 2026-10-16

capa 1 changes

• v10.0.0 · Feature · 2026-10-17

CAPEv2 1 changes

• commits-2026-10-17 · Code activity · 2026-10-19