The week in full · Oct 23–29

Web Application Security · 2026-10-29

Non-Human & Agent Identity · 2026-10-29

Aembit adds AEMBIT_NETWORK_ACCESS_POLICY to control which MCP servers a self-hosted MCP Identity Gateway can reach, and exposes gateway version in protected resource metada⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Read the MCP Identity Gateway version without an access token via the aembit_gateway_version field now present in the protected resource metadata document.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Agent Controller now bypasses an HTTP proxy when calling the AWS instance metadata service for AWS Metadata Service Trust Provider attestation, matching its existing Azure behavior.
• Agent Controller authentication errors now name the Agent Controller ID that failed, prompting you to confirm it is valid and active in your Aembit Tenant.

AI Red Teaming & Testing · 2026-10-29

AI-Infra-Guard adds a Runcrate provider preset to Agent-Scan and packages each scanner for independent pip install⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Install any scanner on its own without pulling the full tool by packaging each scanner for an independent pip install.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Agent-Scan now supports Runcrate as a provider preset, expanding the range of agent runtimes it can target.

SAST / SCA / Code Security · 2026-10-29

Aikido Security adds External Network Pentesting — AI agents map your perimeter and exploit findings from outside, with no code access or credentials required⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Aikido Security now offers an External Network Pentesting capability where AI agents discover subdomains, open ports, and services from a list of top-level domains, then attempt exploitation using known CVEs, misconfigurations, and exposed secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Agents chain findings across hosts — using credentials or access found on one system to pivot to the next — and the report shows the full attack path from entry point to impact.
• Watch agents work in real time via the Agents tab, which shows each agent's current thinking, tools in use, and findings so far.

Identity & Access Management · 2026-10-29

Auth0 adds Universal Portals in Developer Preview — hosted self-service portals for end users and organization admins, built from pre-built components and served on your doma⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Auth0 now offers consumer portals where end users can update their profile, enroll MFA factors and passkeys, and review security settings — hosted by Auth0 on your domain with no interface to build or maintain.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Auth0 now offers business portals where organization administrators can edit organization details and verify domains, without custom development.
• Build portal pages visually using Universal Components, Auth0 Forms, and layout components such as headings, rich text, sections, separators, and images.

Web Application Security · 2026-10-29

Burp Suite DAST adds API scanning from Burp XML and HAR files and clarifies GraphQL API URL entry⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Create an API site from Burp XML and HAR files to scan APIs captured in those formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Burp Suite DAST now makes it clearer which URL to enter when configuring a GraphQL API scan.

Secure Access (VPN / SASE / ZTNA) · 2026-10-29

Cato Networks adds AI Agent Experience Monitoring to DEM, giving IT live latency and error visibility into ChatGPT, Claude, Cursor, and the OpenAI and Anthropic APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Cato DEM now adds an AI Agent Experience Monitoring drill-down view where IT teams can analyze AI latency and errors broken down by model provider, domain, and site.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cato DEM now isolates AI model-provider traffic — including conversational interactions and coding-agent traffic from tools like Claude Code — from background application noise such as downloads, authentication, and telemetry, so latency and error metrics reflect the actual AI interaction.
• Cato DEM now shows how users are accessing AI services — browser, terminal, script, or coding tool — so IT can distinguish, for example, a browser session to Claude from a developer using Claude Code.

Secure Access (VPN / SASE / ZTNA) · 2026-10-29

Container & Image Security · 2026-10-29

Chainguard: Chainguard now offers Rancher 2.11 images, including rancher:2.11 and rancher-agent:2.11, among others.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Chainguard now offers a suite of Sentry images: sentry, sentry-launchpad, sentry-relay, sentry-taskbroker, sentry-uptime-checker, and sentry-vroom.
• Chainguard now offers apache-pulsar:4.0 as a hardened container image.
• Chainguard now offers gitleaks as a hardened container image.

Internet Services · 2026-10-29

Cloudflare adds MCP analytics filters, jurisdiction-restricted Workflows, custom Access pages, and static asset path-prefix serving⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Serve Workers Static Assets from a URL path prefix by setting the prefix in Wrangler or cloudflare.config.ts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Restrict where a Workflow's instances run and store data by setting a jurisdiction in your Wrangler configuration.
• Filter MCP tool-call analytics by response status — counting successful, failed, or cached calls separately, with successful calls as the default view.

Internet Services · 2026-10-29

Cloudflare China Network now serves Turnstile challenge widgets hosted inside Mainland China, eliminating cross-border requests for visitors there⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Challenge Pages on the China Network now use Turnstile widgets hosted in Mainland China, so visitors there complete challenges faster and more reliably without cross-border requests — no configuration change required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-10-29

Compyl adds Workspace ONE and Supabase integrations to collect device compliance, OS inventory, and project configuration data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Compyl adds a Workspace ONE integration that collects device compliance status, patch and OS version inventory, disk encryption (BitLocker) status, profile and policy assignments, and enrollment state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Compyl adds a Supabase integration that syncs organizations, projects, functions, secrets, custom hostnames, and network restrictions.

Identity & Access Management · 2026-10-29

ConductorOne adds a user-scoped review type, three access profile types, and a new Browse page for requestable access⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Start access review campaigns scoped to specific people — by user list, selection criteria, or CEL expression — using the new By users review scope type, which also works on campaign templates to trigger reviews when a user changes roles or leaves.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Access profiles now come in three types: Catalog (self-service requestable), Role (automatic all-or-nothing grants with explicit membership), and Hybrid (the previous behavior — requestable or condition-based); all existing profiles become Hybrid automatically.
• A new Browse page consolidates everything a user can request in one place, with a dedicated AI tools tab, while the Requests page now holds only task queues.

Data Security & DLP · 2026-10-29

Cryptomator adds certificate-chain support for supporter certificates and tighter validation of masterkey scrypt parameters⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Cryptomator now accepts supporter certificates signed via a certificate chain (x5c header), broadening the set of valid certificate formats.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Masterkey files whose scrypt parameters require more than 64 MiB of memory are now rejected before key derivation, with a dedicated error dialog shown on unlock and password change.
• Cryptomator improves usability of the trust-on-first-use dialog.

Software Supply Chain Security · 2026-10-29

cyclonedx-python adds -E flag to the environment command to ignore parent PYTHON* environment variables during SBOM generation⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Isolate SBOM generation from the host shell by passing -E to the environment command, which ignores all inherited PYTHON* environment variables.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-29

Databricks adds serverless GPU compute for clean room notebooks, enabling model inference and training over shared data⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Run clean room notebooks on serverless GPU compute for model inference and training over shared data, using AI Runtime with the same approval flow, data access, and output tables as other clean room notebooks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-29

Databricks adds serverless GPU support in clean rooms, now available via account-level preview toggle⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable serverless GPU in clean rooms before the November 26, 2026 default rollout by turning on Clean Rooms AI Runtime from the Previews page in the account console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-29

Databricks adds the Unity Gateway Usage Dashboard v1.0 with coding-agent adoption tracking, model and user spend analysis, and tag-based spend attribution⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Databricks now offers the Unity Gateway Usage Dashboard v1.0 for tracking coding-agent adoption, harness usage, and estimated session spend.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The dashboard now supports tag-based spend attribution and expanded model and user spend analysis.

WAF, Bot & API Protection · 2026-10-29

DataDome Node.js module 2.7.0 adds TLS fingerprint collection to enrich bot-detection signals⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• DataDome now collects TLS fingerprints from incoming requests to send richer bot-detection signals to the Bot Protect API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• DataDome now includes the RequestMetadata property in the TypeScript type definitions.

Endpoint Management (UEM/RMM) · 2026-10-29

Secure Access (VPN / SASE / ZTNA) · 2026-10-29

DNSFilter adds unblock request form localization in eight more languages and documents the data export restart API call⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• DNSFilter's block page unblock request form now displays in Italian, Dutch, Portuguese, Russian, Swedish, Czech, Turkish, and Ukrainian when the user's browser is set to one of those languages, joining Spanish, French, and German.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• DNSFilter's API documentation now includes the call to restart a failed Data Export using saved connection settings, so no SIEM credentials are needed to retry.

AI-Powered Offensive Security · 2026-10-29

Dreadnode: Access enriched findings parquet exports with reviewed severity and status, audit trail, ASR, compliance tags, adversarial-ML metrics, and project rollups.

• Pin sessions in Chat or Agents › Sessions from the menu in the Chat sidebar so pinned sessions appear at the top of the list.
• Retry dropped hosted inference streams automatically up to 3 times with exponential backoff (1 s, 2 s, 4 s) on unstable network paths.
• Improves the network-ops capability with a full toolchain now installed on local Docker sandboxes — nmap, smbclient, hashcat, john, impacket, certipy-ad, bloodyAD, and NetExec — and structured findings (hosts, users, credentials, shares, and weaknesses) viewable in Agent Output after network-ops enumeration.

Hacking Hardware · 2026-10-29

ESP32 Marauder adds guided per-AP WiFi attack profiles, FCC module ID display, and Censor setting coverage for Remote ID identifiers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Apply the Censor setting to Remote ID identifiers to mask operator and drone identity data during scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Add guided per-AP WiFi attack profiles to walk through targeted attacks against a selected access point.
• Add FCC module IDs and station AP selection to identify regulatory module details and choose a target AP.

Endpoint Management (UEM/RMM) · 2026-10-29

Fleet adds self-service profiles, one-time Windows enroll secrets, on-demand FileVault key rotation, and a major sweep of MDM, Android, and software-inventory capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Improves configuration profile management: adds name and description fields settable via the UI, the API, or GitOps YAML (deprecating display_name on the batch configuration profiles endpoint in favor of name), and adds a dedicated page for adding and editing configuration profiles — replacing the add and edit modals — with support for upload, paste, and inline editing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new configuration profile capabilities: mark a profile as hidden so it only appears on My device > Controls after the end user turns on the Show hidden profiles toggle, and add self-service configuration profiles for macOS hosts that end users can install from the My device page.
• Add a customizable Windows end-user agreement (EULA) — upload a Markdown file up to 512 KB in Settings > Integrations > MDM > End user license agreement, or set windows_eula in GitOps YAML; Fleet renders it as the terms page during Microsoft Entra and Autopilot enrollment.

Secrets Detection & Management · 2026-10-29

GitGuardian adds Docker Hub public monitoring, a --background scan mode, and a local machine dashboard with Codex and opencode redaction⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Open a cleanup overview with ggshield machine dashboard, which now lands on an Overview page grouping findings by AI agents, repositories, and history and logs.
• Docker Hub incidents now carry publishing account, image, repository, and layer context, and flow through the same notifications, integrations, and agents analysis as GitHub incidents.
• Findings pushed to Wiz now include GitGuardian incident, occurrence, and source IDs in the finding's originalObject field for use in Wiz workflows and the Wiz API.

SAST / SCA / Code Security · 2026-10-29

GitHub Copilot adds Fusion, a multi-model routing and orchestration system with three effort levels available across VS Code, JetBrains, CLI, and the Copilot app⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Select Copilot Fusion in the model picker to let Copilot automatically route and orchestrate which models handle each prompt, choosing from Single (one model), Cascade (draft-then-escalate), or Critique (draft-review-revise) workflows without manual model switching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Choose an effort level — Fusion Standard, Fusion High, or Fusion Max — to control whether Copilot Fusion prioritizes versatile, capable, or the most capable models for a given task.
• Enterprise administrators can independently set each model's effective policy state for Copilot Fusion, disabling a model for Fusion without disabling it for all users, via enterprise and organization model policies.

SAST / SCA / Code Security · 2026-10-29

GitHub Copilot app adds Projects (multi-repo orchestration), computer use for desktop apps, and image generation in chat⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable computer use for desktop app automation by going to Settings > Computer Use and turning on Enable Computer Use; grant Accessibility and Screen Recording permissions on macOS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GitHub Copilot app now supports Projects, a workspace that spans multiple repositories and sessions, coordinating multiple agents in parallel and returning results such as pull requests for review — now in public preview.
• GitHub Copilot Projects now support automations for repeatable tasks, such as triggering a workflow whenever a specific event occurs.

SAST / SCA / Code Security · 2026-10-29

GitHub Enterprise now includes Copilot access for every licensed user, billed against an enterprise budget instead of per-seat AI usage⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GitHub Enterprise now includes Copilot access for every licensed user, replacing separate seat and usage tracking with a single enterprise budget model where AI usage is metered from the first request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Code completion and next edit suggestions remain available even when the enterprise budget is exhausted, while Copilot Chat, Copilot code review, and Copilot in the cloud require available budget.
• Users in an enterprise account without a GitHub Enterprise license get Copilot access through Copilot Standalone at $10 per user per month, with the same features and models as Copilot Enterprise but no monthly AI credits per seat.

SAST / SCA / Code Security · 2026-10-29

GitHub adds a security extension for the Copilot app that surfaces code scanning alerts and lets you explain, fix, or dismiss them without leaving the app⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Install the security extension with copilot plugin install github-security@awesome-copilot in the terminal, or search for github-security in the Copilot app's Customize panel and click Install.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Run /security-review on your current local changes to catch new issues before opening a pull request, with the extension flagging when code has changed since the last review.
• Ask Copilot about alerts in chat using the security extension's tools, governed by your existing tool permission settings.

SAST / SCA / Code Security · 2026-10-29

GitHub adds Copilot Memory, Copilot Dreaming, and cross-repository code search to carry context across agent sessions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Use /research in Copilot to search for exact text, symbols, regex patterns, or natural-language descriptions across multiple repositories without a local clone, narrowing results by repository, path, or language.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GitHub Copilot Memory is now generally available on paid Copilot plans, letting Copilot remember personal preferences and repository conventions across sessions in the Copilot app, Copilot CLI, VS Code, Copilot cloud agent, Copilot code review, Slack, Teams, and GitHub Mobile.
• Copilot Dreaming is now in public preview — opt in through Copilot settings (individuals) or Copilot policies (organizations and enterprises) — letting Copilot reflect on past sessions to update personal memories, propose changes to repository skills and custom instruction files via pull requests, and turn recurring accepted code-review feedback into standing guidance.

SAST / SCA / Code Security · 2026-10-29

GitHub adds shared Copilot Automations so teams can collaboratively build, own, and maintain AI-powered workflows billed to the repository owner⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Create shared Copilot Automations by choosing Shared under Type when creating an automation on github.com, the GitHub Copilot app, or Visual Studio Code — making the workflow visible to all readers and editable by anyone with write access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Shared automations are billed to the organization or user that owns the repository rather than to the creator, and actions are attributed to Copilot rather than an individual user.
• Shared automations belong to the repository and persist if the creator leaves the team, with a change history showing how tools, triggers, and prompts have evolved.

SAST / SCA / Code Security · 2026-10-29

GitHub Copilot in VS Code adds cloud agent sessions, Agent Host, computer use, model comparison, connectors, and an open Agent Host Protocol for custom clients⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the new Agent Host, which isolates Copilot sessions from individual VS Code windows: it powers session continuity across VS Code, the GitHub Copilot app, GitHub Mobile, github.com, Copilot CLI, Slack, and Microsoft Teams DMs; lets you control an agent running on your development machine from GitHub Mobile by starting it with code agent host --github-environment from your project folder; keeps sessions alive after closing a VS Code window or project folder; extends agent sessions to remote machines using VS Code's Remote SSH and dev tunnels from the Agents window so the agent keeps running when you disconnect; and exposes an open Agent Host Protocol (AHP) for building custom clients that share live sessions with VS Code, with client libraries for TypeScript, Rust, Go, Kotlin, and Swift via code agent host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enable computer use so Copilot can interact with desktop apps (clicking controls, editing text) by enabling chat.agentHost.computerUse.enabled in VS Code Settings, restarting VS Code, then running /computer on in a Copilot session.
• Run models and harnesses in parallel in the Agents window, review results side by side, ask a Judge model to recommend a solution, or choose Synthesize to combine ideas — model comparison is in preview.

SAST / SCA / Code Security · 2026-10-29

GitHub Copilot adds image generation and editing from natural language in chat, powered by GPT Image 2.5 Flare⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Generate and edit images using natural language in any Copilot chat session in VS Code, the GitHub Copilot app, or Copilot CLI; results preview inline and save directly to your workspace.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Organization and enterprise owners can turn off image generation by disabling the image generation model using Copilot model policies.
• Opt in to a visible Made with AI watermark on Copilot-generated and edited images; watermarking is off by default.

SAST / SCA / Code Security · 2026-10-29

GitHub Copilot Fusion adds intelligent routing between on-device and cloud models in CLI, the Copilot app, and VS Code⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable local model routing in VS Code by setting chat.copilot.localModel.enabled, then select Standard in Copilot Fusion to let Copilot choose between local and cloud models automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Configure MAI Code 1.1 Flash or Qwen3.8 Flash Next through a local OpenAI-compatible server on Windows, macOS, or Linux for bring-your-own local model routing in Copilot CLI.
• Download and configure MAI Code 1.1 Flash through the Windows ML provider on supported Windows devices via Settings > Model providers, then enable Local model auto routing under Settings > Experiments in the Copilot app.

SAST / SCA / Code Security · 2026-10-29

GitHub adds Agentic Workflows as a generally available Actions extension for automating issue triage, CI analysis, and code changes via natural language definitions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Run agentic workflows on self-hosted Actions Runner Controller runners with Docker-in-Docker support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Get a fuller AI credit spend picture using gh aw forecast, which now includes threat detection credits and monthly ranges and is no longer experimental.
• Add new workflow templates to a repository using gh aw add-wizard.

SAST / SCA / Code Security · 2026-10-29

GitLab adds a Business Logic Security Analyzer powered by Claude Mythos 5.1, plus Orbit context graph and Duo Agent Platform agentic remediation workflows⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GitLab adds a Business Logic Security Analyzer — powered by Anthropic's Claude Mythos 5.1 — that reads whole repositories and incoming merge requests, infers what each endpoint should enforce, and flags missing authorization checks, broken ownership logic, and business logic flaws that pattern-based scanners miss.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GitLab adds Orbit, a live context graph of the software lifecycle that connects findings to the changes that introduced them, the pipelines that shipped them, and the teams who own the fix, enabling exposure questions like reachability and blast radius to be answered across thousands of repositories.
• GitLab Duo Agent Platform now gives each agent a composite identity limited to the permissions it shares with the requesting user, a sandbox destroyed when the task ends, and a full action record, with agents earning more autonomy only as controls at each stage are proven under the GitLab Security Standard.

AI-Powered Offensive Security · 2026-10-29

Hacktron adds folder-based scan scope, Closed finding status, Attestation Letters, and raises the PR review file limit to 500⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Scope a Whitebox pentest to specific folders by picking paths to include or exclude in a checkbox file tree inside the new Scope step of the Whitebox pentest wizard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Mark a single finding as Closed directly from its status menu, keyboard shortcut, or command palette — the same place used to set False Positive.
• Access an Attestation Letters page where Hacktron-issued letters appear with a unique shareable link and a PDF download that auditors can view without logging in.

Endpoint Management (UEM/RMM) · 2026-10-29

Iru adds six new Windows Auto Apps to the endpoint catalog, including Make Me Admin, Netbird, and PowerBI Desktop⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Iru now supports six new Windows Auto Apps — Make Me Admin, Meld, Microsoft PowerBI Desktop, Netbird, PDF-XChange Editor, and Private Internet Access — available to all Iru Endpoint customers via the Library Items catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-10-29

Iru adds a GitHub Copilot Auto App for macOS to its catalog⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Iru adds a GitHub Copilot Auto App for macOS, now available to all customers via the Library Items catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-10-29

Iru adds Remote Shell for root command-line access on managed Macs directly from a detection or device record⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Remote Shell gives you a root command line on a managed Mac, reachable directly from a detection or the device record in the Iru console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Remote Shell stays connected while a Mac is in Partial Isolation, so you can contain a threat and investigate it at the same time.

General Utilities & Libraries · 2026-10-29

Joplin adds a read_notes MCP tool and now returns enclosing section context with search_notes results⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds read_notes MCP tool for reading notes via the Model Context Protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Reduce token consumption when reading notes via MCP with outline and section navigation.
• The search_notes MCP tool now returns the enclosing section alongside each result.

Identity & Access Management · 2026-10-29

JumpCloud adds SIEM integration for Directory Insights, Agent Uninstall Protection, MCP Server for Users, Custom Risk Policies, and a Custom Banned Password List alongside se⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable a SIEM integration in Directory Insights to continuously pull JumpCloud identity events into external SIEM platforms using an existing API key, with support for RAW and OCSF-normalized formats, or run asynchronous historical export jobs covering up to 7-day windows across a 13-month retention lookback, delivered as JSON or CSV files with email notification on completion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Protect against unauthorized agent removal with Agent Uninstall Protection, on by default for devices running JumpCloud agent v2.179.2 or later, requiring a per-device maintenance token to uninstall on macOS, Windows, and Linux; manage it at Device Management > Devices > Settings > Agent Uninstall Protection and use the Disable Agent Uninstall Protection policy to exempt specific devices.
• Automate AI Agent identity management via new REST APIs — Agents API and Agent Groups API — to register, retrieve, update, suspend, activate, and delete agent identities, manage credentials, manage agent groups, and control group memberships and application assignments.

Secure Access (VPN / SASE / ZTNA) · 2026-10-29

Knocknoc adds IPFilter integration, predefined networks, and structured action logging to its agent and orchestration layer⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Knocknoc's agent now integrates with IPFilter to dynamically control network access on the host it runs on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Knocknoc adds predefined networks — named lists of networks defined once and reused across multiple places in configuration.
• Knocknoc now writes a structured log line for every notable action and forwards them to configured destinations.

Secure Access (VPN / SASE / ZTNA) · 2026-10-29

Knocknoc adds Spur and IPinfo threat intelligence, native Splunk, Cribl, and Microsoft Sentinel integrations, and predefined network management in v26.10⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Spur and IPinfo threat intelligence integrations to the Trust Engine to assess connection risk — including residential proxies, commercial VPNs, and Tor exit nodes — after authentication but before network access opens, with support for BYOK (bring-your-own credentials) or Knocknoc-provided options, and sends Knocknoc security and access events directly to Splunk, Splunk Cloud, Cribl, and Microsoft Sentinel without additional log collectors or storage pipelines, supporting multiple simultaneous destinations and a new SIEM integration view showing delivery status and failure details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds predefined networks that can be defined once and reused across access configurations and security policies, with controls to decide whether active access ends immediately or expires naturally when a network range is removed, and lets users select specific network sources rather than opening access to all available sources, where predefined networks are configured to allow this.
• Improves device integrations: generates Palo Alto and Panorama device API keys directly within the Knocknoc setup workflow; processes access changes independently per device so a slow or unreachable firewall no longer holds up grants on healthy devices; adds network-range grant support across MikroTik, SonicWall, Sophos, Cisco Firepower, Azure, Cloudflare, Fortinet, nftables, and ipset; improves batching for F5 and Cloudflare to reduce repetitive device writes during bursts of access activity; and moves pfSense to network-compatible alias types for new configurations while existing configurations continue working.

Container & Image Security · 2026-10-29

Kubescape adds MCP server tools, fleet config file support, graded fleet exit codes, webhook notifications for image scans, and CISA KEV/EPSS in image scan output⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Read fleet settings from a config file with feat(fleet): read fleet settings from a config file⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Add --notify webhook support for image scans with --notify
• Improves MCP server tools: adds an include_identity parameter to analyze_vulnerability_exposure, adds filtering and pagination to list_vulnerabilities_in_manifest, adds control filtering to get_configuration_security_scan_manifest, filters list_controls by framework, paginates list_controls responses, and counts unchanged findings in diff_reports while listing them only on request.

Public Key Infrastructure (PKI) · 2026-10-29

lego adds six new DNS providers — CloudPress, GoDaddy v3, Netcup v1, NordName, PrimeDNS, and Selfhost v2 — plus an experimental conditional DNS builder⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• lego adds a DNS provider for CloudPress to enable ACME dns-01 challenges against CloudPress-managed zones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• lego adds a DNS provider for Netcup v1 for dns-01 challenge automation on Netcup-hosted domains.
• lego adds a DNS provider for NordName for dns-01 challenge automation on NordName-hosted domains.

SAST / SCA / Code Security · 2026-10-29

Mend SAST adds AI-based project risk factors to help prioritize which applications and projects to fix first⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Mend SAST now shows a risk factors column in the Applications and Projects lists, filterable by group or individual risk factor, to help prioritize remediation across projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• An evidence page now lists the code signals behind each risk factor classification, grouped by risk factor and file, so teams can see why a project was classified a certain way.
• A risk factors widget now appears on the project summary page for at-a-glance visibility into each project's risk profile.

Endpoint Management (UEM/RMM) · 2026-10-29

Microsoft Intune now supports unlimited-license assignment for Apple VPP apps from Apple Business Manager and Apple School Manager⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Assign Apple Volume Purchase Program apps with unlimited licenses from Apple Business Manager and Apple School Manager on iOS/iPadOS and macOS, removing the need to track or manage license quantities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-29

Nudge Security: Nudge Security now discovers AI agents your team builds on Notion, available in the AI agent discovery research preview — enable the Notion AI agents⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Nudge Security now blocks sending nudges to deleted, archived, or suspended users and accounts, with the nudge button disabled and a message explaining why delivery is not possible.
• Bulk nudge sends now report which recipients were skipped due to deleted, archived, or suspended status.

Software Supply Chain Security · 2026-10-29

OX Security adds Agent Activity, a runtime tracing and guardrail feature for AI agents now in early access across OX.VibeSec and OX.Cloud⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a LiteLLM connector to bring LLM proxy traffic into OX Security's agent visibility picture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• OX Security now traces each AI agent session step by step — covering prompts and responses, MCP server and tool calls, read/write access permissions, and sensitive data touches — via the new Agent Activity feature in early access on OX.VibeSec and OX.Cloud.
• Build custom runtime guardrails scoped to specific AI models, MCP servers, and skills, with a choice to flag or block violations at a severity you set.

Identity & Access Management · 2026-10-29

Ping Identity adds a remote MCP server for AI-agent access, QR code callbacks in scripted nodes, and multi-alias SAML IdP import⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Ping Identity adds the AIC Remote MCP Server, an opt-in, centrally hosted HTTP-based Model Context Protocol server that lets AI agents and development assistants administer Advanced Identity Cloud via natural-language prompts over OAuth 2.0 authentication — available now in sandbox environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ping Identity adds a callbacksBuilder.qrCodeCallback() binding for scripted nodes, letting them generate QR codes that render in hosted pages or apps built with the Ping SDKs.
• Ping Identity now lets you import multiple remote identity providers sharing the same entity ID by specifying an alias, with uniqueness enforced per circle of trust — aliased providers do not support single logout or Enhanced Client or Proxy (ECP), and hosted service-provider assertion consumer service URLs require a manual cot parameter.

CNAPP · 2026-10-29

Plerion adds exemption support for infrastructure-as-code findings across Terraform, CloudFormation, and other template checks⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exempt infrastructure-as-code findings from all 426 Code Security checks (Terraform, CloudFormation, and other template checks) by choosing Exempt on a finding or adding a name exemption to the code integration's profile — name exemptions scoped to a full repository (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ my-org/infra) or a single file (e.g. my-org/infra/s3.tf) persist across every later scan.

Secure Access (VPN / SASE / ZTNA) · 2026-10-29

Prisma Access 6.2 adds App Security, SASE Resilience and Business Continuity, native IPv6 for remote networks and service connections, and multi-Colo-Connect per region⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Prisma Access 6.2 adds App Security as a new capability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Prisma Access 6.2 adds native IPv6 support for remote networks and service connections managed in Strata Cloud Manager.
• Prisma Access 6.2 now supports multiple Colo-Connects per region via Colo-Connect enhancements.

SAST / SCA / Code Security · 2026-10-29

psalm-plugin-laravel adds Blade template analysis with XSS taint tracking, a blade:annotate command, and per-run plugin option overrides⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable Blade template analysis with <blade /> in psalm.xml or --blade on the command line; reports broken references, wrong types, and TaintedHtml on unescaped {!!⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ !!} output at the template's own file and line.
• Run vendor/bin/psalm-laravel blade:annotate to read view() calls and write matching @var declarations into templates; use --dry-run to preview the diff without writing.
• Override any plugin setting for a single run with psalm-laravel analyze --plugin-option=KEY=VALUE (for example, --plugin-option=experimental=true); the command line wins over psalm.xml.

Patch Management · 2026-10-29

Web Application Security · 2026-10-29

Identity & Access Management · 2026-10-29

RIG Security adds Gatewatch, an endpoint agent that attributes cloud actions to the human or AI agent driving them and blocks policy violations before they reach the cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Gatewatch now distinguishes between a human typing a command and an AI coding agent (such as Claude Code, Cursor, or Copilot) spawning the same command by following the full process tree at the endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Gatewatch evaluates policies in real time at the endpoint — before a request reaches AWS, Kubernetes, or other cloud targets — allowing or blocking actions based on the combination of process, identity, and action.
• Gatewatch covers AI coding agents, CLI agents, and local MCP servers running on an engineer's machine with the engineer's credentials, where borrowed-identity risk originates.

Attack Surface & Exposure Management · 2026-10-29

runZero adds LonTalk protocol support and now lets operators cap AI tool-call limits per turn via environment variables and the API⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Configure AI tool-call limits per turn for self-hosted deployments via the RUNZERO_LLM_MAX_TOOL_CALLS_PER_TURN and RUNZERO_LLM_MAX_TOOL_CALLS_PER_DEEP_TURN environment variables (defaults: 8 and 20), and set per-account or per-organization limits through the AI configuration pages or the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• runZero now supports the LonTalk protocol for asset discovery.
• Improves the search operator across the asset, service, software, and vulnerability inventories: it is now case-insensitive, exact-match searches like domain:=corp.example.com now find assets that have that domain among others, and product:= and domain:= now match assets with no products or no domains.

Detection Engineering · 2026-10-29

sigma-cli adds --policy safe and --policy trusted security profiles with RE2 regex engine, template-variable control, and external-source blocking⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Control rule-processing security with --policy safe (default) or --policy trusted on both the convert and check commands — safe mode uses the RE2 regex engine, disables template variable expansion, and blocks external rule sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Override the regex engine independently with --regex-engine re2 or --regex-engine python regardless of the active policy.
• Enable template variable expansion when needed with --enable-template-vars (emits a security warning) on convert and check.

SAST / SCA / Code Security · 2026-10-29

Software Supply Chain Security · 2026-10-29

Socket schedules the removal of the GET /v0/report/view/{id} endpoint and changes Obfuscated code alert defaults on November 10⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Migrate report view calls from the deprecated GET /v0/report/view/{id} endpoint to GET /v0/orgs/{org_slug}/full-scans/{full_scan_id} before November 20, 2026 — the old endpoint now advertises its retirement in a Sunset response header.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Keep Obfuscated code alerts after November 10 by opening Security Policy and setting Obfuscated code to Warn or Monitor instead of Inherit, or by adding a matching rule on the Policies page — the alert will be removed from the Balanced and Comprehensive preset defaults on that date.

SIEM · 2026-10-29

Splunk Enterprise 8.2 adds Federated Search, Dashboard Studio, durable scheduled reports, and four new JSON eval functions plus the tojson command⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new JSON-structured data capabilities for searches, including the tojson search command, plus four new JSON eval functions — json_array_to_mv, mv_to_json_array, json_append, and json_extend — to convert, append to, and extend JSON-structured data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Splunk Enterprise now uses HTTP compression by default in place of SSL compression, reducing the security vulnerability surface.
• Run Federated Search across multiple Splunk Enterprise and Splunk Cloud Platform deployments from a single interface.

Detection Engineering · 2026-10-29

Software Supply Chain Security · 2026-10-29

StepSecurity Dev Machine Guard adds automatic MSI self-updates, language runtime inventory across all platforms, and five new package ecosystems⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Opt out of automatic MSI self-updates at install time with AUTOUPDATE=0; when enabled, the agent verifies SHA-256 hash, signed checksum, and Authenticode publisher before updating, rolls back automatically on failure, and never retries a bad version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Turn off language runtime scanning by setting enable_runtime_scan to false in the agent configuration or passing --disable-runtime-scan; scanning is on by default.
• Set a custom device_id in the agent's config.json to give a device a stable, admin-controlled identity used by scans, scheduling, hooks, and device policies.

AI/LLM Security · 2026-10-29

Straiker adds a Workday Agent Passport integration to submit independent red-team results and surface verifiable agent Stamps⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Straiker adds an integration with Workday Agent Passport that submits signed Ascend AI red-team assessment results through Workday's partner interfaces, so agents carry verifiable evidence of adversarial testing before customers install them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ascend AI now probes agents against Workday-defined Stamps — including Prompt Injection Resistance — covering attack paths from the OWASP LLM Top 10, the OWASP Agentic Security Initiative, and MITRE ATLAS, with results tied cryptographically to the specific agent version tested.
• Workday Agent Passport now includes an Adversarial Resilience Trust Category, sourced from independent partners such as Straiker, joining six existing categories: Build Integrity, Runtime Safety, Audit Integrity, Data Sovereignty, Delegated Authority & Human Control, and AI Governance.

Security Validation (BAS & Automated Pentest) · 2026-10-29

Stratus Red Team adds an EBS volume cross-account sharing technique to emulate exfiltration via AWS RAM⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds attack technique aws.exfiltration.ec2-share-ebs-volume to emulate EBS volume exfiltration by sharing a volume with an external AWS account via AWS Resource Access Manager (RAM) using the AWSRAMPermissionEBSVolumeCopyAccess managed permission, mapped to MITRE ATT&CK tactic Exfiltration and technique T1578.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-29

Sumo Logic adds JSON Unroll for HTTP log sources, automatically splitting JSON arrays into individual log messages while preserving top-level metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• HTTP log sources now automatically split JSON arrays into individual log messages while preserving top-level metadata.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-10-29

Sysdig Secure adds PHP standalone binary scanning and risk acceptance for non-package components across CLI Scanner, Registry Scanner, and Agentless Host Scanning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extend risk acceptance to every component type in CLI Scanner v1.31.0, so accepted risks now apply to vulnerabilities in standalone binaries and other components that are not packages.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Registry Scanner v0.13.0 now adds standalone binary scanning, identifying applications not installed by a package manager — including PHP compiled from source — so distroless and scratch images can surface new findings after upgrade.
• Registry Scanner v0.13.0 adds license detection for packages in scanned images, available in Technical Preview, under License Classification.

Attack Surface & Exposure Management · 2026-10-29

syzkaller adds http_public_url option to syz-manager and a MaxRetries field to CollectRunsOpts for infra-error back-off⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Configure a public-facing URL for the syz-manager HTTP interface with the new http_public_url option in pkg/mgrconfig.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Limit infra-error retries in CollectRuns with the new MaxRetries field on CollectRunsOpts; exceeding the limit now returns ErrTooManyInfraErrors.
• syzkaller's aflow repro loop now tracks LatestOracleFeedback separately from the cumulative OracleFeedback, so the LLM generator receives only the most recent oracle result.

AI/LLM Security · 2026-10-29

ToolHive adds Windows Claude Desktop credential helper support and TLS for operator-wide Redis defaults⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enable TLS for operator-wide Redis defaults to secure broker connections in Kubernetes deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• ToolHive now adds a credential helper for Windows Claude Desktop, extending client integration to Windows users.
• Re-checks upstream Dynamic Client Registration (DCR) registrations while servers are running, keeping registrations current without restarts.

Digital Forensics & Incident Response · 2026-10-29

Unfurl adds ETag, ChatGPT/OpenAI ID, and Firebase Push ID parsers for deeper URL forensic analysis⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Unfurl now parses ETags found in etag query parameters or quoted header values ("..." or W/"...") and decodes layouts from Apache httpd, nginx, and Node.js, extracting file size, mtime (seconds, milliseconds, or microseconds), inode, and compression suffix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Unfurl now parses ChatGPT and OpenAI IDs embedded in URLs.
• Unfurl now parses Firebase Push IDs embedded in URLs.

Backup & Recovery · 2026-10-29

Veeam Backup & Replication: Adds support for VMware vCenter Server 9.1.1, eliminating the warning that the vCenter Server API version is higher than the tested version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Now removes compromised root CA certificates (Comodo AAA Services root and affected emSign roots) from the trust store of the Veeam Software Appliance and Veeam components.
• Third-party components are updated, including OpenSSL 3.5.8, .NET runtime 10.0.12, PowerShell 7.6.6, and Microsoft Edge WebView2.

SAST / SCA / Code Security · 2026-10-29

Veracode SAST adds C# source code scanning, Java source code scanning, a DryRun Security integration, and Pipeline Scan support for artifacts larger than 200 MB⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the ability to exclude specific Java .jar files and Java classes from static analysis using the veracode.json configuration file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Veracode SAST adds an integration with DryRun Security, surfacing Veracode findings and remediation guidance inside pull request and code review workflows.
• Veracode SAST adds scanning of C# source code (Static Analysis Engine v2026.10) and Java source code, including viewing source on the platform (Static Analysis Engine v2026.04).

SAST / SCA / Code Security · 2026-10-29

Waratek adds AI Phylax, a runtime guardian that enforces immutable security rules to block prompt injection and tool hijacking in Java-based AI agents⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• AI Phylax applies deterministic protection — the same security rule produces the same outcome every time — so security teams get certainty against attacks regardless of phrasing or attack origin, without disrupting legitimate agent behavior.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Hacking Hardware · 2026-10-29

WiFi Pineapple Pager 2.0.0 adds BLE and Classic Bluetooth scanning, native GPS, a rebuilt Virtual Pager with offline WiGLE maps, and a files browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Scan BLE and Classic Bluetooth with blue5, a new scanner with a live results list, device identification from built-in company and service databases, an events-per-second dashboard with audio, and logging to WiGLE and a SQLite blue5.db database tracking up to 25,000 devices in RAM.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Configure gpsd settings — service toggle, serial device, baud rate, and restart — from the new Settings > GPS > Advanced page or via the hak5-commands GPS commands.
• Enable SSH and Virtual Pager access over a Client Mode network (such as a phone hotspot) with the new Client Access setting under Settings > System > Virtual Pager (off by default).

Identity & Access Management · 2026-10-28

1Password SaaS Manager adds budget assignment for people and roles, improved access-level visibility, and AI usage record counts in integration results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds budget assignment for people and application roles, with budget owners able to view budget details and receive AI usage and workflow notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates the application Access tab to show access levels, provisioning methods, and access policies more clearly, with search by name or description, catalog settings view, and unsaved-change warnings.
• Integration results now display the total number of AI usage records imported when AI usage is supported and enabled.

Non-Human & Agent Identity · 2026-10-28

Aembit now issues SPIFFE X.509-SVID certificates and JWT-SVID tokens directly from its control plane, eliminating the need for SPIRE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Issues SPIFFE-compliant X.509-SVID certificates for end-to-end mTLS between workloads via Agent Proxy, CLI, or Aembit Secrets Operator (Kubernetes), with certificates auto-rotating at 80% of their lifetime (15-minute default, configurable) and private keys never persisted to disk.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Issues SPIFFE JWT-SVID tokens for bearer-token authentication behind service meshes such as Istio and Envoy, automatically handling standard claims (sub, iss, aud, exp, iat, jti) and supporting custom claims built from literal values or dynamic workload attributes (Kubernetes namespace, AWS account ID, environment).
• Handles SPIFFE identity attestation, credential issuance, and policy evaluation directly from the Aembit control plane, requiring no SPIRE server, agent, or supporting infrastructure.

UNCATEGORIZED · 2026-10-28

ArmorCode launches Forge, four purpose-built LLMs (Assess, Verify, Decide, Resolve) for exposure management decisions inside Anya Agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces ArmorCode Forge, a family of purpose-built LLMs built on NVIDIA Nemotron, running inside Anya's Model Hub alongside frontier models for targeted exposure management decisions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Forge Assess, which recommends contextual severity using asset, exposure, and business context while preserving the original scanner score.
• Adds Forge Verify, which flags false positives by evaluating component applicability, runtime conditions, and scanner signals — returning an undetermined result when evidence is insufficient.

Identity & Access Management · 2026-10-28

Auth0 adds Agent Mode to CLI, CIMD dynamic registration, Identity Conversion Suite, Application Profiles, and FGA Permissions Index EA⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --agent-mode flag (or AUTH0_AGENT_MODE=true env var) for structured JSON output, prompt-free operation, guaranteed non-zero exit on failure, and stable error code/reason fields (auto-detected for recognized agent clients); auth0 commands --flat (with optional --detailed) for full CLI discovery in a single call; --schema to print the exact JSON payload a command expects (sourced live from the OpenAPI spec) and --data to send a whole payload as one JSON object with local validation before it reaches the API; auth0 docs search for searching Auth0 documentation from the terminal without login; and auth0 agent skills install to install the Auth0 skill into Claude Code, Cursor, or all supported assistants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces CIMD (Client ID Metadata Document) with dynamic registration in Early Access, allowing MCP clients and AI agents to connect to a tenant via just-in-time registration using a metadata URL — no pre-registration required.
• Introduces Application Profiles in Early Access, enabling centralized governance of security settings (refresh token lifetimes, leeway, DPoP, B2B login behavior) across all CIMD-registered applications from a single configuration point in the Auth0 Dashboard under the Applications section.

Firewalls & Network Defense · 2026-10-28

Aviatrix launches Clearance: per-workload outbound and lateral containment with monitor-mode shadow rules and one-action enforcement/backout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Aviatrix Clearance™ to the Aviatrix Containment Platform, introducing Outbound Containment (limiting each workload to outbound destinations it is explicitly cleared for, named by domain rather than network address) and Lateral Containment (restricting workload-to-workload reachability by identity across clouds and Kubernetes/serverless paths not governed by hub-based inspection), enforcing per-workload outbound and lateral communication policy by workload identity and protocol across clouds, down to individual containers, serverless functions, databases, and AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Aviatrix Active Defense™, an autonomous agent layer that models the estate from live traffic, drafts per-application policies with no tagging project or inventory import, proves each policy in monitor mode on real traffic, and keeps policies current as the estate changes.
• Adds Shadow Rule Set monitor mode, which evaluates a new policy alongside the live policy on real traffic and shows exactly which connections would be blocked before any enforcement change is made.

Runtime Security · 2026-10-28

aya-ebpf-macros v0.4.0 adds BTF map pinning by name and pinned-map validation before reuse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports BTF map pinning by name in aya-ebpf, enabling maps to be pinned to the BPF filesystem using their BTF-derived names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Validates pinned maps before reuse in aya, ensuring type and size correctness when attaching to an existing pinned map.

Detection Engineering · 2026-10-28

Beelzebub v3.10.0 adds WordPress 6.9.4 and Ollama service lures to expand honeypot deception coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a WordPress 6.9.4 service lure to emulate a WordPress endpoint and attract attackers targeting the CMS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an Ollama service lure to emulate a locally-hosted LLM API and capture probes targeting exposed Ollama instances.

SAST / SCA / Code Security · 2026-10-28

Black Duck launches Signal Agentic Fix, an AI agent that scans, triages, patches, validates, and submits fixes as PRs at machine speed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Signal Agentic Fix, an AI remediation agent that performs end-to-end vulnerability scan, triage, fix generation, validation, and pull-request submission without human bottlenecks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Agentic Fix for Coding Agents integrates as a companion to tools like Claude Code and GitHub Copilot, letting developers remove defects in existing code and prevent new ones as AI writes code.
• Uses the same deterministic SAST and SCA engines from Polaris, Coverity, and Black Duck SCA for consistent scan results inside the agent workflow.

Web Application Security · 2026-10-28

Burp Suite DAST 2026.10.2 adds ServiceNow ticketing integration and expands API scan coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ServiceNow ticketing integration, enabling security issues found by Burp Suite DAST to be raised directly in ServiceNow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands API scan coverage to detect more issues across API targets.
• Reduces memory usage during scans to improve scan reliability.

Web Application Security · 2026-10-28

caido: Adds Settings > AI > Providers to configure OpenAI, Anthropic, Google Gemini, SpaceXAI, OpenRouter, and Amazon Bedrock from one place with credential testing before⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Generate action in the Workflows page to produce an editable passive, active, or convert Workflow from a plain-language description.
• Adds Intercept > Capture menu (marked Experimental) with three recording modes — All traffic, In-scope only, and Custom rules — plus a Passthrough list under the Custom rules mode so hosts on it pass through Caido without being recorded.
• Adds multi-instance support to Caido Desktop, keeping each connection (local project, remote VPS, second test environment) in its own window simultaneously.

Malware Analysis · 2026-10-28

CAPEv2 extracts multi-tenancy into a self-contained plugin library and adds a lightweight plugin hook registry for MongoDB, SQL, and Elasticsearch filters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds lib/cuckoo/common/hooks.py: a lightweight plugin hook registry exposing register_mongo_filter, register_sql_task_filter, register_es_filter, and register_report_hook, replacing inline tenancy logic with zero-overhead hooks that pass queries through unchanged when no plugin is registered.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Integrates lib/tenancy/ as a self-contained library for multi-tenancy and multi-cloud object storage, extracted from CAPEv2 core into the standalone CAPESandbox/CAPE-tenancy plugin repository.
• Adds Django Group-based sandbox resource entitlement policy in lib/tenancy/resources.py, controlling which VMs, routes, tags, interactive sessions, and timeouts a user may discover in the UI/API and request at task submission time.

Identity & Access Management · 2026-10-28

Castle adds AI agent identification, exposing agent identity via a top-level agent object in the Castle API response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a top-level agent object to the Castle API response with fields name, operator, category, and identified_by (supporting values web_bot_auth, fingerprint, and user_agent).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports category values ai_agent, ai_browser, and browser_automation to distinguish agent types in API responses.
• Identifies named AI agents and browsers — including Meta Muse, OpenAI Dots, Grok Bot, ChatGPT agent, Instinct, and Perplexity Comet — using Web Bot Auth cryptographic signing, fingerprinting, and user-agent string analysis.

Secure Access (VPN / SASE / ZTNA) · 2026-10-28

Cato AI Endpoint launches as a lightweight client to discover, monitor, and block AI apps, coding agents, and MCP servers on every endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Cato AI Endpoint, a lightweight client that secures browser AI, desktop AI apps, and local coding agents (Claude Code, Codex, Cursor) from a single dashboard, coexisting with existing EDR and SSE stacks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Discovers Shadow AI — unapproved AI applications, local agents, MCP servers, and skills installed on endpoints — giving security teams a governed inventory before writing policy.
• Assigns a risk finding with a block, monitor, or allow recommendation to each skill, and badges verified remote MCP servers, enabling teams to prioritize and remediate the riskiest agents before they act.

Attack Surface & Exposure Management · 2026-10-28

Censys Investigator gains an API, letting scripts, SOAR playbooks, and AI agents submit indicators and retrieve full campaign-cluster reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a POST /files endpoint to upload raw HTML/text (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ a vendor blog post) as investigation input, returning a file_id for use in subsequent investigation calls.
• Adds a GET /usage endpoint to check an organisation's remaining weekly investigation allowance and next_expire_time before submitting jobs.
• Exposes the Censys Investigator as a programmable API, accepting up to 100 IPs, domains, or file IDs per job with optional start_time and end_time window parameters, and returning a downloadable archive containing a CenQL cluster query and full infrastructure report.

Internet Services · 2026-10-28

API surface changed: +12 endpoints, 55 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /accounts/{account_id}/firewall/payload_logging/key
• New endpoint DELETE /accounts/{account_id}/realtime/kit/{app_id}/meetings/{meeting_id}/participants/{participant_id}/token

Internet Services · 2026-10-28

Cloudflare adds HTML/Liquid Access page templates, Workflow jurisdictions, three new OpenTelemetry span APIs, and SQL introspection include_attributes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds include_attributes query parameter to the SQL API introspection endpoint (GET https://api.cloudflare.com/client/v4/analytics/sql/introspection), returning discovered attribute keys and their types from the preceding seven days of data in an attributes response field.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds jurisdiction field to workflows bindings in wrangler.toml / wrangler JSON config, supporting values eu, us, and fedramp, so Workflow instances only run and store data within that jurisdiction (requires Wrangler 4.152.0 or above).
• Adds span.spanContext(), span.setStatus(status), and span.updateName(name) methods to custom spans in Workers, aligning with the OpenTelemetry span API and enabling trace/span ID correlation, status export, and dynamic span renaming.

Software Supply Chain Security · 2026-10-28

Cloudsmith adds npm provenance verification, TLS-intercepting proxy support in CLI v1.30.0, Mumbai storage region, and exact usage-limit inputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds TLS-intercepting proxy support to the Cloudsmith CLI v1.30.0, enabling connections through TLS-intercepting proxies without disabling certificate verification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cloudsmith's npm registry now serves npm attestations and signing-key APIs, enabling npm provenance verification through Cloudsmith just as it works against the upstream registry.
• Adds Mumbai as a supported artifact storage region, reducing download latency for users and CI/CD pipelines in India.

General Utilities & Libraries · 2026-10-28

GitHub Copilot inline suggestions now support configurable eagerness: low, medium, and high modes controlling suggestion frequency and edit size.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds configurable eagerness for GitHub Copilot inline suggestions with three modes — low, medium, and high — controlling how proactively Copilot offers suggestions and the size of proposed edits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-28

ConductorOne adds a By users review scope so campaigns start from people, not entitlements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new By users review scope type to access review campaigns, letting reviewers target specific users, user criteria, or a CEL expression instead of selecting individual apps and entitlements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports excluding entitlements and narrowing which accounts and grants are in scope within a By users campaign.
• Extends By users scope to campaign templates, enabling automations to trigger a review of a user's current access on role change or departure.

IDS / IPS · 2026-10-28

CrowdSec v1.8.2 adds WAF rate limiting, custom JS bot fingerprinting, a new cscli bot subcommand, and several new expression helpers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cscli bot subcommand for managing bot detection from the CLI and FlagSubmission() helper to bot detection for marking submission events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SkipProcessing() helper to the WAF for conditionally bypassing rule evaluation and a rate limiting feature enabling request-rate-based blocking at the application layer.
• Adds GetDecisionsSinceCountByScenario expression helper for querying per-scenario decision counts.

Privileged Access Management · 2026-10-28

Idira Agent Identity Security is now GA with Prisma AIRS, adding OAuth 2.1 agent credentials, SPIFFE SVIDs, ZSP for databases, and MCP tool-level access policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Provisions SPIFFE Verifiable Identity Documents (SVIDs) and OAuth 2.1 client credentials for each registered agent, issuing short-lived, time-bound access tokens in place of long-lived shared secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds fine-grained access policies to specific tools on an MCP server, enabling least-privilege and zero standing privilege (ZSP) controls per agent, and delivers ZSP for databases via the Secure Infrastructure Access MCP server, with ZSP for cloud providers listed as coming soon.
• Supports automatic OAuth app registration for MCP servers that implement Dynamic Client Registration (DCR), capturing audit data for tool interactions.

Data Security & DLP · 2026-10-28

SIEM · 2026-10-28

Databricks AI Functions Unity Catalog permissions reach GA, letting metastore admins control access to task-specific AI Functions via the system.ai schema.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables metastore admins to apply Unity Catalog permissions on the system.ai schema to control which task-specific AI Functions users can run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-28

ChatGPT, Codex, Claude, Claude Code, and Cursor can now connect to Databricks MCP servers via default OAuth client IDs — no OAuth app setup required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables ChatGPT, Codex, Claude, Claude Code, and Cursor to connect to Databricks MCP servers (including the Genie One MCP server) using default OAuth client IDs, with no OAuth app creation required from an account admin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-28

Databricks account-level security features (network, encryption, compliance) now auto-available at GA — no manual preview opt-in required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Account-level security features covering network connectivity (private connectivity), network security (ingress/egress controls), encryption, and enhanced security and compliance are now automatically available to all accounts upon General Availability, removing the requirement for account admins to manually enable them on the Previews page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-28

DataDome launches datadome-cloudflare-worker Rust crate, bringing native bot-protection to Cloudflare Workers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the datadome-cloudflare-worker Rust crate for integrating DataDome bot protection natively inside Cloudflare Workers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-28

DataDome Fraud SDK .Net 2.1.0 adds optional eventDate field to set effective event time in payloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds optional eventDate field to the payload to specify the effective event time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-28

API surface changed: +11 endpoints, 13 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /v3/organization/{organization_id}/application/{application_id}/transactions/delete/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new GET /v3/import-jobs/ and GET /v3/import-jobs/active/ endpoints.
• New endpoint GET /v3/organization/bank-verification-pricing/

Public Key Infrastructure (PKI) · 2026-10-28

CertCentral Europe now auto-matches ICA chain key type to CSR key type, with warnings on mismatches for products with ICA selection enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• CertCentral Europe automatically selects an ICA chain whose key type matches the CSR key type when a product's default ICA chain is set to DigiCert default, for products with ICA selection enabled that support both RSA and ECC.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• CertCentral Europe shows a key-type mismatch warning on the request form when a specific ICA chain is selected whose key type differs from the CSR key type, while still allowing order submission with a mixed chain (e.g. ECC certificate with RSA ICA chain).
• The Intermediate chains [Intermediate CA] > [Root CA] menu on the request form lets practitioners select a matching ICA chain or proceed with a mixed chain when a mismatch warning appears.

Container & Image Security · 2026-10-28

AI-Powered Offensive Security · 2026-10-28

Dreadnode adds white-box AI red-teaming attacks, three new jailbreak algorithms, two classifier-evasion attacks, and a deterministic tool_call_attack_landed scorer.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tool_call_attack_landed scorer for agentic red teaming — measures whether an agent emitted a specific attacker-intended tool call (name and arguments), providing a deterministic, judge-free attack success rate signal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds metabreak, jhaystack, and hauntattack jailbreak attack algorithms to the airt SDK — covering chat-template control-token manipulation, long-context attention dilution, and shadow-reasoning framing respectively.
• Adds greedypixel (greedy per-coordinate descent) and rayopt (hard-label boundary search) classifier-evasion attacks to the airt SDK, targeting image classifiers via the evasion harness.

Backup & Recovery · 2026-10-28

Druva Data Resiliency Cloud adds support for protecting OpenStack virtual machines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds protection support for OpenStack virtual machines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-28

Endor Labs launches AURI Fix for Open Source, enabling code-level and config-level mitigations triggered via endorctl fix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds endorctl fix CLI command to trigger AURI Fix remediation workflows directly from the terminal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces application-side code mitigations: AURI can change how an application calls a vulnerable dependency to break the exploit path, typically in fewer than 10 lines, without waiting for an upstream patch.
• Introduces configuration-based mitigations: AURI identifies and sets the specific property or configuration flag that disables a vulnerable code path, re-evaluates the configuration to confirm no path remains, and opens a pull request.

Software Supply Chain Security · 2026-10-28

Endor Labs: Adds endorctl fix CLI command to trigger AURI Fix directly from the command line, applying upgrades, code mitigations, config changes, or dependency patches as⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces AURI Fix for Open Source (private beta), enabling automated remediation of open source vulnerabilities through upgrades, first-party code mitigations, targeted dependency patches, or dependency replacement.
• Adds configuration-based mitigation as a new remediation path — AURI can identify and set the specific config property that eliminates an exploitable path when the vulnerability is gated on a setting.
• Supports policy-based and agentic remediation workflows: the Endor Labs policy engine can open a pull request automatically, or an AURI agent can triage, choose the method, apply the fix, and open the PR for human approval.

WAF, Bot & API Protection · 2026-10-28

Fastly Terraform Provider (beta) 0.2.6 adds automated virtual patching support and a VCL-to-CDN-auto state migration path.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds automated virtual patching support to the ngwafworkspace resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a proof-of-concept state migration path from legacy fastly_service_vcl resources to service_cdn_auto.

WAF, Bot & API Protection · 2026-10-28

Rust SDK 0.13.2 adds VPN/proxy client detection, product enumeration, and between-bytes timeout for shield backends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Request::get_vpn_proxy_data, Request::get_vpn_proxy_*, and RequestHandle::vpn_proxy_* methods to expose metadata for detecting whether a downstream client is residential, a VPN, or a proxy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds fastly::compute_runtime::products to report which products are enabled on the service.
• Supports adding a between-bytes timeout for shield backends.

WAF, Bot & API Protection · 2026-10-28

Next-Gen WAF workspaces gain auto_enable_new_virtual_patches to block new virtual patches automatically without manual enablement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds auto_enable_new_virtual_patches setting to Next-Gen WAF workspaces: when true, virtual patches released after the setting is enabled are automatically activated in block mode, requiring no per-patch manual action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-28

Finite State adds custom license lifecycle management via PATCH /v0/licenses and DELETE /v0/licenses, plus exclusion comment visibility on components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PATCH /v0/licenses and DELETE /v0/licenses (with id as a query parameter) to edit, deprecate, restore, or delete a custom license programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds custom license management to the Settings > Policy > Licenses UI, supporting edit, deprecate, restore, and delete actions with audit trail entries for create, update, and delete.
• Extends GET /api/public/v0/components and the component detail endpoint to return the exclusion comment, the time of exclusion, and the author who excluded the component.

Reverse Engineering · 2026-10-28

Finite State adds scan email notifications with per-scope subscriptions and a new POST /api/public/v0/notifications/subscriptions endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /api/public/v0/notifications/subscriptions endpoint to subscribe to email notifications for every scan in a project programmatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds scan email notifications so the user who started a scan is automatically emailed on scan completion or failure.
• Enables subscription to email notifications at three scopes: a single scan, every scan in a Folder, or every scan in a Project.

General Utilities & Libraries · 2026-10-28

Ghostty 1.4 adds 100% Kitty graphics protocol coverage, Kitty clipboard (OSC 5522), scrollback compression, and a new OpenGL renderer for Linux.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new clipboard capabilities: the Kitty clipboard protocol (OSC 5522) on macOS and GTK, letting terminal programs read and write arbitrary clipboard formats (images, HTML) and select among available formats; paste events via mode 5522 so programs can learn what formats a paste contains, enabling pasted-image acceptance; and a new clipboard-write-limit-bytes configuration (default 64 MiB) that caps the size of a single clipboard write, with over-limit writes failing and leaving the clipboard untouched.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Transparently compresses scrollback that isn't visible, reducing physical memory usage by 70–90% for typical text-heavy history; compression runs only while the terminal is idle and decompresses on demand.
• Raises the default scrollback limit from 10 MB to 50 MB per terminal, made possible by scrollback compression.

Secrets Detection & Management · 2026-10-28

GitGuardian Endpoint Protection gains background scanning, an Overview dashboard, Codex/opencode redaction, and validity checks for 501 secret types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --background flag to ggshield machine scan and ggshield machine report to run scans at low priority using 2–4 threads and one-tenth of normal memory (minimum 512 MB), suited for scheduled MDM jobs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds scan.resources.background.mode: auto to machine_scan.yaml to make background-priority scanning the default for every scan.
• Adds an Overview page to ggshield machine dashboard that lists one row per cleanup area (AI agents, repositories, history and logs) and guides remediation order: overprivileged secrets first, then history leaks, then secrets in daily use.

SAST / SCA / Code Security · 2026-10-28

GitHub Copilot SDK gains server-to-server auth for GitHub Apps, letting agents call Copilot under an org identity without a signed-in user.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds server-to-server authentication (public preview) for GitHub Apps installed on organizations, enabling agents and automated services to call the Copilot SDK using a short-lived installation access token instead of a user's credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a read-only Copilot Requests organization permission for GitHub Apps, scoping what an app can do when authenticating as a workload identity against the Copilot SDK.
• Attributes app-driven Copilot usage to the installing organization — including model policies, budgets, and spending controls — with app traffic identifiable in AI usage CSV reports via the app_client_id field.

SAST / SCA / Code Security · 2026-10-28

GitLab Duo Agent Platform's Flows API (GA in 19.5) lets any external system trigger AI triage flows that open GitLab issues automatically.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the POST /api/v4/ai/duo_workflows/workflows Flows API endpoint (generally available from GitLab 19.5) to trigger custom AI agent flows from any external system via HTTP.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports allow_agent_to_request_user, agent_privileges, and pre_approved_agent_privileges request body fields to control autonomous flow execution and tool permissions without human intervention.
• Custom flows are defined as a single YAML file in flow registry v1 syntax, specifying AgentComponent agents, toolsets (find_files, grep, read_file, list_commits, create_issue), and prompt templates.

Vulnerability Management · 2026-10-28

GSA v28.7.0 adds async report export with activity manager, new GMP ReportExport commands, multi-cron scanner schedules, and anonymized agent bundle downloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ReportExport and ReportsExport GMP commands for exporting reports via the GMP protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds an activity manager UI for tracking async report export jobs.
• Adds support for multiple cron schedules in scanner settings.

Vulnerability Management · 2026-10-28

gvmd v26.43.0 adds Active Directory credential integration with a new GMP verify command, plus agent bundle encryption and OS metadata support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new GMP command to verify AD credentials against an Active Directory integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends the credentials model with a new LDAP/AD credential type.
• Adds build and runtime feature flags for AD integration.

Digital Forensics & Incident Response · 2026-10-28

Hayabusa v4.3.0 adds -Z, --timezone <OFFSET> to six commands and extends unaliased rule-field resolution to EventData and UserData.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -Z, --timezone <OFFSET> to dfir-timeline, search, eid-metrics, logon-summary, log-metrics, and extract-base64 to render output timestamps with a fixed UTC offset in signed +HH:MM or -HH:MM form (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ --timezone "+09:00" or -Z "-01:00"); conflicts with --utc and --iso-8601; filtering, sorting, and histogram bins remain UTC-based.

Security Validation (BAS & Automated Pentest) · 2026-10-28

NodeZero integrates with Palo Alto Networks Cortex XSOAR, pushing high/critical findings as actionable incidents with 1-Click Verify.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a certified NodeZero integration on the Cortex Marketplace that automatically ingests NodeZero high- and critical-severity open findings into Cortex XSOAR as actionable incidents, complete with affected asset data, exploitation evidence, and remediation guidance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables 1-Click Verify from within the remediation workflow to retest eligible findings and confirm whether they remain exploitable after a fix is applied.
• Supports continuous Find-Fix-Verify-Repeat workflows: remediated findings stop returning as open incidents in Cortex XSOAR, while unresolved exploitable weaknesses continue to surface for action.

Endpoint Security (EDR/XDR) · 2026-10-28

Huntress adds Identity Posture Assessment report (PDF + API) and Lookback for 180-day M365 login history analysis on ITDR onboarding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Identity Posture Assessment available via the Huntress API, enabling automated retrieval and integration of M365 tenant posture reports into existing workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Identity Posture Assessment, an on-demand PDF report evaluating Microsoft 365 tenants against the Huntress Identity Security Framework — showing gaps, misconfigurations, severity-ranked next steps, and co-brandable output for client QBRs and onboarding.
• Adds Lookback, which automatically runs Huntress Unwanted Access detections across up to 180 days of Microsoft 365 login history when an eligible tenant onboards to Managed ITDR, surfacing earlier compromises and active threats from day one.

Identity & Access Management · 2026-10-28

iDenfy adds an email delivery log in the dashboard, comment editing on KYB/AML records, and free KYB checks for unverified accounts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an email log in the dashboard showing every platform-sent email with its delivery channel and send status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables comment authors to edit or delete their own comments on KYB companies, AML v3 checks, monitoring records, and risk assessments.
• Deleted comments are no longer returned by the API.

Secrets Detection & Management · 2026-10-28

API surface changed: +10 endpoints, 39 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new Jira app connection endpoints: DELETE /api/v1/app-connections/jira/{connectionId}, GET /api/v1/app-connections/jira, GET /api/v1/app-connections/jira/available, GET /api/v1/app-connections/jira/connection-name/{connectionName}, GET /api/v1/app-connections/jira/{connectionId}, PATCH /api/v1/app-connections/jira/{connectionId}, POST /api/v1/app-connections/jira, and POST /api/v1/app-connections/jira/{connectionId}/rotate-credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /api/v1/projects/{projectId}/memberships/available-users
• New endpoint PATCH /api/v1/agent-vault/sessions/{sessionId}

Secrets Detection & Management · 2026-10-28

Kingfisher adds blast-radius HTML triage viewer, provider_metadata.authorization_evidence.assessment report field, and --aws-region/--gcp-project scope expansion flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --aws-region flag to scan and standalone toon commands to expand AWS discovery beyond the SDK-selected region (accepts up to eight explicit regions; global IAM/S3 resources are inventoried once).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --gcp-project flag to scan and standalone toon commands to expand GCP discovery beyond the home project (CLI accepts up to seven additional projects; each uses its own visible IAM context).
• Adds provider_metadata.authorization_evidence.assessment to structured blast-radius report output, containing schema version, assessment timestamp, capability categories, evidence labels, coverage, resource explanations, recommendations, and notes; capability_risk is separate from the original severity field.

Secrets Detection & Management · 2026-10-28

Kingfisher v2.15.0 adds PDF scanning, JWT construction, Betterleaks v2 rule support, HTTP fallbacks, and versioned blast-radius assessments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --fallbacks CLI flag, http_fallbacks=True Python option, and .http_fallbacks(true) Rust option to enable up to two opt-in HTTP fallback environments for validation and revocation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --max-file-size enforcement (default 256 MB) on Git-history blobs before reading content; disable with --max-file-size 0 or --no-limits.
• Adds jwt_sign function to construct complete RS256 JWTs from JSON claims and PEM keys.

Compliance Automation & Trust Management · 2026-10-28

Email Security · 2026-10-28

Material Security adds OAuth auto-classification GA, blast radius cards, investigation sourcing, and rebuilt ATOR reports⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Auto-classify OAuth apps setting (off by default) that automatically applies the OAuth Agent's recommended classification to new and audited app connections and triggers configured remediations without manual review, adds a Classification State filter and column (values: Suggested or Applied) to the OAuth apps list and CSV exports for tracking auto-classification progress, and adds a new OAuth Agent activity report summarising how apps have been classified, which have been remediated, and which require further investigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Blast radius card on each OAuth app's detail view showing how much sensitive content (files and messages) the app's connected accounts can reach, with links into the Explorer view
• OAuth app investigations now show the web searches and sources the OAuth Agent used to reach its verdict, with every claim linking back to its source

Endpoint Management (UEM/RMM) · 2026-10-28

Munki 7.4.0 adds low-data deferral, optional uninstalls, relaunch arguments, custom button labels, and a new --check-hashes option for makecatalogs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --check-hashes option to makecatalogs to optionally verify installer item hashes at catalog-build time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds RestartActionForUninstall pkginfo key support across managedsoftwareupdate, Managed Software Center, munkiimport, and makepkginfo to specify a restart action specific to uninstalling an item.
• Adds support for deferring large downloads when a low data connection is detected in managedsoftwareupdate and Managed Software Center.

Reconnaissance & OSINT · 2026-10-28

naabu v2.7.0 adds native service fingerprinting, -uP UDP probes, dead host reporting, and faster scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds -sV / -service-version flag for native service version detection using embedded nmap-service-probes, with -sV-fast to probe only port-hinted services, -sV-timeout to control probe timeout, -sV-workers for concurrency, and -sV-probes to supply a custom nmap-service-probes file path.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds -uP / -udp-probes flag to send protocol-specific payloads on UDP scans using nmap-service-probes.
• Adds -show-dead flag to report hosts that did not respond during host discovery (requires host discovery to be enabled).

Identity & Access Management · 2026-10-28

Nudge Security now blocks nudges to deleted, archived, or suspended users, with inline explanations and bulk-skip notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Disables the nudge button with an explanatory message when the target user or account is deleted, archived, or suspended.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Reports skipped recipients when sending bulk nudges to a mix of active and inactive users or accounts.

General Utilities & Libraries · 2026-10-28

Obsidian 1.15.0 adds voice capture with transcription on iOS, PDF export on mobile, new URI/CLI heading commands, and Mermaid via Pele.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds append and prepend URI/CLI commands to add content under a specific heading, with control over line breaks around the added content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces the new Pele library for rendering Mermaid diagrams (compatible with Mermaid 12.1.0 syntax, with theme-matched colors/fonts, responsive sizing, and zoom/pan when scaled down), adds --mermaid-* CSS variables for colors, corner radius, and font weights plus .pele-* classes on diagram elements for custom styling, adds a loadMermaid() / window.mermaid compatibility shim supporting initialize(), render(), parse(), mermaidAPI.getConfig(), and setConfig() (with new code able to use window.pele once loadMermaid() resolves), and adds loadPixi() for loading the PIXI global before the first graph opens.
• Adds closing formatting tokens a cm-formatting-*-end class (e.g. cm-formatting-strong-end) in Live Preview, matching the existing cm-formatting-link-end and cm-formatting-highlight-end.

Non-Human & Agent Identity · 2026-10-28

Okta adds mTLS for OIDC apps, authenticator enrollment sets, Sumo Logic/Cloudflare provisioning, and DBSSO visibility for macOS⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds mTLS client authentication for OIDC apps, issuing access tokens cryptographically bound to a client certificate so stolen tokens cannot be reused without it — eliminating shared client secrets to store, share, or rotate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds authenticator enrollment sets, letting admins define groups of authenticators and require a subset (e.g. two of three) or let end users choose which authenticator to enroll, replacing the flat required/optional/disabled model.
• Adds a Device Bound SSO (DBSSO) card to the device details page for managed macOS devices, showing DBSSO session status per OS-level user account alongside existing Platform SSO and Okta FastPass enrollment status.

SAST / SCA / Code Security · 2026-10-28

Openlayer adds governance lifecycle stages, bias/fairness tests, EU data residency, Gateway routing controls, and 10+ new native integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds evaluationScope: step config field for per-step evaluation of tests on each trace step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds openlayer tests delete CLI command — archives by default, --force permanently deletes.
• Extends openlayer init with Copilot CLI and Gemini CLI support, custom CA bundles, a 'debug with an agent' option, and .openlayerignore for smaller uploads.

SAST / SCA / Code Security · 2026-10-28

OpenQodex 0.16.0 links JUnit 4/5 tests to Java call graphs and separates possible issues from the review verdict.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Links JUnit 4 and JUnit 5 test methods to the Java code they call in the code graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends the Java code graph to read anonymous classes, local classes, and enum constant bodies as first-class definitions, with scoped local-class names and qualified this binding.
• Improves Java interface default-method resolution: zero-parameter defaults are selected from the most specific interface; parameterized methods keep both interface declarations as possible candidates.

Runtime Security · 2026-10-28

OpenSandbox 1.2.0 ships auto-pause/wake, Credential Vault API, OCI registry snapshots, and a diagnostics context endpoint across all five SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds lifecycle.idlePolicy create field (with idleTimeoutSeconds 30–86400, onIdle: pause, wakeOnAccess, and optional activeProbe) to enable auto-pause and wake-on-access for fast sandboxes, with server config moving under [automation.idle_pause] (requiring redis.dsn when the sweeper is enabled), and typed client support with fail-fast validation and a wake-retry contract added to all five SDKs: on a 503 with OpenSandbox-Wake: expired, SDKs retry after Retry-After up to a bounded budget (default 5 attempts / 60 s) and raise a typed wake-timeout exception on exhaustion, with stream-start wake-retry active in JavaScript, Python, and Go.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Credential Vault support for fast sandboxes: a POST|GET|PATCH|DELETE /v1/sandboxes/{id}/credential-vault API with credential values sanitized on every public read and expectedRevision as the cross-replica PATCH backstop, plus a Credential Vault client contract added to all five SDKs that routes vault calls through the server for template-backed sandboxes.
• Adds GET /v1/sandboxes/{sandboxId}/diagnostics/context endpoint returning sandbox ID, lifecycle state, backend type, and backend-defined identifiers for Docker, Kubernetes, and Fast Sandbox without connecting to execd; unsupported extension backends return 501.

AI/LLM Security · 2026-10-28

OpenShell v0.1.6 adds OCSF audit events, sandbox suspend/resume, shared Kubernetes supervisors, and new Helm chart fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openshell sandbox suspend and openshell sandbox resume commands to pause and resume sandboxes on supported compute drivers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds supervisor_topology = "gateway" under [openshell.drivers.kubernetes] to enable an experimental shared supervisor that hosts many sandboxes in one process as a pool that can take over a failed supervisor's sandboxes, with supervisor.replicas to set pool capacity.
• Adds binding_policy setting (values: allowlist or exact) to require a middleware service to provide specific bindings such as request inspection.

Identity & Access Management · 2026-10-28

Passbolt 5.17.0 adds phishing-resistant passkey MFA and extends QuickAccess and Offline Mode to PIN codes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds phishing-resistant passkey MFA to the browser extension⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Confirms permission changes during resource moves in the browser extension
• Improves autofill detection across modern websites in the browser extension

Patch Management · 2026-10-28

SAST / SCA / Code Security · 2026-10-28

Phoenix adds a native DAST Scanner integration for scheduling authenticated web scans and monitoring target status from the platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Phoenix DAST Scanner integration under Integrations > Scanners > WEB section, enabling scheduled web application scanning managed from within Phoenix.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports bearer and JWT token authentication for scan targets via the Auth Token (Bearer) field — cookie, basic, and client-certificate authentication are not currently supported.
• Provides per-target configuration including target URL, start time, time zone, and schedule, with support for multiple targets via + Add New Target.

CNAPP · 2026-10-28

Plerion adds LLMjacking detections, new Azure/GCP checks, and expands access-logging asset coverage across API Gateway, load balancers, VPCs and EKS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PLERION-CLOUDTRAIL-84 (Critical) to detect compromised AWS keys via AWS Health exposed/compromised access key reports, naming the key and IAM user (requires us-east-1 in your CDR regions); PLERION-CLOUDTRAIL-85 (High) to detect deletion of Amazon Bedrock model invocation logging, a LLMjacking cover-track technique; PLERION-AWS-1252 (Low) to check whether CloudTrail logs data events for AWS::BedrockMantle::Project, the endpoint for OpenAI-compatible and Anthropic Messages APIs, via an advanced event selector on a multi-region trail; and PLERION-AZURE-463 (Medium) to detect Azure Function App runtimes past Microsoft's end-of-support date, covering .NET, .NET isolated, Java, Node.js, PowerShell and Python, flagging Python 3.8/3.9, .NET 6, PowerShell 7.2, and Node.js 20 on next scan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Promotes PLERION-GCP-18 (Medium) from a manual recommendation to an active finding: scans Cloud Function runtime and build environment variables for credentials (API keys, access tokens, private keys), naming the variable but never its value.
• Expands the Access logging filter on the Assets page and the matching custom-report field to cover API Gateway (PLERION-AWS-494, PLERION-AWS-799, PLERION-AWS-801), load balancers (PLERION-AWS-791, PLERION-AWS-792, PLERION-AWS-795), VPCs (PLERION-AWS-37) and EKS clusters (PLERION-AWS-107).

Software Supply Chain Security · 2026-10-28

plumber v0.7.16: platform push now carries the GitHub bill of materials in its payload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The platform push command now includes the GitHub bill of materials in its upload payload.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-28

Vulnerability Management · 2026-10-28

Rapid7 Command Platform adds SCIM support for automated user provisioning and deprovisioning via identity providers such as Okta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• SCIM is disabled by default and is configured through Command Platform's SSO settings by a platform administrator.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Continuous Control Monitoring (CCM) · 2026-10-28

RegScale 6.55.0 adds per-change-type CCB routing, AlienVault OTX server override, Python 3.15 support, and per-asset issue creation for scanner syncs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds change.approval_by_type config key and --approval-mode CLI flag to route DevSecOps release/deploy Change records to direct completion, policy approval, or CCB per change type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds otxUrl setting (environment variable REGSCALE_OTX_URL) to point alienvault ingest_pulses at a custom AlienVault OTX server, defaulting to https://otx.alienvault.com.
• Adds REGSCALE_STRICT_EXIT_CODES=1 support for JCAM imports: exits 3 when records could not be imported instead of silently exiting 0.

MCP Servers & Tooling · 2026-10-28

Runlayer 1.40.0 adds rate-limit policies, artifact secret scanning, waterfall agent timelines, voice over iMessage, and GPT-6.1 Terra support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds rate-limit policies letting admins cap tool-call frequency per connector — for example 100 calls per hour per user or 30 calls per minute per session — with Rate limit as a policy action, two rate-limit templates, per-policy badge display, and refused calls logged as Tool Call Rate Limited in the audit log.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Blocks artifact publishing when content contains an obvious API key, access token, or private key, telling the agent to redact and republish.
• Adds Timeline / Waterfall switch to the agent run drawer, charting each tool call as a bar at its real offset from run start with subagent steps nested under their call.

Attack Surface & Exposure Management · 2026-10-28

Software Supply Chain Security · 2026-10-28

sbom-operator 0.48.0 adds global per-pod parent project configuration for Dependency-Track.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds global configuration per pod for parent projects in the Dependency-Track (dtrack) integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Password & Credential Cracking · 2026-10-28

SecLists 2026.2 adds SSH credential, SQLi payload, template engine fuzzing, and Claude-path wordlists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Claude-related paths to quickhits.txt for discovery fuzzing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds LureScope-observed SSH credential list for credential-stuffing and brute-force testing.
• Adds a risk-classified SQLi payload list for structured injection testing.

Software Supply Chain Security · 2026-10-28

Software Supply Chain Security · 2026-10-28

Socket Threat Intel Campaigns page now shows per-org blocked/detected status with drill-down to scans and Firewall events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per-organization campaign impact summaries — Blocked by Socket, Detected in Firewall/SCA, or Not Detected — to every malware campaign on the Threat Intel → Campaigns page, drawn from repository scans and Firewall event traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New Org Impact tab on each campaign shows each affected package and version separately, with the repositories, branches, and first/last-seen dates that link directly to the originating scan report or matching Socket Firewall events.
• Adds Blog and Affected Packages tabs to each campaign detail view, surfacing Socket write-ups and the complete list of affected packages alongside the impact data.

SAST / SCA / Code Security · 2026-10-28

SonarQube Remediation Agent can now propose pull-request fixes for Hunter Agent findings (broken access control, business logic flaws, auth gaps) on SonarQube Cloud and Serve⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for the hunter-agent tag and category tags such as hunter-broken-access-control to filter Hunter Agent findings on the Issues page alongside the Fixable by Agent filter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Each Hunter Agent finding sent to the Remediation Agent generates its own individual pull request (or merge request on GitHub), separate from the grouped-by-rule-key behavior used for rule-based issues.
• Enables CI follow-up for Hunter Agent fix pull requests via GitHub Actions: when CI fails, the agent reads build logs, pushes a corrective commit, and retries up to three times before leaving the PR open.

Software Supply Chain Security · 2026-10-28

StepSecurity adds org-wide AI agent plugin inventory for Claude Code and Codex — on developer machines and in GitHub repos.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a plugin detail panel in Dev Machine Guard listing marketplace source, plugin file origin, per-device installation scope (User, Project, Local, System), version, state, and component breakdown by kind (skills, commands, MCP servers), with Claude Code skill usage counts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Attributes plugin-sourced skills and MCP servers back to their originating plugin on the existing Agent Skills and MCP Servers pages, showing the marketplace and plugin that delivered each component.
• Adds an Agent Plugins page under GitHub > AI Agents that inventories plugin manifests (.claude-plugin/plugin.json for Claude Code, .codex-plugin/plugin.json for Codex) published across your organization's GitHub repositories, identifying the publishing repository, plugin folder path, declared metadata, branch, commit scanned, and which repositories enable the plugin via their settings.

Software Supply Chain Security · 2026-10-28

StepSecurity Dev Machine Guard renames Suspicious Files to Malicious Files and adds dedicated Rules and Findings pages for fleet-wide detection management.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Rules page under Developer Machines listing every malicious-file detection rule with its campaign, indicator groups, and file patterns; supports search by rule name and filter by campaign.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-rule activate/deactivate controls that stop a rule from scanning all enrolled devices and move its findings to a Suppressed state, reversible at any time.
• Adds a Findings page under Developer Machines showing flagged files grouped into New, Resolved, and Suppressed tabs, with device, user, OS, campaign, confidence, and status metadata.

Software Supply Chain Security · 2026-10-28

StepSecurity adds Malicious Files scanning (Beta) for GitHub repos — full history across branches, PRs, and tags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Malicious Files section under GitHub scans that inspects full repository history — every branch, pull request, and tag — for files planted by known supply chain attack campaigns such as Shai-Hulud, GlassWorm, and Miasma.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Rules view showing each detection rule's campaign, severity, revision, and the ordered checks it runs against every file version.
• Adds a Scan Status view showing the most recent scan per repository, including commits and file versions scanned, findings, and last/next scan times.

Email Security · 2026-10-28

Attack Score Flash is now generally available, adding ML-based threat detection to all inbound mail with Malicious, Suspicious, Spam, and Graymail verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Attack Score Flash to all inbound mail, providing Attack Score-like detections that catch messages existing rules may miss, with high-precision Malicious, Suspicious, Spam, and Graymail verdicts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Promotes Potentially Malicious and Spam detections into the core feed, removing the need for custom rules to use them.
• Existing automations triggered on Attack Score verdicts now also act on messages flagged by Attack Score Flash, increasing automated flagged message volume.

Secure Access (VPN / SASE / ZTNA) · 2026-10-28

Tailscale OAuth Apps for Device Provisioning are now generally available via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables creation and management of OAuth Apps for Device Provisioning via the Tailscale API (now GA).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SOAR · 2026-10-28

Tines 44.0.0 adds keyless cloud credentials, fallback AI models, cursor pagination for Record Lists, and new record field types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Removes RECORD_RESULT_SET_TABLE_NAME and RECORDS_MIGRATION_DISABLED configuration keys — both must be removed from your configuration before upgrading to 44.0.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds keyless cloud credentials via workload identity federation.
• Adds fallback models for AI Agent actions so a secondary model is used when the primary is unavailable, adds custom model settings for AI providers, and adds Claude Haiku 5.5 as an available model for AI actions.

Non-Human & Agent Identity · 2026-10-28

Token Security launches Rehearsal, an AI-driven walkthrough that navigates the platform and applies filters on your behalf.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Rehearsal, an AI-driven walkthrough mode accessible via Token AI that accepts plain-language goals, plans a route through the platform, opens pages, sets filters, highlights results, and writes the answer — all in the user's own tab.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Rehearsal supports read-only automation (no secret fields filled, no blocked calls sent) and can be paused at any time by clicking to resume control, then picked up from where it left off.

AI/LLM Security · 2026-10-28

ToolHive v0.58.0 adds opt-in AT+JWT token type for embedded AS access tokens and tightens auth-server lifecycle controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds opt-in at+jwt typ header for embedded Authorization Server access tokens, enabling standards-compliant JWT typing for downstream consumers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Refuses refresh grants whose upstream credential has expired or been revoked, preventing silent use of dead credentials to obtain new tokens.

Endpoint Security (EDR/XDR) · 2026-10-28

Agentless Vulnerability & Threat Detection can now be deployed directly into your AWS VPC via CloudFormation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports deploying Agentless Vulnerability & Threat Detection directly into your AWS Virtual Private Cloud (VPC) via CloudFormation, enabling greater network security control and resource isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Compliance Automation & Trust Management · 2026-10-28

API surface changed: +2 endpoints, 10 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint POST /frameworks/{frameworkId}/reactivate⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint POST /frameworks/{frameworkId}/snooze

Backup & Recovery · 2026-10-28

Veeam Backup & Replication 13.1.2.57 adds VMware vCenter Server 9.1.1 support, Google Cloud Plug-In v8.1, and a 90-day archive-window floor for Veeam Data Cloud Vault.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Bundles Veeam Plug-In for Google Cloud v8.1 in both the Veeam Backup & Replication ISO and the Veeam Software Appliance ISO.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for VMware vCenter Server 9.1.1, eliminating spurious warnings about untested API versions.
• Enforces a minimum 90-day archive window when Veeam Data Cloud Vault Archive is used as the archive tier of a scale-out backup repository, applied consistently across the console, Web UI, and PowerShell.

SAST / SCA / Code Security · 2026-10-28

Veracode adds GitHub Workflow App for org-wide scanning, JetBrains SCA plugin, Identity REST API support, and a slew of integration improvements across 2023.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scanpollinginterval and lifecyclestage as optional parameters to the Azure DevOps Extension Upload and Scan task (lifecyclestage is not supported in YAML).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for the -includenewmodules parameter to the Java API Wrapper.
• Supports proxies via the https_proxy environment variable in the C# API Wrapper 23.5.8.8, accepting host, port, and credentials.

SAST / SCA / Code Security · 2026-10-28

Veracode SAST gains a new COBOL scanner, Pipeline Scan --include module selection, and broad language/framework additions through 2023.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --include parameter to Pipeline Scan to specify top-level modules to include during scanning, with prescan module discovery now shown in results; available in Veracode CLI version 23.4.3-0 and Veracode Docker image version 23.4.3.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a new COBOL scanner for Veracode Static Analysis with advanced pattern recognition and static analysis techniques for more accurate vulnerability detection in COBOL code.
• Adds support for Quarkus (Kubernetes-native Java stack for OpenJDK HotSpot and GraalVM) in static analysis.

SAST / SCA / Code Security · 2026-10-28

Veracode CLI v2.53.0 adds veracode scan static and veracode findings static commands plus a --csharp-source packaging flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces several new commands: veracode scan static for running static scans and reviewing security findings within a Git workflow; veracode findings static for accessing cached static scan findings in the local Veracode directory; veracode package discover for detecting toolchains required to create scannable artifacts; veracode sca for SBOM generation via SCA agent-based scans, publishing results in CycloneDX 1.6 and SPDX 2.3 formats; and auth login for onboarding new users via OAuth2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds several enhancements to veracode package: the --csharp-source flag to package C# source code directly for Static Analysis without compiling it into binaries; the --skip-packagers flag to exclude specific artifacts (such as unsupported SQL) from packaging results without affecting other languages; the --exclude flag to prevent specified Java packages or JAR files from being scanned; the VERACODE_PACKAGE_GOLANG_GENERATE environment variable to enable client-side CGO code generation when packaging Go applications; the SRCLR_MAKE_WINDOWS environment variable to support preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler; the --java-source flag and VERACODE_PACKAGE_JAVA_SOURCE=true environment variable to enable Java source code packaging; support for requirements-dev.txt in Python packaging workflows to include development dependencies; support for the Poetry package management tool for Python autopackaging; automatic inclusion of .yaml, .yml, and .properties files when packaging Java source code; and support for packaging Go v1.24.
• Supports asynchronous Fire-and-Forget (FnF) mode in veracode fix sca, submitting remediation requests for background processing without waiting for fixes or pull requests.

SAST / SCA / Code Security · 2026-10-28

Veracode DAST gains domain-based HTTP basic auth, multi-team target ownership, custom host-to-IP mappings, and open-port scanning in Enterprise mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an optional Domain field when configuring HTTP basic authentication for DAST web application scans, enabling authentication to applications that require domain-based credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for custom host-to-IP address mappings in DAST scans, configurable when DNS lookup is unavailable or not desired.
• Enables assigning multiple teams to a DAST target when creating a web application or API specification, improving collaborative security ownership.

Web Application Security · 2026-10-28

WPScan v4.2.0 adds --max-response-size to cap response reads and improves SARIF aborted-run reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --max-response-size MiB flag to stop reading any response once it exceeds the specified size (default 16 MiB, max 2047, 0 disables the cap), guarding against memory exhaustion on targets serving huge or endless responses.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• SARIF output now reports aborted runs as unsuccessful, with the abort reason recorded in toolExecutionNotifications, so consumers show an aborted scan as a failed analysis instead of a clean run with zero alerts.

AI-Powered Offensive Security · 2026-10-28

xalgorix v4.6.173 adds parser support for DSML-namespaced tool-call markup so model invocations are no longer silently dropped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports DSML-namespaced tool-call markup (<｜DSML｜invoke name="…"> / <｜DSML｜parameter …>) so scans no longer stall at the no tool call stop limit when a model emits DSML-tagged invocations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-10-28

LiteLLM adds abliterated model providers Refuseless and Abliteration, routable via existing gateway config with access controls intact.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds refuseless/ prefix support and REFUSELESS_API_KEY env var to route requests to Refuseless abliterated models (glm-5.3-abliterated, glm-5.3-flash-abliterated, deepseek-v4.1-flash-abliterated) and original-weight models (deepseek-v4.1-flash-fast, minimax-m3.1-flash) through the LiteLLM gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds abliteration/ prefix support and ABLITERATION_API_KEY env var to route requests to Abliteration models (abliterated-model, abliterated-model-large-v2, abliterated-model-large-flash) — with image input supported on Base and Large Flash variants.
• Adds both providers to model_list in config.yaml under litellm_params, keeping existing gateway authentication, budgets, rate limits, and routing policies in place.

AI-Powered Offensive Security · 2026-10-28

LiteLLM adds Day 0 support for GPT-6.1 Terra, routing tool-call requests automatically to OpenAI's Responses API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds openai/gpt-6.1-terra as a supported model in config.yaml under model_list, available on v1.76.0 and above.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Automatically routes /chat/completions requests with tools to /v1/responses when reasoning is enabled for GPT-6.1 Terra.
• Adds POST /reload/model_cost_map endpoint (or UI Reload Price Data under Models + Endpoints) to pull updated pricing without a proxy restart.

Malware Analysis · 2026-10-28

YARA v4.6.0 adds yr_get_version for runtime library version detection and nine new elf.machine constants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds yr_get_version(int* major, int* minor, int* micro) API to report the version of libyara loaded at runtime, allowing any pointer to be NULL and working before yr_initialize.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes nine new elf.machine named constants in the elf module: EM_PARISC (15), EM_SPARC32PLUS (18), EM_S390 (22), EM_MCORE/EM_RCE (39), EM_SH (42), EM_SPARCV9 (43), EM_ARC_COMPACT (93), EM_BPF (247), and EM_LOONGARCH (258), replacing the need to hardcode raw numbers in rules.

AI Security Posture & Discovery · 2026-10-28

Zenity Boundaries gains chained Boundaries and Dogwood-style temporal logic for multi-step AI agent enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds chained Boundaries, letting a Boundary rule reference an earlier Boundary so a Detect match in one step can trigger a hard block on a sensitive tool call in a later step of the same agent session.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends Boundaries with Dogwood-style temporal conditions, enabling policies that reason about the sequence and timing of agent tool calls — such as blocking a GitPush unless tests passed within the last 15 minutes with no subsequent failure.
• Introduces steering as an alternative to blocking, letting a Boundary return guidance to an agent about why an action was stopped and what an acceptable path looks like, so the agent can reroute rather than search for a workaround.

Secure Access (VPN / SASE / ZTNA) · 2026-10-28

Zscaler Cloud Sandbox adds AI Instant Verdict inline blocking, macOS detonation, 200 MB large file support, and API-driven file analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI/ML Detection Source column to Insights Logs for reviewing AI/ML-driven detections and actions inline.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AI Instant Verdict: files scoring 91–100 on the AI/ML threat confidence scale are blocked inline before reaching an endpoint, with ~91% receiving instant benign verdicts and ~9% escalated to full dynamic detonation.
• Adds macOS detonation support for .dmg and .pkg files across both inline and API channels, extending behavioral analysis to Mac fleets.

Identity & Access Management · 2026-10-27

Auth0 launches Identity Conversion Suite in Early Access, bundling Anonymous Sessions and Experiment Center for Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Anonymous Sessions to maintain session context for visitors before they sign up or log in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Experiment Center to A/B test login experiences and review results in metrics dashboards.
• Introduces the Identity Conversion Suite as a paid add-on for Enterprise plans, combining Anonymous Sessions and Experiment Center.

AI/LLM Security · 2026-10-27

Backslash adds a native AI Plugin Inventory with child-component risk scoring, signature verification, and inline host-level guardrails for agentic endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Plugin Inventory (Plugins tab) that discovers every AI plugin installed on developer endpoints — surfacing publisher, source repository, unpacked contents, risk severity, associated agents, and last sync timestamp, fully filterable and sortable — alongside child-component risk scoring that assigns a plugin's overall severity by the highest risk found among its nested scripts, MCP tools, hooks, and rules (preventing a low-risk wrapper from concealing a critical child component), and MCP server and agent-skill mapping that ties every MCP connection and skill to its parent plugin and host agent, surfacing over-permissive tool definitions and untrusted content sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Hooks Inventory that automatically discovers hooks across Claude Code, Codex, Cursor, and Copilot, tracking whether a hook was added by Backslash, a developer, or a third-party plugin, combined with deep code parsing and digital-signature validation for hook files to verify component provenance and detect unauthorized script tampering before execution, while vetting scripts against backdoor and credential-theft threat models.
• Adds local model discovery on macOS and Windows model directories for runtimes such as Ollama, LM Studio, and llama.cpp, governing locally-run models under the same allow/deny controls as remote foundation models.

Post-Exploitation · 2026-10-27

BloodHound v9.9.0 adds CSV export from findings, bulk Priority Zone rule ingestion, graph layout controls, and DCA-migrated post-processing for 20+ AD attack paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds is_null and is_not_null query parameters to API endpoints for null-aware filtering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds extension as a valid scope value for the list queries endpoint, enabling retrieval of extension-based saved queries.
• Adds profiles create endpoint (BED-9573) and profiles update endpoint (BED-9574) to the jobs API.

Malware Analysis · 2026-10-27

CAPEv2 adds a disabled-by-default html_scraper auxiliary option to auxiliary.conf.default with setup instructions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the disabled-by-default html_scraper auxiliary option to auxiliary.conf.default with setup instructions for enabling HTML scraping during analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Attack Surface & Exposure Management · 2026-10-27

Censys adds a fingerprint observation API endpoint, four new Platform fingerprints, and updates four SIEM/SOAR integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new fingerprint observation API endpoint in the Adversary Investigation module to retrieve which TLS certificate chains an IP has presented, on which ports, and when — enabling infrastructure-change spotting and host pivoting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Updates the ServiceNow TISC integration (v1.1.0) to add the option to use the host enrichment API when enriching host assets, and updates the ip and cen-rescan commands in the Palo Alto XSOAR integration (v3.2.3) to include reputation details and network/privacy details from the IPinfo source in human-readable output, plus additional context outputs.
• Adds four new software fingerprints to the Platform — changedetection.io, CLIProxyAPI, MarkLogic Server, and ManageEngine OpManager — and a new ASM risk fingerprint Vulnerable PHP (php2shell) [CVE-2026-109618 / CVE-2026-109619], queryable via risks.name: 'Vulnerable PHP (php2shell) [CVE-2026-109618 / CVE-2026-109619]'.

Container & Image Security · 2026-10-27

Chainguard adds 47 new container images this week, including GitLab EE, Sentry suite, vllm-omni, and gitleaks — many with FIPS variants.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new images across tiers: at the commercial tier, 5 commercial GitLab EE images (commercial-gitlab-geo-logcursor-ee, commercial-gitlab-sidekiq-ee, commercial-gitlab-toolbox-ee, commercial-gitlab-webservice-ee, commercial-gitlab-workhorse-ee) with FIPS variants; at the application tier, 6 Sentry images (sentry, sentry-launchpad, sentry-relay, sentry-taskbroker, sentry-uptime-checker, sentry-vroom) with FIPS variants, plus gitleaks, automq, gke-deploy, aws-elasticache-controller, aws-sns-controller, kubernetes-csi-driver-smb, mpi-operator, snuba, sloth, and symbolicator, each with a FIPS variant, and node-red, supabase-storage-api, and supabase-studio without FIPS variants; and at the ai tier, vllm-omni with a FIPS variant.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-27

Edit files in Unity Catalog volumes directly in the Databricks workspace file editor — no download/upload required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables in-place editing of files stored in Unity Catalog volumes via the workspace file editor, accessible from Catalog Explorer or the schema browser in a notebook or SQL editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-27

OpenAI GPT-6.1 Terra is now available on Unity Gateway via Foundation Model APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds OpenAI GPT-6.1 Terra model access on Unity Gateway via Foundation Model APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-27

Lakeflow Jobs gains GA job-level query performance metrics and an Optimize button that opens Genie Code for query improvement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Optimize button in the Lakeflow Jobs UI that opens Genie Code to surface query performance insights and improvement suggestions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-27

Databricks: Adds job-level query performance metrics and insights to Lakeflow Jobs for supported tasks, enabled by default in compliance security profile workspaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports query profiling for serverless compute, SQL Warehouses, and Lakeflow Pipelines.

SIEM · 2026-10-27

Databricks Lakeflow Connect adds a managed QuickBooks Online connector (Beta) with OAuth and incremental ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a managed QuickBooks connector in Databricks Lakeflow Connect (Beta) to ingest accounting data — accounts, customers, vendors, items, invoices, bills, payments, and journal entries — from QuickBooks Online into Databricks, with OAuth user authorization and incremental ingestion with delete capture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-27

Databricks Lakeflow Connect adds a managed PayPal connector (Beta) for ingesting payments data via OAuth.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a managed PayPal connector (Beta) to Databricks Lakeflow Connect, supporting ingestion of transactions, disputes, invoices, balances, catalog products, and billing plans from PayPal into Databricks via OAuth client credentials with incremental ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-27

DefectDojo 3.4.300 adds a product export API (manifest + NDJSON stream), bulk Jira unlink, location test attribution, and Siemens SSB VulnIDs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a product export API returning a manifest and an NDJSON stream for bulk product data export.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds feat(jira): unlink findings from Jira in bulk edit via the UI and API.
• Adds feat(locations): attributes each location reference to the test that reported it, with a supporting database migration.

Container & Image Security · 2026-10-27

distroless diff tool now fails fast when no image targets are selected, and batches Bazel builds to cut elapsed time by up to 34%.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The diff tool exits with an explicit error when --only <target> matches no image targets in the query file, rather than silently succeeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-10-27

Docker Sandboxes v0.50.0 adds cloud sandbox inspection, configurable kit host mounts, persistent kit volumes, and HTTP query-parameter network rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds sbx --cloud inspect <id|name> to show details for a single cloud sandbox, including published port URLs; supports --format json and --format yaml for scripting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --mount HOST:SANDBOX_PATH flag to sbx create and sbx run for selecting a host directory for a kit-declared host mount; environment files support the same bindings through mounts.
• Adds --query name=value flag (repeatable) to HTTP network rules to require specific query-parameter restrictions.

Software Supply Chain Security · 2026-10-27

Software Supply Chain Security · 2026-10-27

Endor Labs integrates with SpaceXSI Grok Build, adding AURI agent kit, coding agent governance hooks, and package firewall for agentic pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Endor Labs Agent Kit for Grok Build, installable from the marketplace or via /add-plugin endorlabs in the agent chat, bringing AURI remediation agents—AI SAST Remediation and SCA Remediation—into Grok Build sessions: the AI SAST Remediation agent proposes fixes with test plans for critical code flaws and can open a pull request on developer approval, while the SCA Remediation agent queries scan results, checks package usage, and applies upgrades, code changes, or Endor Patches, then rescans to confirm no new vulnerabilities were introduced; Agent Kit workflows can also run outside the IDE in CI or cloud runs through the Grok Build SDK.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Coding Agent Governance hooks that record every MCP tool call, shell command, and file operation and enforce policies before each action runs, with deterministic blocking that does not depend on model judgment.
• Adds Endor Scores to rate each MCP server and skill for trust, mapped to the OWASP Top 10 for LLM Applications.

Software Supply Chain Security · 2026-10-27

WAF, Bot & API Protection · 2026-10-27

Fastly CLI v17.0.0 adds --autoEnableNewVirtualPatches flag to NGWAF workspace commands for Automated Virtual Patching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --autoEnableNewVirtualPatches flag to ngwaf workspace create and ngwaf workspace update for Automated Virtual Patching, and surfaces it in ngwaf workspace get.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-27

Feedly launches Credential Leak Dark Web Agent to monitor exposed corporate email domains across dark web, Telegram, Discord, and data leaks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Credential Leak Dark Web Agent, monitoring up to five email domains per agent (including subsidiaries and acquisitions) across Tor, I2P, ZeroNet, OpenNIC, Telegram, Discord, IRC, FTP, and named data leak collections, checking for new matches every 24 hours.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports exporting the Insights Card credential table as CSV (with passwords, if present) or retrieving findings and Insights Card content — including passwords — through the Feedly API.
• Adds password-policy filtering to hide leaks where no password meets the organization's complexity requirements, reducing noise from non-compliant credentials.

Threat Intelligence · 2026-10-27

Feedly adds a Credential Leak Dark Web Agent to monitor exposed accounts found on the dark web.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Credential Leak Dark Web Agent to monitor for exposed accounts discovered on the dark web.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-27

Finite State Platform adds manual Version pinning and ordering on the Versions page, with new API fields to match.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds previousVersion field to GET /public/v0/versions/{id} to expose the preceding version in the API response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds sort=order query parameter to GET /public/v0/versions to list a Project's Versions in the custom order set on the Versions page (e.g. projectId=<id>&sort=order:desc).
• Adds ability to pin a Version as current on the Versions page, preventing new scans from replacing it, with changes recorded in the Audit trail.

Reverse Engineering · 2026-10-27

Finite State Platform adds Project ownership transfer via new PUT API endpoints and bulk UI controls, with owner filtering on existing GET endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PUT /public/v0/projects/{projectId}/owner to transfer ownership of a single Project to another user in the organization, with optional previousOwnerRole to set the departing owner's role.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds PUT /public/v0/projects/owner for bulk Project ownership transfer, also accepting previousOwnerRole.
• Exposes owner, ownerId, and ownerDeactivated fields on GET /public/v0/projects, GET /public/v0/projects/{projectId}, and GET /public/v0/folders/{folderId}/projects, with filter and sort by owner.

Reverse Engineering · 2026-10-27

Finite State Platform adds an All versions tab to the Projects page for org-wide version discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an All versions tab on the Projects page (positioned between All projects and Folders) listing every visible version across the organization, sorted newest first, with search to filter by project and row-click to open a version directly — archived project versions are excluded.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-27

Finite State adds subfolder project listing, deprecated SPDX license support, and dependency version editing via API and UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds includeSubfolders=true query parameter on GET /public/v0/folders/{folderId}/projects to return projects in a folder and all its subfolders in a single request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds includeSubfolderProjectCount=true query parameter on GET /public/v0/folders and GET /public/v0/folders/{folderId} to include each folder's project count across subfolders.
• Includes deprecated SPDX licenses in GET /public/v0/licenses by default (listed after current licenses); adds filter=false to exclude them.

SAST / SCA / Code Security · 2026-10-27

GitHub Copilot assisted permissions reach GA, letting an LLM auto-approve safe commands across CLI, app, and VS Code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Assisted permission mode in GitHub Copilot CLI via /permissions command — select assisted to let an LLM auto-approve clearly safe commands, file-system access, and URL opens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Assisted permissions mode in the GitHub Copilot app via Tool permissions in the mode picker.
• Adds Assisted permissions mode in Visual Studio Code via the permissions picker.

SAST / SCA / Code Security · 2026-10-27

GPT-6.1 Terra is now generally available in GitHub Copilot for agentic coding and terminal work across all major IDEs and platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GPT-6.1 Terra model selection in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, github.com, GitHub Mobile (iOS and Android), JetBrains IDEs, Xcode, and Eclipse.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Copilot Enterprise and Business administrators can manage access to GPT-6.1 Terra via the model policy in Copilot settings, with new models auto-enabled by default unless the global default is turned off or the model is explicitly disabled.

Reverse Engineering · 2026-10-27

ILSpy v11.2 ships native AOT ilspycmd packages for linux-x64/win-x64, cross-platform PDB dumping, and a new Options search box.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --type and --member selection support to ilspycmd -il (IL disassembly now respects the same filtering flags as decompilation).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds cross-platform PDB dumping to ilspycmd.
• Adds opt-in native AOT packages for ilspycmd targeting linux-x64 and win-x64, reducing per-call startup from ~1.8 s to ~315 ms (4–7× faster) for use cases like agent loops that spawn ilspycmd per query.

Secrets Detection & Management · 2026-10-27

Infisical v0.167.4 makes batched secret changes always-on in Secrets Overview and moves the quick-add row to the top of the table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables batched secret changes as always-on behavior in the Secrets Overview, removing the need to opt in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Moves the quick-add row to the top of the Secrets Overview table for faster secret entry.

Secrets Detection & Management · 2026-10-27

Infisical v0.167.3 adds a batch commit API, bulk secret-approval reviews, PAM auto-approvals, and Cloudflare variable-type selection for syncs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a private v2 batch commit API route (/api/v2/…) for atomically committing batched secret and folder changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds bulk review of change requests in secret approvals, letting reviewers approve or reject multiple requests at once.
• Adds auto-approvals for PAM (Privileged Access Management) workflows.

Reconnaissance & OSINT · 2026-10-27

Instaloader v4.16 adds a progress counter to the Retrieving highlights log line.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a progress counter to the Retrieving highlights log line for better visibility into highlight retrieval progress.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Management (UEM/RMM) · 2026-10-27

Endpoint Management (UEM/RMM) · 2026-10-27

Secrets Detection & Management · 2026-10-27

OpenBao v2.7.2 adds SSH wildcard-identity control via allow_wildcards_in_identity_templates and PKI external-key UI fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds allow_wildcards_in_identity_templates parameter to secrets/ssh to control whether wildcards (*) are permitted in SSH certificate identity templating (denied by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds UI fields to configure external keys in PKI.

Vulnerability Management · 2026-10-27

oxo v2.20.0 adds oxo auth logout to revoke local tokens and routes OpenRouter models through regional endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds oxo auth logout subcommand to delete the locally stored authorization token.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Routes OpenRouter models through regional endpoints for improved availability.

CNAPP · 2026-10-27

Plerion now inventories Amazon ECS cluster settings — KMS keys, Fargate ephemeral storage, and ECS Exec config — enabling custom checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Collects Amazon ECS cluster configuration in inventory, including KMS keys for managed storage and Fargate ephemeral storage, ECS Exec settings, and its associated KMS key and logging, surfaced as fields on each cluster asset after the next scan so custom checks can query them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Cloud Security Posture · 2026-10-27

Prowler 5.46.0 adds an Issues page, GCP Vertex AI Workbench checks, new AWS Bedrock/Cognito/WAFv2 checks, PHP runtime coverage, and edition-aware Google Workspace findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bedrock_guardrail_sensitive_information_filter_enforced, which flags Bedrock guardrails whose PII entities or custom regexes take no action on the output path, and bedrock_model_invocation_logging_text_data_enabled, which verifies that model invocation logging delivers prompt and response text instead of only naming a destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds cognito_user_pool_account_recovery_sms_not_preferred check, which verifies that Cognito user pools do not rank SMS first for account recovery.
• Adds wafv2_webacl_managed_rule_groups_enabled check, which verifies that WAFv2 Web ACLs reference at least one managed rule group.

CNAPP · 2026-10-27

InsightCloudSec 26.10.27 adds a Lifecycle Management page, Compliance Scorecard tag export, and BotFactory API updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Lifecycle Management page for tracking and managing deprecated components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds tag export options to the Compliance Scorecard.
• Updates the BotFactory API with new capabilities.

Reverse Engineering · 2026-10-27

refinery 0.11.3 adds six new units (dau3, xtwim, xtiex, dns, huffman, batev, batfs) and breaks several meta variable names and command names⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dau3 script deobfuscator for AutoIt3 scripts, xtwim unit for unpacking WIM archives, xtiex unit for unpacking IExpress setup files, dns unit for parsing DNS packets from PCAPs (used with the pcap and udp units), huffman unit as a low-level option to directly handle huffman-compressed data, batev unit to extract environment variables set during a batch emulation, and batfs unit to extract file system artifacts from batch emulation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Renames script deobfuscator commands (js becomes djs, ps1 becomes dps1, vba becomes dvba, php becomes dphp) to remove shadowing of real script interpreters, and improves deobfuscation quality and speed in both djs and dps1.
• Every unit that reports a start meta variable now also reports the matching end offset.

MCP Servers & Tooling · 2026-10-27

Runlayer 1.39.0 adds hosting-type filtering for connectors, cookie masking in approvals, federated agent server scoping, and a 36 MiB MCP request size cap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Hosting filter on the Connectors page to narrow connectors by type: Local, Remote, or Runlayer Deploy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Applies cookie masking in approval requests across the web app, Slack, and Microsoft Teams for every cookie field, including fields such as auth_cookie and session_cookie.
• Enforces server scoping for federated agent accounts (those signed in through an identity provider): tokens are restricted to the servers they were issued for, the setting shows as on and locked, and existing API keys on those accounts are refused.

MCP Servers & Tooling · 2026-10-27

Runlayer 1.38.0 adds runlayer_agent_trigger in Terraform and exposes MCP resources/templates/list through the gateway.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds runlayer_agent_trigger Terraform resource to manage an agent's event and poll triggers as code; changing trigger_type, event_key, or account_id replaces the trigger (requires agent triggers enabled for the organization).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes MCP resources/templates/list through the Runlayer gateway so clients can list a connector's resource templates from upstream servers.
• Admins can now delete a connector directly from the ⋯ menu on its connector page, not only from Manage connectors.

SAST / SCA / Code Security · 2026-10-27

Semgrep adds Anthropic direct connection, PowerShell support in Guardian, new dashboard filters, and a related-issues API endpoint.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds experimental GET /api/deployments/{deployment_id}/issues/{issue_id}/related-issues endpoint that returns a finding's related issues; the existing relatedIssues field on finding responses is now deprecated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds direct Anthropic connection support in Semgrep Multimodal AI settings via Manual mode, used for in-app features such as Autotriage and Autofix.
• Adds a Finding type filter to dashboards, enabling separate views of AI-powered and Rule-based Semgrep Code findings in charts, drilldowns, and PDF exports.

AI-Powered Offensive Security · 2026-10-27

Shannon v3.5.0 adds an experimental --exp-php2shell upgrade-verification probe to the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds experimental --exp-php2shell upgrade-verification probe flag to the CLI for testing PHP-to-shell attack paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-27

StepSecurity Secure Registry gains two new beta pages — Inventory and Statistics — for package visibility and request analytics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Secure Registry Inventory page listing every package requested through Secure Registry with its last pulled version, request counts, licenses, and known vulnerabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports package search in Inventory by package name, SPDX license identifier, or advisory ID/alias to surface affected versions.
• Adds filtering in Inventory by ecosystem, vulnerability severity, minimum CVSS score, version, and license status.

Attack Surface & Exposure Management · 2026-10-27

Detection Engineering · 2026-10-27

Tenzir v6.20.0 adds a new heterogeneous-list data model, ai_decide typed decisions, secrets in function args, DuckDB/ClickHouse/Hydrolix integrations, and encryption functi⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ai_decide operator with typed decisions and a new Decisions endpoint, plus Cloudflare Workers AI and OpenAI backends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the type_kind function to inspect a value's type, Luhn check digit and CRC-32 checksum functions, OCSF functions, and functions for record conversion to key-value entries and record values as a list.
• Adds encryption functions and Parquet encryption with a shared AES key.

Reconnaissance & OSINT · 2026-10-27

tookie-osint v4.2.2.3 adds --tor flag for Tor-routed username scans⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --tor flag to route scans through the Tor network for anonymised username lookups⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-10-27

ToolHive v0.57.0 adds backend-scoped vMCP authorization, authorization_details token exchange, workload auth secret mounting, and OIDC transport wiring for thv run.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dcrConfig.registrationProbe with an authorization-endpoint strategy for dynamic client registration probing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports authorization_details on token exchange requests, enabling fine-grained OAuth 2.0 Rich Authorization Requests (RAR) in vMCP token flows.
• Wires OIDC transport flags into thv run auth middleware config, allowing OIDC settings to be passed directly at server launch.

Endpoint Security (EDR/XDR) · 2026-10-27

Trend Vision One AI Scanner streams partial results mid-scan with partial-upload: true and configurable partial-frequency on the visionone output destination.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds partial-upload: true to the visionone output destination config to enable partial result uploads while an AI scan is still running.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds partial-frequency: <int> to the visionone output destination config to control how often partial results are sent, as a completion-percentage threshold (defaults to 25%).
• The TrendAI Artifact Scanner interactive configuration wizard exposes the partial-upload option when configuring outputs.

Endpoint Security (EDR/XDR) · 2026-10-27

Support Settings splits remote support into granular proactive-access and diagnostics controls with Automatic or Manual approval per task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds granular remote support controls under Administration → Support Settings, separating access into Proactive service console access (read-only access for customer success advisors, solution engineers, incident response, and threat researchers) and Troubleshooting and diagnostics (technical support console access, diagnostic package collection, and remediation utility deployment).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Automatic or Manual approval mode selectable per remote support task, giving administrators fine-grained control over each access type.
• Enables TrendAI™ remote support as a master toggle before individual access types can be granted.

AI/LLM Security · 2026-10-27

vArmor v0.10.6 adds Network Allowlist Advisor, Automated Diagnosis, and Automated Policy Optimization for EnhanceProtect policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Network Allowlist Advisor to build and validate NetworkProxy egress allowlists from live application traffic, with a user-review step before enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Automated Diagnosis for read-only troubleshooting of policies, Pod injection, node enforcement, and NetworkProxy.
• Adds Automated Policy Optimization to refine EnhanceProtect policies through violation-log analysis and user-approved rule removal.

Web Application Security · 2026-10-26

Burp Suite 2026.10.1 lets you send requests and responses to Burp AT from more Burp tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables sending requests and responses to Burp AT from more Burp tools, making it easier to bring manual testing evidence into a task.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Web Application Security · 2026-10-26

Caido v0.59.0 adds AI-generated workflows, cURL import in Replay, TLS pass-through, and multi-instance desktop support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds AI workflow generation from natural-language prompts, with support for AWS Bedrock and OpenAI OAuth flow for personal subscriptions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds cURL import in Replay, letting practitioners create requests directly from copied cURL commands.
• Adds TLS pass-through in Traffic Control, enabling raw TLS traffic to bypass interception.

Identity & Access Management · 2026-10-26

API surface changed: +3 endpoints, 18 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /directories/{directory_id}/groups/{group_id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /directories/{directory_id}/groups/{group_id}/members
• New endpoint POST /users/{user_id}/merge

General Utilities & Libraries · 2026-10-26

API surface changed: 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GET /unlocks: param ip (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-26

Google SecOps gains agentic case reports, action executor, AI billing settings, and search session results APIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /v1alpha/{parent}/actionExecutor:fetchActionDetails and GET /v1alpha/{parent}/actionExecutor:fetchActions endpoints under v1alpha.projects.locations.instances.actionExecutor to fetch detailed descriptions and parameter schemas for specific actions on a SIEM alert.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds getAiBillingSettings and PATCH /v1alpha/{aiBillingSettings.name} (updateAiBillingSettings) endpoints to read and update AI billing settings for an instance.
• Adds full CRUD API under v1alpha.projects.locations.instances.agenticCaseReportTemplates — POST, GET, PATCH, and delete — to create, list, retrieve, update, and delete agentic case report templates.

Threat Intelligence · 2026-10-26

API surface changed: +26 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new endpoints DELETE /surveillance/components/{id}, PATCH /surveillance/components/{id}, and POST /surveillance/sources/{id}/components for managing surveillance components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds new endpoints DELETE /surveillance/sources/{id}, GET /surveillance/sources, GET /surveillance/sources/{id}, PATCH /surveillance/sources/{id}, POST /surveillance/sources, and POST /surveillance/sources/{id}/refresh for managing surveillance sources.
• Adds new endpoints GET /cve/exploited, GET /cve/{id}/affected, GET /cve/{id}/indicators, GET /edl/cve/{id}, and GET /edl/exploited-cves for CVE exploitation and indicator intelligence.

Identity & Access Management · 2026-10-26

JumpCloud adds SIEM integration with OCSF/RAW formats, Agent Uninstall Protection, Custom Risk Policies, MCP Server for Users, and more in 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SIEM Integration in Directory Insights supporting continuous API pull ingestion using an existing API key in RAW or OCSF-normalized formats, plus asynchronous historical export jobs for up to 7-day windows across a 13-month retention lookback delivered as JSON or CSV files with email notification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Agent Uninstall Protection, enabled by default for all devices running JumpCloud agent v2.179.2 or later on macOS, Windows, and Linux, requiring a per-device maintenance token to uninstall (tokens rotate 60 minutes after being viewed, with Directory Insights logging failed uninstall attempts, successful uninstalls, and exemption policy changes), plus a Disable Agent Uninstall Protection policy to exempt specific devices during maintenance, troubleshooting, or imaging.
• Adds REST APIs for AI Agent and Agent Group management — Agents API and Agent Groups API — enabling programmatic registration, credential management, group membership, and application assignment.

Pentest Distributions · 2026-10-26

Kali 2026.3 refreshes build-scripts with container support, adds 6 new tools, updates KDE Plasma to 6.7, and expands NetHunter with WearHunter, NFC Arsenal, and KernelSU.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds build-in-container.sh to each refreshed build-script, auto-detecting Docker or Podman to build Kali images inside a container without installing dependencies on the host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --hostname, --packages, --branch, --variant, and --arch flags to build.sh for customizing Kali installer images at build time.
• Adds dalfox (XSS scanner), katana (crawling/spidering framework), qsreplace (query-string value replacer), rustscan (modern port scanner), sdrangel (Qt-based SDR front-end), and snaffler-ng (SMB share credential and sensitive data scanner) to the Kali network repositories.

AI/LLM Security · 2026-10-26

AI Runtime Defense & Guardrails · 2026-10-26

Lakera Analytics page gains a request latency percentiles chart showing p25, p50, p75, and p95 Guard API latency over time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a request latency percentiles chart to the Analytics page, plotting p25, p50 (median), p75, and p95 latency of Guard API requests over time, with hover-to-inspect and per-percentile show/hide controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

UNCATEGORIZED · 2026-10-26

Lumia adds Claude Compliance API integration for visibility into Claude Enterprise conversations, file uploads, and agent activity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for Anthropic's Claude Compliance API, connecting Claude Enterprise to the Lumia platform without network infrastructure changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables monitoring of Claude conversations, file uploads, and activity from tools such as Claude Code and Cowork through the Lumia AI Control Plane.
• Supports inline deployment alongside the Compliance API integration for real-time policy enforcement, blocking, redaction, and contextual user guidance.

Digital Forensics & Incident Response · 2026-10-26

MVT v2026.10.26 adds Python 3.15 support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Python 3.15 support, extending the supported runtime range alongside Python 3.10–3.14.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-26

OpenQodex 0.15.0 adds Java code-graph support, parsing types, methods, constructors, imports, and call chains with no build step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Java support to the code graph: reads types, methods, constructors, imports, static imports, and calls with no build step required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Names callers of changed Java code in review output, each annotated with its tier.

SAST / SCA / Code Security · 2026-10-26

OpenTaint analyzer adds the $* star operator and more precise passthrough models for taint tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the $* star operator for use in taint rules (#340).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Makes passthrough models more precise (#315).

CNAPP · 2026-10-26

Plerion adds package-based asset search with version range filtering to answer 'do we run this, and where?' across your inventory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Find by package search on the Assets page to locate every asset running a given package, with version range filtering (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ >= 2.0, < 2.15.0) and results showing exact version, environment, owner, and exposure per asset.
• Every package on an asset's SBOM tab now links directly to the Find by package view for that package.

Cloud Security Posture · 2026-10-26

Plexicus v1.2.42 ships a next-gen AI pentest scanning engine, a live War Room, and richer certification question types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Upgrades the AI Pentest feature to a next-generation scanning engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a live Pentest War Room for real-time collaboration during active pentests.
• Adds richer question types and lifecycle management to certifications.

Cloud Security Posture · 2026-10-26

Plexicus v1.2.43 ships a reworked AI Pentest Wizard, a live War-Room board, per-node PlexiFlow automation testing, and repo-centric asset views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Reworks the AI Pentest Wizard with an updated guided experience for penetration testing workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces per-node automation testing with data mapping via PlexiFlow.
• Adds repo-centric asset views for browsing findings and assets organized by repository.

Cloud Security Posture · 2026-10-26

Plexicus v1.2.71 adds a Scan Modules settings page, a full role permission matrix, and unified compliance controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Scan Modules settings page that replaces the old connector catalog for managing scan integrations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces a full View/Edit/Manage role permission matrix for granular access control across the platform.
• Unifies compliance controls into a single location for centralized policy management.

Vulnerability Management · 2026-10-26

Software Supply Chain Security · 2026-10-26

API surface changed: +3 endpoints, 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint PATCH /api/v1/advisories/{advisory_id}/products/{product_id}/status⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint PATCH /api/v1/advisories/{advisory_id}/statuses/{status_id}
• New endpoint POST /api/v1/advisories/{advisory_id}/products

Attack Surface & Exposure Management · 2026-10-26

syzkaller adds AI root cause analysis in bug reports and GCE image auto-deletion with reuse for unchanged local images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds auto_delete GCE image lifecycle management via the gce.LabelAutoDelete and gce.LabelLastActive labels, enabling external jobs (e.g., an Argo CronWorkflow in syz-cluster) to delete stale images older than gce.StaleImageAge; requires gce_image to be empty in the VM config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Reuses an existing GCE image when the local image file is unchanged, avoiding redundant image uploads.
• Includes AI-generated root cause analysis summaries in dashboard bug report emails.

SAST / SCA / Code Security · 2026-10-26

EASM gains KEV-flagged risk scoring, GDPR/NIS2/DORA compliance evidence collection, and real-time scan notifications.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Validates components against the EASM knowledge base so risk scores reflect real vulnerabilities per version, not just software age.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Collects compliance evidence for cookie consent tracking, third-party data flows, destination countries, and privacy, legal, and copyright documentation to support GDPR, NIS2, and DORA assessments.
• Delivers real-time in-app notifications when scans complete, fail, or are cancelled.

Digital Forensics & Incident Response · 2026-10-25

ALEAPP v2026.4.4 adds Yandex Disk, Google Pay, DJI flight records, Discord Servers, SHA-256 staging hashes, LVM2/LUKS/RAID raw image support, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --hash flag (and a matching GUI checkbox) to record SHA-256 hashes for staged files, capturing container-recorded timestamps from ZIP NTFS/extended timestamp fields, tar headers (GNU, PAX), L01/AD1 entries, FAT/exFAT entries, and ext/APFS/HFS+ times.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends -t raw acquisition reading: qnxprobe advances from 1.58 to 1.76 and ewfprobe to 0.15.0, adding LVM2 logical volumes (split, striped, RAID1), LUKS containers opened with a passphrase, RAID member images read together, and FAT12/FAT16 filesystems.
• Raw image input now offers free space, flash filesystem deleted files, and NTFS directory indexes to artifacts that request them.

UNCATEGORIZED · 2026-10-25

Arcade Plugin lets agents call 1K+ tools via a single gateway in Claude, Cursor, VS Code, Copilot CLI, and Codex — no MCP config needed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Arcade Plugin, installable in Claude Code, Claude Desktop, Cursor, VS Code, GitHub Copilot CLI, and Codex, connecting agents to a single shared Arcade gateway without MCP gateway configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Tool Recommendation capability that keeps a catalog of over 1K agent-optimized tools out of the model context window, enabling one gateway to serve all users dynamically.
• Ships Skills and lifecycle hooks inside the plugin that teach agents when to invoke Arcade tools and how to authorize services like Gmail or Slack from inside the agent client.

Identity & Access Management · 2026-10-25

Auth0 adds CIMD manual pre-registration and dynamic registration (Early Access) plus Application Profiles for AI agent identity at scale.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CIMD with manual pre-registration, letting administrators submit a client metadata URL to Auth0, which retrieves and validates the metadata before creating the client after admin approval.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds CIMD with dynamic registration (Early Access), enabling just-in-time client discovery and registration during an OAuth authorization flow using a client ID metadata URL — without requiring admin pre-registration of every client.
• Adds Application Profiles (Early Access) for centrally managing security and authorization settings — including refresh token policies, Demonstrating Proof of Possession (DPoP), and Organizations — across dynamically registered CIMD clients.

Identity & Access Management · 2026-10-25

Auth0 launches the b2b-saas-starter Terraform module on the Terraform Registry, packaging a full B2B identity foundation into a single module block.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the b2b-saas-starter Terraform module (auth0/modules/auth0//modules/b2b-saas-starter), available on the Terraform Registry, that provisions a complete B2B SaaS identity foundation — app client, API, RBAC, MFA, attack protection, and branding — from a single module block.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds roles and permissions map inputs to the module so role and permission definitions can be declared as plain data, with pre-apply validation that catches references to undeclared roles before any Auth0 resources change.
• Adds an organizations input that creates Auth0 Organizations with per-customer enterprise SSO connections, supporting type = "samlp" (SAML) and type = "oidc" (OIDC), domain_aliases, sign_in_endpoint, and signing_cert.

Container & Image Security · 2026-10-25

API surface changed: +6 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /argos/v1/partners/{partnerId}/capabilities⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /argos/v1/mitigation-methods
• New endpoint GET /argos/v1/partners/{partnerId}/capabilities

Hacking Hardware · 2026-10-25

ChameleonUltra v2.3.0 adds SEOS emulation, MIFARE Ultralight C auth/emulation, Farpointe Pyramid support, and DC-block FSK demod for HID/ioProx.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds hf 14a sniff parity checks to flag malformed frames during ISO 14443-4 sniffing sessions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SEOS card emulation support.
• Adds DC-block FSK demodulation for improved weak-coupling robustness with HID and ioProx LF credentials.

Runtime Security · 2026-10-25

cicd-sensor v0.0.49 adds GitHub Actions OIDC authentication so Agents no longer need long-lived Manager tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GitHub Actions OIDC authentication for Agents connecting to the Manager, eliminating the need to store long-lived Manager tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a detection rule for the litellm 1.107.0 PyPI compromise exfiltration domain IOC.

Internet Services · 2026-10-25

Cloudflare adds Brotli WAF rules, Radar interactive map, and npm version pinning for Workers Builds⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds WAF rules for Brotli-encoded request bodies and the Next.js image optimization endpoint via an emergency Cloudflare Managed Ruleset release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Redesigned Cloudflare Radar homepage with an interactive traffic and outages map, curated insights section with tabbed navigation, and updated Kumo-based interface.
• Workers Builds now pins the npm version from the packageManager field in package.json, ensuring build and local environments use the same npm version.

Internet Services · 2026-10-25

Compliance Automation & Trust Management · 2026-10-25

Compyl adds custom fields for the Clients module, letting administrators define and manage fields on client records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds custom fields support to the Clients module, enabling administrators to define and manage custom fields on client records.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-25

cyclonedx-core-java 13.4.0 switches to streaming deserializers across the board for faster, lower-memory SBOM parsing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Switches hash and external reference list deserialization to a unified, streaming path for reduced memory overhead.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Converts remaining simple list, nested component, pedigree, choice, entity, extension, and risk deserializers to streaming for consistent low-allocation parsing.

Data Security & DLP · 2026-10-25

AI-Powered Offensive Security · 2026-10-25

Decepticon v1.6.0 persists per-thread AI controls and adds compaction thresholds, SSE recovery, and improved checkpoint diagnostics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Installs or updates to v1.6.0 via decepticon update --channel latest, pulling matching launcher, configuration, and versioned images in one step.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Persists per-thread model, fallback, reasoning effort, and compaction controls across sessions, including a verified 4096-token compaction threshold.
• Improves scoped checkpoint diagnostics, SSE recovery, and transcript navigation across CLI, web, and server surfaces.

Identity & Access Management · 2026-10-25

API surface changed: +82 endpoints, 60 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /v3/events/{event_uuid}/delete/⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /v3/lists/{list_uuid}/
• New endpoint DELETE /v3/lists/{list_uuid}/entries/{entry_uuid}/

Network Analysis & Monitoring · 2026-10-25

Adds --text-source pcapng to openssl, gotls, and gnutls modules for pcapng-based HTTP/1.1 and HTTP/2 reconstruction in text mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Converts packet timestamps from TC monotonic time to Unix time before pcapng serialization when using --text-source pcapng.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Saves a raw pcapng copy alongside text output only when --pcapfile is also specified with --text-source pcapng.

Digital Forensics & Incident Response · 2026-10-25

iLEAPP v2026.4.5 adds raw-image LVM2/LUKS/RAID support, 30+ new app artifacts, and SHA-256 staging hashes via --hash⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --hash flag (and a matching GUI checkbox) to record a SHA-256 digest for each staged file, covering zip NTFS and extended timestamp fields, tar headers (GNU and PAX), L01 and AD1 entries, FAT/exFAT entries, and ext/APFS/HFS+ times.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends -t raw support to LVM2 logical volumes (split, striped and RAID1), LUKS containers opened with a passphrase (via --image_password_file, --image_password_env, a prompt, or the GUI), RAID member images read together, and FAT12/FAT16 filesystems, and further extends it to expose free space, flash-filesystem deleted files, and NTFS directory indexes to artifact modules that request them, naming each file read through missing acquisition data.
• Reads Cellebrite CLBX zip timestamps from metadata.msgpack (adding msgpack as a dependency), and reads the creation time from the fourth value of four-value extended timestamp blocks (GrayKey-style files_full.zip).

Secrets Detection & Management · 2026-10-25

API surface changed: +3 endpoints, −1 endpoint, 111 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}/personal-values⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}/personal-values
• GET /api/v1/agent-vault/access-bundles: param granted (query) added; param requiresSetup (query) added

Endpoint Management (UEM/RMM) · 2026-10-25

Identity & Access Management · 2026-10-25

JumpCloud launches an End User MCP Server so employees can handle self-service identity tasks inside AI tools like ChatGPT, Claude, and Cursor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the JumpCloud End User MCP Server, enabling employees to perform User Portal self-service (profile updates, SSO app lookup and launch, access requests, approval tasks, password/MFA status review) from compatible AI clients such as ChatGPT, Claude, and Cursor via the Model Context Protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables the End User MCP Server org-wide from Settings > JumpCloud AI in the Admin Portal, with controls for session duration and automatic revocation.
• Lets IT view and bulk-revoke active End User MCP sessions — including connected client, client ID, redirect URI, employee, creation time, last-used time, and expiry — from the same Settings > JumpCloud AI area.

AI Runtime Defense & Guardrails · 2026-10-25

Manifold now inventories and risk-rates all ~17,000 Open VSX editor extensions nightly, surfacing supply-chain risk alongside AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Open VSX editor-extension scanning to the Manifest public intelligence site, covering ~17,000 extensions refreshed nightly and searchable without a Manifold account under Editor Extensions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Every editor extension detected on a managed machine by the endpoint collector (version 0.997.2 or newer) now appears in the Manifold inventory with its Manifest rating, alongside MCP servers, skills, and plugins.
• Extensions rated critical, high, or medium automatically raise a supply-chain risk on each AI agent running on the same machine.

Email Security · 2026-10-25

Material launches a Google Drive Management Agent that investigates sensitive files, assigns verdicts, and automatically remediates over-permissioned sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the Drive Management Agent, which investigates sensitive Google Drive files across content summary, sensitivity, and collaborator exposure, then assigns one of four verdicts — Cleared, Contained, Exposed, or Overexposed — to determine automated remediation actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports configurable, verdict-based remediations: for example, Exposed files can trigger an owner notification followed by a grace period before access revocation, while Overexposed files can trigger immediate access revocation.
• Retains manual search, sort, and filter across the full universe of flagged Drive documents for investigations that require human review.

SAST / SCA / Code Security · 2026-10-25

Mend Platform 26.9.3 adds aggregated SBOM exports in CycloneDX/SPDX and makes Custom Roles generally available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new organizational setting, 'Include Proprietary Libraries in Workflows,' to exclude proprietary (in-house) components from automation workflows that check for Empty License conditions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces aggregated SBOM export for application and multi-project scopes, consolidating multiple project-level files into one deduplicated document; supports CycloneDX and SPDX standards. Projects in multi-project scope must belong to the same application; per-project generation remains the default.
• Promotes Custom Roles from closed beta to general availability, with an enhanced role breakdown and Create Role wizard for custom role management.

Agentic Infrastructure · 2026-10-25

microsandbox v0.7.11 exposes HTTP CONNECT proxy authentication in the SDK.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds HTTP CONNECT proxy authentication support to the SDK, enabling sandboxes to reach external services through authenticated proxies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-25

Ory v26.4.3–v26.4.6: admin API attribution in events, external-ID event matching, new Console layout, and configurable OTP codes⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds configurable length and character set for one-time codes in Ory Kratos Identities via Ory Network⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds external-ID matching for identity, login, registration, recovery, settings, verification, and session events in the Ory Network event stream
• Events emitted by Ory Identities, Ory OAuth2, and Ory Permissions now show who made an admin API request

Endpoint Security (EDR/XDR) · 2026-10-25

osctrl v0.6.1 adds per-node osquery config/flag overrides, extension delivery, gradual rollout, and Windows upgrade support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per-node osquery overrides for both config and flags, letting operators apply node-specific osquery config and flags independently of the environment default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds osquery extensions delivery so osctrld can push extensions down to enrolled nodes.
• Adds osquery version management with a version library, environment-level target, per-host version pin, upgrade reporting, and a pin retry rule.

Web Application Security · 2026-10-25

ZAP adds a new passive scan rule detecting PHP2Shell and 60+ PHP CVEs from response headers — no extra requests sent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Raises a PHP Version with Known Vulnerabilities alert scoped to one alert per site/technology/version, risk-rated by the most severe applicable CVE, listing all affected CVEs with severity and links to a new PHP Known Vulnerabilities help page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports suppressing known-patched servers via an Alert Filter matching URL, the PHP Version with Known Vulnerabilities alert name, and the specific version string evidence (e.g. PHP/8.1.2), configurable globally, in a context, or in the Automation Framework for CI/CD pipelines.
• Keeps the PHP vulnerability list current via a weekly automated job that pulls from the official php-src GitHub security advisories and raises a pull request to update the add-on.

Endpoint Security (EDR/XDR) · 2026-10-25

Cortex XDR One merges XDR and Koi Agentic Endpoint Security into a single sensor and console to protect AI agents alongside traditional endpoints.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Cortex XDR One, a unified platform combining Cortex XDR and Cortex Agentic Endpoint Security (AES) under a single sensor and console for centralized visibility, management, and investigation of both traditional endpoints and AI agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Delivers real-time inventory of every AI artifact (agents, MCP servers, AI co-pilots, browser tools) the moment it appears on an endpoint, enabling security teams to control which packages, extensions, agents, and AI artifacts are allowed to be installed or used.
• Adds Managed AES with Cortex XDR One, providing 24/7 Unit 42-staffed governance, threat hunting, investigation, and response across the full endpoint attack surface including AI agents.

SIEM · 2026-10-25

Firewalls & Network Defense · 2026-10-25

Palo Alto Networks launches Unit 42 Managed Agentic Endpoint Security (Managed AES) and extends AI Runtime Security to NVIDIA BlueField DPUs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Unit 42 Managed Agentic Endpoint Security (Managed AES), a 24/7 managed service built on Cortex AES that adds Unit 42 threat hunting, investigation, response, and AI governance expertise to the existing Cortex AES platform.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Makes AI Runtime Security on NVIDIA BlueField DPUs generally available, isolating security processing in dedicated infrastructure silicon to enforce policies independently of a potentially compromised host across AI factory and industrial edge deployments.
• Adds a Managed AES with Standalone Cortex AES deployment option, allowing organisations to run Cortex AES alongside an existing endpoint security solution to gain AI-native visibility and governance without replacing incumbent tooling.

MCP Servers & Tooling · 2026-10-25

Runlayer 1.36.0 lets skill admins detach skills from their source repos and improves Go agent follow-through and ToolGuard recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables skill owners and skill admins to detach a skill published with runlayer skills push from its source repository so it can be edited directly in Runlayer, preserving files, version history, and sharing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Allows editors to detach a skill once its owner is deactivated, preventing orphaned skills when a publisher leaves.
• After detachment, later pushes from the source repository no longer update the skill, automatic updates are turned off, and pushing a skill with the same name fails until one is renamed.

Software Supply Chain Security · 2026-10-25

sbomify v26.10.0 adds a Vulnerabilities page, VEX approval queue for AI agents, Operator role, Vanta integration, and live WebSocket updates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Vanta integration, enabled via new VANTA_* environment variables, to sync frameworks and controls from Vanta with optional Trust Center publishing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds REDIS_CACHE_MAX_CONNECTIONS and REDIS_CACHE_POOL_TIMEOUT environment variables to tune Redis connection pooling, LOG_MAX_SIZE and LOG_MAX_FILE environment variables for log rotation control, and KEYCLOAK_PUBLIC_URL environment variable for self-hosted Keycloak configuration.
• Adds history_limit query parameter and all_runs_total field to GET /plugins/assessments/{sbom_id}, capping all_runs at 50 runs.

SAST / SCA / Code Security · 2026-10-25

SonarQube Cloud adds native container image scanning (open beta) with a new sonar-container-scanner CLI and --fail-on threshold flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces sonar-container-scanner <IMAGE> --organization <ORGANIZATION_KEY> --token <TOKEN> CLI to scan container images for known OS-layer vulnerabilities and malicious packages, generating an SBOM sent to SonarQube Cloud for analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --fail-on flag to sonar-container-scanner to set a minimum severity threshold (default: high) at which the scanner exits with a failing code, enabling CI pipeline gates on container image risk.
• Adds a Container images section in the SonarQube Cloud organization sidebar, listing every analyzed image with its tag, risk count, most severe risk, and last-analyzed timestamp alongside code and dependency risks.

Detection Engineering · 2026-10-25

Tenzir adds an isMalicious integration via STIX 2.1/TAXII 2.1, enriching DNS and network events against a local indicator lookup table mapped to OCSF.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ismalicious, stix, and tenzir packages to the Tenzir Library, enabling TAXII collection pulls from isMalicious and local indicator lookup without per-event API calls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Fetches TAXII collections (starting with malicious-domains and malicious-ips) and maps each STIX Indicator to OCSF OSINT Inventory Info for in-stream DNS and network event enrichment.
• Tracks indicator lifecycle locally: enforces valid_until expiry and removes revoked indicators after incremental polls using added_after between scheduled walks.

SOAR · 2026-10-25

Tines September 2026 adds a v2 Records API, MCP server, new AI models, API-managed agent skills, and eight new markdown formulas.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces the v2 Records API, enabling single-call retrieval of related cases and child record data, with record searches running twice as fast.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the Tines Model Context Protocol (MCP) server, letting compatible AI clients search and summarize records and manage cases.
• Supports updating case fields and triggering notifications on comment changes through the Tines API.

Non-Human & Agent Identity · 2026-10-25

Token Security integrates with Grok Build via a marketplace plugin and the Grok Build Admin API to surface and remediate risky agent credential access inside the editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Token Security plugin in the Grok Build Marketplace, letting developers query Token findings — secrets, MCP server permissions, and credential ownership — without leaving the editor.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Integrates with the Grok Build Admin API to enumerate which users are enabled in a workspace and which MCP servers and tools each team has configured.
• Pairs EDR integrations (e.g. CrowdStrike) with Grok Build workspace data to surface MCP config files and hardcoded credentials found on developer endpoints, including agents running outside the sanctioned workspace.

Endpoint Security (EDR/XDR) · 2026-10-25

Trend Vision One File Security Storage Azure template 2.6.0 adds optional customer-managed Azure VNet support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds optional customer-managed Azure VNet support to the File Security Storage Azure deployment template.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Endpoint Security (EDR/XDR) · 2026-10-25

Runtime Malware Scanning now covers Amazon ECS (EC2 and Fargate), with Terminate mitigation to stop affected tasks and block flagged images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Runtime Malware Scanning to Amazon ECS clusters for both EC2 and Fargate launch types, adding real-time and scheduled malware detection previously available only for Kubernetes clusters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Terminate mitigation for ECS: Container Security stops affected ECS tasks and blocks additional tasks from launching with a flagged image, using the same filter rules and log/terminate options as Kubernetes.

UNCATEGORIZED · 2026-10-25

vigolium v0.5.5 adds HTTP/3 fuzzing, new fingerprint/hosts/dns subcommands, TSV output, and JSON schemas across core commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --http-version, --http3, and --http3-only flags to fuzz, multiplexing over HTTP/3 → HTTP/2 → HTTP/1.1 with protocol reported as pace.protocol.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds vigolium fingerprint subcommand with --depth light|standard|full to store per-origin host facts, vigolium hosts subcommand with --sans and --soft-404 flags to read stored host facts, and vigolium dns subcommand to resolve and store DNS records, with dig and host shims routing to it.
• Adds vigolium schema storage [table] subcommand to describe tables, columns, and row counts, a --usage flag on any command, vigolium schema flags <command> -j for machine-readable flag docs, and JSON schemas for fuzz, replay, ingest, traffic body/headers, hosts, dns, fingerprint, and schema storage/flags.

Threat Intelligence · 2026-10-25

World Monitor v2.11.4 pins Iran–GCC tensions and adds live 168-hour scoring for geopolitical pairs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds live scoring for Iran–GCC tension pairs over a rolling 168-hour window in the tensions module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Activates seed-notam-nms on FAA production for aviation NOTAM ingestion.

AI-Powered Offensive Security · 2026-10-25

Adds opt-in native tool calling via XALGORIX_NATIVE_TOOL_CALLS for llama.cpp, Ollama, and vLLM backends, replacing fragile XML tag parsing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds XALGORIX_NATIVE_TOOL_CALLS environment variable (default off) to enable structured function-calling instead of XML tag parsing, supporting llama.cpp, Ollama, and vLLM backends.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI-Powered Offensive Security · 2026-10-25

xalgorix v4.6.160 adds target-wide finding deduplication classes and two opt-in env-var flags for stuck-scan recovery and leaner tool schemas.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds XALGORIX_ADVANCE_PAST_STUCK environment variable (default off) to skip un-completable tasks and continue the rest of the scan plan, bounded by XALGORIX_MAX_STUCK_ADVANCES (default 3) consecutive no-progress advances.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds XALGORIX_LEAN_TOOL_SCHEMA environment variable (default off) to strip illustrative example spans from tool/parameter descriptions, shrinking the per-request prompt while preserving every tool, parameter and core instruction.
• Adds debug_disclosure finding class (stack-trace / debug-page / verbose-exception keywords; CWE-209) so error-verbosity findings are classified and collapsed to one finding per target instead of being re-reported on every path.

SAST / SCA / Code Security · 2026-10-25

ZeroPath adds configurable SD Elements task-status mapping and new Security Compass API/MCP methods for verification push workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds securityCompass.listTaskStatuses, updateProjectMapping, and pushLatestScan API and MCP methods for Security Compass integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds per-integration and per-project Task status mapping configuration to control which SD Elements task status each ZeroPath verification outcome (Pass, Partial, Fail) sets.
• Adds Push latest scan action to re-push a repository's latest finished full scan to SD Elements on demand.

Identity & Access Management · 2026-10-24

1Password CLI beta adds dotenv output format and secret listing with concealment status for 1Password Environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds dotenv as an output option for --format flag when listing 1Password Environment secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The op environment secret list command now displays the name, value, and concealment status of each secret in a 1Password Environment.

UNCATEGORIZED · 2026-10-24

ArmorCode Zero launches: an agentic remediation layer that auto-triages findings, groups them into fixes, drafts pull requests, and proves closure via rescan.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces ArmorCode Zero, a new agentic remediation product that reads every finding, writes a triage call automatically, and groups findings by the single change that resolves them — reducing a backlog (in ArmorCode's own testing, ~28,600 findings became ~8,900 fixes, a 69% reduction).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a conversational interface where security teams can ask questions, request charts, and describe trends in plain language, with Zero building charts and flows from the team's own data on demand.
• Introduces the ArmorCode Context Risk Graph as the shared knowledge layer, connecting findings to assets, code, owners, business services, and controls to enable risk-ranked fix prioritization.

Public Key Infrastructure (PKI) · 2026-10-24

Integrated & IT Risk Management · 2026-10-24

CISO Assistant v4.1.4 adds Microsoft Graph mail transport, MCP tools, DPIA import from CNIL, ISO/IEC 27090:2026, and a dynamic data wizard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds update_folder, update_user, and update_evidence tools to the MCP integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Microsoft Graph as a mail transport option for outbound email delivery.
• Supports importing DPIA studies from CNIL's PIA tool exports into the privacy module.

AI Red Teaming & Testing · 2026-10-24

clawscan v0.3.0 adds opt-in lifecycle diagnostics, versioned inspection receipts, and parallelized SkillSpector discovery.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds opt-in phase and bounded child-judge lifecycle diagnostics that survive outer scan interruption without exposing commands, paths, or raw output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Binds versioned judge inspection receipts to required-file hashes and canonical inspected paths, and retries invalid inspection once within the original deadline.
• Adds an opt-in live judge inspection check on Ubuntu 22.04 that verifies package-file receipts without publishing.

Identity & Access Management · 2026-10-24

Clerk adds agent feedback collection via MCP server, reviewable in the Clerk dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables AI agents to submit product feedback directly from an MCP server, with submissions reviewable in the Clerk dashboard.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Identity & Access Management · 2026-10-24

Clerk adds a Backend API endpoint to merge a duplicate user into another and delete the duplicate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Backend API endpoint to merge a duplicate user into another user and delete the duplicate.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Internet Services · 2026-10-24

API surface changed: +21 endpoints, −2 endpoints, 140 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /accounts/{account_id}/cloudforce-one/v2/priority-intelligence/profile⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /accounts/{account_id}/email/domains/{email_domain_id}
• New endpoint DELETE /zones/{zone_id}/settings/aegis

Software Supply Chain Security · 2026-10-24

Cycode adds three Threat Intelligence dashboard queries to surface eMudhra-compromised CA trust in container images, runtimes, and Dockerfiles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Images with unpatched ca-certificates query to the Threat Intelligence dashboard, showing container images whose ca-certificates package is older than the fixed version for Alpine/Chainguard (apk), Debian/Ubuntu (deb), and RHEL/Fedora (rpm), with results displaying image tags and installed version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Images with outdated runtimes query to the Threat Intelligence dashboard, identifying images carrying Node.js, Java, pip, or certifi below the fixed versions that bundle their own trust data independently of the base image.
• Adds Dockerfiles on unpatched base images query to the Threat Intelligence dashboard, flagging Dockerfiles that build on Node.js, Python, Go, Java, Bun, or Deno images below the fixed version, on an end-of-life line, or pinned by digest.

SIEM · 2026-10-24

Files API 3.0 (Beta) adds multipart uploads for files larger than 5 GB and conditional operations to Unity Catalog volumes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds multipart upload support in Files API 3.0, enabling uploads of files larger than 5 GB to Unity Catalog volumes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds conditional operations in Files API 3.0, allowing upload, download, and delete of files in Unity Catalog volumes based on their current version to prevent unintended changes.

SIEM · 2026-10-24

Lakeflow Connect adds a managed Google Analytics Aggregated connector (Beta) for ingesting GA4 report data into Databricks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a managed Google Analytics Aggregated connector to Lakeflow Connect (Beta), supporting incremental ingestion of Google Analytics 4 report data — user activity, acquisition, engagement, monetization, demographics, and tech reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports custom report definitions with user-defined dimensions, metrics, and aggregation level.
• Supports both service account and OAuth user-to-machine (U2M) authentication for the Google Analytics Aggregated connector.

SIEM · 2026-10-24

AI/BI Dashboards gain private bookmarks, bulk import of up to 100 Power BI/Tableau files, layered combo charts, and custom waterfall totals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bulk import via Genie Code to bring up to 100 Power BI or Tableau files at a time into AI/BI dashboards and metric views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds private bookmarks so dashboard viewers can save and return to filter combinations visible only to themselves.
• Adds layered combo charts, letting authors build combo charts from separate chart layers.

SIEM · 2026-10-24

Genie One gains conversation navigation, skill-file uploads, external-tool query snippets, and mobile sign-in memory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Upload skills button to upload existing skill files and folders directly to your skills folder in the workspace (Public Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds conversation outline along the left edge of Genie One conversations to jump between messages and hover-preview responses.
• Genie Ontology now extracts snippets from queries run by external tools such as dbt on Databricks, surfacing those runs in query history alongside native queries (Public Preview).

SIEM · 2026-10-24

Serverless job tasks can now read dependencies from a pyproject.toml file to configure their environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Serverless notebook and Python script tasks support pyproject.toml for configuring job environments, configurable via the Jobs UI, Jobs API, or a bundle.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Workspace admins can enable Project-Scoped Shared Compute on the Previews page to use this feature.

SIEM · 2026-10-24

Elastic Security adds a SIEM detection rule for CVE-2026-73570 Zimbra Swatchdog command injection via log-file RCE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Zimbra Swatchdog SNMP Command Injection Execution SIEM rule, which fires on a two-step process sequence: a shell spawned from a Perl swatchdog_script parent with snmptrap, zmservicename, and zmservicestatus in its command line, followed by any child process other than snmptrap.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-24

Threat Intelligence · 2026-10-24

Flashpoint Ignite gains Ransomware Files view for instant visibility into leaked file paths and directory trees from ransomware incidents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Ransomware Files in Ignite, giving organizations direct visibility into leaked file paths and directory trees to assess exposure and prioritize response before threat actors can further exploit the data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-24

Flashpoint Ignite gains Ransomware Files: searchable leaked file trees with path alerting, Slack notifications, and MCP server access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Ransomware Files as a searchable data type in Ignite, enabling search across leaked file trees by file name, path, or keyword.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds filters — Ransomware Group, Victim Name, and File Type — to refine Ransomware Files search results.
• Adds proactive alerting on critical file paths with real-time notifications delivered in-platform, via email, or to Slack channels.

SAST / SCA / Code Security · 2026-10-24

Copilot usage metrics API gains totals_by_client array, breaking down model requests, sessions, and tokens by tool (OpenCode, Zed, VS Code, etc.)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds totals_by_client array to the Copilot usage metrics API for enterprise, organization, enterprise-user, and organization-user 1-day and 28-day reports, exposing per-tool model traffic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Each totals_by_client entry includes client (tool identifier such as opencode, claude_code, codex, zed, copilot_cli, github_app, cloud_agent, code_review, vscode, or jetbrains; unrecognized clients grouped as other), request_count, session_count, and token_usage (prompt tokens, output tokens, and average tokens per request).
• Each totals_by_client entry also includes totals_by_model, which breaks down request and token metrics by model and adds a model_selection_mode field with values user_selected, auto, product_selected, other, or unknown.

SAST / SCA / Code Security · 2026-10-24

GitHub's new Teams app merges notifications and Copilot so you can @mention GitHub to investigate issues and open PRs without leaving Teams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds @github mention support in Microsoft Teams channels, group chats, and private chats to trigger Copilot actions — such as investigating an issue, fixing a bug, and opening a pull request — directly from a notification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Consolidates the former GitHub notifications Teams app and Copilot capabilities into a single unified GitHub app for Microsoft Teams.

SAST / SCA / Code Security · 2026-10-24

GitHub Public Monitoring gains alert triage, validity checks, a REST API endpoint, and enterprise webhooks for leaked-secret response.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts REST API endpoint for enterprise admins and security managers to query attributed public monitoring findings programmatically, returning alert metadata, secret type, attribution, and exposed locations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds secret_scanning_public_monitoring_alert enterprise webhook event to receive real-time notifications whenever a newly detected leak is attributed to your organization.
• Adds always-on validity checks for supported secret types that continuously display whether a credential is Active, Inactive, or Unknown, enabling teams to prioritize response for live tokens.

SAST / SCA / Code Security · 2026-10-24

GitHub Apps can now be installed at the enterprise level GA, replacing classic PATs for governance, security, and admin automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a set of new Enterprise/Organization GitHub App permissions: Enterprise organization and repository policies permission (read/write) exposing EnterpriseOwnerInfo policy fields and REST APIs to update private repository forking, default repository permissions, repository visibility changes, repository creation, repository deletion, issue deletion, collaborator invitations, deploy keys, protected branch updates, dependency insights setting, organization projects setting, and repository projects; Enterprise bypass requests permission (read) to read push-rule and repository-policy bypass requests via GitHub Apps; Enterprise settings permission (read/write) to read enterprise data through EnterpriseOwnerInfo (including server installations and organization invitations) and update the enterprise profile; Enterprise two-factor authentication permission (read/write) to read two-factor fields on EnterpriseOwnerInfo and update two-factor requirements and disallowed authentication methods; Enterprise verifiable domains and Organization verifiable domains permissions (write) to access VerifiableDomain objects for enterprises or organizations; Enterprise IP allowlist and Organization IP allowlist permissions (read/write) to access IpAllowListEntry and associated mutations to create, update, and delete entries, and toggle allowlist enforcement, trust of GitHub Apps, and user-level enforcement for Enterprise Managed Users; Enterprise access restrictions permission (write) to enable or disable enterprise access restrictions; and Enterprise repository rulesets permission (write) to manage rulesets through enterprise rules REST APIs and RepositoryRuleset in GraphQL.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Expands Enterprise people permission (read/write) to read EnterpriseRepositoryInfo including repository details through EnterpriseOwnerInfo.outsideCollaborators and add the app to an organization with the owner or member role, and expands Enterprise billing permission (write) to update the member purchasing setting for the Marketplace.
• Enterprise-level GitHub App installations arrive in GHES 3.24.

Secrets Detection & Management · 2026-10-24

Infisical v0.167.2 adds secret scanning audit events, proxy-token-based vault agent start, default session-log storage, and PKI admin code-signing config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds audit events for secret scanning activity tracking, giving operators a log trail for scanning operations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables vault agent proxies to start using a proxy token via agent-vault proxy token support.
• Adds default storage configuration for vault agent session logs.

Endpoint Management (UEM/RMM) · 2026-10-24

Iru adds AI-assisted BitLocker and Android policy authoring, automated FileVault key rotation, and minimum OS enforcement in ADE.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds native Iru AI integration for building BitLocker and Android Restrictions Library Items directly within Iru.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables automatic FileVault key rotation triggered by Iru.
• Adds minimum OS version enforcement within Automated Device Enrollment (ADE).

Agentic Infrastructure · 2026-10-24

microsandbox v0.7.10 adds anonymous registry auth support to the Go SDK⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds anonymous registry authentication support to the Go SDK, enabling pulls from OCI registries that do not require credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-24

myip v8.0.0 adds IP Blocklist Check across ~80 DNSBLs, an Ad & Tracker Blocking Test, and per-tool full-page navigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds IP Blocklist Check tool — tests whether an IP appears on about 80 real-time DNSBLs and threat intelligence lists.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Ad & Tracker Blocking Test tool — reveals which ad, analytics, social, and device-maker endpoints, tracking scripts, and ad-shaped elements pass through a blocker, DNS filter, or VPN.
• Advanced Tools now open as full pages (sliding app-style), preserving data when switching between tools.

Reconnaissance & OSINT · 2026-10-24

Nerva v1.83.0 adds fingerprinting support for the Citrix ADC management plane.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection of the Citrix ADC management plane to the fingerprinter plugin set.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-24

Nerva v1.82.0 adds elasticsearch-no-auth detection for unauthenticated Elasticsearch instances via --misconfigs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds elasticsearch-no-auth finding, emitted when an unauthenticated HTTP GET / succeeds against an Elasticsearch node (requires --misconfigs).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-24

Nerva v1.81.0 extends OS end-of-life detection beyond RDP to additional protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-24

nerva: Adds oracle-no-auth detection to identify Oracle DB instances accessible without authentication when running with --misconfigs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-24

Nerva v1.79.0 adds fingerprinting for internet-exposed Verifone VHQ and Ingenico Estate/TMS payment management UIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds fingerprinting support for internet-exposed Verifone VHQ and Ingenico Estate/TMS management UIs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-24

Nerva v1.78.0 adds a pcAnywhere protocol fingerprinting plugin, extending service detection coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Nerva plugin for pcAnywhere remote-access service fingerprinting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Threat Intelligence · 2026-10-24

OpenCTI 7.261023.0 upgrades the knowledge graph with SVG export, keyboard control, grouped nodes, and ingestion health monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports SVG export and higher-resolution image export from the knowledge graph.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables keyboard stroke control of knowledge graphs.
• Groups objects of the same type together in the knowledge graph.

SAST / SCA / Code Security · 2026-10-24

OpenQodex 0.14.0 adds a staged multi-pass review engine, full lockfile scanning, and a public graph query API with writeIndex/readIndexFrom.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exports a public library API including query, querySliced, OPERATIONS, SLICE_CHECKS, parseTarget, resolveTarget, prepareIndexes, writeIndex, readIndex, readIndexFrom, assemble, INDEX_FORMAT, serializeModel, deserializeModel, graphOf, floorReasons, hotSymbols, and isTestPath — plus their types — so external programs can build a graph, persist the index files writeIndex returns (now including projects.json), reload them with readIndexFrom, and run any query over the result.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a staged review pipeline: two finder sessions read each changed file with surrounding context, a fresh verifier session checks every candidate, and only confirmed candidates become findings; style, naming, docs, and test items are surfaced separately as observations; review.stages: false falls back to the original single-pass mode.
• Extends replaced-line behavior-loss review to cover .c, .cc, .cpp, .cxx, .C, .h, .hh, .hpp, .hxx, .rs, .cs, .php, .ts, .tsx, .js, .jsx, .mjs, .cjs, .mts, .cts, .py, .pyi, .go, .rb, .java, .kt, .kts, .swift, .m, .mm, .scala, .sc, .sh, .bash, .zsh, .sql, .lua, .pl, .pm, .r, .R, .dart, .ex, .exs, .erl, .hrl, .hs, .clj, .cljs, .cljc, .vue, .svelte, .vb, .fs, .fsx, .ps1, .psm1, .groovy, .gradle, .asm, .s, .S, .zig, .jl, .ml, .mli, .nim, .v, .vhd, .vhdl, .f, .f90, .f95, .for, .cob, .cbl, .coffee, .elm, .el, .lisp, .lsp, .scm, .ss, .rkt, .d, .pas, .p, .raku, .tcl, and .awk.

General Utilities & Libraries · 2026-10-24

OpenSSL 4.1.0 adds DTLS 1.3, GREASE, IKEV2 KDF, DTLS listener API support, and post-quantum crypto performance boosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DTLS 1.3 support per RFC 9147, documented in the ossl-guide-dtlsv13(7) manual page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds no-ecdsa and no-ecdh removal from Configure — use no-ec to disable elliptic curve support.
• Adds RFC 8701 GREASE (Generate Random Extensions And Sustain Extensibility) support.

AI Runtime Defense & Guardrails · 2026-10-24

Operant AI launches Agentic Commerce Defense to detect and block malicious agent transactions in real time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Agentic Commerce Defense, a new runtime protection layer that distinguishes legitimate shopping agents (e.g., Meta Muse, OpenAI Dots) from scalper fleets, scrapers, and rogue agents at checkout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds loop detection that identifies a paid API call repeating without progress, stopping runaway token and dollar spend from misbehaving pricing or merchandising agents.
• Adds per-agent token limits that can throttle a single misbehaving agent independently without affecting other agent instances.

Identity & Access Management · 2026-10-24

Ping Identity AIC adds QR-code scripted nodes, multi-provider SAML import by alias, and case-normalized managed object enums.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds callbacksBuilder.qrCodeCallback() binding to scripted nodes, enabling QR codes to render in the Advanced Identity Cloud admin console.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for importing multiple remote identity providers sharing the same entity ID by specifying an alias; uniqueness is enforced per circle of trust.
• Enables omission of the scope parameter in authorization code requests (including PAR) when authorization_details are requested and Rich Authorization Requests with RCS is enabled.

MCP Servers & Tooling · 2026-10-24

Runlayer 1.35.0 adds bulk agent deletion, .xlsx spreadsheet previews, Stop-effect visibility, and compliance import scope clarity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds bulk deletion of disabled agents from the Agents Inventory tab — select agents, choose Delete, and their schedules, webhooks, and Slack apps are removed in one action; enabled agents are left untouched.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds read-only .xlsx spreadsheet previews in the artifact viewer, with a tab per sheet and the workbook's number formats, colors, and merged cells, so agents' Excel outputs are readable without downloading.
• Settings → Agent session monitoring now clarifies that a Claude or ChatGPT compliance import covers every user in the connected organization or workspace, including people who have never signed in to Runlayer.

Attack Surface & Exposure Management · 2026-10-24

runZero 5.1.261022.0 expands search operators across inventories and adds notification_count: numeric comparisons for alert channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Alert channel searches now support notification_count: with numeric comparisons such as notification_count:>5, and settings: now matches a channel's email recipients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Scan template searches now support AND, OR, and NOT operators; a plain word searches template names and descriptions, and an unsupported keyword is reported as an error.
• External report searches now support AND, OR, and NOT operators.

Secrets Detection & Management · 2026-10-24

TruffleHog v3.99.7 adds xAI key analyzer plus Fireworks AI and Infisical detectors⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds xAI analyzer (xai case in analyzer CLI) that inspects a live xAI API key via GET https://api.x.ai/v1/api-key and GET https://api.x.ai/v1/models, reporting the key's name, ID, team, ACL-derived endpoint and model access bindings, and blocked/disabled status.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Fireworks AI API key detector to classify and validate Fireworks AI credentials found in scanned sources.
• Adds Infisical service token detector to classify and validate Infisical service tokens found in scanned sources.

Compliance Automation & Trust Management · 2026-10-24

API surface changed: +6 endpoints, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /vendor-categories/{categoryId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /vendor-categories
• New endpoint GET /vendor-categories/{categoryId}

Data Security & DLP · 2026-10-24

Varonis lets you clone existing data protection automations to speed up consistent policy deployment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Clone existing data protection automations to reuse configurations instead of rebuilding from scratch, supporting consistent policy deployment across environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-24

Varonis extends Exact Data Match classification to tabular files and supports offline source data preparation for air-gapped environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends Exact Data Match (EDM) classification to tabular files, enabling the same policies to apply across both tabular and non-tabular data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports offline EDM source data preparation by hashing files on disconnected systems and uploading only the hashed package from a connected environment, keeping source data within restricted networks.

Data Security & DLP · 2026-10-24

Varonis Export API now supports native CSV output in addition to AVRO, eliminating conversion steps for spreadsheet and reporting workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds CSV format support to the Export API, enabling direct CSV output alongside the existing AVRO format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-24

Varonis adds in-app classification pattern management — create, edit, and test patterns directly in the Web Interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a unified classification pattern workspace in the Varonis Web Interface for creating, editing, testing, and managing patterns without switching tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-24

Varonis now monitors and manages Microsoft Main links in SharePoint Online and OneDrive with analytics and policy workflow support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds monitoring and management of Microsoft Main links within SharePoint Online and OneDrive, extending analytics and policy workflows to the new Microsoft sharing experience.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-24

Varonis adds named data source collections for reuse across analytics, dashboards, and policies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Group multiple data sources into named collections that can be reused across analytics, dashboards, and policies to reduce repetitive source selection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Data Security & DLP · 2026-10-24

Varonis adds Entity ID Lookup API to translate folder paths into entity IDs for Search and Export API workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Entity ID Lookup API to resolve physical folder paths into entity IDs required by Search and Export APIs, supporting exact path resolution, bulk lookups, path discovery, and subtree resolution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-24

Veracode CLI gains veracode scan static, veracode findings static, async fix mode, --csharp-source, --skip-packagers, and more across recent releases.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds veracode scan static command to run static scans and review security findings within a Git workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds veracode findings static command to access cached static scan findings in the local Veracode directory.
• Adds --csharp-source flag to veracode package to package C# source code directly for Static Analysis without compiling it into binaries.

Vulnerability Management · 2026-10-24

vulnerability-db v7.0.3 adds Bottlerocket, Oracle Linux, and Seal Security advisory sources, and verifies database downloads layer-by-layer as they stream.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Set VDB_IGNORE_SEAL=true to exclude the two Seal Security (vulnfeed.sealsecurity.io) OSV feeds from ingestion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ingestion of Bottlerocket (BRSA), Oracle Linux (ELSA), and Seal Security advisories as three new upstream advisory sources.
• Image downloads now stream through a registry client that checks each layer's digest and size before moving the file into place, logging progress every GiB, so an interrupted download no longer leaves a truncated database.

AI-Powered Offensive Security · 2026-10-24

Xalgorix v4.6.159 adds XALGORIX_PLAN_COMPLETE_IDLE to cap idle scan iterations and recovers mis-tagged LLM tool calls to cut wasted token usage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds XALGORIX_PLAN_COMPLETE_IDLE environment variable (default 600) to bound the no-new-findings tail after a structured plan is exhausted, finalizing scans instead of re-testing already-covered surface indefinitely; any new finding resets the counter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Recovers LLM tool calls where the model emits <parameter=NAME> instead of <function=NAME>, avoiding the wasted turn and full-context retry that previously occurred when the call was discarded as malformed.

Email Security · 2026-10-23

Web Application Security · 2026-10-23

Acunetix 360 adds default protocol to website API responses and lets custom roles send scan notifications to external recipients.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds default protocol parameter to website API responses, enabling retrieval of the default protocol for each website.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables custom roles to send scan notifications to external recipients without granting full access to all organizational notifications.

Reconnaissance & OSINT · 2026-10-23

Adalanche r1014 adds new attack-path edges, assessment-sourced collection, cross-realm Kerberos, and AQL OOM protection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SystemRights edge so computer-account takeover paths now reach through to the actual host.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends WriteAltSecIdent edge to also target computer accounts, not just user accounts.
• Adds NTLM and LDAP client hardening attributes as graph nodes/edges.

Reconnaissance & OSINT · 2026-10-23

Adalanche r996 changes node dragging to move individual nodes instead of the entire view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Dragging a node in the graph UI now moves that node independently, rather than panning the entire view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-23

Adalanche r995 adds MCP documentation serving and get_acl for human-readable security descriptor inspection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds MCP get_acl to display a security descriptor in plain, human-readable terms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• MCP now serves the built-in documentation.
• REACH CHEAPEST and SHORTEST path analysis keeps fewer (more relevant) routes between each start and end node.

Reconnaissance & OSINT · 2026-10-23

Adalanche r987 adds MCP server mode, WASM graph layouts, AQL REACH/UNION/TRAIL modes, LAPS analysis, and GPO targeting improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes an MCP server at /mcp on the web service, with routes, causes, and no secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AQL REACH mode (returns every edge on any valid route between nodes), TRAIL mode (avoids edges already present in the result and drops the former SIMPLE mode), UNION parsing support (combining multiple query result sets), and traversal priorities SHORTEST, LONGEST, LIKELY, and UNLIKELY for steering path results.
• Adds Windows LAPS analysis (requiring read and control access, with DSRM support), tags stale GPO links, delegation targets, and published templates as findings, adds task SDDL parsing for scheduled task attack-path analysis, adds session-type edges for Batch, Service, Negotiate, SessionNetworkKerberos, and SessionNetworkNTLMV2 logon paths, and adds Service Control Manager permission analysis for privilege escalation on local machines.

Detection Engineering · 2026-10-23

ATHF v0.23.0 adds a five-verdict ladder with evidence and provenance gates enforced in hunt findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds verdict field to hunt findings / ruled_out entries with five explicit values: confirmed, suspected, attempted_not_vulnerable, benign, inconclusive.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds evidence gate requiring verdict: confirmed entries to carry a confirmation mapping with a supported method, a produced_by producer declared in .athfconfig.yaml whose capabilities include that method and reach beyond query-only access, an attested_by person distinct from the producer, and a non-empty detail; telemetry-only or query-only producers cap an entry at suspected.
• Adds routing rule enforcing that attempted_not_vulnerable, benign, and inconclusive verdicts live in ruled_out (never in findings), and that attempted_not_vulnerable entries name the control that held.

Detection Engineering · 2026-10-23

Adds /gates skill to score hunt findings and issue promotion verdicts (PROMOTE, CONDITIONAL, HOLD, TIME-BOX, RECURRING HUNT) for ADEF handoff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds /gates skill with methodology at .claude/skills/gates/SKILL.md, output schema at .claude/skills/gates/AGENT_MEMORY_SCHEMA.md, and worked examples under .claude/skills/gates/examples/ for every verdict type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GATES scoring produces five verdicts — PROMOTE, CONDITIONAL, HOLD, TIME-BOX, RECURRING HUNT — evaluated across five dimensions (Generalizability, Accuracy, Telemetry, Exposure-tested, Sustainability).
• PROMOTE and prerequisite-complete CONDITIONAL verdicts emit YAML for ADEF to ingest, bridging hunt findings to production detection engineering.

Detection Engineering · 2026-10-23

Adds hunt_type category with stats, list, validate, and metrics support to the threat hunting framework.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Makes hypothesis-generator runnable directly from the printed Next Steps output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-23

Aikido adds Cloud Security Audits, External Network Pentesting, FedRAMP Moderate authorization, Google SecOps integration, and new Zen Firewall agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new API endpoints: API - List CWE descriptions to retrieve CWE metadata, API - List pending invites to query outstanding user invitations, API - List AI code analysis assessments to fetch AI code analysis results, API - List pentest assessments to retrieve pentest findings, API - Disable user to deactivate users, and API - Remove attach surface subdomain to remove subdomains from the attack surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New Google SecOps integration to optionally forward Aikido Activity logs to a SIEM.
• Adds Zen Firewall agent releases for Dotnet, Python, PHP, Ruby, and Node.

Wireless & RF · 2026-10-23

Airgorah v0.9.0 adds full PMKID attack support and drops aircrack-ng/mergecap dependencies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PMKID detection, display, solicitation, and cracking support as a new attack workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Removes the aircrack-ng suite and mergecap as external dependencies.
• Shows the channel the interface is currently listening on in the status bar.

Secure Access (VPN / SASE / ZTNA) · 2026-10-23

Adds --i1 flag to amneziawg-installer, letting operators pin a custom I1 concealment packet instead of using a generated one.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --i1 flag to set a custom I1 concealment packet (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ --i1='<b 0xHEX><r 16>'), validated immediately against accepted tags (<b 0xHEX>, <r N>, <rc N>, <rd N>, <t>; packet ≤ 1024 bytes); the <c> tag is rejected with an explanation because it prevents mobile profile loading.
• Pins the --i1 value in awgsetup_cfg.init so reinstalls and 2.0 fallbacks preserve it; --no-cps, --preset, --mobile, --jc, --jmin, or --jmax drop it with a warning.
• On a running server, --force --i1=... updates only I1 and leaves the rest of the parameter set unchanged; issued profiles receive the new value after regen.

Secure Access (VPN / SASE / ZTNA) · 2026-10-23

amneziawg-installer v6.0.0 defaults to AmneziaWG 3.1 with header encryption, adding --protocol=2.0 fallback and new AWG_PROTOCOL_SOURCE/AWG_PROTOCOL_FALLBACK config key⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --protocol=2.0 flag to force installation of AmneziaWG 2.0 when clients (routers on stock firmware, Hiddify, older apps) do not support 3.1.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AWG_PROTOCOL_SOURCE (default or explicit) and AWG_PROTOCOL_FALLBACK (reason code for automatic 2.0 fallback) keys to awgsetup_cfg.init.
• New default installation deploys AmneziaWG 3.1 with header encryption (HeaderProtectionKey, unique per installation) and ContentPaddingAddition = 32-128 padding on every new server.

AI-Powered Offensive Security · 2026-10-23

Apex v2.6.1 adds custom inference endpoints, Hoonify provider, session restore, exact-endpoint pentests, and a wave of new models via OpenRouter.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for custom OpenAI-compatible inference endpoints via customProviders configuration or the APEX_CUSTOM_PROVIDERS environment variable (selectable with --model-provider <id> --model <model> in headless commands), and a new built-in Hoonify inference provider connectable via /providers in the TUI or by setting HOONIFY_API_KEY (headless commands accept --model-provider hoonify --model <catalog-model-id>).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --resume <session-id> CLI flag (with optional --model <model-id>) to reopen a saved session, restoring operator mode and approval settings after a server restart.
• Adds feat(cli): launch exact endpoint pentests — new targeted-pentest CLI command with --target and --objective flags for scoped, objective-driven testing.

SAST / SCA / Code Security · 2026-10-23

APKHunt v2.0.0 replaces the Go CLI with a local Docker web workbench for Android APK static analysis, adding SBOM, secret review, entry point graphs, and a threat model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• (new) Replaces the Go CLI (go run apkhunt.go -p ... / -m ...) with a Docker Compose web workbench served at http://localhost:5005 (launched via export SECRET_KEY="$(openssl rand -hex 32)" && docker compose up --build), and bundles JADX, Apktool, Syft, TruffleHog, curl, and ADB inside the Docker image — no separate host installation required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds background APK scanning (up to 200 MB by default) with a status dock that persists across page navigation, accepting uploads via the web UI and queuing one scan at a time.
• Adds a coverage ledger that records APK member extraction states, recovered-file rule evaluations, skipped files, and decompiler attempts across 38 active static signals plus one inventory-only rule.

Identity & Access Management · 2026-10-23

Auth0 Early Access: Application Profiles centralize security settings for DCIMD apps used by AI agents in one config point.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Application Profiles (Early Access) to govern security settings — refresh token lifetimes, leeway, and DPoP — across all DCIMD applications from a single configuration point.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds B2B behaviour configuration for DCIMD applications via Application Profiles, controlling whether applications serve individuals, organizations, or both, along with login experience settings.
• Enables centralized management of third-party applications created and used by AI agents through Application Profiles.

Identity & Access Management · 2026-10-23

Auth0 adds CIMD with dynamic registration (Early Access): MCP clients and AI agents self-register via metadata URL at OAuth time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports Client ID Metadata Document (CIMD) with dynamic registration (Early Access): MCP clients and AI agents present an HTTPS metadata URL during the OAuth authorization flow and are discovered and registered just-in-time — no administrator pre-registration required.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Picks up changes to a client's metadata and public signing keys automatically, without manual syncing.
• Introduces Application Profiles (Early Access) to centrally manage refresh token policies, DPoP, and Organizations for dynamically registered CIMD clients.

Identity & Access Management · 2026-10-23

Auth0 Brute-Force Protection gains a Manual Unblock Behavior mode to prevent email scanners from auto-consuming recovery links.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Unblock Behavior setting to Brute-Force Protection with Automatic (default) and Manual modes — Manual mode presents a confirmation page so headless email scanners (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Microsoft 365 Defender) cannot silently consume the recovery link before the user opens it.

Web Application Security · 2026-10-23

burp-ai-agent v1.1.0 ships two separate JARs, opt-in auto-queue, and a Suggested targets panel for passive-to-active handoff.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ./gradlew bappJar and ./gradlew fullJar build tasks, producing build/libs/custom-ai-agent-bapp.jar (BApp Store build) and build/libs/Custom-AI-Agent-full-<version>.jar (GitHub full build) from separate source roots; adds a bom.json to each release listing the full build's runtime dependencies, including every dependency the BApp Store build packages, for dependency version verification; and adds per-release .sha256 files in sha256sum format for both JARs, verifiable with sha256sum -c <asset>.sha256.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Suggested targets section to the AI Active Scanner Queue dialog, listing passive findings by Suggested At, Vulnerability, Injection Point, URL, and Confidence, with Queue N suggested targets and Queue selected actions and a cap of 500 entries per session, plus a new opt-in Auto-queue passive findings for active testing setting on the AI Active Scanner tab (full build only), defaulting OFF on every install including upgrades from 1.0.1.
• The full build loads drop-in backend JARs from ~/.burp-ai-agent/backends; the BApp Store build never creates, lists, or loads that directory.

Data Security & DLP · 2026-10-23

Bytebase 3.24.0 adds MCP read-write agent workflows, BigQuery SQL review, and self-hosted admin recovery without downtime.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds release and has_release filter parameters to ListPlans API, plus task_status filter, so GitOps plans can be distinguished from console-created plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends MCP read-write mode so a connected agent can request just-in-time access, approve or reject issues and access requests, toggle project just-in-time access, grant or revoke masking exemptions, and revoke access grants — all bounded by the signed-in user's own permissions.
• Adds BigQuery SQL review support with two rules: 'Enforce the presence of WHERE condition in UPDATE/DELETE statements' and Restrict the SQL file size.

Identity & Access Management · 2026-10-23

Castle now identifies AI agents and browser automation tools in traffic, returning name, operator, category, and detection method.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a new top-level object in Castle's response identifying AI agents and browser automation tools, including the agent's name, operator, category, and how it was identified.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports detection via verified Web Bot Auth signatures for AI agent identification.

Identity & Access Management · 2026-10-23

Cerbos v0.57.0 improves Hub audit log sync, query plan accuracy, and adds a Homebrew cask for cerbosctl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds cerbosctl Homebrew cask for easier installation via Homebrew.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Resumes Hub audit log sync correctly after the last shipped marker, preventing missed entries.
• Syncs Hub audit log batches outside the Badger read transaction, improving throughput.

Runtime Security · 2026-10-23

cicd-sensor v0.0.48 adds drain-progress logging and IOC rules for @subql/common and tensorlake npm compromises.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds job_event_channel_closed, job_drain_in_progress, and job_drain_completed log records so operators can see whether the Agent is draining or stuck when a job finalizes with queued events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds detection rules for the @subql/common npm package compromise IOCs.
• Adds detection rules for the tensorlake npm package compromise IOCs.

Internet Services · 2026-10-23

Flagship gets structured evaluation context, Cloudflare Tunnel gains URL normalization, and a new Tunnel Read And Monitor role goes GA.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Cloudflare Tunnel supports URL normalization starting with cloudflared 2026.10.0; new releases will enable it by default from 2027-01-25.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Cloudflare MCP servers now serve only /mcp — the /sse endpoint is retired.
• Adds structured evaluation context to Flagship feature flags, supporting nested objects, arrays, and null values with dot-path targeting and array membership operators.

Internet Services · 2026-10-23

Cloudflare launches Basin, a serverless data platform built on Apache Iceberg and R2 for ingesting, storing, cataloging, and querying analytics data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Cloudflare Basin: a generally available serverless data platform built on Apache Iceberg and Cloudflare R2 that lets teams ingest, store, catalog, and query analytical data without provisioning or managing infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Stores all data in Apache Iceberg open format, allowing any compatible tool to read it directly with no copying, converting, or vendor lock-in.
• Provides Basin Pipelines, Catalog, and SQL as named components, replacing complex setups such as AWS S3 and Athena with a unified, serverless architecture.

Software Supply Chain Security · 2026-10-23

Cloudsmith CLI v1.30.0 adds anonymous error reporting, TLS-intercepting proxy support, and persistent credential helper installation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports TLS-intercepting proxies without disabling certificate verification, enabling CLI use in enterprise environments with SSL inspection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Installs credential helpers in a location that survives package-manager upgrades, preventing accidental removal.
• Sends anonymous reports of unexpected errors to Cloudsmith by default, allowing crash detection without manual support tickets.

SAST / SCA / Code Security · 2026-10-23

API surface changed: +2 endpoints, 4 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint POST /organizations/{provider}/{remoteOrganizationName}/security/dashboard/remediation/history/search⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint POST /organizations/{provider}/{remoteOrganizationName}/security/dashboard/remediation/search

AI/LLM Security · 2026-10-23

coi v0.15.0 ships AI coding-agent sandboxes with kernel-level threat monitoring, nftables network isolation, and JSONL audit streaming.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds coi shell to drop into an isolated Incus system container with the project mounted at /workspace, correct file ownership, and no host credentials exposed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds coi run -- <command> to execute arbitrary commands in the sandbox with streamed output and propagated exit codes, and coi run --prompt-name <name> for headless, unattended agent runs from a predefined prompt (suitable for cron and CI).
• Adds coi build to construct the base container image with Docker, systemd, and package-manager access pre-installed.

Identity & Access Management · 2026-10-23

ConductorOne access profiles now come in three distinct types: Catalog, Role, and Hybrid, each with purpose-built access behaviour.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Catalog access profile type: a collection of entitlements users can self-service request from the catalog.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Role access profile type: grants entitlements automatically based on a membership condition, with membership that can be granted, revoked, and requested like other entitlements — access is all-or-nothing with no piecemeal grants.
• Introduces Hybrid access profile type: the original C1 behaviour — entitlements requestable or auto-granted on a condition — now explicitly named; all existing profiles migrate to this type automatically.

Security Data Pipeline · 2026-10-23

Cribl Lake Azure Storage Locations gain Outpost support for in-network management calls and Private Endpoint support for private Search reads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Cribl Outpost support for Azure Storage Locations, routing all Azure management calls (container creation, lifecycle and retention policies, validation) through an Outpost you deploy inside your Azure vNet rather than from the Cribl control plane.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Azure Private Endpoint support for Cribl Search, enabling query traffic to your Azure Blob Storage to travel over the Microsoft backbone instead of the public internet, with a connection you approve and can revoke at any time.
• Both Outpost and Private Endpoint capabilities are opt-in per storage location, with no migration required for existing Azure Storage Locations.

Software Supply Chain Security · 2026-10-23

cyclonedx-core-java 13.3.0 adds CycloneDX 1.6 provides mapping on Dependency and bumps the SPDX license list to 3.29.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds provides mapping to the Dependency model to comply with the CycloneDX 1.6 spec.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Bumps the bundled SPDX license list to version 3.29.0, expanding license identifier coverage.
• Improves license string mappings for more accurate SPDX identifier resolution.

Software Supply Chain Security · 2026-10-23

Cycode adds Custom Maestro Agents — user-defined AI agents with configurable outcomes that plug into Agentic Workflows for automated violation triage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Custom Maestro Agents: define an agent's analysis instructions, evidence to weigh, and up to three named outcomes (plus a reserved Failure outcome) in the AI agents library — covering use cases like upgrade impact analysis, credential validity, and code ownership mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds custom Maestro agents as steps in Agentic Workflows, where each outcome branch drives a downstream action — open a Jira ticket, message a Slack channel, set severity or status, add a label, open a fix pull request, or hand off to another agent.
• Adds confidence thresholds per outcome branch (default 70%) so a branch executes only when the agent's confidence meets the configured minimum.

SIEM · 2026-10-23

Lakeflow Connect gains a Box Audit Logs managed ingestion connector (Beta) for enterprise audit events.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the Box Audit Logs connector in Lakeflow Connect (Beta) to ingest enterprise audit events from Box into Databricks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-23

DataFrame caching via df.cache() and df.persist() now available on serverless compute in Public Preview.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables df.cache() and df.persist() on serverless compute (environment version 5+) to reuse expensive DataFrame results within a session, supported by Databricks Connect for Python 18.1.8+ or Scala 18.1.5+.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-23

Databricks: Adds a managed Microsoft Entra ID connector (Beta) in Lakeflow Connect to ingest users, groups, and audit and sign-in logs via OAuth M2M.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-23

Genie Code tasks in Lakeflow Jobs reach GA, enabling autonomous prompt execution as part of automated job pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Genie Code task type to Lakeflow Jobs, which runs a prompt autonomously, reads upstream task outputs, calls tools as needed, and returns a link to the resulting Genie Code chat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SIEM · 2026-10-23

Lakeflow pipelines and pipeline_update_timeline system tables reach GA, giving full account-level pipeline audit data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Promotes the lakeflow system tables pipelines and pipeline_update_timeline to generally available, recording pipeline definitions and update history across your account.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

DefectDojo Pro adds service user tokens (ddsu_ prefix) exchangeable for OAuth 2.0 bearer tokens via POST /api/v2/oauth/token/.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds POST /api/v2/oauth/token/ endpoint to exchange a service user token (prefixed ddsu_) for a one-hour OAuth 2.0 bearer access token using the client credentials grant, sent as Authorization: Bearer <access_token>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces service user tokens in DefectDojo Pro, prefixed ddsu_, usable directly via Authorization: Token ddsu_<token> for API authentication.
• New endpoint documented: POST /api/v2/oauth/token/

Identity & Access Management · 2026-10-23

Didit adds async batch-delete jobs, filtered select-all deletion, and child-verification counts in deletion results.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds async deletion job workflow: Batch Delete Sessions returns HTTP 202 when more than 20 sessions match, and callers poll Get Session Deletion Job until the job reports COMPLETED or FAILED.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds delete_all: true to Batch Delete Sessions to delete every session matching a filter set, narrowed with filter_-prefixed parameters (e.g. filter_status, filter_date_from) mirroring the List Sessions filters — invalid or unreadable filter values are rejected before any deletion begins.
• Deletion results now include deleted_child_verifications, reporting how many key-person and company verifications were deleted as children of a business verification.

AI Runtime Defense & Guardrails · 2026-10-23

Doberman v0.19.0 adds an alert-only ambient monitor, --dry-run pruning, and tighter git branch-delete blocking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds doberman monitor run and doberman monitor status subcommands to score non-inline activity through the same risk engine in alert-only mode, never enforcing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --dry-run flag to doberman decision-log-prune to list what a prune would delete without committing the deletion.
• Extends doberman doctor to fail when Claude Code's disableAllHooks setting turns every hook off.

AI-Powered Offensive Security · 2026-10-23

Dreadnode adds SLIP jailbreak attack, enriched findings parquet with audit/compliance columns, and session pinning in Chat and Agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SLIP self-jailbreaking attack tool to AI red-teaming, enabling tree-search-based prompt jailbreaks against a target model with configurable depth, branching, and judge models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enriches the findings parquet export with new columns for audit trail, ASR, compliance tags, adversarial-ML metrics, and project-level rollups, and reflects the latest operator-reviewed severity and status.
• Adds session pinning in Chat and Agents: pin sessions from the ... menu in the Chat sidebar or Agents › Sessions; pinned sessions appear at the top of the list and are visible only to you.

Network Analysis & Monitoring · 2026-10-23

eCapture v2.8.2 includes Android executables in release archives for x86_64 and aarch64.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Includes Android executable binaries in release archives, enabling direct download and use on Android x86_64 and aarch64 devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Network Analysis & Monitoring · 2026-10-23

eCapture v2.8.0 adds Linux/LoongArch64 support and full text/keylog/pcapng capture for GnuTLS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds gnutls module support for text, keylog, and pcapng capture modes, bringing GnuTLS interception to parity with the OpenSSL module.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Supports Linux/LoongArch64 (loong64, kernel 6.6+) with tar.gz and deb release artifacts, cross-builds, BTF/ELF checks, and QEMU smoke tests.

Vulnerability Management · 2026-10-23

WAF, Bot & API Protection · 2026-10-23

Fastly adds Automatic CVE Virtual Patching setting to apply future CVE patches to your workspace on release.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables the Automatic CVE Virtual Patching setting in the Fastly control panel to auto-apply all future CVE virtual patches to a workspace as soon as they are released.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

WAF, Bot & API Protection · 2026-10-23

Adds api_endpoint provider argument and FASTLY_API_URL env var to target non-default Fastly API endpoints (HTTPS only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds api_endpoint provider argument and FASTLY_API_URL environment variable to target a non-default Fastly API endpoint (HTTPS only).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reconnaissance & OSINT · 2026-10-23

favirecon v1.1.0 expands the fingerprint database by ~349 new products and improves favicon detection via <link> tags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands the fingerprint database by 381 entries (~349 new products), broadening technology, WAF, and exposed-panel detection coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-23

API surface changed: +19 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint DELETE /defender_posture_providers/{id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint DELETE /intune_posture_providers/{id}
• New endpoint DELETE /iru_posture_providers/{id}

Secrets Detection & Management · 2026-10-23

GitGuardian v2.174.0 adds 10 new detectors, 2 new analyzers, and a new SMTP validity checker across dozens of credential types.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds new detectors for sftp_credentials_assignment SFTP credentials, Lago API keys, Composio project API keys, Composio organization API keys, Codex API keys, CARTO Basemaps API keys, Google Chat incoming webhook URLs, HubSpot CLI personal access keys, AmneziaWG VPN private keys, and Kubernetes bearer tokens stored in kubeconfig files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables validity checker for SMTP credentials.
• Adds aws_ses_keys checker timeout to reduce kills by apikey-checker.

Secrets Detection & Management · 2026-10-23

GitGuardian adds NHI Identity and Source APIs plus ticket-unlinking endpoint for secrets and honeytokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds DELETE /v1/incidents/secrets/{resource_id}/destination-tickets/{ticket_id} to unlink a Jira or ServiceNow ticket from a secret incident, public secret incident, or honeytoken without deleting the ticket on the external platform; uses resource_type query parameter to select the resource kind.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds GET /v1/nhi/identities to list non-human identities (NHIs) in the workspace, with filters including source__in, env__in, policy__in, risk_criticality__in, validity__in, principal_type__in, owner_id__in, vault_source_id__in, consumer_source_id__in, endpoint_source_id__in, provider_source_id__in, detector_group_name__in, detector_type__in, secret_family__in, secret_category__in, secret_provider__in, has_owner, has_detector, is_admin, and hmsl_hash.
• Adds GET /v1/nhi/identities/{identity_id} to retrieve a single non-human identity with its permissions and a summary of its secrets.

Secrets Detection & Management · 2026-10-23

GitGuardian Self-Hosted 2026.10 adds Wiz integration, source-status filtering, AI Hook expansion, and 19+ new secret detectors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a Wiz integration that syncs active secret incidents from version control sources to Wiz daily as native secret findings, with detection context and a link back to GitGuardian (never the secret value); requires outbound HTTPS access to your Wiz tenant.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds source-status visibility — every source now shows Monitored, Unmonitored, Unreachable, Archived, or Deleted state — and lets you filter on that status from the perimeter page and incident list, and save it as a named view.
• Adds automatic pause-and-resume for unreachable integrations (GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Confluence, Slack, and Microsoft Teams on Self-Hosted): real-time ingestion and historical scans pause when a token expires or a provider is unreachable, and resume automatically once reconnected.

SAST / SCA / Code Security · 2026-10-23

GitHub Copilot in Visual Studio gains PR exploration via Git agent, Bring Your Own Model preview, and one-click NuGet vulnerability fixing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Git agent support for exploring pull requests in Copilot Chat by attaching a PR as context from the Git Repository window, returning a summary with navigable links to comments and files — requires connecting GitHub or Azure DevOps MCP servers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Introduces Bring Your Own Model (BYOM) in preview, enabled by default across Community, Professional, and Enterprise editions, supporting Microsoft Foundry, OpenAI, Anthropic, and Ollama providers — works with or without a GitHub sign-in.
• Adds a fixer action on NuGet Audit warnings in the Error List that opens Copilot Chat in agent mode and uses the NuGet MCP server to fix vulnerable packages — requires signing in to GitHub Copilot and enabling the NuGet MCP server from the Copilot Chat tools menu.

SAST / SCA / Code Security · 2026-10-23

Copilot usage metrics API now surfaces named custom skills, agents, MCP servers, slash commands, and plugins — up to 25 entries each.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The totals_by_skill, totals_by_custom_agent, totals_by_mcp, totals_by_slash_cmd, and totals_by_plugin arrays in enterprise and organization usage reports now show the configured name of each customer-defined item instead of grouping them under other or custom.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Each totals_by_* array now returns up to 25 named entries per record, up from 5, with remaining activity collapsed into a trailing other entry.
• Named entries appear in all report scopes: per-user 1-day and 28-day reports, aggregated 1-day reports, and day_totals inside aggregated 28-day reports.

SAST / SCA / Code Security · 2026-10-23

GitHub rolls out enforcement of the global default policy for Copilot features on Business and Enterprise plans through October 26.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a global default policy for generally available Copilot features, reachable via AI Controls → Copilot → Default policy for new features, that sets unconfigured eligible settings to Enabled, Disabled, or Let organizations decide on Copilot Business and Enterprise plans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Applies the global default policy to eligible settings on the Features & clients and MCP servers in Copilot configuration surfaces.

SAST / SCA / Code Security · 2026-10-23

GitHub meta API now lists new Actions blob storage endpoints; network allowlists must add the new host ranges to avoid broken job logs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds productionresultssa30.blob.core.windows.net through productionresultssa49.blob.core.windows.net and productionresultssa100.blob.core.windows.net through productionresultssa199.blob.core.windows.net as new GitHub Actions blob storage hosts, retrievable via the REST meta data API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

SAST / SCA / Code Security · 2026-10-23

GitHub Enterprise Cloud with data residency gains public monitoring for secret scanning via verified domain matching.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Delivers secret scanning alerts encrypted directly to the enterprise dashboard, keeping data within the designated geography through tenant isolation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enterprise admins and enterprise security managers can enable public monitoring under enterprise security settings, included at no additional cost with an active GitHub Advanced Security or GitHub Secret Protection license.

SAST / SCA / Code Security · 2026-10-23

GitHub PR review gains persistent whitespace preferences and full-width split view for new/deleted files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a persistent whitespace visibility preference under Settings → Whitespace changes with options Always show, Always hide, or Hide for this diff only, applied per user across all pull requests.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Displays an active Hide whitespace filter badge beside All commits when whitespace is hidden, with an X to temporarily reveal whitespace without changing the saved preference.
• In split view, new and deleted files now span both columns (full width), matching unified view behavior to reduce line wrapping.

SAST / SCA / Code Security · 2026-10-23

Copilot impact dashboard gains opt-in industry benchmarking, letting enterprises compare agentic adoption against peer medians and top deciles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Industry comparison section to the Copilot impact dashboard showing agentic adoption and leverage benchmarks ranked against a peer median and top decile for the 28-day reporting period.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables peer group filtering by company size (1–999, 1,000–4,999, or 5,000+ employees) and one of ten industries, with automatic widening to all industries when a selected industry's peer group is too small.
• Adds a Copilot metrics industry comparison policy — opt in from the dashboard or centrally from enterprise or organization Copilot policies — that controls both data contribution and visibility with a single toggle.

SAST / SCA / Code Security · 2026-10-23

SAST / SCA / Code Security · 2026-10-23

gosec v2.30.0 adds G125 to detect unescaped url.JoinPath elements and extends G706 log/slog method coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends G706 to cover additional log/slog methods.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Names the sink in taint finding messages for clearer taint-analysis output.

Vulnerability Management · 2026-10-23

GSA v28.5.0 adds markdown-rendered NVT technical info, anchor scrolling on detail pages, and richer chart hover effects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Renders NVT technical information using React-markdown and enables scrolling to anchors on DetailsPage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds technical information links in result views and updates localization files.
• Adds hover effects with dimming transitions to BarChart, BubbleChart, WordCloudChart, ScheduleChart, and DonutChart for improved dashboard interactivity.

Vulnerability Management · 2026-10-23

gvm-libs v23.15.0 adds CA certificate data support to the LDAP and Active Directory connector interfaces.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables gvmldap to accept CA certificate data directly, supporting more flexible TLS configurations for LDAP connections.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Enables ad_connector to accept CA certificate data directly, supporting more flexible TLS configurations for Active Directory connections.

Vulnerability Management · 2026-10-23

gvm-libs v23.14.0 updates the Agent Controller client to handle the revised agent response format.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Updates the agent_controller client to handle the revised agent response format from the Agent Controller.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

gvm-libs v23.13.0 adds encryption and anonymization options for agent support bundles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds encryption and anonymization options for agent support bundles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

gvmd v26.42.0 adds scan config information to report XML output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds scan config information to report XML output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

gvmd v26.41.0 adds support for executable report format files and validates keys/certificates on credential modification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports executable report format files, enabling custom executable-based report generators.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Validates keys and certificates when modifying credentials, hardening credential store mutations.

Reconnaissance & OSINT · 2026-10-23

API surface changed: 6 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GET /domain-search: param provenance (query) added⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GET /leads: param query (query) added; param sort (query) added
• POST /domain-search: param provenance (query) added

AI Red Teaming & Testing · 2026-10-23

ifixai v4.3.0 adds chat-native auditing for 15 inspections, new author, windtunnel commands, V11 check, and stricter --judge-budget controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ifixai author command to generate a fixture from a short JSON agent profile; --example writes a starter profile and --force allows overwriting an existing file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds ifixai windtunnel command with subcommands controls, run, sweep, and sensitivity to measure whether governance defects are caught by the suite and report false-positive rates — runs offline without changing grades.
• Extends ifixai validate to check evidence floors, refusing any fixture that would leave an inspection without a verdict; accepts the same -b, -c, --suite, --strategic, and --full-run flags as ifixai run.

Secrets Detection & Management · 2026-10-23

Infisical adds Agent Vault for AI agents to operate without holding credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces Agent Vault, enabling AI agents to run with the access, context, and capabilities they need without ever holding a credential.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-10-23

Infisical v0.167.1 adds Linux Server certificate discovery to PKI capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Linux Server certificate discovery to the PKI certificate management surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-23

ipatool v2.7.0 adds MCP server, phone-number sign-in, and expands app downloads to tvOS, watchOS, Arcade, and legacy macOS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds mcp subcommand to serve App Store tools (search, download, list-purchases, list-versions, get-version-metadata, purchase) over MCP via stdio for AI agent integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds phone-number sign-in support for Apple Accounts in mainland China and India.
• Supports downloading delisted tvOS apps by numeric app ID.

Patch Management · 2026-10-23

Ivanti Neurons for Patch Management 2026.4 adds concurrent deployment conflict resolution and an AI Risk Summary tile for prioritized patch insights.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an AI Risk Summary tile on the Deployment History page that uses AI to summarize and prioritize patch deployment status, surfacing successful deployments, issues needing attention, and urgent conditions without manual data-grid review (Technical Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

MCP Servers & Tooling · 2026-10-23

jadx-ai-mcp v6.5.0 adds annotation tools, OpenAI-compatible client, and Kotlin metadata slimming across all source-returning tools.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds add_comment and list_comments MCP tools (bringing total to 34), backed by new plugin GET /add-comment and GET /list-comments endpoints in CommentRoutes, so agents can annotate decompiled classes, methods, fields, or individual lines and have comments persist in the JADX project file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds slim=True default parameter to get_class_source, get_method_by_name, fetch_current_class, get_main_activity_class, and get_main_application_classes_code, stripping @Metadata and @DebugMetadata Kotlin compiler annotations and returning source 25-50% smaller; pass slim=False to restore original output.
• Adds examples/openai_compatible_client.py, a client for --http server mode that converts the 34 MCP tools into OpenAI function-calling tools and drives any POST /v1/chat/completions-compatible provider (OpenRouter, LiteLLM, vLLM, Ollama, OmniRoute) via --base-url, --api-key, --model, OPENAI_* environment variables, --list-tools, --max-steps, and --max-tool-chars.

Backup & Recovery · 2026-10-23

Kasten K10 9.0.9 adds Kubernetes 1.36 support, per-policy timeout annotations, restartless log-level control, and new Helm limiters.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds the logLevelOverrides Helm value (requiring features.restartlessLogLevelChange, enabled by default on new installs) to set the log level (info, debug) of individual Veeam Kasten services without restarting; adds the ability to specify the global Kasten log level without requiring a restart; and new operation pods now inherit the current log level of the service that creates them, with explicit LOG_LEVEL settings and command-line logging options retaining precedence.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds limiter.repositoryOperationsPerCluster Helm value (default: 3) to cap concurrent background repository maintenance runs and storage usage scans.
• Adds per-policy action phase timeout overrides via annotations k10.kasten.io/backup-timeout, k10.kasten.io/restore-timeout, k10.kasten.io/retire-timeout, and k10.kasten.io/blueprint-resource-hooks-timeout on the policy object.

Backup & Recovery · 2026-10-23

Kasten K10 9.0.9 adds Veeam Backup & Replication 13.2 compatibility and enforces minimum timeout Helm parameter values.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds support for the updated data mover certification exchange required for compatibility with Veeam Backup & Replication 13.2 and later.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-10-23

Kingfisher v2.14.0 adds Azure Blob Storage scanning, OAuth2 validator auth, rsa_sha256 JWT signing, Jira access checks, and unified path/extension filtering across all stor⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds rsa_sha256, luhn_valid, and iban_valid Liquid filters: rsa_sha256 enables RS256 JWT validation with PKCS#1/PKCS#8 PEM keys, while luhn_valid and iban_valid provide offline checksum validation for rule validation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Azure Blob Storage scanning with SAS, account-key, Entra-token, and anonymous authentication.
• Adds shared path/extension selection across files, Git sources, and archive members; S3, GCS, Azure Blob, and Hugging Face storage scans filter before downloading and support resumable listings and incremental caching.

Secrets Detection & Management · 2026-10-23

Kingfisher v2.13.0 adds bounded Amazon Bedrock discovery to AWS blast-radius mapping with regional foundation-model and inference-profile visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• JSON and both HTML viewers retain region/model context without invoking or enabling models; the standalone graph uses model IDs as labels with full ARNs in the details.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secrets Detection & Management · 2026-10-23

Kingfisher v2.12.0 adds local Docker image scanning, SMTP credential validation, and opt-in AWS responder credentials with explicit deactivate/delete actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds opt-in AWS responder credentials via a named profile or the default credential chain, with explicit deactivate or delete actions — deletion is never an automatic fallback.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds SMTP credential validation through STARTTLS or implicit TLS without sending email, including credential URIs, common-port fallback, and distinct accepted, rejected, and inconclusive outcomes.
• Adds local image scanning through the Docker Engine API via Bollard, with active-context support, Docker CLI/OCI fallbacks, and cleanup of failed local attempts.

Secrets Detection & Management · 2026-10-23

Kingfisher v2.11.0 adds composable Python scan inputs, Git-scope enumeration, DetectionScanner, archive expansion, and 488 built-in rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Python SDK caching by default with Rules(cache_dir=...) and Rules(cache=False) controls, and reuses compiled rule caches across compatible deployments using exact engine build identity, automatically recompiling on native CPU/version rejection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds composable Python filesystem and Git-history enumeration via ScanInput, filesystem(), git_history(), and Scanner.scan_inputs(), plus native git_inputs() with GitScope history baselines, inclusive branch roots, time windows, snapshots, net diffs, staged index content and unreachable object coverage; GitInput retains author/committer identities, times, parents and messages.
• Adds opt-in Python DetectionScanner and Rust detection options for shared CLI confirmation/component-window semantics, credential-URI fallback, secret containment suppression, bounded two-level Base64 decoding, inline-ignore and HTML/CSS context filtering, along with a frozen Python DetectionPolicy configuration, direct native finding properties, structured result conversion, and scanning of borrowed Python bytes.

Secrets Detection & Management · 2026-10-23

Kingfisher v2.10.0 adds cooperative scan timeouts/cancellation to Rust and Python SDKs, gix-backed Git metadata, and environment variables KF_GIT_BINARY and KF_GIT_SSL_B⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds KF_GIT_BINARY and KF_GIT_SSL_BACKEND environment variables for controlling Git binary selection and SSL backend on Windows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Replaces Git subprocesses with gix for faster repository audit metadata.
• Adds Python rule-detail inspection and a Rust embedding example covering regexes, filters, dependencies, validation, and revocation definitions.

Secrets Detection & Management · 2026-10-23

Kingfisher v2.9.0 adds --no-limits, --user-file, and --since-hours flags plus parallelised GitHub/GitLab org scans⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --no-limits flag to remove all scan budget and timeout caps in a single switch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --user-file for GitHub and GitLab scans to supply a list of users or groups from a file.
• Adds --since-hours N to scan only recent Git history within the last N hours.

Secrets Detection & Management · 2026-10-23

Kingfisher v2.8.0 adds a native wizard GUI, stabilized 1.0.0 embedding APIs, and full-range commit scanning by default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Git author name and email to finding metadata alongside existing committer information.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the optional native wizard (gui) for configuring scans, tracking progress, and inspecting JSON/JSONL or SARIF reports with filters, exports, and Git provenance.
• Adds independent report tabs and native Kingfisher desktop icons for macOS, Linux, and Windows in the wizard.

Secrets Detection & Management · 2026-10-23

Kingfisher v2.7.0 adds opt-in bounded verification for ambiguous credential pairs across AWS, BrowserStack, ClickHouse Cloud, MongoDB Atlas, PlanetScale, Razorpay, and Wiz.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds opt-in bounded verification for ambiguous credential components, with ranked candidates for AWS, BrowserStack, ClickHouse Cloud, MongoDB Atlas, PlanetScale, Razorpay, and Wiz.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Limits candidate verification searches to at most 16 combinations within 30 seconds, keeps unresolved pairings inconclusive, requires supported fixed destinations, disables HTTP redirects, and keeps unselected secrets out of reports.

Secrets Detection & Management · 2026-10-23

Kingfisher v2.6.0 adds GitHub Gist, GitLab snippet, and Bitbucket Cloud snippet scanning, plus a --disk-offload flag to manage finding memory across large scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --disk-offload flag to offload accumulated finding memory to disk across repositories, falling back to memory with a warning when temporary storage fills up.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds opt-in GitHub Gist scanning with full Git history support.
• Adds GitLab snippet and Bitbucket Cloud snippet scanning with full Git history support.

Network Analysis & Monitoring · 2026-10-23

Kubeshark v53.6.0 adds private-CA S3 snapshot support, a trace log level, and step-by-step auth diagnostics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds tap.snapshots.cloud.s3.insecureSkipVerify config key to let the Hub connect to S3-compatible endpoints signed by a private CA, enabling cloud snapshots that previously failed the startup bucket check.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds logLevel: trace support in the Hub, worker, and dissector; the Hub now also propagates its log level to spawned dissection jobs, which previously ran at their own default.
• Adds step-by-step authorization diagnostics: every REST, MCP, and Connect-RPC denial now logs the route, required capability, resolved role, and effective capability set; OIDC pipeline logs discovery, login, token verification, and role resolution; snapshot creation records request details, per-worker results, and distinguishes three previously identical 'no PCAP files found' causes — all at trace with actionable outcomes at warn.

WAF, Bot & API Protection · 2026-10-23

Levo 1.4.0 makes authentication a first-class surface: per-endpoint auth visibility, autonomous posture findings, and exportable web scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Every API endpoint now shows how it authenticates directly in the inventory view.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Application Insights gains a dedicated view for tracking weak authentication trends over time.
• Web application scans can be saved and shared as a file.

Agentic Infrastructure · 2026-10-23

microsandbox v0.7.9 adds live label edits, port-publish modify, sandbox exit outcomes, HTTP CONNECT proxy auth, JSON policy denials, output backpressure, and backend restrict⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds context commands and the ability to restrict allowed backends via feat(config) configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds HTTP CONNECT proxy basic authentication support for network egress through authenticated proxies.
• Returns JSON-formatted policy denials by default when network requests are blocked by policy.

Identity & Access Management · 2026-10-23

mock-oauth2-server 6.1.0 tightens OAuth 2.0/OIDC spec compliance with corrected error codes, logging behaviour, and algorithm advertisement⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Set LOG_LEVEL=DEBUG to include stack traces for client errors that are otherwise logged at INFO level.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Unknown grant_type now returns unsupported_grant_type instead of invalid_grant, per RFC 6749 section 5.2.
• id_token_signing_alg_values_supported in the discovery document now lists only the configured algorithm (RS256 by default) instead of every algorithm the server knows.

Reconnaissance & OSINT · 2026-10-23

Nerva v1.77.1 adds a PHP fingerprinter with version/SAPI detection and php2shell finding detection.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PHP fingerprinter with version and SAPI detection, plus php2shell security findings support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-23

Recursive PDB search via --sympath-append / .sympath+ loads mounted ISO driver symbols eight levels deep without manual copying.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds recursive subdirectory scanning (eight levels deep) to --sympath-append and .sympath+, so a mounted virtio-win ISO's driver PDBs (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ viostor/w11/amd64/viostor.pdb) load without copying them out; .reload re-scans the directory for PDBs added since the session started.

Reverse Engineering · 2026-10-23

ntoseye v0.50.0 overhauls the Python SDK: unified command methods, typed record results, and a redesigned Stop hierarchy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds SDK methods for previously uncovered commands: dbg.inspect.hang(), decode_bugcheck(), blackbox_bsd() and other blackbox_*() reports, session_processes(), vtop(), set_global_flags(), virtio_driver(), vring_raw(), etw_save(), etw_crash_save(), etw_crash_session(), Memory.pte(), Process.inspect(), decode_peb(), loader_modules(), Thread.decode_teb(), UserDump.address_report(), Breakpoints.list(), and commands().⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Every SDK handle (Process, Thread, Module, Cpu, Heap, Driver, Device, Breakpoint, Trustlet, UserThread, and the hypervisor handle) now exposes its record as .info, each record field as a property, to_dict(), and == and hash equality scoped to the named object and its target.
• An exception passing a notify filter (sxn) is now reported as a notice on every host: in the REPL, via dbg.notices() in the SDK, and over MCP and DAP, and its -c command runs.

Reverse Engineering · 2026-10-23

ntoseye v0.49.0 adds user-mode minidump analysis, dx data model, NDIS/StorPort/registry inspection, power-hang diagnosis, and KMDF request tracing⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --dump to open Windows user-mode minidumps (AMD64 and ARM64) from procdump, Task Manager, and Windows Error Reporting, with lm, ~, .ecxr, .exr -1, k, !analyze, !teb, !peb, !gle, !dlls, !handle, !address, !vprot, !heap, .time, vertarget, dt, x, ln, dx, $teb, and $peb reading captured memory; the SDK exposes results via dbg.user_dump and inspect.triage().⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds --srcpath <directory> to map a driver's source tree from session start (repeatable), equivalent to .srcpath+.
• Adds dx to read WinDbg's debugger data model: Debugger.Sessions, @$cursession, @$curprocess, @$curthread, KernelObject, Io.Handles, LINQ-style queries with lambdas (Where, Select, OrderBy, SelectMany, First, Any, Count), Debugger.Utility.Collections.FromListEntry, grid output via dx -g, and format modifiers , d and , <count>.

Reverse Engineering · 2026-10-23

ntoseye v0.48.0 adds virtio/StorPort/NDIS I/O inspection, crash-dump blackboxes, ETW sessions, dx, and Tern browser stepping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds !virtio to list guest virtio devices and queue states (held, unclaimed, moved) and name a stuck queue, !vring to show a queue's buffers and decode SCSI, network, or GPU requests with device answers, !storagekd.storadapter and !storagekd.storunit to show StorPort adapters and units (viostor, vioscsi, storahci) with state, frozen/paused/busy queue, and each miniport request's IRP and SRB, and !ndiskd.miniports, !ndiskd.miniport, and !ndiskd.minidriver to show guest network miniports (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ NetKVM) including driver, state, link, adapter context, filter stack, bindings, and pending OID request; SDK exposes inspect.virtio() and inspect.vring().
• Adds guest debug output (DbgPrint) support on gdb and memory backends: REPL prints it live, MCP results carry it as [dbgprint], DAP shows it in its console; !dbgprint dumps the full kernel buffer on all backends including crash dumps.
• Adds .enumtag, !blackboxbsd, !blackboxntfs, !blackboxpnp, !blackboxwinlogon, and !blackboxpci to list and decode bugcheck-callback tagged data in a crash dump, !wdfkd.wdfcrashdump to show the KMDF In-Flight Recorder log, and !wmitrace crash-dump support to read ETW sessions Windows saves in a minidump (e.g. EventLog-System, WiFiSession) and decode their events; SDK exposes version().dump.tagged_blocks, inspect.read_tagged(), inspect.wdf_crash_log(), inspect.wdf_crash_drivers(), inspect.etw_crash_sessions(), and inspect.etw_crash_events().

Reverse Engineering · 2026-10-23

ntoseye v0.47.0 adds a native Tern REPL UI with rich cards/tables/trees, a display command, and a full-screen browse code and memory browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds display <expression> to show an expression's value at every stop, marked when it changed; display alone lists active displays and undisplay removes them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds browse command (also reachable via F2 in Tern) opening a full-screen code and memory browser: pages through disassembly and memory as hex, colored bytes, an inspector, or pointers with symbols; g navigates to an expression, / finds text/bytes/a pointer, and b sets or clears breakpoints in code or write watchpoints in memory.
• Tern prompt gains Tab completions narrowing in a popup, live line coloring as you type, Ctrl+Z undo, paste-as-one-command, Alt+P palette searching commands/recent lines/symbols/types/processes, and Ctrl+R opening the palette on history.

Reverse Engineering · 2026-10-23

ntoseye v0.46.0 adds live debugging inside Windows Sandbox and Hyper-V VMs: breakpoints, stepping, memory and register writes on guest VPs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds hardware breakpoints and data watchpoints in a Windows Sandbox or Hyper-V guest (experimental, gdb backend): ba in a .partition view sets a breakpoint scoped to that guest's VPs, /c selects a VP, and /p, /t, and conditions read that guest.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds g, t, p, gu, and g <address> in a .partition view to run, step, step-over, step-out, and run-to-address inside the guest's thread.
• Adds eb, ed, and other memory-write commands in a .partition view to change the guest's memory, and r to change registers of a VP stopped at a breakpoint.

Reverse Engineering · 2026-10-23

ntoseye v0.45.0 adds full Windows hypervisor debugging: partition/VP inspection, EPT walking, hypercall tracing, and breakpoints on hypercalls and VM exits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds hypervisor partition and VTL state inspection: !hvpartitions shows the hypervisor's partitions as a tree with privileges and !hvvps lists a partition's virtual processors and the host processors running them (SDK: dbg.hypervisor_partitions(), VirtualProcessor.processors); !hvr [partition vp [vtl]] displays the registers of any hypervisor VP, including those no processor currently runs (such as a WSL2 VP blocked in HLT) (SDK: VirtualProcessor.registers()); .partition <id> inspects the Windows guest of a hypervisor partition (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ a Windows Sandbox) in place of the target, read-only, using its kernel symbols, with .partition 1 returning to the target (SDK: Debugger.select_partition(), Debugger.partition); .vtlcxr 1 selects the hypervisor-saved state for VTL1 so that k, r, u, and expressions inspect the secure kernel where it left off (read-only), with .vtlcxr returning to VTL0; the SDK adds SavedVtlState.general_registers and may_be_stale, exposing the VM exit's qualification, interruption info, instruction length, and recovered guest GPRs, marking stale states '(may be one exit behind)' and excluding them from automatic selection; and hypervisor stack unwinding uses hvix64.exe unwind data (when a copy is in the symbol cache or local store, importable with .fetchimage /f <file> or Symbols.import_image()), with prologue-based fallback marked [prolog], as Cpu.backtrace() gains a vtl= parameter to walk from a saved VTL state.
• Adds hypervisor memory and VMCS inspection commands: !hvept <gpa> (or -v <address> for a root virtual address) walks each VTL's extended page tables to show host address, access, page size, and memory type, while !hveptdiff lists guest physical ranges where VTL0 and VTL1 map differently (SDK: HypervisorVtl.translate(), VirtualProcessor.ept_differences()); !hvvmcs [-msr|-io] displays every field of a VTL's Enlightened VMCS, the MSRs it intercepts or passes (named, e.g. IA32_EFER), and its intercepted I/O ports (SDK: HypervisorVtl.vmcs_fields(), msr_intercepts(), io_intercepts()); and !hvd reads and !hvu disassembles a guest partition's memory (virtual 4-level long-mode or -p physical) (SDK: HypervisorVtl.read(), translate_virtual(), disassemble()).
• Adds hypercall and VM-exit inspection and breakpoints: !hvcalls lists the hypervisor's hypercall table with TLFS names, rep/variable-header flags, input/output sizes, and handlers (-a includes unimplemented codes) (SDK: dbg.hypercalls()); !hvbp <call> [partition [vp]] breaks on a hypercall only from a given caller, with a condition evaluated on the caller's registers and memory (e.g. $pqwo(rdx) for slow-call input) (SDK: Breakpoints.add_hypercall(), Breakpoint.hypercall, Cpu.hypercall_caller()); !hvexit <reason> [partition [vp]] stops on a VM exit by reason (cpuid, rdmsr, wrmsr, ept_violation, or a number) from a given caller, with a condition on the caller's registers at the exit (e.g. !hvexit wrmsr if @rcx==0x6e0) (SDK: Breakpoints.add_exit(), Breakpoint.vm_exit); and !hvcall at a hypervisor stop shows the full hypercall input, including XMM fast calls, rep lists, and extended GVA flush ranges with addresses, page counts, and page sizes.

General Utilities & Libraries · 2026-10-23

Obsidian 1.15.0 adds faster themed Mermaid diagrams via Pele, reorderable Bases filters, and new URI/CLI heading-append commands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds URI/CLI commands to append or prepend content to a heading, with control for line breaks around the appended/prepended content.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Replaces the Mermaid rendering engine with the new Pele library, supporting Mermaid 12.1.0 syntax, theme-matched colors and fonts, responsive sizing, and zoom/pan for scaled-down diagrams with no code-execution sandbox required, and adds --mermaid-* CSS variables for colors, corner radius, and font weights to let developers style Mermaid/Pele diagrams.
• Exposes window.pele for new code to use once loadMermaid() resolves, and updates loadMermaid() and window.mermaid to draw with Pele supporting initialize(), render(), parse(), and mermaidAPI.getConfig(), setConfig(), and render().

General Utilities & Libraries · 2026-10-23

Obsidian Mobile 1.15.0 adds voice capture with live transcription, PDF export, and Siri/Spotlight Quick Capture integration on iOS.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds voice note recording and live transcription to iOS Quick Capture, including from the Lock Screen, with recordings saveable to your vault (requires iOS 26).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Quick Capture to Spotlight actions and Siri, enabling invocation via phrases like Open Quick Capture in Obsidian.
• Adds PDF export for notes on mobile.

Identity & Access Management · 2026-10-23

OpenFGA v1.22.0 adds read-replica support to the MySQL datastore via --datastore-secondary-uri.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds read-replica (primary/secondary) support to the MySQL datastore backend via --datastore-secondary-uri (or OPENFGA_DATASTORE_SECONDARY_URI), routing non-HIGHER_CONSISTENCY reads to the replica and all writes to the primary; GetStore, ListStores, ReadAssertions, ReadAuthorizationModel, ReadAuthorizationModels, FindLatestAuthorizationModel, and ReadChanges always hit the replica when configured.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

OpenVAS Scanner v23.52.0 adds a GET /health/performance API endpoint for scanner performance monitoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GET /health/performance endpoint to query scanner performance metrics via the REST API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

OpenVAS Scanner v23.51.0 replaces its HTTP API with an axum-based implementation, tightening routing and Content-Type enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Requires Content-Type: application/json on all routes that accept a JSON-encoded payload — requests without it are now rejected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Routes with a trailing / are now treated as separate, distinct routes and return 404 instead of matching the non-trailing route.
• The enable-get-scans option under [endpoints] now works correctly and defaults to false as documented — previously it was silently ignored and defaulted to true.

Identity & Access Management · 2026-10-23

Ory Hydra admin API events now capture who made the request, giving audit trails for Identities, OAuth2, and Permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds actor identity to events emitted by Ory Identities, Ory OAuth2, and Ory Permissions when handling authenticated admin API requests, enabling audit trails that show who made each admin action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

OXO v2.19.0 adds pause/resume and save-and-restart capabilities for local scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds pause and resume support for local scans, letting practitioners halt and continue in-progress scans without losing state.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Captures and persists the state of a local scan universe to a local file, enabling scan state to survive restarts.
• Saves the full definition of a local scan to disk so it can be started again later without re-specifying all parameters.

Vulnerability Management · 2026-10-23

OXO v2.18.0 adds scan snapshot capture and restore, enabling paused universe state to be preserved and resumed across MQ, Redis, and agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds snapshot bucket options to the oxo scanner command so agents receive snapshot storage configuration through their settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Captures the full MQ (RabbitMQ) and Redis state of a running universe and stores it in the snapshot bucket for later restoration.

Vulnerability Management · 2026-10-23

OXO v2.16.0 adds a new TCP message type and extends open-port discovery to both TCP and UDP protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Introduces a new TCP message type and adds open-port reporting for both TCP and UDP protocols.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

OXO v2.15.0 adds scan snapshot/restore and experimental agent release channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds experimental release channel support for agent installation and fetching, enabling use of pre-release agent builds.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds the ability to snapshot and restore the state of a scan universe, enabling scan continuity across interruptions.
• Adds support for storing scan snapshots in a bucket for durable, remote snapshot persistence.

Vulnerability Management · 2026-10-23

OXO v2.14.1 adds a generic OpenAI-compatible provider for self-hosted AI models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a generic openai_compatible provider to the AI subsystem, enabling use of self-hosted or third-party OpenAI-compatible models.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Vulnerability Management · 2026-10-23

OXO v2.14.0 adds shared AI model/provider infrastructure for agents and expands provider support to include Mistral, Qwen, and Ollama.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds shared AI model and provider construction infrastructure (ostorlab.ai) for use across OXO agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Mistral, Qwen, and Ollama as supported AI providers for agents.

Vulnerability Management · 2026-10-23

OXO v2.11.0 adds vulnerability_target to vulnerability messages and mixin for richer vuln attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds vulnerability_target field to the vulnerability message and mixin, enabling agents to specify the exact target associated with a reported vulnerability.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Post-Exploitation · 2026-10-23

Pathrunner v1.0.0: modular AWS privilege-escalation framework with 80+ exploit modules, Metasploit-style REPL, and PMapper integration⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Launches an interactive Metasploit-style REPL (pathrunner) with identity add, identity list, identity switch, search, info, use, show options, show payloads, set, and exploit commands for navigating and executing AWS privilege-escalation modules, alongside a scriptable CLI interface that shares identical command handlers via an adapter pattern.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Ships 80+ exploit modules across 20+ AWS services — IAM, EC2, Lambda, STS, ECS, Glue, CloudFormation, SSM, Bedrock, and more — sourced from the pathfinding.cloud catalog.
• Provides dozens of interchangeable payloads selectable at runtime via set PAYLOAD, including credential exfiltration (exfil/response), HTTPS exfiltration, backdoor role/user/policy creation, and reverse shells.

Post-Exploitation · 2026-10-23

Pathrunner v0.2.3 adds --from-profile alias, purple team CloudTrail logging, and expands backdoor payloads to IAM roles.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --from-profile alias to the identity add CLI command for loading AWS identities by profile name.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds purple team CloudTrail event logging across all exploit modules and the discovery layer.
• Extends backdoor/attach-policy payloads to support IAM roles in addition to IAM users.

Cloud Security Posture · 2026-10-23

Cloud Security Posture · 2026-10-23

Plexicus v1.2.55 adds C#/.NET and Razor AI-SAST coverage plus a rebuilt PlexiFlow automation editor with undo, visual conditions, and scheduling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends AI-SAST engine to cover C#/.NET and Razor source files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds searchable pickers to the PlexiFlow automation editor.
• Adds a schedule builder to the PlexiFlow automation editor.

Software Supply Chain Security · 2026-10-23

plumber now publishes an API — 131 endpoints across 27 areas: Config, Projects, Settings, …⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds API endpoint coverage across all areas: Config (26 endpoints) — create, read, update, delete; Projects (19 endpoints) — create, read, update; Settings (19 endpoints) — create, read, update, delete; Catalog (12 endpoints) — create, read, update, delete; Issues (11 endpoints) — create, read; Me (6 endpoints) — create, read, delete; Reports (6 endpoints) — create, read, update; Audit (4 endpoints) — read; plus 19 more areas: Auth, Overview, Sync, Dependencies, Onboarding, Badge, Controls, Events, Healthz, Instances, Issue Types, Openapi.yaml, Policy Templates, Pushes, Readyz, Recheck, User, Users, Version.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-23

Plumber v0.7.11 locks workflow steps via a lockfile and accepts tags backed by immutable releases for GitHub Actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Workflow lockfile now pins individual steps rather than reusable workflows, tightening supply-chain control for GitHub Actions pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Accepts a tag backed by an immutable release as a valid reference, expanding the set of allowed action pinning strategies.

Software Supply Chain Security · 2026-10-23

Plumber v0.7.9 adds detection of invalid GitHub Actions workflow files as a CI control.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds detection of invalid GitHub Actions workflow files as a flagged control, surfacing YAML parse failures that would otherwise silently pass CI checks.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-23

In platform mode, plumber now exposes the full capability list rather than a restricted subset.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Expands the set of capabilities served in platform mode to the complete built-in list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-23

Plumber v0.7.5 adds a capability recognition engine with a defaults command, built-in capability list, glob matcher, and --pbom artifact output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds plumber capabilities defaults command to print the built-in capability list, ready to copy into .plumber.yaml.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a capability recognizer with five evidence rules that detects capabilities from the pipeline context or .plumber.yaml declarations.
• Adds --pbom artifact flag so a push carries the recognized capabilities in the PBOM output.

Software Supply Chain Security · 2026-10-23

Plumber v0.7.1 adds GitHub job trigger analysis, environment checks, claim-state tracking in reports, and a three-valued score evaluator.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds GitHub Actions analysis for who can trigger a job, environment protections, inert jobs, and the real default token permissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds claim-state tracking to every path claim in the report, using the Radar corpus as a regression gate.
• Introduces a three-valued evaluator for job conditions and claim states in the scoring engine.

Software Supply Chain Security · 2026-10-23

Software Supply Chain Security · 2026-10-23

Plumber v0.6.4 adds the ability to exempt specific images from forbidden-tag controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds exemption support in controls to skip listed images from forbidden-tag enforcement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-23

Plumber v0.6.1 enforces authorized sources for GitLab CI components and functions, and factors them into the contextual score.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a control requiring GitLab CI components and run: step functions to come from authorized sources.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Collects run: step functions and the registry host in the intermediate representation (IR) for GitLab CI pipelines.
• Includes component and function sources as inputs to the contextual score.

Software Supply Chain Security · 2026-10-23

plumber v0.6.0 makes contextual scoring the default and adds job facts for attack-path analysis in situation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Makes the contextual score the default on every output, with a labelled corpus and migration report; use --score-profile v3 or set PLUMBER_ANALYZE_SCORE_PROFILE=v3 to keep the previous formula.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds job facts for attack paths, entry subjects, push trigger filters, and cache inheritance to the situation command.

Software Supply Chain Security · 2026-10-23

Software Supply Chain Security · 2026-10-23

Plumber v0.5.21 runs each job in a dedicated environment and scopes GITLAB_TOKEN to the plumber environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Runs each job in a dedicated environment, isolating execution for improved security posture in CI/CD pipelines.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Scopes GITLAB_TOKEN to the plumber environment in GitLab CI/CD variables, limiting token exposure.

Software Supply Chain Security · 2026-10-23

Plumber v0.5.19 adds per-job situation facts evaluation and GitLab CI only/except keyword support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds per-job situation facts and their engine entry point to the situation analysis subsystem.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds support for GitLab CI only and except keywords on jobs.
• Evaluates situation facts and attaches them to the control analysis output.

Software Supply Chain Security · 2026-10-23

Plumber v0.5.18 enriches GitHub Actions and GitLab CI pipeline models with visibility, runs-on, needs, caches, artifacts, and environment data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• GitHub Actions jobs now carry runs-on, needs, caches, and artifacts fields in the pipeline model.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• GitLab CI jobs now carry needs, caches, artifacts, and environment fields in the pipeline model.
• GitHub repository visibility is collected into the pipeline model.

Software Supply Chain Security · 2026-10-23

plumber analyze now accepts a repository as a positional target, enabling remote scans without a local clone.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds positional target argument to plumber analyze so you can pass a repository (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ github.com/owner/repo or gitlab.com/group/project) directly on the command line without a local clone.

Software Supply Chain Security · 2026-10-23

Plumber v0.5.13 carries if conditions for GitHub Actions jobs, actions, and run scripts into its IR.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Extends the GitHub Actions intermediate representation (IR) to carry if conditions for jobs, actions, and run scripts, enabling more precise conditional-flow analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-23

plumber v0.5.12 trusts the Microsoft Artifact Registry by default in its built-in config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Microsoft Artifact Registry to the default trusted registries in the built-in configuration, so pipelines that pull mcr.microsoft.com images no longer require manual trust entries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Reverse Engineering · 2026-10-23

pwndbg 2026.10.22 adds m68k support, Objective-C inspection, Android Bionic detection, Linux 7.0 SLUB sheaf/barn, setrlimit, and SIMD register display.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds nearpc --opcode / nearpc -o to show opcode bytes sized to the longest instruction in the listing, or nearpc -o 4 for a fixed-width column — without changing nearpc-num-opcode-bytes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds objc show-class -n <ClassName> to display Objective-C class metadata in pseudo-ObjC syntax, including method implementations and selector addresses, with -a <address> and -m <module> lookups, and objc list-classes to list Objective-C classes in the main module, where -a includes all modules except the DYLD shared cache and -A includes it.
• Adds setrlimit command to set debugee resource limits — e.g. setrlimit nofile 1 2 sets soft and hard open-file limits, setrlimit core infinite sets both core-file limits to unlimited.

Vulnerability Management · 2026-10-23

Vulnerability Management · 2026-10-23

Threat Intelligence · 2026-10-23

Recorded Future API docs gain an MCP server, llms.txt index, and agent discovery endpoints for AI-native client access.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds https://docs.recordedfuture.com/mcp as a streamable-HTTP MCP server so clients like Claude Code, Cursor, and VS Code can list and search endpoints, read schemas, and execute test requests against live OpenAPI definitions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds reference/llms.txt as a complete index of all API endpoints with links to per-endpoint Markdown documentation, following the llms.txt standard.
• Adds an Agent Skills index and API catalog as standard discovery endpoints for agents, with the catalog linking to every raw OpenAPI definition on the site.

Continuous Control Monitoring (CCM) · 2026-10-23

RegScale CLI 6.55.0 adds DevSecOps release/deploy Change records with flexible approval routing and Python 3.15 support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds change.approval_by_type config key and --approval-mode CLI flag to route Change records directly to completion, to policy approval, or always to the CCB, configurable per change type.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds DevSecOps release and deploy Change record types.
• Adds Python 3.15 support with updated CI test matrices and wheel bounds.

MCP Servers & Tooling · 2026-10-23

Runlayer 1.34.0 adds artifact search in Launcher, audit-log entries for agent run cancels, and Chrome-policy-managed AI Watch extension installs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Chrome extension installed by your policy toggle in AI Watch browser extension settings, letting you install AI Watch via Google Admin, Chrome Enterprise Core, or MDM instead of having AI Watch write its own Chrome policy — preventing it from overwriting yours and removing extensions like Okta.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds audit log entries when an agent run is stopped via the API, web app, or Slack, recording who stopped it and whether the sandbox halted.
• Stopping a session now also cancels all Runlayer Agents runs inside it, including runs you do not own, and only reports Terminated once the agent's runtime confirms.

MCP Servers & Tooling · 2026-10-23

Runlayer 1.33.0 adds an Auto-sync API, v1 deprecation headers, and artifact comment notifications via Slack/Teams.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an Auto-sync API to read, set, or remove a connector, plugin, or skill's device auto-sync setting by its type and ID, using an idempotent PUT.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds a Deprecation response header to API-key calls made to v1 endpoints, making it easy to identify scripts that still depend on unsupported v1 automation paths.
• Adds artifact comment notifications via Slack or Teams: mentions, replies, and comments on owned artifacts now trigger a message from the Runlayer assistant linking directly to the artifact.

WAF, Bot & API Protection · 2026-10-23

SafeLine v9.4.3 adds Monitor Mode for Deny Rules and stable ACME key reuse on auto-renewal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Monitor Mode for Deny Rules, allowing matched requests to be logged without being blocked.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• ACME auto-renewal now reuses the existing private key, keeping the public key fingerprint stable across certificate renewals.
• Adds an application quota notice when downgrading to Personal/Lite; applications exceeding the limit are disabled while their data and configurations are retained.

Software Supply Chain Security · 2026-10-23

sbom-operator 0.47.0 adds SBOM download from OCI cosign attestations, including embedded additional SBOMs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports SBOM download from OCI cosign attestations, including any additional SBOMs embedded within the attestation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Software Supply Chain Security · 2026-10-23

API surface changed: +7 endpoints, 7 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /api/v1/vulnerability-scanning/components/{component_id}/vex-submissions⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint GET /api/v1/vulnerability-scanning/vex-submissions/{submission_id}
• New endpoint GET /api/v1/vulnerability-scanning/workspaces/{team_key}/fix-prompt

Cloud Security Posture · 2026-10-23

ScubaGear v2.0.0 adds a Security Suite baseline, risky AI agent blocking, Invoke-SCuBADiff, CSV risky-app output, and severity scoring.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Invoke-SCuBADiff command to diff two ScubaResults.json runs, enabling change-over-time comparison of assessment outputs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds MS.AAD.9.1v1 policy requiring risky AI agents to be blocked in Entra ID, covering agents with access to tenant resources (requires Entra ID P2 plus Microsoft Agent 365 or M365 E7; not applicable to GCC High/DoD).
• Adds new MS.SECURITYSUITE baseline (Groups 1–8) covering advanced threat protection — including email attachment blocking, post-delivery scanning, malware quarantine, DLP for PII, unified audit logging, alert enablement, and anti-spam/anti-phishing controls — replacing the retired Microsoft Defender baseline.

Secrets Detection & Management · 2026-10-23

Controller now dynamically reloads sealing keys and self-heals manually modified Secrets without a pod restart.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Controller dynamically detects new, updated, and deleted sealing key secrets at runtime — no pod restart required when keys are added, relabeled, or removed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Controller heals manually modified Secrets by restoring them to the state defined by their parent SealedSecret.
• The --skip-recreate controller flag now also suppresses restoration of manually modified Secrets (previously it only skipped recreation of deleted ones).

Web Application Security · 2026-10-23

Sitadel v2.0.0 adds JWT attacks, WebSocket/CSWSH, XXE, SSRF, SSTI, OpenAPI discovery, --tui dashboard, and enriched findings with OWASP/CWE/WSTG mapping.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --tui flag for an optional real-time terminal UI dashboard during scans.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds several new discovery modules: API-first discovery via OpenAPI/Swagger specs with JSON/XML body injection testing, WebSocket discovery with a Cross-Site WebSocket Hijacking (CSWSH) attack module, exposed-file discovery with passive secret-leak scanning of responses, and HTML form discovery with POST/body parameter injection testing.
• Adds JWT/token security testing module covering alg=none, RS256-to-HS256 confusion, kid parameter abuse, and weak secret attacks.

AI Red Teaming & Testing · 2026-10-23

SkillSpector v2.13.1 hardens atomic report writes, tightens P2 HTML-comment scope, and adds gap_fill_status incomplete reporting with exit code 2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Writes report files (scan, scan --recursive, scan --mcp-registry, and --output) and baselines atomically through an already-opened, no-follow parent directory; skillspector baseline <path> -o - writes the baseline as JSON to stdout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Rejects --use-shipped-baseline with exit code 2 when scan --recursive detects one or more child skills, before any report is written.
• Rejects scan --mcp-registry combined with --use-shipped-baseline, --transitive, --transitive-depth, --transitive-allow-prefix, or --transitive-deny-prefix with exit code 2 before the registry is read or a report is written.

SAST / SCA / Code Security · 2026-10-23

Skylos v5.0.0 adds skylos agent recap, skylos cicd agent-review with GitHub OIDC, and five new security/quality detection rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds skylos agent recap subcommand and hooks agent activity into skylos doctor, plus a live README badge.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds skylos cicd agent-review for approved Cloud PR reviews, with GitHub OIDC support, bounded source bundles, and a generated trusted workflow.
• Adds security detections SKY-D360–SKY-D364 covering Dependabot execution and cooldown checks, decoded-secret exposure, workflow obfuscation, and trusted-publishing advice.

Firewalls & Network Defense · 2026-10-23

SFOS 23.0 automates Sophos Firewall onboarding and DoH configuration for Sophos DNS Protection, replacing manual Fusion location setup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Enables Sophos DNS Protection with a single setting, with DNS filtering policies managed from Sophos Fusion.

Firewalls & Network Defense · 2026-10-23

Sophos Firewall v22.0 adds a CLI command to disable strict IPsec SA policy checks for third-party VPN peers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a command to turn off strict policy checks for site-to-site IPsec VPN tunnels when third-party peers share Security Associations (SAs) across multiple subnet pairs, preventing incoming IPsec traffic from being dropped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Secure Access (VPN / SASE / ZTNA) · 2026-10-23

Detection Engineering · 2026-10-23

Exploitation & C2 · 2026-10-23

ssh-mitm 6.0.1 adds Flatpak sandbox warnings for unreachable host key and file paths, and drops four external dependencies for in-house replacements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds startup warning in Flatpak builds when running without home/host filesystem access, alerting that --scp-replace-file, --sftp-replace-file, --ssh-mirrorshell-key, and custom host key paths outside the app's private data directory are unreachable.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds permission-denied host key read hint under Flatpak, alongside the existing Snap ssh-keys hint.
• Replaces python-json-logger with an in-house JSON log formatter.

Cloud Security Posture · 2026-10-23

Sysdig CLI and Registry Scanners gain PHP binary detection, extended risk acceptance, and license classification (Technical Preview).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds PHP to the applications identified by CLI Scanner standalone binary scanning, including PHP compiled from source such as in official Docker Hub php images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends risk acceptance to every component type in the CLI Scanner, so accepted risks now apply to vulnerabilities in standalone binaries and other non-package components.
• Adds standalone binary scanning to the Registry Scanner, enabling detection of applications not installed by a package manager — including PHP compiled from source — in distroless and scratch images.

Attack Surface & Exposure Management · 2026-10-23

syzkaller gains LLMAdvisor support, partial-result agents, and a linux-subsystems-update agent skill in its aflow framework.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds LLMAdvisor to the aflow framework, usable via the Advisor field on LLMAgent, to provide iterative evaluation guidance during agent runs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds AllowPartialResults field to LLMAgent so agents can return partial outputs when iteration limits are reached rather than failing entirely.
• Adds linux-subsystems-update agent skill across the aflow system.

Reconnaissance & OSINT · 2026-10-23

Taranis AI 1.5.2 adds resumable bot pipelines, eight-category topic classification, live story tasks, and collapsible admin navigation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Replaces binary cybersecurity classification with eight-category LLM-bot topic classification, now requiring a dedicated Decisions endpoint instead of a Responses or Chat Completions endpoint; CLASSIFICATION_THRESHOLD no longer controls topic classification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Runs bot DAGs in one resumable worker pipeline, allowing interrupted pipelines to pick up where they left off.
• Shows live story tasks in My Tasks and Scheduler views.

Reconnaissance & OSINT · 2026-10-23

Taranis AI 1.5.1 adds central LLM endpoint management, OpenRouter batch processing, fuzzy news deduplication, and dashboard source distribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Admin Settings → LLM Endpoints UI to centrally manage LLM providers, models, credentials, and timeouts — with per-feature or per-bot assignment and private CPU inference support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds OpenRouter batch processing for background LLM bots (NER, sentiment, classification, clustering, summarization) via the shared LLM endpoint; realtime remains the default and Chat requires a realtime endpoint.
• Adds opt-in source-scoped fuzzy deduplication for collected news: changed articles at an existing URL update the original news item with revision history, and similar articles from the same source can join an existing story while retaining each article separately; configurable under Collection Similarity Matching with a default score threshold of 85 and a 30-day lookback.

Vulnerability Management · 2026-10-23

Nessus 10.12.6 lifts the Amazon Linux restriction on --aws-scanner linking and drops several legacy OS platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Linking a Tenable One Vulnerability Management-managed scanner using the --aws-scanner flag from an AWS-hosted scanner is no longer restricted to Amazon Linux.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Removes support for Windows Server 2012 and 2012 R2, Ubuntu 16.04, RHEL and derived distributions version 8 minor versions before 8.10, and macOS 14.

AI/LLM Security · 2026-10-23

Tenuo v0.3.3 adds ControlPlaneClient.status, audit buffering, filesystem jail, Temporal warrant-chain delegation, and TypeScript one-use approvals.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds ControlPlaneClient.status to expose connection state and audit delivery counters (Rust callers use start_heartbeat_loop_with_status), plus audit-event buffering through control plane outages that is drained on shutdown.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds optional filesystem feature on the Rust guard to open an authorized Subpath argument through a pinned jail.
• Adds warrant_chain= parameter on Temporal workflow-start helpers so delegated warrants reach workers that trust only the root, and workflow-scoped capabilities via _workflow_namespace and _workflow_id reserved argument names.

AI/LLM Security · 2026-10-23

Tenuo v0.3.2 adds Rust-native proof construction, TenuoServerMiddleware for MCP SDK 2.x, delegated warrant chains across five agent frameworks, and a native manylinux_2_28⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Centralizes holder-side proof construction, approval request-hash verification, and receipt-chain verification in the Rust core.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds one core-owned _meta.tenuo envelope with shared conformance vectors for Rust, Python, and TypeScript.
• Adds delegated warrant-chain support across CrewAI, Google ADK, AutoGen, OpenAI, and LangChain adapters.

AI/LLM Security · 2026-10-23

Tenuo 0.3.1 adds path_glob()/pathGlob() safe path helpers, exports enforce_tool_call and EnforcementResult, and hardens chain verification across all SDKs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds path_glob() (Python) and pathGlob() (TypeScript) to compose Subpath with a glob that decides after normalization, replacing the unsafe bare Pattern which lets * cross / boundaries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exports tenuo.enforce_tool_call, enforce_tool_call_async, and EnforcementResult as first-class public API.
• Adds installable tenuo-agent-authorization skill via npx skills add tenuo-ai/tenuo --skill tenuo-agent-authorization with automated release re-pin.

Detection Engineering · 2026-10-23

Tenzir: Adds machine credentials for organizations in the Tenzir Platform (v1.41.0), enabling non-interactive, programmatic authentication.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports slow node startups in Tenzir Helm Charts (v0.2.0).

Detection Engineering · 2026-10-23

Tenzir Helm Charts v0.2.0 adds an optional startup probe for nodes with large partition catalogs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds an optional startup probe to give nodes with large partition catalogs time to initialize before Kubernetes liveness checks begin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Kubernetes version labels now reflect the configured image tag.

Detection Engineering · 2026-10-23

Tenzir Platform v1.41.0 adds machine credentials for organizations: federated OIDC workload identity and service tokens.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds organization service tokens to cover automation use cases such as the Terraform provider, with immediate invalidation on revocation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds federated credentials for workload identity, letting workloads such as GitHub Actions authenticate using their own OIDC tokens instead of a stored secret.

Detection Engineering · 2026-10-23

Tenzir Skills v4.0.0 adds Codex and Claude Code plugin support and rebuilds the OCSF skill on structured YAML schema data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds Codex plugin support, enabling Tenzir Skills to run inside the Codex environment.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Claude Code plugin support, enabling Tenzir Skills to run inside Claude Code.
• Adds OCSF release notes surfacing inside the OCSF skill.

SOAR · 2026-10-23

API surface changed: +2 endpoints, 2 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• New endpoint GET /api/v1/caseReportTemplate/{caseReportTemplateId}/export⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• New endpoint POST /api/v1/caseReportTemplate/import

SOAR · 2026-10-23

API surface changed: −1 endpoint⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

AI/LLM Security · 2026-10-23

ToolHive v0.56.0 adds auth-server TLS/SPIFFE support, Claude Code gateway model discovery, and DCR client caps with 24h expiry in the CRD.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Exposes DCR client cap and register rate limit as CRD fields, letting Kubernetes operators declare limits declaratively.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds TLS listener and SPIFFE middleware to the auth server, and starts it in vMCP.
• Caps Dynamic Client Registration (DCR) clients and expires unused ones after 24 hours.

Secrets Detection & Management · 2026-10-23

TruffleHog v3.99.4 adds per-source debug logging, skipped-verification marking, and a Lambda Cloud API key detector.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds a debug field to LocalSource in source config files, enabling debug-level logging for a single source without raising the global log level — old configs default to off and are unaffected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds Result.VerificationSkipped field to result output, distinguishing results where no verifier ran (due to --no-verification, a per-detector override, or a source verify setting) from genuine unverified verdicts.
• Adds a detector for Lambda Cloud API keys.

SAST / SCA / Code Security · 2026-10-23

Veracode Fix for SCA adds async GitHub Workflow Integration and a new veracode fix sca CLI command for dependency remediation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds veracode fix sca CLI command (and SCM integration) to analyze vulnerable dependencies from SCA findings, generate remediation patches, and identify safe upgrade paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Veracode Fix for SCA now processes fix requests from the GitHub Workflow Integration asynchronously, freeing the GitHub Actions runner immediately and delivering fixes as a new pull request with a results comment on the original PR.

Vulnerability Management · 2026-10-23

VulnerableCode v40.2.0 adds datasource_id to advisory API responses and a pipeline-run cleanup job.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Includes datasource_id field in advisory API responses, letting callers identify which data source produced each advisory.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds config and job to automatically clean up old pipeline runs, keeping the database tidy over time.

Vulnerability Management · 2026-10-23

VulnerableCode v40.1.0 adds CWE weakness and mitigation curation, AVID-based advisory lookup, and federated advisory schema.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Supports advisory todo lookup by AVID identifier via the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Exposes advisory todo count and curating advisories in API responses.
• Adds a schema for federated advisory data.

MCP Servers & Tooling · 2026-10-23

Wazuh MCP Server v5.0.0 adds OIDC sign-in, per-tool scope annotations, toolset filtering, and a local LLM stack with vLLM and Open WebUI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds WAZUH_TOOLSETS and WAZUH_DISABLED_TOOLS environment variables to limit which tools appear in tools/list and are callable via tools/call; unknown names fail at startup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds WAZUH_CA_BUNDLE (and per-cluster ca_bundle) for private CA verification, checked at startup and passed to httpx as an SSL context; WAZUH_ALLOW_SELF_SIGNED now defaults to false.
• Adds OAUTH_IDP_ISSUER to enable OpenID Connect sign-in via Entra ID, Google Workspace, Okta or any OIDC provider, with RS256/JWKS token verification, tenant/domain/user allow-lists, and group-to-scope mapping.

Endpoint Security (EDR/XDR) · 2026-10-23

XFA Desktop Application now supports NixOS, installable without root via nix profile.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds NixOS support for the XFA Desktop Application, installable into a user's nix profile without root permissions, with auto-update and optional system-wide deployment via NixOS system configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

Detection Engineering · 2026-10-23

Detection Engineering · 2026-10-23

Detection Engineering · 2026-10-23

Detection Engineering · 2026-10-23

Software Supply Chain Security · 2026-10-23

Zarf v0.88.0 expands v1beta1 support with new lint, inspect, schema-gen commands and adds arch-check skip on deploy.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --skip-arch-check capability to zarf package deploy to bypass architecture validation when deploying packages to mismatched hosts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Extends zarf dev lint to validate, zarf dev generate-schema to emit JSON schemas for, zarf dev inspect to support, and zarf dev find-images to support v1beta1 packages and component configs, and makes v1beta1 commands publicly visible in the CLI with an opt-in feature flag.
• Introduces v1beta1 init config support for cluster initialization and adds JSON Schema validation for init chart values.

Software Supply Chain Security · 2026-10-23

Zarf v0.87.0 adds component-level sign/verify, explicit git server mode, and a --components flag for dev inspect values-files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• Adds --components flag to zarf dev inspect values-files to filter inspection by specific components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• Adds component sign and verify capability, enabling individual components to be signed and their signatures verified.
• Moves package signing out of zarf package publish into a dedicated signing step, decoupling publish and sign workflows.

SAST / SCA / Code Security · 2026-10-23

zizmor v1.31.0 sharpens cache-poisoning, dangerous-trigger, and typosquat audits with broader and more precise coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

• The cache-poisoning audit (improved) now recognises the cache-mode setting and skips findings when a job's effective cache-mode is none, flags cache-mode: write and cache-mode: write-only usage when combined with dangerous triggers that grant an attacker privileged code execution, and gains awareness of the pnpm/setup action.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
• The dangerous-triggers audit (improved) now treats the issue_comment trigger as fundamentally dangerous and produces more precise finding/diagnostic spans.
• The typosquat-uses audit now supports pre-commit config inputs.

1Password 2 changes

• 1Password SaaS Manager #2231 (2026-10-21) · Feature · 2026-10-28
• 1Password CLI Beta 2.43.0-beta.02 (2026-10-22) · Feature · 2026-10-24

Abnormal AI 1 changes

• changelog · Oct 23, 2026 · Feature · 2026-10-23

Acunetix 360 1 changes

• changelog · Oct 23, 2026 · Feature · 2026-10-23

Acunetix Premium 1 changes

• 27 October 2026 – Security (2026-10-28) · Feature · 2026-10-29

adalanche 4 changes

• r1014 · Feature · 2026-10-23
• r996 · Feature · 2026-10-23
• r995 · Feature · 2026-10-23
• r987 · Feature · 2026-10-23

Aembit 2 changes

• changelog · Oct 29, 2026 · Feature · 2026-10-29
• Aembit Now Supports SPIFFE: X.509-SVID and JWT-SVID Without SPIRE (2026-10-27) · Feature · 2026-10-28

Agentic Threat Hunting Framework 3 changes

• v0.23.0 · Feature · 2026-10-23
• v0.22.0 · Feature · 2026-10-23
• v0.21.0 · Feature · 2026-10-23

AI-Infra-Guard 1 changes

• v4.6.8 · Feature · 2026-10-29

Aikido Security 2 changes

• 🚀External Network Pentesting: test your perimeter before someone else does · Feature · 2026-10-29
• #58 - Cloud Security Audits, External Network Pentesting and Aikido is now FedRAMP Moderate · Feature · 2026-10-23

airgorah 1 changes

• v0.9.0 · Feature · 2026-10-23

ALEAPP 1 changes

• v2026.4.4 · Feature · 2026-10-25

amneziawg-installer 2 changes

• v6.1.0 · Feature · 2026-10-23
• v6.0.0 · Feature · 2026-10-23

apex 1 changes

• v2.6.1 · Feature · 2026-10-23

apkhunt 1 changes

• v2.0.0 · Feature · 2026-10-23

Arcade 1 changes

• announced · Oct 22, 2026 · Product launch · 2026-10-25

ArmorCode 2 changes

• announced · Oct 28, 2026 · Feature · 2026-10-28
• announced · Oct 24, 2026 · Product launch · 2026-10-24

Auth0 8 changes

• Introducing Universal Portals - Developer Preview (2026-10-27) · Feature · 2026-10-29
• changelog · Oct 28, 2026 · Feature · 2026-10-28
• Identity Conversion Suite is now in Early Access (2026-10-26) · Feature · 2026-10-27
• announced · Oct 22, 2026 · Feature · 2026-10-25
• announced · Oct 22, 2026 · Feature · 2026-10-25
• Application Profiles are available in Early Access (2026-10-22) · Feature · 2026-10-23
• CIMD with Dynamic Registration in Early Access (2026-10-22) · Feature · 2026-10-23
• Configurable Unblock Mode for Brute Force Protection (2026-10-22) · Feature · 2026-10-23

Aviatrix 1 changes

• announced · Oct 28, 2026 · Feature · 2026-10-28

aya 1 changes

• aya-ebpf-macros-v0.4.0 · Feature · 2026-10-28

Backslash 1 changes

• AI Plugin Inventory: Uncover Hidden Risks | Backslash - Backslash (2026-10-26) · Feature · 2026-10-27

Beelzebub 1 changes

• v3.10.0 · Feature · 2026-10-28

Black Duck 1 changes

• Introducing Signal Agentic Fix: Your 24×7 remediation team (2026-10-27) · Feature · 2026-10-28

bloodhound 1 changes

• v9.9.0 · Feature · 2026-10-27

Burp Suite 3 changes

• DAST 2026.10.3 (2026-10-29) · Feature · 2026-10-29
• DAST 2026.10.2 (2026-10-27) · Feature · 2026-10-28
• Professional / Community 2026.10.1 (2026-10-26) · Feature · 2026-10-26