This Week's Highlights — issue 003, July 17, 2026
THE CYBER TOOLCHAIN
NO. 003
The best tooling updates that shipped this week.
The week in numbers · Jul 10–16
Changes per week, last 12 weeks · Jul 10–16
Changes we read in that week's dailies, including docs and API changes. A gap means no daily was published.
Every feature release from the 1309 tools on our watchlist goes into the daily newsletter. Once a week we read the whole field side by side and choose our top picks, judged on two questions: how deep and complete is the single best capability in the release, and how much it changes what you can actually do.
A tool is judged on everything it shipped that week, so a project that releases daily gets credit for the sum — and still only takes one slot. We would rather run a short list than a padded one.
Focus: What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out: Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus: New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out: Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus: Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out: Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus: API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out: Governance, SOC operations, and vendor launches with no developer surface.
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
The picks in full
Cloudflare Blog is a publication sharing updates, technical insights, and announcements about Cloudflare's internet security, performance, and developer infrastructure products.
Precursor delivers session-scoped behavioral bot detection injected transparently into HTML responses — no app changes, continuous re-evaluation across the full user journey, and privacy-preserving signal collection — a capability that didn't exist in any WAF product before this week; combined with Cloudforce One threat-intel fields in WAF custom rules and the BotBase bot directory, this is the most complete and novel security release of the week.
Cloudflare shipped Precursor, a continuous client-side behavioral signal system that extends bot detection across entire user sessions, alongside a wave of WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. managed-rule detections (Citrix NetScaler, Kemp LoadMaster, FortiSandbox, Ivanti Sentry, Ghost CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly., and generic SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly./LFI/XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. classes), new Cloudforce One threat-intelligence fields for WAF rules, EDE-based DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit.-bypass visibility in 1.1.1.1, cloud region hints for Smart Tiered Cache, and new AI-crawler traffic controls plus a BotBase bot directory and Attribution Business Insights dashboard.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Smart Tiered Cache now supports cloud region hint configuration for anycast origins on AWS, GCP, Azure, and Oracle Cloud, letting it select the optimal upper tier instead of routing on default anycast geolocation. A new Origin Configuration table (dashboard: Caching > Tiered Cache > Origin Configuration) supports per-IP region hint assignment or bulk editing of all origin IPs, and region hints can also be managed via the Cloudflare API and Terraform. Anycast origins are detected using speed-of-light latency checks across multiple global checkpoint data centers, with cloud provider IP range mappings refreshed every few hours, upper-tier probe data refreshed every 15 minutes, and geographic fallback for regions lacking probe data.
WAF custom and rate-limiting rules can now match new cf.intel.ip.* fields populated from Cloudforce One threat intelligence for IPs flagged within the past seven days: cf.intel.ip.datasets (DDoSDDoSDistributed Denial of Service: an attack that floods a target system with traffic from many sources simultaneously, exhausting its resources so legitimate requests cannot be served. or WAF attack activity), cf.intel.ip.attacker_names and cf.intel.ip.attacker_countries (known threat actor identity and source country), and cf.intel.ip.target_industries and cf.intel.ip.target_countries (historically targeted sectors/regions). Matches are recorded in Security Analytics and are fully supported via the Cloudflare API and Terraform.
$ any(cf.intel.ip.target_countries[*] == "FR") and any(cf.intel.ip.datasets[*] == "ddos")
Precursor is a new client-side JavaScript engine Cloudflare dynamically injects into HTML responses to continuously collect behavioral signals — pointer movement, keyboard timing/rhythm, focus changes, visibility — across an entire user session rather than at a single challenge point, with no application changes required. Session-scoped evaluation accumulates signal throughout the session (preventing bots from resetting their signature via refresh or a new challenge) and cross-references multiple interaction streams in an edge-side evaluation layer with modular evaluators to detect automation such as linear mouse interpolation, inhuman click precision, missing physiological tremor, and atypical timing. Signals feed directly into existing bot score, challenge decisions, and Security Rules; a new session-based view in Security Analytics lets practitioners inspect full visitor journeys and find sessions with sustained automation. Keyboard data is captured only as timing/rhythm (not keystrokes) and is not exposed to dashboards or tied to identities. Precursor is enabled from the dashboard under Security > Bots, with a configurable mode (low-friction background observation or enforced Challenge for unverified sessions).
BotBase is a new searchable in-dashboard directory (Security > Bots > BotBase) of every bot Cloudflare tracks, classified by behavior (Search, Agent, Training, Transact, Data Collection, SEO, Ads Verification), letting practitioners filter live zone traffic to a single bot and copy its detection ID for use in Security > WAF > Custom Rules. Attribution Business Insights is a new dashboard showing crawl-to-referral ratios per bot operator over 24 hours, 7 days, or 30 days with Allowed/Blocked/Partially blocked status, and every bot tracked in BotBase is also published to Cloudflare Radar's public bots and agents directory.
New managed rule 32075e19b1494117ac5915e8d84c92c9 blocks unauthenticated arbitrary file reads via Fortinet FortiSandbox path traversal (CVE-2026-39813), currently set to Log action.
New managed rule 439c4ef64b32447989bdf412b4c29bc6 detects and blocks blind SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. in the Ghost CMS Content API (CVE-2026-26980, versions 3.24.0–6.19.0), set to Block action. A second new rule 6c64b68ef5ed45e7a622cdaab56f403f identifies generic SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. bypass attempts using obfuscated boolean logic in URI parameters, shipped Disabled by default.
All plans, including Free, now get three independently controllable AI traffic behavior categories — Search, Agent, and Training — with per-behavior policies of block on all pages, block only on ad-displaying pages, or allow. A new default policy effective September 15, 2026 will automatically block Training and Agent crawlers on ad-displaying pages for newly onboarded domains (opt-out available before that date), and multi-purpose crawlers combining Search and Training behaviors will be subject to the Training-class blocking rules.
1.1.1.1 now returns Extended DNS Error EDE 33 (Negative Trust Anchor) on every response served while an NTA is active — including for non-DNSSEC domains — making DNSSEC validation bypass visible to clients and monitoring tools. It also returns EDE 9 (DNSKEY Missing) alongside EDE 33 to expose the underlying DNSSEC chain-of-trust failure that triggered the NTA.
$ kdig @1.1.1.1 google.al
The managed rule Anomaly:Header:User-Agent - Fake Bing or MSN Bot (rule ae20608d93b94e97988db1bbc12cf9c8) has its action changed from Enabled/Block to Disabled; zones relying on it for bot enforcement must implement alternative coverage, such as a custom User-Agent matching rule.
New Cloudflare Managed Ruleset detections block unauthenticated memory disclosure in Citrix NetScaler ADC and Gateway appliances configured as SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. IdPs (CVE-2026-8451, rule 78826e3223b94da493a2ade876973ac4) and unauthenticated remote code executionremote code executionRemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. via OS command injectionOS command injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. in Progress Kemp LoadMaster load balancers (CVE-2026-8037, rule 6b64d216620449fbb273d07910233f36), first scheduled for Log mode on 2026-07-13 and shipped live on 2026-07-14.
Eight new managed detections deploy in Log mode on 2026-07-20: SSRF - Restricted Protocol (rule 7fbdc9407bdb4a4eae2b3d91215e7d31), SSRF - Obfuscated Host (rule 6ca512d240d848d6a0c7ef42a935ee5d), LFI - Path Traversal (rule a3fb0870c38440d8a9a0eba81b0230ac), Adobe ColdFusion File Upload Path Traversal CVE-2026-48276 (rule 452a04be3f73458c863d8dae61349c8b), Adobe ColdFusion Path Traversal CVE-2026-48282 (rule a53a3fb491c64d74908081ee9cb61eac), and XSS via JavaScript bracket-concatenation obfuscation across three surfaces — request body (rule d8b63828c2344d919b94d2594ac5e21f), headers (rule 264a83a764be428ca41d516ff31f5559), and URI (rule 4ba21a60837244029183b782987984fd).
New Cloudflare Managed Ruleset detection (rule 500a90789f874345b60b0de7242fdf83) blocks unauthenticated OS command injectioncommand injectionAn attack that makes an application execute operating-system commands supplied through untrusted input. It often happens when input is passed unsafely to a shell. attacks against Ivanti Sentry (CVE-2026-10520) at the WAF layer.
Keycloak is an open-source identity and access management solution that provides single sign-on, authentication, and authorization for applications and services.
Keycloak 26.7 ships stateless multi-cluster mode (auth sessions in DB, no external Infinispan required), a SCIM API preview, an SSF 1.0 Transmitter with CAEP/RISC event profiles and durable outbox, an AuthZen PDP endpoint, and SAML step-up auth — a release that advances the open-source identity stack on multiple fronts simultaneously.
Keycloak's headline change is a database-backed stateless mode enabling Multi-Cluster v2 deployments without an external Infinispan cluster, accompanied by a wave of new experimental APIs — SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, a Shared Signals Framework transmitter, an AuthZen PDP, Identity Brokering v2, Admin APIAdmin APIA dedicated HTTP interface that exposes management and configuration operations separately from the data plane, letting cyber tools automate provisioning, policy changes, or monitoring without touching the main user-facing service. v2, ID-JAG, token exchangetoken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. delegation, and organization-level fine-grained permissions.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Experimental SSF 1.0 Transmitter role pushes signed Security Event Tokens (SETs) to subscribed receivers for events like session revocation, credential change, and account disable, supporting CAEP 1.0 and RISC 1.0 event profiles and mapping native Keycloak events automatically. Delivery uses HTTP push (RFC 8935) and HTTP poll (RFC 8936) channels backed by a transactional outbox that persists events durably then drains asynchronously with exponential backoff; a synthetic event REST endpoint lets external tools inject events that didn't originate in Keycloak. Receivers are configured as standard OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. clients with a per-client ssf.enabled toggle, ssf.read/ssf.manage scopes, a defaultSubjects policy of ALL or NONE, and a per-receiver emit-only-events allowlist; a legacy SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. CAEP draft profile supports Apple Business Manager/Apple School Manager interoperability. Full stream CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. plus status, verification, and stream-config endpoints are exposed via the Admin REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and new Admin Console SSF tabs, with Prometheus metrics under the keycloak_ssf_* namespace. Enable with --features=ssf or --feature-ssf=enabled.
$ bin/kc.sh start --features=ssf
$ kc.sh start-dev --feature-ssf=enabled
$ curl -s -X POST "https://my.keycloak.test/realms/myrealm/protocol/openid-connect/token" \ -d "grant_type=client_credentials" \ -d "client_id=caep-receiver" \ -d "client_secret=…" \ -d "scope=ssf.read ssf.manage"
ssf.transmitterEnabled).
2. Go to Clients → Create client, set Client authentication On, Service accounts roles enabled.
3. On the client's SSF tab: enable SSF, set Default Subjects to ALL, add an Audience (e.g. https://caep.dev), and tick Push and Poll as supported delivery methods.
4. Under Client scopes, add ssf.read and ssf.manage as Optional scopes.New stateless preview feature stores authentication sessions, action tokens, and brute-force counters in the database instead of distributed Infinispan caches, enabling Multi-Cluster v2: two or more independent Keycloak clusters connected only through a synchronously replicated database, with no external Infinispan cluster required. Cross-cluster cache invalidation uses a database outbox/queuing table with a default polling interval of 100 ms; auth sessions survive full cluster restarts during minor upgrades. Failover is environment-agnostic, tested with Amazon Aurora PostgreSQL and AWS Global Accelerator, removing the monitoring and failover/failback overhead of an external Infinispan cluster.
$ bin/kc.sh start \ --features=stateless \ --spi-cache-embedded--default--cluster-name=CLUSTER1 \ --db=postgres --db-url=jdbc:postgresql://db-host/keycloak \ --db-username=keycloak --db-password=<password>
$ bin/kc.sh start \ --features=stateless \ --spi-cache-embedded--default--cluster-name=CLUSTER2 \ --db=postgres --db-url=jdbc:postgresql://db-host/keycloak \ --db-username=keycloak --db-password=<password>
Adds OID4VCIOID4VCIAn OpenID Foundation protocol for issuing verifiable credentials to a digital wallet over OAuth 2.0, giving cyber tools a standard way to request and receive cryptographically signed identity claims. credential refresh interval configuration via vc.refresh_interval_in_seconds in client scope settings, plus admin UI support for all OID4VCI settings and user-initiated credential issuance from the account console.
Adds Identity Brokering API v2 with client-level authorization, confidential-clients-only enforcement, an OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms.-compliant POST endpoint, and a new session-based token storage option.
Preview SCIM API automates user and group provisioning and deprovisioning via standard CRUD, PATCH, filtering, pagination, and schema discovery endpoints; enabled via --features=scim-api.
$ bin/kc.sh start --features=scim-api
Experimental implementation of the OpenID AuthZENOpenID AuthZENAn emerging standard from the OpenID Foundation that defines a common API for querying authorization engines, letting cyber tools swap policy decision points without rewriting integration code. Authorization API 1.0, exposing single and batch PDP evaluation endpoints for vendor-neutral authorization decisions; enabled via --features=authzen.
$ bin/kc.sh start --features=authzen
Experimental Admin API v2 enables declarative OIDC and SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. client management with strict validation, an accurate OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. spec, and Java, JavaScript, and CLI clients.
Experimental token exchange delegation introduces a new delegation parameterized scope type that validates impersonation rights before granting token exchange.
Experimental support allowing Keycloak to accept cross-domain identity assertions and issue access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. without re-authentication.
Step-up authentication for SAML clients is promoted to supported status, enabling SAML service providers to request specific authentication context classes.
Adds fine-grained delegation for organization administration, introducing dedicated admin roles and Fine-Grained Admin Permissions scoped to organizations.
Adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. authorization documentation for Claude Code as a new MCP client integration alongside existing VS Code support.
The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.
XSRFProbe v3 is a ground-up rebuild delivering 25 named, severity-rated CSRF checks covering token tampering, Origin/Referer bypasses, and SameSite bypass via client-side redirect gadgets and sibling-subdomain XSS — with optional headless Firefox for browser-dependent tests and auto-validated PoC generation; no other tool this week covers this attack surface at this depth.
XSRFProbe v3.0.0 rebuilds its CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. audit engine around 25 categorized checks with headless-browser SameSite bypass testing, a bounded crawler, JSON reporting, auto-validated proof-of-concept generation, and a response-diffing engine to cut false positives.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds optional headless Firefox (Selenium) integration via --browser to run browser-dependent SameSite bypass tests and auto-validate generated proof-of-concept pages; --auto-validate-poc triggers validation and --geckodriver-path points to a custom geckodriver binary. Each finding gets a tailored, auto-validated exploitable CSRF PoC page.
$ xsrfprobe --url https://target.example.com --browser --json
$ xsrfprobe --url https://target.example.com --browser --auto-validate-poc --geckodriver-path /opt/geckodriver/geckodriver
New crawler exposes configurable --max-urls, --max-depth, and --crawl-timeout flags to control scan scope and wall-clock time.
$ xsrfprobe --url https://target.example.com --max-urls 50 --max-depth 2 --crawl-timeout 120 --json
Adds a --json flag producing machine-readable reports; each finding includes test_id, severity, and an exploitability note, suited for pipeline consumption.
$ xsrfprobe --url https://target.example.com --browser --json
New SameSite bypass checks S2–S4 probe SameSite=Strict protections via client-side redirect gadgets and sibling-subdomain XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session., and SameSite=Lax via cookie-refresh/OAuth flows; sibling-subdomain testing is supported by optional crt.sh-based subdomain enumeration.
New token-tampering checks T2–T8 actively probe GET↔POST method switching, token omission, empty token values, cross-session token replay, double-submit cookie bypasses, and custom-header token forgery.
New Origin/Referer bypass checks R0–R2c and O1–O3 test header removal, regex tricks, subdomain tricks, and Origin: null against real-world validation implementations.
XSRFProbe's audit engine now runs a battery of 25 named checks spanning IDs D1–A1, covering token tampering, method/Content-Type overrides, Origin/Referer bypasses, SameSite cookie analysis, and token strength. Each check carries a unique test_id, a severity rating, and exploitability notes used in reporting.
Adds a response diffing/benchmark engine that compares baseline and test responses before declaring an endpoint vulnerable, reducing false positives.
Docker Sandboxes adds SOCKS5 egress proxy support, a native SSH endpoint for pairing-free access, kit source allowlisting, and a secret import workflow that keeps credentials out of the sandbox environment — and closes a DNS-based data-exfiltration CVE (CVE-2026-12039) by gating DNS resolution on network policy — a runtime security sandbox that meaningfully advances the practitioner's ability to contain agentic workloads.
Docker Sandboxes shipped three releases (v0.33.0-v0.35.0) that add a SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy transport for sandbox egress, an experimental native SSH endpoint, kit source allowlisting, wildcard host patterns for secrets, named sandbox identity/re-attachment, and network-policy hardening that closes two CVEs, alongside a long tail of policy, kit, and CLI improvements.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
A new experimental native SSH endpoint in sandboxd allows connecting with ssh <sandbox-name>@127.0.0.1 -p 2222 (publickey auth, connect-to-create, interactive shell and exec), enabled via sbx settings set feature.ssh true.
$ sbx settings set feature.ssh true
$ ssh <sandbox-name>@127.0.0.1 -p 2222
Adds a SOCKS5 upstream-proxy transport (socks5:// / socks5h://) for sandbox egress, configurable via DOCKER_SANDBOXES_PROXY, HTTP_PROXY, or HTTPS_PROXY, with optional proxy authentication and exclusions via DOCKER_SANDBOXES_NO_PROXY.
$ DOCKER_SANDBOXES_PROXY=socks5://proxyuser:proxypass@proxy.corp.example.com:1080 DOCKER_SANDBOXES_NO_PROXY=localhost,127.0.0.1 sbx run
Kit installs are now restricted to an allowlist of sources, defaulting to Docker Hub (docker.io/) only; installing from another registry or a Git URL fails until its prefix is added with sbx settings set kit.allowedSources.
$ sbx settings set kit.allowedSources ghcr.io/myorg/
sbx secret set-custom --host and serviceDomains in kits now accept wildcard host patterns (* for one label, ** for any number of labels) and are repeatable, allowing one secret to cover multiple subdomains.
$ sbx secret set-custom --host '*.internal.corp' --host '**.api.internal.corp' MY_API_TOKEN
New sbx policy inspect examines policy details, sbx policy check network tests whether the current policy would allow a network access request before executing, and sbx policy ls gains --wide, --source, and --decision filters. sbx policy set-default is renamed to sbx policy init (old name kept as a hidden deprecated alias).
$ sbx policy check network --host api.example.com --port 443
New sbx secret import imports credential env vars into the keychain, and sbx secret ls now flags env-only and OAuth-shadowed entries. Host env vars no longer auto-inject at runtime, requiring migration via sbx secret import.
$ sbx secret import
A new --name flag for sbx run identifies a sandbox independently of the working directory, enabling multiple named sandboxes in the same workspace and re-attachment from any directory. Re-attaching to a sandbox created with a custom --kit agent now works via sbx run --name <name> without re-passing --kit.
$ sbx run --name feature-a claude && sbx run --name feature-b claude
$ sbx run --name feature-a
Sandbox DNS resolution is now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039), with loopback names remaining exempt. Outgoing ICMP from sandboxes is now blocked persistently across daemon restarts (CVE-2026-12539).
virtiofs cache is now enabled by default on macOS and Linux for improved filesystem performance, and this was extended to all operating systems; opt out via DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=0.
sbx kit add now recreates the sandbox container with the full kit set while preserving state, and applies the kit's network allow/deny rules and composed policy.
New sbx daemon command with start, stop, status, and log-level subcommands for managing the sandbox daemon's lifecycle.
Adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. v2 kit artifact streaming that decompresses layers once to a cache directory and uses seek-based random access, reducing memory pressure during kit reads.
sbx rm now requires --force to delete an active session, preventing accidental teardown.
The balanced network preset now allows VS Code domains, Azure Blob Storage (*.blob.core.windows.net), and dhi.io over HTTP.
sbx ls --json now reports a stable per-sandbox id field for scripting and automation.
Claude connectors (Slack, Gmail, Notion, Atlassian, etc.) now work inside sandboxed Claude Code without manual policy overrides.
New keychain fallback to an encrypted on-disk store on Linux when dbus-launch is unavailable, enabling headless/server deployments.
MITM proxy now publishes a CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. and embeds a CRL distribution point in generated certificates, supporting revocation-strict TLS clients (e.g., .NET).
sbx inspect now surfaces the sandbox's kits, injected secrets, and sandbox information.
Kits can inject the user's Docker login token into requests to docker.com hosts via a credential with service sbx-login.
Sandbox startup is faster due to optimized TLS-proxy CA installation, which merges into the trust bundle instead of running update-ca-certificates, saving several hundred milliseconds.
New experimental sbx setup command imports agent credentials from environment variables for smoother first-time onboarding.
sbx cp -L now follows symlinks in the source path for sandbox-to-host copies.
Restores published sandbox ports on restart, with automatic recovery from host-port conflicts by selecting a new host port.
Droid OAuth credentials are now proxy-managed, keeping real tokens on the host and out of the sandbox.
Linux arm64 build packages are now produced, extending platform support.
sbx exec now uses the same working directory as sbx run.
Adds Cursor OAuth support as a recognized agent.
- !Host env vars no longer auto-inject at runtime — use
sbx secret importto migrate existing env-var-based secrets. - !
sbx rmnow won't delete an active session unless--forceis passed. - !Installation is blocked on Windows versions older than Windows 11.
- !Kit installs are restricted to an allowlist of sources defaulting to Docker Hub (
docker.io/) only; installing a kit from another registry or a Git URL fails until you add its prefix withsbx settings set kit.allowedSources. - !The
sbx policy set-defaultcommand is renamed tosbx policy init(the old name still works as a hidden deprecated alias, but is deprecated). - !The
sbx run <name>positional argument form for re-attaching to an existing sandbox now prints a deprecation warning; the positional argument forsbx runis expected to be an agent (e.g.claude,codex), not a sandbox name, and the old positional-name form will be removed in a future release. - !
sbx run --nameno longer auto-creates numbered sibling sandboxes when a same-named sandbox exists. - !
sbx createnow errors when run without arguments instead of proceeding.
SSH server & client security auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)
ssh-audit v3.9.0 adds post-quantum gap warnings (flagging every key exchange lacking PQC protection), UNIX socket scanning for containerized environments, SOCKS5 proxy support, and built-in offline hardening guides — making it immediately actionable for practitioners auditing SSH posture ahead of quantum migration deadlines.
ssh-audit v3.9.0 adds post-quantum key exchangepost-quantum key exchangeA cryptographic handshake algorithm designed to resist attacks from quantum computers, using math problems like lattices that quantum algorithms cannot efficiently solve, letting tools stay secure against future quantum-capable adversaries. warnings, UNIX socket and SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy scanning, and built-in offline hardening guides, alongside expanded algorithm detection and the removal of SSHv1 and older Python support.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
New --list-hardening-guides and --get-hardening-guide flags surface built-in hardening guides for common platforms (Debian, Ubuntu, Rocky Linux, OpenSSH) without requiring internet access.
$ ssh-audit --list-hardening-guides ssh-audit --get-hardening-guide "Debian 13"
New --socks5 host:port flag enables scanning through a SOCKS5 proxy; using it implies --skip-rate-test.
$ ssh-audit --socks5 proxy.example.com:1080 target-host.internal
ssh-audit supports scanning SSH servers over UNIX sockets (e.g. unix:///path/to/socket), enabling auditing in containerized and CI/CD environments.
$ ssh-audit unix:///run/ssh-unix-local/socket
SSHv1 support has been removed entirely, breaking scans or configurations that relied on it. Support for Python 3.8 and Python 3.9 has been dropped. Batch mode (-b) no longer implicitly enables verbose mode, so scripts depending on that behavior must now add -v explicitly.
ssh-audit now identifies 2 new post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. key exchanges (mlkem768nistp256-sha256, mlkem1024nistp384-sha384), 11 new host key types including ML-DSAML-DSANIST's main post-quantum digital signature standard (FIPS 204), formerly Dilithium. It is the planned replacement for RSA and ECDSA signatures on certificates and code. variants (mldsa-44, mldsa-65, mldsa-87, and OpenSSH-namespaced equivalents) and webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com, and 2 new ciphers (AEAD_CAMELLIA_128_GCM, AEAD_CAMELLIA_256_GCM).
Adds an allow_hostkey_subset_and_reordering policy option letting policy definitions accept targets with a stricter or differently-ordered host key list, plus new built-in policies for OpenSSH 10.0 through 10.4 and new platform hardening guides for Debian 13, Rocky Linux 10, and Ubuntu 26.04.
ssh-audit now warns on all key exchanges that lack post-quantum protection, flagging exposure to Harvest Now, Decrypt Later attacks.
- !Support for Python 3.8 has been dropped, so setups running ssh-audit on Python 3.8 will no longer work.
- !Support for Python 3.9 has been dropped, so setups running ssh-audit on Python 3.9 will no longer work.
- !SSHv1 support has been removed, so any scans or configurations relying on SSHv1 scanning will no longer function.
- !Batch mode (
-b) no longer automatically enables verbose mode, so scripts or workflows that depended on batch mode implying verbose output will see less output unless-vis explicitly added.
Where each pick stands · Jul 10–16
Tools with changes in each pick's category over the last 12 weeks, including the pick itself.
Each pick's release rhythm · Jul 10–16
Changes per week for the last 12 weeks. The bright bar is this week; a dash marks a week with no daily.
Which categories moved · Jul 10–16
The thick bar is this week. The thin bar is the average of the four weeks before, counting only weeks with a daily.
Who shipped the most · Jul 10–16
Changes per tool this week. Volume is not a quality score.