The week in full · Jul 10–16

Identity & Access Management · 2026-07-16

1Password for Linux adds a local MCP server so AI assistants can access 1Password Developer tools.

• New local MCP server in the Developer tab lets AI assistants connect to 1Password Developer tools.
• Watchtower descriptions now explicitly surface scanning for plaintext secrets, including .env files and SSH keys.

Identity & Access Management · 2026-07-16

1Password adds a local MCP server for AI assistant integration and expands Watchtower plaintext secret scanning visibility.

• New local MCP server in the Developer tab lets AI assistants access 1Password Developer tools.
• Watchtower and Developer homepage descriptions now surface scanning coverage for plaintext secrets, including .env files and SSH keys.

Identity & Access Management · 2026-07-16

1Password for Windows adds a local MCP server for AI assistant access to Developer tools and expands Watchtower secret scanning descriptions.

• Adds a local MCP server launchable from the Developer tab, enabling AI assistants to access 1Password Developer tools.
• Watchtower descriptions on the Developer homepage now explicitly mention scanning for plaintext secrets, including .env files and SSH keys.

Identity & Access Management · 2026-07-16

1Password in the browser adds toggleable extension diagnostic logging in Settings > Help.

• Adds a toggle to enable or disable extension diagnostic logging via Settings > Help > Share diagnostic logs with 1Password.
• Improves SSO account migration so the desktop app only comes to the front when the migrating account is already configured in the desktop app.

Identity & Access Management · 2026-07-16

1Password CLI gains a command to manually trigger Google Workspace user provisioning syncs.

• New op provisioning google sync command triggers an on-demand Google Workspace user provisioning sync.

Web Application Security · 2026-07-16

Burp Suite 2026.7 launches beta of AI-driven agentic pentesting that autonomously pursues user-defined testing goals.

• New agentic pentesting beta (Burp Suite Professional): AI-driven engine autonomously pursues user-defined testing goals using Burp's own tools.

AI Coding Agents · 2026-07-16

Claude Code v2.1.211 adds subagent stream visibility, cross-worktree permission persistence, and scientific-notation env vars.

• Adds --forward-subagent-text flag and CLAUDE_CODE_FORWARD_SUBAGENT_TEXT env var to surface subagent text and thinking inside --output-format stream-json output.
• Changes always allow permission rules to save at the repository root, so approvals granted in one git worktree persist across all worktrees and sessions.
• Accepts scientific notation and digit-separator spellings (e.g. 1e6, 64_000) for integer environment variables such as timeouts, token budgets, and retry counts.

Identity & Access Management · 2026-07-16

Clerk SAML connections can now send an email address, custom attribute, or no login hint to your IdP.

• Supports per-SAML-connection configuration of the login hint sent to identity providers: email address, a custom attribute, or none.

AI Coding Agents · 2026-07-16

Cline CLI v3.0.41 adds compaction progress in the TUI, model ID suggestions from OpenAI-compatible endpoints, and persistent workspace git info.

• Shows compaction progress status in the TUI so you can track context-reduction operations in real time.
• Suggests model IDs from OpenAI-compatible endpoints when configuring a provider, reducing manual lookup.
• Persists and refreshes workspace git branch and remote info across sessions.

AI Coding Agents · 2026-07-16

Cline SDK v0.0.61 adds context compaction progress, Plan/Act system-prompt guidance, and OpenAI-compatible model ID suggestions.

• Adds progress status reporting while context compaction runs, giving visibility into long-running compaction operations.
• Persists and refreshes workspace git info (branch/remote) across sessions so agents maintain accurate repo context.
• Adds Plan/Act mode guidance to the system prompt, with nudges when switching between modes.

Web Application Security · 2026-07-16

• Returns EDE 9 (DNSKEY Missing) alongside EDE 33 to expose the underlying DNSSEC chain-of-trust failure that triggered the NTA.
• Emits EDE 33 on every response under an active NTA — including non-DNSSEC domains — so the entire affected zone is transparently flagged.

Endpoint Security (EDR/XDR) · 2026-07-16

CrowdStrike launches Falcon AIDR, a new runtime security category detecting and blocking threats targeting and originating from AI agents across endpoint, SaaS, and cloud.

• Introduces Falcon AI Detection and Response (AIDR), a new security category providing unified runtime visibility, detection, and automated response for AI agents across endpoints, SaaS, and cloud environments.
• Discovers shadow AI by illuminating employee agent and tool usage across endpoints, AI gateways, MCP servers, cloud environments, and Copilot ecosystems.
• Enforces granular attribute-based access controls aligned to AI governance policy, including policy based on user and model version.

AI Coding Agents · 2026-07-16

Crush v0.85.0 adds an interactive question tool, an elapsed-time timer, and LM Studio vision support.

• Adds a first-class question tool letting LLMs prompt users with single-choice, multiple-choice, free-form text, and yes/no forms — with full mouse support.
• Displays an elapsed-seconds timer so you can see how long the LLM has been running.
• Enables LM Studio vision capabilities (image support) via SupportsImages.

Vulnerability Management · 2026-07-16

Adds DD_WATSON_SEARCH_ENABLED toggle to control Watson search indexing in DefectDojo.

• New DD_WATSON_SEARCH_ENABLED setting in settings.dist.py / local_settings.py to gate Watson search indexing on or off.

Secure Access (VPN / SASE / ZTNA) · 2026-07-16

DNSFilter Identities framework adds direct Entra ID/SCIM integration, rebuilt Collections, and MSP-level identity management.

• New Identities framework in the DNSFilter dashboard unifies users, collections, and policy assignment across identity sources for enterprise and MSP environments.
• Direct Microsoft Entra ID integration via SCIM provisioning eliminates the AD Sync Tool dependency, with support for Entra Hybrid environments.
• Rebuilt Collections engine supports large directories, multiple identity sources, and high-complexity group structures.

Digital Forensics & Incident Response · 2026-07-16

Elcomsoft Phone Breaker 11.03 adds universal binary for macOS and restores SMS-based iCloud 2FA sign-in.

• Ships as a universal binary, running natively on both Apple Silicon and Intel Macs without Rosetta translation.
• Removes the pre-login 2FA status check that Apple no longer supports, enabling successful authentication flows.

SIEM · 2026-07-16

Exabeam Threat Center adds caseClosedTimestamp field to case details, enabling Time-to-Close metrics.

• Adds caseClosedTimestamp (date-time string) to the Get Case Details response schema, exposing when a case was closed for Time to Close (TTC) and Mean Time to Close (MTTC) calculations.

Endpoint Security (EDR/XDR) · 2026-07-16

Fleet 4.89.0 adds policy label targeting, setup experience policy checks, new vulnerability filtering, Google Workspace IdP integration, and more.

• Adds ability to target policies to hosts using a combination of include and exclude labels.
• Adds policy check before installing Windows and Linux setup experience software, skipping installs when the policy already passes to speed up end-user setup.
• Changes calendar remediation events to be scheduled on the next business day (skipping weekends) after a policy failure.

SIEM · 2026-07-16

Google SecOps dashboards gain Advanced Filtering with dynamic query variables, regex support, and multi-select logic injection into YARA-L at runtime.

• Adds Advanced Filtering in dashboards (Public Preview): security analysts can define token variables to inject dynamic values, complex regular expressions, or boolean logic directly into YARA-L queries at runtime.
• Supports token values generated dynamically from YARA-L query results or entered as a static manual list.
• Enables customizable prefix/suffix wrappers around token values to express regex or other query logic.

Identity & Access Management · 2026-07-16

iDenfy adds Brazil Digital CNH, new KYB automation API, Risk Assessment PDF export, Arabic/RTL IDV support, and multi-theme KYC branding.

• Adds Brazil Digital CNH support for identity verification.
• New API endpoint to re-run KYB automation workflows.
• Dedicated tax identification fields (VAT Number, EIN, TIN) added to KYB workflows.

Data Security & DLP · 2026-07-16

Immuta adds automated Redshift discovery, built-in managed groups, OAuth for Alation, Delta Sharing masking, and Teams/Slack notifications.

• Introduces three built-in system-managed groups — All Agents, All Users, and All Identities — usable in both subscription and data policies without manual membership management.
• Supports OAuth 2.0 authentication for Immuta's Alation integration, eliminating the need for recurring API key rotation.
• Enables row filtering and column masking on Unity Catalog managed, external, and foreign tables in Databricks Delta Sharing shares (now GA for all accounts).

Data Security & DLP · 2026-07-16

Immuta adds automated Redshift data discovery, built-in managed groups, Delta Sharing row/column masking, Teradata hashing, and OAuth 2.0 for Alation.

• Introduces three built-in Immuta-managed groups — All Agents, All Users, and All Identities — available for use in subscription and data policies without manual membership management.
• Enables row filtering and column masking (subscription and data policies) on Unity Catalog managed, external, and foreign tables in Databricks Delta Sharing shares.
• Supports OAuth 2.0 authentication for Immuta's Alation integration alongside existing API key authentication, eliminating recurring token rotation.

Endpoint Security (EDR/XDR) · 2026-07-16

Microsoft launches Defender Experts Threat Intelligence service and expands MDR to multi-cloud/third-party coverage via Sentinel.

• New Microsoft Defender Experts Threat Intelligence service delivers curated, expert-interpreted threat intelligence tailored to your industry, geography, and environment — including early-warning campaign alerts, evolution updates, and recurring expert briefings.
• Microsoft Defender Threat Intelligence (MDTI) capabilities are now fully converged into the Defender portal, making intelligence available in real-time across detection, investigation, response, hunting, and automation without context switching.
• Microsoft Defender Experts MDR (formerly Defender Experts for XDR) adds a new Plan 2 tier with third-party and multi-cloud coverage powered by Microsoft Sentinel, enabling expert-led monitoring and response across non-Microsoft cloud, identity, email, network, and endpoint sources.

Identity & Access Management · 2026-07-16

Nudge Security adds two AI agents to automatically assess and remediate OAuth grant and browser extension risk.

• New OAuth Grant Risk Analyst AI agent reviews newly discovered OAuth grants, flags overly permissive or high-risk ones, and resolves them by automatically revoking access or nudging the grantor — with human-in-the-loop oversight.
• New Browser Extension Risk Analyst AI agent inspects installed browser extension artifacts and metadata, flags malicious, compromised, or misrepresented extensions, and orchestrates disable and uninstall workflows.

AI Coding Agents · 2026-07-16

Codex CLI adds Frameless Bidi realtime voice, MCP cache opt-out, Cursor import support, and paginated thread history.

• Adds realtime conversation protocol v3 with Frameless Bidi support, translating audio, transcripts, handoffs, session context, and lifecycle events over WebSocket and WebRTC.
• Allows MCP servers to opt out of tool catalog caching via the experimental codex/tool-catalog-cache capability (cacheable: false), preventing stale snapshots from being served.
• Adds Cursor IDE support to the setup import flow, joining existing editor integrations.

AI Coding Agents · 2026-07-16

Codex CLI alpha.16 adds prompt cache write token tracking and stronger forced rm command detection.

• Tracks prompt cache write token usage (cache_write_input_tokens) and reports it in analytics, metrics, traces, and rollout data alongside existing cache-read usage.
• Strengthens forced rm command detection to catch forced removals inside control flow, substitutions, pipelines, traps, nested shells, and sudo/env wrappers — including combined, separate, and long-form force options even when they follow operands.
• Extends image generation timeout in code mode to 120 seconds for both the initial call and subsequent waits.

AI Coding Agents · 2026-07-16

Codex CLI alpha.15 adds external agent memory migration, paginated subagent history, and smarter MCP capability-root propagation.

• Adds external agent memory migration: discovers project memory Markdown files, preserves project scope, copies selected projects into the Codex memory extension workspace, and enqueues memory consolidation after workspace changes.
• Propagates deferred environment capability roots to MCP, making executor plugins available as soon as their environment is ready and refreshing the MCP runtime when the selected root set changes.
• Preserves paginated history for spawned or forked subagents, inheriting the parent's model context as a rollout prefix and resuming from stored model context instead of legacy rollout history.

AI Coding Agents · 2026-07-16

Adds Mod+N shortcut for new tabs and a configurable subagent_depth limit to prevent runaway nested subagents.

• Adds Mod+N as an alternative keyboard shortcut for opening a new tab in the desktop app.
• Adds configurable subagent_depth limit to control how deeply subagents can spawn nested subagents (defaults to 1).

Runtime Security · 2026-07-16

OpenShell v0.0.85 adds elevated gateway info surfacing to the gateway component.

• Adds elevated gateway info to the gateway component, surfacing additional context for privileged gateway sessions.

Firewalls & Network Defense · 2026-07-16

Prisma AIRS AI Gateway reaches GA with inline LLM/MCP/A2A enforcement, agent identity binding, and quantum-resilient SASE fabric via AT&T partnership.

• Introduces Prisma AIRS AI Gateway as a unified control plane sitting inline between AI apps, LLMs, MCP tool calls, and A2A interactions for centralized governance.
• Adds unified observability across all AI usage: tracking users, projects, models, token counts, latency, and cost in a single view to expose shadow AI.
• Enables central governance of approved models, tools, and access with FinOps controls including per-team/project budget enforcement and rate limiting before access is granted.

AI Coding Agents · 2026-07-16

Pi v0.80.8 adds unified model/auth runtime, live catalog refresh, and xAI Grok 4.5 with device-code OAuth.

• Adds ModelRuntime as the canonical async SDK facade, centralizing model configuration, provider authentication, and dynamic provider catalogs.
• Adds pi update --models command to force an immediate model catalog refresh without updating pi or extensions.
• Adds /model live background refresh of configured providers, updating the selector with partial results as they arrive.

Cloud Security Posture · 2026-07-16

Prowler 5.34.0 adds E2E Networks provider, 9 new security checks across AWS/Azure/Kubernetes/STACKIT, and cross-provider compliance rollup.

• New provider: Scans E2E Networks with 27 checks covering compute nodes, networking, security groups, load balancers, block/file storage, and managed databases.
• New AWS check ec2_ami_account_block_public_access: verifies AMI block public access is enabled at the account level per region.
• New AWS check datapipeline_pipeline_no_secrets_in_definition: scans Data Pipeline object fields, parameter objects, and parameter values for hardcoded secrets using Kingfisher.

General Utilities & Libraries · 2026-07-16

pipx 1.15.1 adds outdated, exec, reset, PEP 751 lock file support, scriptable JSON output, and major performance improvements.

• New pipx outdated command lists all installed tools that have upgrades available.
• New pipx exec command runs an already-installed application directly without re-resolving environments.
• New pipx reset command wipes and rebuilds pipx's state from a clean install.

Continuous Control Monitoring (CCM) · 2026-07-16

RegScale 6.31.1.5 adds custom rules support for POA&M configuration.

• Adds custom rules configuration support for POA&M (Plan of Action & Milestones) items.

SAST / SCA / Code Security · 2026-07-16

StackHawk adds self-upgrade, scan drill-down commands, standalone binary, AI skills status, and org-wide Findings page.

• New hawk upgrade command updates HawkScan CLI in place, detecting install method (Homebrew, binary, MSI, PKG, Docker) and printing the exact command when direct upgrade isn't possible; --check previews available versions and --version <x.y.z> pins to a specific release.
• New hawk skills status command reports which StackHawk AI agent skills (Claude Code, Codex, Copilot) are installed and whether they are current, fetching latest published versions live.
• New hawk op scan config retrieves the exact effective configuration a completed scan ran with; hawk op scan uris lists the full attack surface including GraphQL operations and JSON-RPC methods.

SAST / SCA / Code Security · 2026-07-16

StepSecurity adds a secure-registry CI/CD control and OIDC replaceability tracking for Actions secrets.

• New Overview dashboard control detects CI/CD jobs that download packages directly from public registries (registry.npmjs.org, pypi.org, registry-1.docker.io) instead of a secure proxy registry.
• Control findings are filterable by repository, workflow, and compliance status, with remediation tracking and finding suppression on the control detail page.
• Repository Secrets tab now surfaces Usage Status (Active, Stale, Unused, Unknown) for each secret, including which workflow file and step references it and the last run time and conclusion.

Container & Image Security · 2026-07-16

Syft v1.48.0 adds vcpkg, macOS .app, Kerberos 5, SafeTensor, and Ubuntu Pro/ESM cataloging plus Go binary symbol capture.

• Adds dependency relationship edges from mix.lock to SBOM output.
• Adds SafeTensor model type cataloging to SBOM output for ML model inventories.
• Captures symbols from Go binaries for richer binary-level SBOM data.

Cloud Security Posture · 2026-07-16

Sysdig Secure now supports multiple S3/S3-compatible custom storage buckets across Captures, Response Actions, and Rapid Response.

• Supports connecting multiple S3 or S3-compatible buckets (MinIO, Google Cloud Storage, and others) for use across Captures, Response Actions, and Rapid Response.
• New Custom Storage configuration supports AWS access keys, AWS role delegation (AssumeRole), and S3-compatible endpoints, with connection testing on save and per-bucket failure history.

Detection Engineering · 2026-07-16

Tenzir v6.7.0 adds fork_merge for fanning out subpipelines and a force-stop action for pipelines.

• New fork_merge operator fans out subpipelines over the same input and merges their outputs into a single stream.
• Adds a force-stop action for pipelines in the Tenzir Platform.
• Improved Tenzir Platform performance.

Detection Engineering · 2026-07-16

Tenzir Platform v1.37.0 adds custom Git-backed package libraries, force-stop for pipelines, and a workspace key minting command.

• Adds custom library sources: organizations can add public or private Git repositories alongside the built-in Tenzir Library to maintain their own package libraries.
• Adds a Force stop action for pipelines that are slow to drain, enabling operators to hard-terminate stalled pipelines.
• Adds an admin command to mint workspace keys.

SOAR · 2026-07-16

Tines lets tenant owners restrict which users can create API keys via a new tenant-level setting.

• New tenant setting on the API keys settings page lets owners restrict which users are permitted to create API keys.

Endpoint Security (EDR/XDR) · 2026-07-16

Trend Vision One adds Global approved list for teams, letting admins exempt specific collaboration spaces from ATP and DLP scanning.

• New Global approved list for teams lets administrators designate trusted teams to bypass Advanced Threat Protection and Data Loss Prevention inspection while keeping full protection elsewhere.
• Reduces alert noise and improves performance by scoping security scanning away from known-safe collaboration spaces.

Endpoint Security (EDR/XDR) · 2026-07-16

Trend Vision One lets admins suppress notifications for Pass-action detections with a single global toggle.

• Adds a global Skip notification for Pass actions setting that suppresses admin and end-user alerts when a detection results in no action taken on an email or file.

Secure Access (VPN / SASE / ZTNA) · 2026-07-16

Zscaler launches Autonomous Application Shield to auto-apply app-specific protections in the patch gap via App Connectors and global threat intel.

• New Autonomous Application Shield capability continuously assesses private application exposure via App Connectors and automatically applies per-app protections in the Zscaler cloud without requiring a patch.
• Per-application protection reasoning: the Zscaler cloud evaluates each private application individually and applies only the controls that specific application needs, reducing false positives and performance impact.
• Automatic protection adaptation when developers ship new releases — security policy updates without manual re-tuning, policy review meetings, or security team intervention.

Data Security & DLP · 2026-07-16

Zscaler DLP, DSPM, and inline proxy now detect and block SSLKEYLOGFILE TLS session-key material across endpoints, cloud storage, and network traffic.

• Adds endpoint DLP detection for SSLKEYLOGFILE content matching legacy and newly standardized formats, including obfuscated or renamed files, to catch TLS key material exfiltration on user devices.
• Extends DSPM scanning to identify files containing TLS session secrets across SaaS platforms, public cloud, and on-premises storage regardless of naming convention or file type.
• Enables inline DLP engine to detect and policy-enforce outbound SSLKEYLOGFILE transfers in real time via file uploads, web channels, non-web channels, and email — with options to block, alert, or trigger investigation workflows.

Secure Access (VPN / SASE / ZTNA) · 2026-07-16

Zscaler Endpoint Context enriches security logs with endpoint data for SIEM and SOC automation workflows.

• Enriches security logs with endpoint context data, making it available for downstream SIEM analysis and SOC automation via Zscaler Nano Streaming Service.

Secure Access (VPN / SASE / ZTNA) · 2026-07-16

Zscaler adds Endpoint Context policy enforcement and Autonomous Application Shield for continuous private-app protection.

• New Endpoint Context capability feeds endpoint-derived intelligence into Zero Trust Exchange policy decisions across TLS/SSL inspection, Zero Trust Firewall, DNS security, intrusion prevention, and Advanced Threat Protection.
• New Autonomous Application Shield continuously assesses private application exposure via App Connectors and automatically applies app-specific protections in the Zscaler cloud to cover the window between vulnerability disclosure and patching.

Exploitation & C2 · 2026-07-15

Bugcrowd Savant Vista enters Public Beta with autonomous asset discovery, vulnerability scanning, and baseline setup.

• New Savant Vista platform introduces autonomous asset/estate discovery capabilities.
• Adds vulnerability baseline setup workflow for establishing a known-good state before scanning.
• Supports launching autonomous vulnerability scans against discovered assets.

SAST / SCA / Code Security · 2026-07-15

Cloudsmith adds a Hardened Images tab for proxying and caching hardened, minimal container images via upstreams.

• New Hardened Images tab enables proxying and caching hardened, minimal container images through upstreams without manual format or URL entry.

AI Coding Agents · 2026-07-15

Codex CLI gains conversation branching on prompt edits, interrupted-prompt history retention, and auto-compaction fallback token-budget settings.

• Branches conversations when editing an earlier TUI prompt, forking at that point rather than overwriting the active thread, preserving the original conversation.
• Keeps interrupted prompts (via Esc or Ctrl-C) in the conversation transcript and opens a blank composer for the next instruction.
• Adds auto-compaction fallback token-budget settings to handle context approaching the limit before automatic rollover.

SAST / SCA / Code Security · 2026-07-15

Snyk Code Rule Extensions now GA: register custom sanitizers via UI or REST API to eliminate false positives from your own security controls.

• Supports custom sanitizer registration — define in-house sanitizer functions so Snyk Code recognizes them as valid data-cleaning paths and stops flagging code already protected by your controls.
• New in-product UI for defining and managing custom sanitizers, including an FQN (fully-qualified name) builder to pinpoint exact functions.
• New public REST API for managing and previewing rule extensions programmatically, enabling automation and agent-driven configuration at scale.

General Utilities & Libraries · 2026-07-15

SysReptor 2026.55 adds AI agent support for notes, release signing with cosign, and richer project filtering.

• Signs releases and Docker images with cosign for supply-chain verification.
• Adds name-based filters for project, design, and template list views.
• Passes finding status to PDF rendering data, enabling status-aware report output.

Endpoint Security (EDR/XDR) · 2026-07-15

Service Gateway 3.0.31 adds FQDN support for the Indonesia (ID) site and expands disk space allocation to the /data partition.

• Adds FQDN support for the Indonesia (ID) site, enabling Service Gateway deployments in that region.
• Allocates remaining disk space to the /data partition when a disk is extended, unlocking larger storage capacity for gateway operations.

Endpoint Security (EDR/XDR) · 2026-07-15

Forward Proxy Service 2.0.12 adds FQDN support for the Indonesia (ID) site.

• Adds FQDN support for the Indonesia (ID) site, enabling forward proxy connectivity for deployments in that region.

Endpoint Security (EDR/XDR) · 2026-07-15

Trend Vision One raises the tag value limit per custom tag property, enabling larger-scale asset organization.

• Supports more tag values per custom tag property, allowing asset labeling and organization at greater scale.

Identity & Access Management · 2026-07-14

1Password 8.12.28 adds exact-phrase search, Universal Autofill for HTTP auth prompts, and a unified Developer settings section.

Identity & Access Management · 2026-07-14

1Password for Windows adds exact-phrase search with special characters and consolidates Developer settings into one section.

Identity & Access Management · 2026-07-14

• Adds Shell Plugin support for Cline CLI, CrateDB CLI, Cursor CLI, Descope CLI, Exercism CLI, Expo and EAS CLIs, GitHub Copilot CLI, Google Gemini AI API CLI, JetBrains Junie CLI, Kiro CLI, OpenCode CLI, OpenTofu CLI, PyPI (twine, flit, hatch), and UpCloud CLI — enabling Touch ID and other unlock options for each.
• GitHub shell plugin now provisions GH_ENTERPRISE_TOKEN for GitHub Enterprise Server hosts and supports authenticating to both github.com and Enterprise simultaneously when separate credentials are configured.
• Redis CLI shell plugin now supports environment variable-based credential provisioning.

Cloud Security Posture · 2026-07-14

Aikido #51 adds repository-wide code quality scans, an ignore approval inbox, AI-powered noise reduction for secrets & CVEs, and a wave of new integrations and APIs.

• New Code Quality Repository Scan (early access): scan entire codebases for quality issues, monitor trends, and identify refactoring hotspots — not just PR-level checks.
• New Approval Inbox for Ignores: routes every ignore request through a central inbox requiring admin sign-off before issues leave the feed.
• New AI-powered Noise Reduction for Secrets & CVEs: analyzes each secret and CVE against actual code to surface only truly exploitable findings and suppress irrelevant ones.

Wireless & RF · 2026-07-14

airgeddon v12.01 adds WPA3 MFP analysis, dynamic WPA3 plugin menus, and band-aware WPS/Evil Twin controls.

• Adds WPA3 MFP (Management Frame Protection) status analysis feature for targeted WPA3 assessments.
• Adds dynamic WPA3 plugin menu options without fixed slots, enabling flexible plugin-driven WPA3 attack workflows.
• Displays band data (2.4 GHz / 5 GHz / 6 GHz) in Evil Twin and WEP control windows, WPS attack screens, and trophy files for clearer session context.

Identity & Access Management · 2026-07-14

Auth0 Dashboard now supports real-time Role search by ID and name, available in Public Beta.

• Adds real-time search for Roles by ID and name in the Auth0 Dashboard, replacing paginated list scrolling (Public Beta, rolling out to Public Cloud tenants).

Attack Surface & Exposure Management · 2026-07-14

Censys Assistant gains page-aware context and 8 new fingerprints added to the Platform.

• Censys Assistant now automatically reads the current page (host, certificate, web property, search result, or collection) as context when opened, enabling deeper questions about specific assets without manually specifying them.
• Adds 8 new fingerprints to the Platform: Chatto, RedHat Cockpit, D-Link DAP Series Access Point, BigBlueButton, Monospace Directus, Google Mod PageSpeed, Hugo, and Streamlit.

Container & Image Security · 2026-07-14

cilium-cli v0.19.6 adds table-json BGP output, hybrid routing mode support, Gateway API listenersets in sysdump, and TCPRoute/UDPRoute v1.

• Adds table-json output format to cilium-dbg bgp peers and cilium-dbg bgp routes for machine-readable BGP state.
• Includes Gateway API listenersets in cilium sysdump captures.
• Supports hybrid routing mode (routing-mode: hybrid), dynamically choosing native routing for same-subnet traffic and tunnel encapsulation for cross-subnet traffic.

AI Coding Agents · 2026-07-14

Claude Code v2.1.210 adds a live tool timer, memory overflow errors, screen-reader mode announcements, and agent input-waiting counts.

• Adds a live elapsed-time counter to the collapsed tool summary line so long-running tool calls visibly tick instead of appearing frozen.
• Adds a startup warning when permission rules use Write(path), NotebookEdit(path), or Glob(path) — directing users to Edit(path) or Read(path) instead.
• Memory writes that would push a MEMORY.md index over its read limit now surface an explicit error instead of silently truncating content.

AI Coding Agents · 2026-07-14

Claude Code v2.1.208 adds screen reader mode, vim insert remaps, corporate process wrapper, and fullscreen mouse support.

• Adds --ax-screen-reader flag (also CLAUDE_AX_SCREEN_READER=1 env var or "axScreenReader": true in settings) for opt-in plain-text rendering compatible with screen readers.
• Adds vimInsertModeRemaps setting to map two-key vim insert-mode sequences (e.g. jj → Escape) without leaving the editor.
• Adds CLAUDE_CODE_PROCESS_WRAPPER env var so every Claude Code self-spawn routes through a corporate launcher executable, enabling enterprise wrapper enforcement.

AI Coding Agents · 2026-07-14

Cline CLI v3.0.40 adds a manual API key escape hatch for OAuth providers and clearer ClinePass usage-limit error surfacing.

• Adds a manual API key entry option in settings for Cline OAuth providers, letting you bypass OAuth and supply a key by hand.
• Surfaces ClinePass usage-limit errors clearly when you hit the plan limit, instead of failing silently.

Web Application Security · 2026-07-14

1.1.1.1 now emits EDE 33 (Negative Trust Anchor) on responses served under an NTA, making DNSSEC bypass visible to clients.

• Adds EDE code 33 (Negative Trust Anchor) to all responses served while an NTA is active, signalling that DNSSEC validation was bypassed rather than silently returning an unverified answer.
• Surfaces EDE 9 (DNSKEY Missing) alongside EDE 33 during NTA incidents, giving operators and monitoring tools full visibility into both the underlying DNSSEC failure and the resolver's mitigation.

Web Application Security · 2026-07-14

Cloudflare WAF adds new managed rules blocking critical RCE and memory disclosure CVEs in Citrix NetScaler and Progress Kemp LoadMaster.

• New managed rule blocks unauthenticated memory disclosure (CVE-2026-8451) targeting Citrix NetScaler ADC and Gateway appliances configured as SAML IdPs.
• New managed rule blocks unauthenticated remote code execution (CVE-2026-8037) via OS command injection in Progress Kemp LoadMaster load balancers.

Web Application Security · 2026-07-14

Cloudflare WAF adds 8 new detections covering SSRF, LFI, Adobe ColdFusion CVEs, and JS bracket-concat XSS obfuscation.

• New detection: SSRF - Restricted Protocol (rule 7fbdc9407bdb4a4eae2b3d91215e7d31), deploying in Log mode on 2026-07-20.
• New detection: SSRF - Obfuscated Host (rule 6ca512d240d848d6a0c7ef42a935ee5d), deploying in Log mode on 2026-07-20.
• New detection: LFI - Path Traversal (rule a3fb0870c38440d8a9a0eba81b0230ac), deploying in Log mode on 2026-07-20.

Web Application Security · 2026-07-14

Cloudflare launches Precursor: continuous client-side behavioral signals that extend bot detection across entire user sessions.

• Introduces Precursor, a session-based client-side verification system that dynamically injects JavaScript into HTML responses to continuously collect behavioral signals (pointer movement, keyboard timing/rhythm, focus changes, visibility) across the full user journey — no application changes required.
• Adds session-scoped behavioral evaluation that accumulates signal throughout a session, preventing bots from resetting their behavioral signature via page refresh or new challenge.
• Detects automation patterns (linear mouse interpolation, inhuman click precision, missing physiological tremor, atypical timing) by cross-referencing multiple interaction streams in an edge-side evaluation layer with a roster of modular evaluators.

Web Application Security · 2026-07-14

Cloudflare Precursor adds session-based JavaScript bot detection with continuous behavioral re-evaluation across user sessions.

• New Precursor client-side JavaScript engine continuously evaluates behavioral signals across a session for bot detection.
• Enables re-validation of challenge clearance as session behavior changes, updating bot scores with session context.
• Provides client-side visibility into bot signals where no previous detection existed.

Data Security & DLP · 2026-07-14

Cyera expands Access Trail to Google Workspace with audit visibility, event enrichment, saved filters, and access revocation.

• Adds Access Trail coverage for Google Workspace, including My Drive and Shared Drives audit visibility.
• Enriches access events with data classification and identity context for deeper investigation.
• Introduces saved high-risk filters to quickly surface and revisit critical access patterns.

Data Security & DLP · 2026-07-14

Cyera Browser Shield adds policy creation and a template catalog to enforce data controls on browser-based AI workflows.

• New Policy Creation editor for Browser Shield lets security teams configure and deploy data-leak policies for browser-based AI tools in a single workflow.
• New Policy Catalog provides pre-built templates so teams can start from a baseline rather than a blank editor for each new AI surface.
• Policies distinguish managed AI tools from shadow AI destinations, enabling enforcement aligned to how employees actually use AI.

Data Security & DLP · 2026-07-14

Cyera adds eight new ecosystem integrations and extends Claude Enterprise support in its June release.

• Extends Claude Enterprise integration for AI-driven data security workflows.
• Adds integration with Abnormal Security for email and collaboration threat response.
• Adds integration with Cohesity for data protection and backup coverage.

Data Security & DLP · 2026-07-14

Cyera Omni DLP Memories retains investigation context across alerts so analysts build on prior decisions instead of starting from scratch.

• Adds persistent investigation context across DLP alerts, retaining history for users, destinations, organizations, and departments to eliminate repeated triage of recurring patterns.
• New dedicated Memories view lets analysts review and delete stored entries to keep automation predictable and auditable.

Data Security & DLP · 2026-07-14

Cyera launches Remediation Center: a dedicated workspace for data owners to triage and resolve assigned data exposures.

• New Remediation Center workspace gives data owners a dedicated interface to triage and resolve data security issues assigned to them.
• Adds a To Do vs. Completed workflow so remediation progress is clearly tracked and measurable.
• Consolidated notifications keep data owners informed of new assignments without manual coordination from security teams.

Vulnerability Management · 2026-07-14

DefectDojo 3.1.100 adds FTS+trigram global search indexes, Jira close/reopen transition fields, and exposes dedupe policy on the Test API.

• Adds full-text search (FTS) and trigram GIN indexes for global search, requiring a settings and database migration update.
• Supports custom fields on Jira close/reopen transitions via a new database migration.
• Exposes the effective dedupe matching policy on the Test API endpoint.

Data Security & DLP · 2026-07-14

CertCentral adds Persistent DNS TXT Record DCV, enabling one-time DNS setup for repeated domain revalidations.

• Adds Persistent DNS TXT Record as a new domain control validation (DCV) method, allowing a single DNS TXT record to satisfy repeated revalidations without creating new records each cycle.
• Supports an Account URI option — one shared persistent URI to validate any domain across the entire CertCentral account, simplifying multi-domain DNS management.
• Supports a Unique URI option — a domain-specific persistent URI to avoid publicly linking domains through shared DNS records.

Secure Access (VPN / SASE / ZTNA) · 2026-07-14

iOS Roaming Client v1.4.4 adds automatic MDM site reassignment, stronger admin PIN protection, and refreshed branding.

• Supports syncing user name, hostname, and device tag changes from MDM configuration profiles to the Dashboard without requiring a Site Secret Key change.
• Enables automatic site reassignment when a Site Secret Key changes in the MDM configuration profile, allowing fleet migrations without reinstalls or policy gaps.
• Adds progressive delays between incorrect admin PIN attempts to make automated guessing impractical while keeping legitimate retries fast.

Secure Access (VPN / SASE / ZTNA) · 2026-07-14

DNSFilter adds CyberSight Data Export for SIEM integration and clearer Mobile Roaming Client auto-registration status display.

• Adds CyberSight Data Export to all Data Export customers, enabling SIEM ingestion of CyberSight data alongside existing DNS log exports.
• Automatic Registration setting now surfaces its 7-day duration and an explicit Ends on [date] status for Mobile Roaming Client, replacing the previous helper text.

Vulnerability Management · 2026-07-14

Edgescan adds custom policy compliance insights, split retest permissions, self-service domain management, and a Credential Vault across this release.

• New Custom Policy Compliance insight: upload company policy documents and see how vulnerabilities align with those policies.
• New manage-retests permission lets admins delegate retest execution without granting access to start new assessments.
• Self-service creation, renaming, and removal of internal domain suffixes directly on the Organizations Scanning tab.

AI Coding Agents · 2026-07-14

Goose v1.43.0 adds per-message cost/token stats, OllamaCloud provider, --edit session flag, TLS for ACP serve, and six new model providers.

• Adds --edit session flag to edit conversation history before forking a session.
• New per-message usage stats UI showing tokens, cost, TTFT, and tok/s for each turn.
• New OllamaCloudProvider with dynamic model discovery and automatic context-limit detection.

AI Coding Agents · 2026-07-14

Goose v1.42.0 adds Ollama Cloud provider, per-message token/cost stats UI, project-grouped sessions, and Python SDK provider bindings.

• Adds OllamaCloudProvider with dynamic model discovery and automatic context-limit detection.
• Adds per-message usage stats in the desktop UI: token counts, cost, time-to-first-token (TTFT), and tokens/sec.
• Adds per-message usage and cost tracking with derived session totals.

Endpoint Security (EDR/XDR) · 2026-07-14

New Partner Investigations View (Early Access) exposes full Huntress SOC activity — including Closed-Benign outcomes — across EDR, ITDR, and SIEM.

• Adds Partner Investigations View (Early Access) showing all completed SOC investigations — both Reported and Closed-Benign — across Managed EDR, ITDR, and SIEM, not just those that became incident reports.
• Each investigation includes a chronological timeline of signals reviewed, actions taken, remediations applied, and final outcome.
• Automatically surfaces completed investigations from the last 90 days upon opt-in.

Data Security & DLP · 2026-07-14

• Adds automated sensitive data discovery for the Amazon Redshift viewless integration, supporting regex, dictionary, and column name regex identifier types with automatic tag application.
• Adds Slack and Microsoft Teams event-driven notifications for the Request app (approvals, access changes, requests), now generally available.
• Expands Teradata integration masking support to include constant and hash masking in addition to existing null masking.

Web Application Security · 2026-07-14

Invicti adds LDAP sync, HashiCorp Vault integration, a new API scan profile, custom scan speed, and expanded API discovery.

• New LDAP user synchronization: automates user provisioning from OpenLDAP or Microsoft Active Directory into Invicti Platform.
• New HashiCorp Vault integration: Secrets Manager can now retrieve credentials directly from HashiCorp Vault for scan authentication.
• New dedicated API scan profile applied by default to all new API targets for comprehensive API vulnerability coverage.

Identity & Access Management · 2026-07-14

JumpCloud Agent 2.147.2 adds AWS Client VPN authentication and a Windows App Catalog in the system tray.

• Supports AWS Client VPN authentication, enabling managed devices to verify posture and connect to AWS VPN gateways using JumpCloud identity (macOS and Windows).
• Adds App Catalog to the Windows tray app, letting users browse, search, and manage software applications directly from the system tray.
• Requires users to supply a reason when submitting Device Admin approval requests, aligning the workflow with security best practices.

AI Coding Agents · 2026-07-14

Kiro 1.0.138 adds full PowerShell trust support on Windows and MCP tool recovery from transient network failures.

• Adds full PowerShell trust support on Windows for Kiro sessions.
• MCP tools now recover from transient network failures instead of failing silently.

AI Coding Agents · 2026-07-14

OpenAI GPT-5.6 Sol, Terra, and Luna are now available in Kiro across IDE, CLI, and Web.

• Adds OpenAI GPT-5.6 Sol (flagship), Terra (balanced), and Luna (fast/low-cost) model tiers to Kiro's IDE, CLI, and Web interfaces.
• Supports 272K context window across all three GPT-5.6 tiers.
• Enables longer autonomous runs with tool-coordinating mini-programs that reduce round-trips, available across all three tiers.

SAST / SCA / Code Security · 2026-07-14

Lakera adds AI Agent Security (Early Access), Policy Impact Simulator, per-detector confidence levels, and a self-harm subcategory to content moderation.

• New result field in Guard API breakdown responses exposes per-detector confidence levels (l1_confident through l5_unlikely), matching the granularity already available in /guard/results.
• New self-harm sub-category added to the content moderator detector.
• New product: AI Agent Security (Early Access) — discovers and inventories agents, their tools, and connected MCP servers across Amazon Bedrock, Amazon Bedrock AgentCore, Google Cloud, Microsoft Copilot Studio, Salesforce Agentforce, n8n, and Relevance AI.

Post-Exploitation · 2026-07-14

Ligolo-ng v0.9 adds faster UDP scanning via ICMP, configurable paths, in-flight TCP tuning, cert fingerprint verification, and ARM64 builds.

• Speeds up UDP port scanning by processing ICMP port-unreachable messages to immediately mark closed ports.
• Adds configurable paths for the config file, session history, and self-signed certificates.
• Supports configurable in-flight TCP connection limits for tuning tunnel throughput.

Reconnaissance & OSINT · 2026-07-14

Maigret v0.6.3 adds 15 new sites and a DiscourseJson detection engine to its 3,000+ site database.

• Adds 15 new sites to the username-search database (two separate batches of 10 and 5).
• Adds support for a new DiscourseJson detection engine, broadening coverage of Discourse-based community forums.
• Adds Chinese-language platforms — including Tuchong, GitCode, Yuque, LeetCode CN, Bangumi, NGA, and Moegirl — to the site database.

Identity & Access Management · 2026-07-14

Microsoft Entra ID makes passkeys the default MFA method and retires native SMS/voice auth by February 2027.

• Starting September 1, 2026, users enabled for SMS or voice MFA are automatically enabled for passkeys and prompted to register one during their next MFA sign-in.
• Supports synced passkeys (iCloud Keychain, Google Password Manager) and device-bound passkeys (Microsoft Authenticator, Entra passkey on Windows, FIDO2 security keys) as first-class authentication options.
• New Microsoft Security Store partner marketplace enables organizations that still require SMS or voice to select, configure, and manage third-party telecom providers starting October 30, 2026.

Threat Intelligence · 2026-07-14

MISP 2.5.43 adds collection sync between instances, environment-variable settings, Pivotick pivot explorer, and TAXII Bearer auth.

• Adds collection synchronisation between MISP instances in both pull and push directions, with per-server pull_collections / push_collections toggles, feature negotiation with pagination, and a collections.locked origin-protection flag.
• Supports environment variables as a third settings source alongside config file and database, enabling cleaner containerised and IaC deployments.
• Introduces Pivotick as an initial drop-in replacement for the legacy event graph, including a draft drag-and-drop reference editor.

Runtime Security · 2026-07-14

nono v0.68.0 adds process-count caps, port ranges, per-OS profile overrides, domain blocking, plain HTTP proxy support, and bun/mise policy presets.

• Adds --max-processes flag to cap the number of processes a sandbox may spawn (enforced via cgroup v2 pids.max).
• Adds port range support to sandbox profiles, enabling network rules that span a range of ports rather than individual ports.
• Adds platform_overrides field to profiles for per-OS patch sets, letting a single profile express different rules on macOS vs Linux.

Local LLM Runtimes · 2026-07-14

Ollama v0.32.0 adds an interactive agent TUI, renames the ChatGPT integration, and warns on deprecated agent models.

• Adds an interactive agent experience: running ollama now launches a built-in agent for chat, coding, web search, and delegating real work.
• Adds --restore flag to ollama launch chatgpt to return to your usual ChatGPT profile.
• Simplifies the ollama launch root menu to a curated short list of popular integrations; all others remain accessible via ollama launch <integration>.

AI Coding Agents · 2026-07-14

Codex CLI alpha adds managed Bedrock login, stabilized memories, MCP OAuth credential pinning, and Windows sandbox level support.

• Adds managed Bedrock login API for authenticating with AWS Bedrock-hosted models.
• Stabilizes the memories feature flag, making conversation memory generally available.
• Supports MCP OAuth credential store resolution and pinning, with serialized credential refreshes.

AI Coding Agents · 2026-07-14

Codex CLI adds environment status inspection API and SQLite-backed paginated thread history for faster local reads.

• New experimental environment/status request lets you inspect a configured environment's state (ready, pending, disconnected, or unknown) without starting or reconnecting it.
• Adds cursor-based local reads for turn summaries and thread or per-turn items backed by SQLite, enabling paginated thread history with archived-thread and history-mode validation.
• Probes ready remote environments over their existing exec-server connection to report live status.

AI Coding Agents · 2026-07-14

Codex CLI alpha.7 makes GPT-5.6 Sol the default Bedrock model and adds explicit advanced-reasoning selection in the TUI.

• Sets GPT-5.6 Sol as the default Amazon Bedrock model, prioritizing Sol, Terra, and Luna variants ahead of GPT-5.5 and GPT-5.4.
• Adds explicit advanced reasoning selection in the TUI, making reasoning-level choices visible rather than implicit.
• Automatically omits unsupported reasoning.summary parameter for models that lack the capability, including spawned agents using a different model.

AI Agent Frameworks · 2026-07-14

OpenClaw v2026.7.1 adds openclaw attach for Claude Code, GPT-5.6/Tencent Hy3/Muse Spark 1.1 support, guarded terminals, and a redesigned Control UI.

• Adds openclaw attach command to give Claude Code temporary access to a selected session, enabling tracked Codex delegation and native subagent workflows.
• Supports GPT-5.6 across OpenAI and Codex routes, adds Tencent Hy3 with a complete setup path, and adds Meta Muse Spark 1.1 via the Meta Model API.
• Introduces guarded workspace terminals accessible across web, iOS, and Android.

AI Coding Agents · 2026-07-14

OpenCode v1.18.0 completes Desktop v2 migration with a new layout-switch setting and improved file comments in the session timeline.

• Adds a setting to switch between the new Desktop v2 and old layouts during the transition period.
• Completes the Desktop v2 migration, including upgrade handling and first-launch onboarding flow.
• Improves file comments display in the Desktop session timeline.

AI Coding Agents · 2026-07-14

OpenCode v1.17.19 adds per-prompt model selection, middle-click tabs, and an interface-switching setting in the desktop app.

• Adds per-prompt model selection in the composer, letting you switch models on a message-by-message basis.
• Adds middle-click to open sessions in a new tab in the desktop app.
• Adds a temporary setting to toggle between the old and new interface in the desktop app.

Runtime Security · 2026-07-14

OpenShell v0.0.82 adds Kubernetes sidecar supervisor topology and PVC subPath driver config support.

• Adds sidecar supervisor topology for Kubernetes deployments, enabling a new deployment model for supervisor processes.
• Supports PVC subPath in driver configuration for Kubernetes, allowing more granular persistent volume claim targeting.

AI Coding Agents · 2026-07-14

Pi v0.80.7 adds cache-friendly dynamic tool loading, toolChoice for OpenAI/Codex Responses, Fable 5 xhigh/max thinking, and a Ctrl+X message copy shortcut.

• Adds cache-friendly dynamic tool loading: extensions can inject tools during execution while Anthropic and OpenAI Responses models preserve prompt-cache prefixes.
• Adds toolChoice support for OpenAI and Codex Responses, including required and named tool selection.
• Adds native xhigh and max thinking levels for Claude Fable 5 across all generated provider catalogs.

SAST / SCA / Code Security · 2026-07-14

• New video generation providers: AWS Bedrock Nova Reel/Luma Ray 2 and Azure AI Foundry Sora.
• xAI Voice provider adds apiBaseUrl, websocketUrl override, and function call support.
• Provider config hover: view provider configuration details inline on hover in eval results.

Attack Surface & Exposure Management · 2026-07-14

Qualys ETM Identity unifies identity risk, attack path analysis, and automated remediation into CSAM's risk model.

• New Qualys ETM Identity module discovers risky identities and correlates identity and asset risk into a unified risk model.
• Supports attack path analysis and domain trust mapping to visualize lateral movement exposure across Active Directory environments.
• Introduces Identity TruRisk scoring to quantify identity risk based on criticality and associated misconfiguration severity.

Vulnerability Management · 2026-07-14

InsightVM 8.52.0 adds fingerprinting for AI tools, Microsoft Intune-managed apps, and Splunk Enterprise.

• New fingerprinting coverage for AI tools enables detection and inventory of AI software on scanned assets.
• New fingerprinting support for Microsoft Intune-managed applications expands visibility into managed endpoint software.
• New fingerprinting capability for Splunk Enterprise improves detection of Splunk deployments during scans.

Attack Surface & Exposure Management · 2026-07-14

runZero 5.0.260714.0 adds crown jewel status and Purdue level to the Dragos integration.

• Adds crown jewel status and Purdue level fields to assets surfaced via the Dragos integration.
• Vulnerability groups inventory now displays a meaningful error message when a search contains unsupported terms.

Identity & Access Management · 2026-07-14

NERM Users connector gains real-time ISC sync toggle and UI-based role assignment for non-employee accounts.

• Adds a new Sync with Identity Security Cloud toggle in Admin > System > Identity Security Cloud Connection Settings > USERS tab, triggering immediate account or entitlement aggregation on any NERM user/role change instead of waiting for periodic aggregation.
• Adds a Source ID field to the USERS tab, allowing NERM to auto-detect an existing NERM Users connector source or optionally create one automatically when the sync toggle is first enabled.
• Enables NERM admins to assign and unassign roles directly to users from Admin > Lifecycle > User Roles in the Non-Employee Risk Management Admin UI, a capability previously limited to the API.

SAST / SCA / Code Security · 2026-07-14

Snyk Open Source adds uv SCM integration for Python and GA support for Go private dependency scanning.

• Supports uv package manager in SCM integrations, enabling import of uv projects and workspaces, PR Checks, and monitoring directly from connected Git repositories — no CLI required.
• Enables Go scanning for private dependencies via private module proxies (Artifactory, Nexus) and private repositories via Broker, now generally available across all SCM integrations.

Detection Engineering · 2026-07-14

Splunk Security Content v6.2.0 adds 10 new detections spanning Linux Dirty Frag, Phantom Stealer, AWS Bedrock Claude AI abuse, and browser process injection.

• New detection: Linux Dirty Frag Kernel Privilege Escalation (CVE-2026-43284 & CVE-2026-43500) — identifies high-frequency splice() syscall activity followed by setuid binary execution within the same audit session.
• New analytic story: Phantom Stealer — expands Windows infostealer coverage with a new detection for unauthorized WinSCP security configuration folder access, plus enhanced tagging of existing analytics for credential theft, PowerShell abuse, process injection, and data exfiltration.
• New detection: Windows Uncommon Remote Thread Creation In Browser Process — strengthens visibility into CreateRemoteThread-based process injection targeting browser processes using native Sysmon Event ID 8 field mappings.

Firewalls & Network Defense · 2026-07-14

Sublime Security adds CrowdStrike Falcon Sandbox detonation for suspicious emails directly from the message detail view.

• Adds one-click email detonation via CrowdStrike Falcon Sandbox from the message detail view — no manual file handling required.
• New in-platform Sandbox Analysis section displays verdict (Malicious / Suspicious / Benign) and detonation environment, updating live without a page refresh.
• One-click pivot opens the full Falcon detonation report — including behavioral indicators, network activity, dropped files, and IOCs — in a new tab.

Cloud Security Posture · 2026-07-14

Sysdig Secure adds column customization for Vulnerability Management Findings reports.

• Enables selection and reordering of columns in newly created Vulnerability Management Findings reports.

Attack Surface & Exposure Management · 2026-07-14

Tenable One Cloud Exposure earns FedRAMP High and IL5 authorization, enabling use in highly sensitive federal and intelligence environments.

• Achieves FedRAMP High authorization, expanding support beyond the existing FedRAMP Moderate status to highly sensitive federal environments.
• Achieves IL5 authorization, enabling use by intelligence agencies and mission-critical use cases that previously required separate tooling.
• Delivers unified CNAPP capabilities within strictly regulated federal cloud ecosystems with strict data isolation requirements.

SOAR · 2026-07-14

Tines App endpoints can now cache and reuse recent responses for identical requests, cutting latency and redundant story runs.

• Enables response reuse on App endpoints so identical incoming requests return a cached result without re-executing the story.

SOAR · 2026-07-14

Tines adds find-and-replace across entire stories for faster bulk edits.

• Adds find-and-replace functionality to search and update text throughout an entire story at once.

Endpoint Security (EDR/XDR) · 2026-07-14

Trend Vision One adds a self-service Credit Transaction view with balance history, drawdown details, and downloadable usage reports.

• New Credit transaction view in Platform Usage and Credits provides a chronological ledger of every credit-affecting event: purchases, monthly drawdowns, expirations, adjustments, license transfers, and licensing-model transitions.
• Balance history ledger shows transaction date, event type, credit amount, and running balance, filterable by time period (current month, last 3/6/12 months, or custom date range) and by transaction type.
• Drawdown entries expand to reveal per-package credit breakdowns with direct navigation into detailed monthly views.

Data Security & DLP · 2026-07-14

Ubiq overhauls dataset access controls with Access Groups and tagging, adds advanced structured encryption config, and expands library support.

• Introduces Access Groups to replace the Dataset Group → Identity model, granting dataset access to API Keys or IDP users independently of dataset organization.
• Advanced Dataset Configuration for Structured Encryption now lets operators define encryption behavior for dates, numerics, short fields, and large character sets at the dataset policy level — no custom code required.
• Unified Identities section consolidates API Keys and IDP-managed users, with a new per-identity access graph for at-a-glance visibility into access groups and datasets.

Data Security & DLP · 2026-07-14

Varonis Atlas adds native coverage for Claude Code and Claude Cowork with runtime guardrails and AI activity monitoring.

• Adds direct integration with Claude Code and Claude Cowork, extending Atlas coverage across the full Anthropic enterprise Claude suite.
• Enables runtime guardrails that can block, modify, or alert on risky AI behavior in real time.
• New AI activity monitoring detects exposure of sensitive data, credentials, API keys, and regulated information with user, project, resource, and token-usage context.

SAST / SCA / Code Security · 2026-07-14

Veracode adds OAuth 2.0 credentials UI, new Reporting API filters, CMEK encryption, and Firewall Analytics in this release cycle.

• Adds custom_severity filter to the Reporting API Findings report for targeted severity-based querying.
• Adds six new built-in security policies to the Veracode Platform.
• Policy Settings page now supports light and dark mode.

Cloud Security Posture · 2026-07-14

Wiz adds detection and IOCs for the @asyncapi npm supply chain compromise (M-RED-TEAM v6.4 malware).

• Adds detection for five malicious @asyncapi npm package versions (@asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/specs 6.11.2 and 6.11.2-alpha.1) tied to the July 14, 2026 supply chain attack.
• Surfaces IaC coverage as a three-stage funnel metric (IaC-supportable → Tracked by IaC → Mapped to a declaration in code) within the Wiz platform to quantify how much cloud infrastructure is governed, traceable, and remediable via pull request.

CNAPP · 2026-07-14

Wiz IaC Inventory reaches GA, linking every IaC module to its live cloud deployments and managed resources.

• IaC Inventory is now Generally Available, connecting every IaC module to the deployments it created and the live cloud resources it manages.
• Reconciles Wiz Code IaC scan results with Wiz Cloud runtime visibility, bridging infrastructure-as-code definitions to what is actually running.

Identity & Access Management · 2026-07-13

1Password CLI Beta 2.37.0 adds 14 new shell plugins, tab completion for bash/zsh, and GitHub Enterprise Server support.

• Adds Shell Plugin support for 14 new CLIs: Cline, CrateDB, Cursor, Descope, Exercism, Expo/EAS, GitHub Copilot, Google Gemini AI API, JetBrains Junie, Kiro, OpenCode, OpenTofu, PyPI (twine/flit/hatch), and UpCloud — enabling Touch ID and other unlock options for each.
• Extends the GitHub shell plugin to provision GH_ENTERPRISE_TOKEN for GitHub Enterprise Server hosts and support simultaneous authentication to both github.com and Enterprise with separate credentials.
• Adds environment variable-based provisioning support to the Redis CLI shell plugin.

Identity & Access Management · 2026-07-13

1Password for Android adds exact-phrase search with support for special characters like IPs and hostnames.

• Supports quoted exact-phrase search queries, enabling lookups of strings containing dots, dashes, and other special characters (e.g., 10.1.2.3).

Identity & Access Management · 2026-07-13

1Password Linux beta adds exact-phrase search, simpler MCP server launch, and a unified Developer settings section.

• Supports exact-phrase search queries wrapped in double quotes, enabling precise lookup of IP addresses, hostnames, and strings containing dots or dashes.
• Enables launching the bundled 1password-mcp binary by name instead of requiring an absolute path when configuring MCP server clients.
• Consolidates 1Password CLI, SDKs, and MCP client integration into a single unified section under Settings > Developer.

Identity & Access Management · 2026-07-13

1Password beta adds exact-phrase search, native HTTP auth autofill, and a launchable MCP binary alongside developer settings consolidation.

• Supports exact-phrase search queries using double quotes, including special characters like IP addresses (e.g., 10.1.2.3).
• Adds Universal Autofill support for native HTTP authentication prompts in browsers.
• Enables launching the bundled 1password-mcp binary by name instead of requiring an absolute path for MCP server clients.

Identity & Access Management · 2026-07-13

1Password for Windows adds exact-phrase search with special characters and a simpler MCP server launch path.

• Adds exact-phrase search: wrap a query in double quotes to match special characters like dots and dashes (e.g., 10.1.2.3).
• Enables launching the bundled 1password-mcp binary by name instead of requiring an absolute path in MCP client configs.
• Groups 1Password CLI, SDKs, and MCP client integrations into a single unified section under Settings > Developer.

Identity & Access Management · 2026-07-13

1Password iOS beta adds exact-phrase search with special characters and password generation without unlocking via Autofill.

• Supports exact-phrase search using double quotes, including special characters like dots and dashes (e.g., 10.1.2.3).
• Enables password generation through Autofill without requiring 1Password to be unlocked first.
• Improves Credential Exchange export error messages with actionable remediation steps.

Identity & Access Management · 2026-07-13

1Password browser extension adds exact-phrase search and smarter phishing-prevention prompts.

• Supports exact-phrase search queries using double quotes, including special characters like IP addresses and domain names (e.g., 10.1.2.3).
• On verified low-risk sites, phishing prevention prompt now promotes Add website and autofill as the primary action.

Identity & Access Management · 2026-07-13

1Password Android adds Open 1Password shortcut in autofill suggestions and updates item-move/duplicate audit events to Export Vault.

• Adds an Open 1Password option directly in the autofill login suggestion list, letting users search for any vault item without leaving the sign-in flow.
• Changes the audit event type for items moved or duplicated between 1Password accounts from a generic event to an Export Vault event, improving audit log fidelity for security teams.

Identity & Access Management · 2026-07-13

1Password for Linux 8.12.26 adds configurable default landing section and updates audit events for cross-account item moves.

• Adds a configurable default landing section so the app opens to a chosen view after launch or inactivity (Settings > General > Defaults).

Identity & Access Management · 2026-07-13

1Password 8.12.26 adds configurable default view, CTAP2 authenticator support, and improved Safari inline menu navigation.

• Adds configurable default section shown on app open or resume (Settings > General > Defaults).
• Supports CTAP2 authenticators requiring user verification for 1Password account sign-in with two-factor authentication.
• Changes the audit event logged for items moved or duplicated between accounts to an Export Vault event.

Identity & Access Management · 2026-07-13

1Password for Windows 8.12.26 adds configurable default view, improved audit events, and smarter display handling.

• Adds configurable default section shown on app open or resume via Settings > General > Defaults.
• Changes the audit event for items moved or duplicated between accounts to an Export Vault event, giving security teams more accurate audit trails.
• Large Type and QR code windows now open on the active display rather than the primary display.

Identity & Access Management · 2026-07-13

1Password browser extension 8.12.26 adds instant unlock fallback, system language matching, and body-level field exclusion attributes.

• Enables immediate unlock of the browser extension when the 1Password desktop app is not detected, eliminating the previous forced connection-attempt delay.
• Adds Use system defaults option in the language selector so the extension matches the browser's configured language automatically.
• Supports body-level data-1p-ignore and data-op-ignore attributes to exclude entire pages' fields from 1Password autofill.

Identity & Access Management · 2026-07-13

Android beta adds Open 1Password shortcut in autofill suggestions and changes item-move audit events to Export Vault.

• Adds an Open 1Password option directly within the autofill suggested-logins list, letting users search for any item without leaving the sign-in flow.
• Changes the audit event recorded when an item is moved or duplicated between 1Password accounts from a generic event to an Export Vault event, improving audit trail clarity for security teams.

Identity & Access Management · 2026-07-13

1Password Android beta adds quick vault access in autofill and updates audit event for item moves/duplicates.

• Adds an Open 1Password option in the autofill suggested-logins list, letting users search the full vault without leaving the sign-in flow.
• Changes the audit event logged when an item is moved or duplicated between 1Password accounts from a generic event to an Export Vault event.

Identity & Access Management · 2026-07-13

1Password Linux beta adds configurable default section on launch and updates audit event classification for item moves.

• New setting to choose which section of 1Password is shown on first open or after inactivity (Settings > General > Defaults).
• Audit event for moving or duplicating items between 1Password accounts now classified as an Export Vault event for clearer audit trails.

Identity & Access Management · 2026-07-13

1Password Mac beta adds configurable default landing section, CTAP2 user-verification support, and improved audit events for item moves.

• Adds configurable default landing section so users can choose which part of 1Password is shown on first open or after inactivity (Settings > General > Defaults).
• Adds support for CTAP2 authenticators that require user verification during 1Password account sign-in with two-factor authentication enabled.
• Changes the audit event logged when an item is moved or duplicated between accounts to an Export Vault event, giving security teams clearer cross-account activity signals.

Web Application Security · 2026-07-13

Acunetix 360 v26.6.1 adds pre-scan auth validation, interactive MFA login, and sitemap data retention.

• New pre-scan authentication validation checks that credentials are working before a full scan begins.
• New interactive MFA login support enables authenticated scanning of targets protected by multi-factor authentication.
• New sitemap data retention preserves discovered sitemap information across scans for ongoing analysis.

Cloud Security Posture · 2026-07-13

Aikido adds MCP for AI-driven security workflows, AI Pentest re-testing, Azure Management Group auto-discovery, and a wave of new integrations.

• New Aikido MCP integration lets AI agents analyze code for security risks and fixes locally, without sending code or data to the cloud.
• New re-test capability for individual AI Pentest findings lets teams confirm a specific fix is resolved without running a full pentest.
• New Azure Management Group support: connect once and Aikido auto-discovers all existing and future groups and subscriptions.

Cloud Security Posture · 2026-07-13

Aikido adds Kubernetes real-time image scanning, Eclipse IDE plugin, AI pentest preview, and dependency upgrade breaking-change analysis.

• New Dependency Upgrade Breaking Change Analysis: Aikido AutoFix surfaces code-breaking impacts of dependency upgrades before they are applied.
• New Kubernetes In-Cluster Image Scanning: continuously monitors container images running in live Kubernetes clusters for vulnerabilities.
• New AI Pentest Skip-Payment model: run a full whitebox pentest and pay only to unlock details of High or Critical findings.

Cloud Security Posture · 2026-07-13

Aikido adds continuous pentesting, VM reachability diagrams, full IDE workspace scanning, and expanded integrations.

• New Aikido Infinite (Continuous Pentesting): automatically re-tests your app after every code change, focusing on what changed and validating exploitability to reduce false positives.
• New Reachability Diagrams for Cloud VMs: visualizes whether a finding is exploitable by mapping the network path, entry points, and exposed ports in your cloud environment.
• Full Workspace Scan now available across all supported IDEs (VS Code, JetBrains, Visual Studio, Eclipse, Cursor), with IaC scanning added for VS Code.

Cloud Security Posture · 2026-07-13

Aikido adds conversational AutoFix refinement, Pentest Threat Model, Alibaba Cloud support, and new APIs in release #44.

• Adds Refine with Aikido AI — iteratively adjust AutoFixes using natural language to match your code style without leaving Aikido.
• New Pentest Threat Model provides a real-time, transparent view of your attack surface and how your application's security posture will be tested.
• Supports Alibaba Cloud: scan for misconfigurations, exposed resources, and risky settings across your Alibaba Cloud environment.

Cloud Security Posture · 2026-07-13

Aikido adds Lovable pentesting integration, container network reachability, new APIs, and expanded Zen Firewall agent support.

• Adds Container Reachability: maps the complete network route to running containers and surfaces CVEs in deployment context, showing what is exposed to the internet.
• Detects org.opencontainers.image.source tags in Docker images for improved container identification.
• Extends Virtual Machine Reachability support to Azure.

Cloud Security Posture · 2026-07-13

Aikido adds AI pentest escalation, AutoTriage custom context, cloud reachability for GCP, and new Zen firewall agents.

• Enables escalation of AI pentest vulnerabilities beyond default cautious mode to perform deeper exploitation analysis and confirm whether protection layers hold up.
• Adds custom environment context input for AutoTriage to improve finding accuracy and reduce false positives.
• New out of SLA graph added to Reports Trends Over Time view.

Cloud Security Posture · 2026-07-13

Aikido adds Device Protection for blocking malicious packages on developer machines, AI Chat in AutoFix, and new API endpoints.

• New Device Protection agent blocks malicious packages (npm, PyPI, Maven, NuGet, and more) and risky IDE/browser extensions at install time on developer devices to stop supply chain attacks.
• Aikido AI Chat is now embedded in the AutoFix & Code Analysis Modal, enabling natural-language interaction with security findings and in-product AutoFix PR customization.
• Adds cloud support for detecting Supabase common configuration issues.

Cloud Security Posture · 2026-07-13

Aikido adds AI code auditing, MCP integration, ServiceNow ticketing, Oracle/Alibaba cloud support, and Zen Firewall agent expansion.

• New AI Code Audit capability performs pentest-grade reasoning on source code to catch logic flaws and vulnerabilities that traditional scanners miss — activated by connecting a repo.
• New Aikido MCP integration lets AI coding assistants (e.g. Cursor, Claude) query Aikido issues — critical findings, leaked secrets, and open vulnerabilities — directly from the coding environment.
• New ServiceNow integration automatically converts security findings into ServiceNow tickets, routing them into existing team workflows.

Cloud Security Posture · 2026-07-13

Aikido #49 adds threat model diagrams, Windows device protection, repo/container labels, and a wave of new API endpoints.

• New threat model visualization: every AI pentest and code audit now ships an architecture diagram showing roles and trust boundaries.
• Device Protection now supports Windows, including MDM rollout for fleet-wide deployment.
• New Labels feature lets you attach arbitrary metadata (business unit, PII, region, etc.) to repositories and container images and filter your issue feed by those labels.

Cloud Security Posture · 2026-07-13

Aikido adds agentic dependency AutoFix, a registry proxy for malware blocking, and Ruby/Rust device protection.

• New Agentic Dependency AutoFix automatically resolves complex, interlocking dependency interactions on your behalf.
• New Registry Proxy routes your private registry through Aikido to block malware and risky new packages and serve safe, patched versions before they reach your codebase.
• Device Protection now covers Ruby (gems) and Rust (crates), blocking malware on install and adding them to your device SBOM.

Cloud Security Posture · 2026-07-13

Aikido launches Code Audit: agentic pentest-grade source code reasoning that finds logic flaws without a live environment.

• New Code Audit feature applies agentic, pentest-grade reasoning directly to source code to detect logic flaws — such as cross-tenant data leakage — that pattern-based scanners miss.
• Supports codebases that are difficult to test via URL: mobile apps, smart contracts, desktop apps, embedded software, and libraries.
• Integrates with Aikido's existing issue experience: findings include code-based evidence, root cause analysis, remediation guidance, and AI-powered AutoFix for opening remediation PRs.

Cloud Security Posture · 2026-07-13

Aikido adds LLM-powered AutoTriage for secrets and CVEs to cut noise and automate prioritization decisions.

• New Secrets AutoTriage agent: assesses whether a detected secret is a real, exposed credential and evaluates its liveness and scope to determine actionable risk.
• New CVE Exploitability Analysis agent: uses LLM reasoning against your actual codebase to determine whether a CVE is reachable and how urgently it must be addressed.
• Automated remediation actions: the CVE agent can upgrade, downgrade, snooze, or ignore findings automatically based on configurable rules.

Cloud Security Posture · 2026-07-13

Aikido launches Device Protection: real-time malware blocking, extension governance, and group-based policies for developer devices.

• New Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGet package ecosystems powered by Aikido Intel.
• Adds extension governance covering VS Code, OpenVSX, Chrome, and skills.sh extensions with policy-based controls.
• New request-and-approval workflow pauses blocked installs and routes one-click exception requests to the admin Inbox inside Aikido.

Web Application Security · 2026-07-13

Arcjet adds proxy support, Nosecone Nonce API, enhanced security briefings, and a new Console activity view.

• Adds proxy support to the JS SDK 1.6.
• Introduces an optimized Wasm bundle across JS, Go, and Python SDKs.
• Delivers the first numbered Go SDK release (0.1.0) with improved per-request caching.

Identity & Access Management · 2026-07-13

Auth0 Organizations now supports third-party app access with per-org controls and scoped user consent.

• Enables third-party application access for Auth0 Organizations, configurable on a per-organization basis by tenant admins.
• Blocks third-party app access by default for all existing organizations — admins must explicitly opt in, preserving backward compatibility.
• Supports domain-level connections (is_domain_connection: true) as a requirement for authenticating org users through third-party apps.

Identity & Access Management · 2026-07-13

Auth0 Universal Login now supports Google One Tap for frictionless, one-click sign-in (Early Access).

• Adds Google One Tap support to the Universal Login prompt (Early Access), letting users authenticate instantly via a non-intrusive identity overlay without manual forms or page redirects.

Identity & Access Management · 2026-07-13

Auth0 adds IPSIE session_expiry claim support for Okta and OIDC Enterprise connections to enforce federated session ceilings.

• Supports the IPSIE SL1 session_expiry claim for Okta and OIDC Enterprise connections, using the IdP-provided expiry as a hard ceiling on Auth0 session lifetime.
• Automatically terminates Auth0 sessions when a federated user's upstream IdP session expires, eliminating stale federated sessions and residual access.
• Enforces session expiry as the minimum of three values: the IdP session_expiry claim, the tenant's absolute session expiration, and any expiry set via Actions.

Identity & Access Management · 2026-07-13

Auth0 adds an Outbound SCIM Action template for Event Streams, enabling infrastructure-free user provisioning to any SCIM 2.0 app.

• New Outbound SCIM Action template for Event Streams pushes user.created, user.updated, and user.deleted events to any SCIM 2.0-compliant downstream application without custom infrastructure.
• Supports SCIM 2.0 REST operations (POST, PUT, DELETE) translated directly from Auth0 user lifecycle events.
• Template-driven customization lets practitioners map Auth0 attributes to downstream SCIM schemas and enable opt-in UPSERT (create-on-update) behavior for gradual user trickle-in.

Identity & Access Management · 2026-07-13

Auth0 Refresh Token Metadata is now GA: attach up to 25 custom key-value pairs to refresh tokens via Actions and the Management API.

• Adds Refresh Token Metadata (GA for Enterprise): attach up to 25 custom key-value pairs to refresh tokens that persist throughout the token lifecycle.
• New api.refreshToken.setMetadata() method in Post-Login Actions lets you store contextual data (device, region, org) at login time.
• New Management API endpoints support retrieving (GET), updating (PATCH), and revoking (DELETE) refresh tokens with metadata at /api/v2/refresh-tokens/{id}.

Identity & Access Management · 2026-07-13

Google Workspace Directory Sync for Groups enters open Early Access with native RBAC role assignment for synced groups.

• Enables Google Workspace Directory Sync for Groups in Early Access for all public cloud customers — no enrolment required.
• Supports automated group synchronization, Sync all, and partial group selection out-of-the-box.
• Adds native assignment of synced Google Workspace groups to Auth0 tenant-level RBAC roles and organization-specific roles, so group members automatically inherit permissions at login.

Identity & Access Management · 2026-07-13

Auth0 Dashboard now supports real-time API search by ID, identifier, or name — no more paginated scrolling.

• Adds real-time search for APIs in the Auth0 Dashboard, allowing lookup by API ID, identifier, or name (Public Beta, rolling out to Public Cloud tenants).

Endpoint Security (EDR/XDR) · 2026-07-13

Automox adds Remote Command and File Transfer to its new Remote Tools umbrella, enabling shell access and file I/O without a full desktop session.

• Introduces Remote Tools — a unified remote support hub that consolidates Remote Control, Remote Command, and File Transfer in one place.
• New Remote Command capability opens an interactive shell session on a managed Windows or macOS device in the background, without taking over the end user's screen.
• New File Transfer capability lets practitioners push scripts, configs, or installers to — and pull logs or diagnostic output from — a managed device without launching a full remote control session.

Endpoint Security (EDR/XDR) · 2026-07-13

Automox adds native Slack MSIX detection and patching plus a migration Worklet for Windows MSI-to-MSIX transitions.

• Adds native detection and patching support for Slack MSIX packages on Windows, reported under the existing Slack catalog title with no policy reconfiguration required.
• Supports Slack MSIX on both x64 and ARM64 Windows devices.
• Introduces the base Worklet Windows - Software Lifecycle - Migrate Slack to MSIX, available to all customers (including non-Worklet Catalog subscribers), to remove legacy MSI/EXE installs and provision the current MSIX package in a single controlled action.

Endpoint Security (EDR/XDR) · 2026-07-13

Automox adds KEV & EPSS exploit-risk targeting to Windows OS patching and Advanced Patch policies.

• Extends KEV (CISA Known Exploited Vulnerabilities) and EPSS scoring to Windows OS packages, visible on Software and Device Details pages.
• Enables automated remediation targeting by KEV and EPSS status inside Advanced Patch policies, eliminating manual CVE triage.
• Surfaces exploited and high-probability-of-exploitation vulnerabilities alongside third-party titles for unified risk-based prioritization.

Digital Forensics & Incident Response · 2026-07-13

AVML v0.19.0 collapses all subcommands into one binary and adds a stream subcommand for diskless memory capture.

• New stream subcommand streams a live memory snapshot directly to Azure Block Blob or a remote TCP listener without writing to local disk — ideal for read-only roots, limited-disk hosts, or forensic chain-of-custody requirements.
• New stream blob <SAS_URL> destination pipes memory directly to Azure Block Blob Storage, auto-sizing block size to stay within Azure's 50,000-block limit; --sas-block-size (MiB) sets a floor and --sas-block-concurrency caps in-flight uploads.
• New stream tcp <host:port> destination streams a snapshot over a raw TCP connection to a netcat-style collector.

Attack Surface & Exposure Management · 2026-07-13

Axonius 9.0.2 adds CISA Vulnrichment, Latest Snapshot View, Ingestion Rules set_value, 4 new adapters, and SAML Visiting Data Scopes.

• Adds CISA Vulnrichment as an out-of-the-box vulnerability enrichment source, providing CWE mappings, affected product data, and SSVC metrics.
• New CVE Enrichment Settings section under System Settings > Enrichment consolidates control over 24 vulnerability enrichment sources with granular field selection.
• Introduces Latest Snapshot View — a point-in-time, read-only view of asset data isolated from live discovery cycles, enabling faster and stable query results during active discovery.

Identity & Access Management · 2026-07-13

Remote Support 25.3.5 adds LDAP authentication and SCIM integration support through Pathfinder.

• Adds LDAP authentication support via Pathfinder, enabling user validation against existing directory services with improved login reliability and error feedback.
• Adds SCIM integration for Pathfinder, enabling automated user and access synchronization with identity providers to reduce manual administration.

Vulnerability Management · 2026-07-13

Brinqa 11.33.98 adds drill-down support on dashboard charts with complex BQL relationship queries.

• Adds drill-down functionality on dashboard charts that use complex BQL queries with relationship conditions (e.g., FIND Asset THAT HAS Finding), enabling interactive exploration of data previously locked behind static charts.
• Extends due date behavior now preserves the extended due date on findings tied to expired exception requests, preventing retroactive out-of-SLA marking for findings remediated within their approved extension window.

Vulnerability Management · 2026-07-13

Brinqa 12.0.248 adds case-insensitive search and scalability improvements for high-volume environments.

• Adds case-insensitive search across the platform.
• Enhanced platform scalability and performance capabilities to support high-volume customer requirements.
• Improved orchestration performance to meet high-volume customer requirements.

Vulnerability Management · 2026-07-13

Brinqa 12.0.321 adds Source Data Computation automation, new orchestration stages, and expanded flow step timeouts.

• Introduces Source Data Computation to automatically identify and process Source Data Models (SDM) with calculated attributes.
• Adds new orchestration stages enabling automations to trigger after source data computation and data lifecycle management (DLM) pipeline steps.
• Increases the data lifecycle flow step timeout from 1 to 5 minutes, accommodating larger dataset processing.

Vulnerability Management · 2026-07-13

Brinqa 12.1.118 adds delta computes, consolidation, and Analytics Source support.

• Adds delta computes and consolidation (feature-flagged), enabling incremental data processing workflows.
• Adds Analytics Source support, expanding the range of data sources available for ingestion and analysis.
• Adds BQL Optimizer feedback loop to improve query planning over time.

Vulnerability Management · 2026-07-13

Brinqa 12.1.403 adds BCL-based connector filtering, multi-hop BQL traversal, bulk activate/deactivate actions, and richer API pagination.

• Adds BCL condition-based filtering during connector sync, letting users control which records are imported based on attribute values.
• Adds nested projection and wildcard field selection to the BQL API returningFields parameter for precise control over query response attributes.
• Adds row count details to BQL API pagination responses, simplifying the construction of pagination-aware integrations.

Vulnerability Management · 2026-07-13

Brinqa 12.2.201 debuts SmartFlows v1.0, an AI Attribution Engine, BrinqaIQ enhancements, and a new Platform API replacing GraphQL.

• Introduces SmartFlows v1.0, a new workflow automation capability for building and executing security flows.
• Adds ConnectIQ: AI Attribution Engine v1.0 for AI-driven attribution of security findings.
• Enhances BrinqaIQ Assistant with expanded AI-driven capabilities.

Exploitation & C2 · 2026-07-13

Bugcrowd VRT 1.19.1 adds Active Directory, Kerberos/SCCM, and server misconfiguration categories plus granular SSRF classifications.

• Adds Active Directory misconfiguration entries to the VRT, covering a new class of findings for AD-related vulnerabilities.
• Adds Kerberos and SCCM abuse vectors as distinct VRT categories, enabling more precise classification of common internal attack paths.
• Adds server security misconfiguration classifications rated across the full P1–P5 severity spectrum.

Web Application Security · 2026-07-13

Burp Suite DAST 2026.6 adds wildcard and IPv6 support to proxy exclusion lists and a new scanner update filename format.

• Supports wildcard entries in the proxy exclusion list for flexible traffic filtering.
• Supports IPv6 addresses in the proxy exclusion list.
• Supports the new scanner update filename format.

Attack Surface & Exposure Management · 2026-07-13

Censys Active DNS goes GA, adds Live Resolution, 11 new fingerprints, GOPHER scanner, and 2 new ASM CVE risk fingerprints.

• Censys Active DNS is now generally available to all Censys Search and Censys Core users, enabling domain-to-host relationship mapping, infrastructure change analysis over time, and extensive DNS record review.
• New Live Resolution feature lets users retrieve DNS records for domains not currently present in Censys datasets, with explicit confirmation when an FQDN does not resolve.
• Adds 11 new platform fingerprints covering hardware (D-Link DCS Network Camera), firmware (Lantronix G Series), and software (Wordfence Security, Advanced Custom Fields, All in One SEO, Autoptimize, and more WordPress plugins).

Attack Surface & Exposure Management · 2026-07-13

Censys adds 16 new software/hardware fingerprints and a Gogs RCE risk detection (CVE-2026-52813) to Platform and ASM.

• Adds 15 new Platform software fingerprints covering OpenVPN, Tor, TeamViewer, FreeSWITCH, OpenFlow, RTMP, Redfish, HL7, Bubble, Lovable, Replit, Synergy, EZVIZ IP Camera, GeoVision NVR, Reolink IP Camera, and Windows CE embedded OS.
• New ASM risk fingerprint detects hosts running Gogs versions vulnerable to CVE-2026-52813, an unauthenticated path traversal enabling remote code execution via Git hook overwrite.
• All new fingerprints are queryable in the Censys Platform; new ASM risk types may be disabled by default and must be reviewed in the ASM web console risk type configuration.

Attack Surface & Exposure Management · 2026-07-13

Censys adds bulk API asset tagging, Okta SCIM provisioning, 8 new protocol scanners, and 6 new software fingerprints.

• Adds bulk asset tagging via API: assign or un-assign a tag to every asset matching a CenQL query in a single operation.
• Supports SCIM provisioning via Okta, enabling Platform Admins to automatically provision and de-provision Censys users from their IdP.
• Adds 8 new protocol/application scanners: CLICKHOUSE_NATIVE, CLICKHOUSE_HTTP, OPENFLOW, REOLINK_BAICHUAN, RTMP, SYNERGY, WINCE_CERDISP, and WORDPRESS.

Attack Surface & Exposure Management · 2026-07-13

Censys adds a lightweight Host Enrichment API built for high-volume SOC automation in SIEM/SOAR pipelines.

• New Host Enrichment API delivers a curated, fixed subset of IPv4/IPv6 host data optimized for high-volume, automated lookups without traditional credit consumption.
• Supports SIEM and SOAR integrations, enabling SOC teams to operationalize external internet data at scale.

Reverse Engineering · 2026-07-13

checksec 3.2.0 adds SafeStack, sanitizer, W^X, Selfrando, and stack-clash detection plus a --fail-if CI gate and CSV output.

• Adds SafeStack detection for ELF binaries by scanning for the __safestack_init symbol.
• Extends CFI hardening detection to i386 CET and RISC-V Zicfilp/Zicfiss (landing pads and shadow stack), covering both RV32 and RV64.
• New sanitizer detection (ASAN, UBSAN, MSAN, TSAN, LSAN) via compiler-rt symbol prefix scan.

Reverse Engineering · 2026-07-13

CHIPSEC 2.0.6 restores the uefi types command and adds platform autodetection to uefi tables.

• Adds platform autodetection to chipsec_util uefi tables, removing the need to specify the platform manually.
• Adds a decode dictionary to ExitCode in cfg_checker.py, making exit code interpretation programmatic.
• Expands platform DID matching to HostCtrl DIDs for ADL, ARL, MTL, RPL, and TGLU platforms.

Reverse Engineering · 2026-07-13

CHIPSEC 2.0.5 adds Intel 440FX (QEMU) config, Meteor Lake DIDs, and expanded cfg_checker validation.

• Adds platform configuration for Intel 440FX (QEMU), enabling CHIPSEC analysis against QEMU-emulated environments.
• Adds Meteor Lake (MTL) Device IDs from the datasheet, extending hardware coverage for 14th Gen Intel Core platforms.
• Adds BAR register/field validity and subcomponent type checks to cfg_checker, improving configuration correctness validation.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Duo Desktop adds Microsoft Defender for Endpoint detection on Linux, Ubuntu 26.04 LTS support, and major macOS agent-detection performance gains.

• Adds detection for Microsoft Defender for Endpoint on Linux (v4.6.0).
• Supports Ubuntu 26.04 LTS on Linux; drops support for Ubuntu 23.04 and 20.04 LTS (v4.6.0).
• Significantly improves performance of security agent detection on macOS (v7.18.0.0).

Identity & Access Management · 2026-07-13

Clerk CLI 2.0 adds local webhook testing, one-command user impersonation, and a refreshed interactive UX.

• New local webhooks toolkit lets you receive and inspect webhook events during development without a public URL.
• New one-command user impersonation enables developers to instantly act as any user for debugging and testing.
• Refreshed interactive CLI experience redesigned for both human developers and AI agents.

Identity & Access Management · 2026-07-13

Clerk SAML connections now support disabling just-in-time provisioning to block unprovisioned users.

• Adds opt-in control to reject SAML sign-ins from users who lack an existing account, preventing automatic JIT provisioning.
• Exposes a disable_jit field on the Backend API for programmatic control of JIT provisioning per SAML connection.
• Adds a self-serve toggle in the Clerk Dashboard to enable or disable JIT provisioning on SAML connections.

Identity & Access Management · 2026-07-13

Clerk Billing adds account credit balance management via Dashboard and API.

• Enables adjustment of customer credit balances directly from the Clerk Dashboard.
• New API support for programmatically managing customer credit balances in Clerk Billing.

Identity & Access Management · 2026-07-13

Clerk adds self-serve enterprise SSO configuration for IT admins via a new Security tab in OrganizationProfile.

• New Security tab in <OrganizationProfile /> lets customers' IT admins configure and manage their own enterprise SSO connections without involving your support team.

Identity & Access Management · 2026-07-13

Clerk lets you host and customize the OAuth consent screen on your own domain via the <OAuthConsent /> component.

• New <OAuthConsent /> component enables hosting the OAuth consent screen directly on your application's own domain.

Cloud Security Posture · 2026-07-13

cloud-nuke v0.52.0 adds parallel scanning and deletion via a new --parallelism flag, dramatically speeding up multi-region cleanups.

• Adds --parallelism flag (default 10) to control concurrent scanning and deletion of regions and resource types under a single global concurrency cap.
• Enables concurrent nuking of regional resources while preserving within-region dependency order; global resources (IAM, Route53, CloudFront) are deleted last.
• Breaking change for library consumers: aws.NukeAllResources and gcp.NukeAllResources now require an additional parallelism int parameter.

Web Application Security · 2026-07-13

WAF adds new detections for Citrix NetScaler ADC and Progress Kemp LoadMaster RCE vulnerabilities.

• New detection for Citrix NetScaler ADC insufficient input validation (CVE-2026-8451), rule 78826e3223b94da493a2ade876973ac4, deploying in Log mode on 2026-07-13.
• New detection for Progress Kemp LoadMaster remote code execution (CVE-2026-8037), rule 6b64d216620449fbb273d07910233f36, deploying in Log mode on 2026-07-13.

Web Application Security · 2026-07-13

Enterprise Bot Management gains BotBase bot directory and Attribution Business Insights crawl-to-referral dashboard.

• Adds BotBase, a searchable in-dashboard directory of every bot Cloudflare tracks, classified by behavior (Search, Agent, Training, Transact, Data Collection, SEO, Ads Verification).
• Enables filtering live zone traffic down to a single bot within BotBase to investigate its activity and copy its detection ID for use in Security rules.
• Introduces Attribution Business Insights dashboard showing crawl-to-referral ratios per bot operator over 24 hours, 7 days, or 30 days, with Allowed/Blocked/Partially blocked action status.

Web Application Security · 2026-07-13

Cloudflare now lets all plans block AI crawlers by behavior — Search, Agent, or Training — independently per page type.

• Introduces three independently controllable AI traffic behavior categories — Search, Agent, and Training — available to all customers including Free plan.
• Enables per-behavior blocking policies: block on all pages, block only on ad-displaying pages, or allow — giving fine-grained control over which AI crawlers can access content.
• New default policy (effective September 15, 2026) automatically blocks Training and Agent crawlers on ad-displaying pages for newly onboarded domains, with opt-out available before that date.

Web Application Security · 2026-07-13

WAF adds FortiSandbox path traversal detection (CVE-2026-39813) and disables Fake Bing/MSN Bot rule.

• New detection for Fortinet FortiSandbox path traversal (CVE-2026-39813): rule 32075e19b1494117ac5915e8d84c92c9 blocks unauthenticated arbitrary file reads, currently set to Log action.
• Breaking change: Anomaly:Header:User-Agent - Fake Bing or MSN Bot rule (ae20608d93b94e97988db1bbc12cf9c8) action changed from Enabled/Block to Disabled — zones relying on this rule for bot enforcement must now implement alternative coverage.

Web Application Security · 2026-07-13

New managed rule blocks CVE-2026-10520 pre-auth OS command injection in Ivanti Sentry.

• Adds Cloudflare Managed Ruleset detection (rule 500a90789f874345b60b0de7242fdf83) blocking unauthenticated OS command injection attacks against Ivanti Sentry (CVE-2026-10520) at the WAF layer.

Web Application Security · 2026-07-13

WAF custom rules can now match Cloudforce One threat intelligence fields to block IPs flagged for recent attack activity.

• Adds cf.intel.ip.* fields populated from Cloudforce One threat intelligence, enabling WAF custom and rate-limiting rules to act on IPs flagged within the past seven days.
• New cf.intel.ip.datasets field identifies whether a flagged IP was associated with DDoS or WAF attack activity.
• New cf.intel.ip.attacker_names and cf.intel.ip.attacker_countries fields expose known threat actor identities and source countries for use in rule expressions.

Web Application Security · 2026-07-13

WAF adds Ghost CMS blind SQLi detection (CVE-2026-26980) and a new generic obfuscated boolean SQLi bypass rule.

• New managed rule 439c4ef64b32447989bdf412b4c29bc6 detects and blocks blind SQL injection in Ghost CMS Content API (CVE-2026-26980, versions 3.24.0–6.19.0), moving to Block action.
• New managed rule 6c64b68ef5ed45e7a622cdaab56f403f identifies generic SQLi bypass attempts using obfuscated boolean logic in URI parameters (currently set to Disabled).

Vulnerability Management · 2026-07-13

Cloudmersive Cloud Virus API v11-9-1 adds enhancements to the Scan Website capability.

• Enhances Scan Website functionality with new improvements for web-based threat detection.

Vulnerability Management · 2026-07-13

Cloudmersive Cloud Virus API v11-8-8 adds detection enhancements to its virus scanning service.

• Adds detection enhancements to the cloud-based virus scanning engine.

Vulnerability Management · 2026-07-13

Cloudmersive Cloud Virus API v11-7-3 adds virus scanning support for .vpd and .fsdb file formats.

• Supports scanning of .vpd and .fsdb file formats for viruses and malware.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith cooldown policies now extend to NuGet packages for supply-chain protection.

• Supports cooldown policies for NuGet packages, blocking newly published versions from being consumed until a configured quarantine period has elapsed.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith API keys are now automatically detected by GitHub secret scanning to prevent unauthorized use.

• Integrates with GitHub secret scanning partner program to automatically detect exposed Cloudsmith API keys in repositories.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith now supports PEP-658, letting Python clients fetch package metadata without downloading full wheels.

• Supports PEP-658 on the Simple API, enabling Python package clients (pip, uv, etc.) to retrieve only package metadata during dependency resolution instead of downloading full package archives.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith cooldown policies now extend supply-chain protection to Go packages.

• Supports cooldown policies for Go packages, quarantining newly published versions until a configured delay period has elapsed.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith now manages Docker Hub and DHI upstream auth automatically, raising rate limits without user-supplied credentials.

• Supports Cloudsmith-managed authentication for Docker Hub upstreams, eliminating the need to provide personal credentials.
• Supports Cloudsmith-managed authentication for Docker Hardened Images (DHI) upstreams with the same credential-free setup.
• Enables higher Docker Hub and DHI pull rate limits automatically via managed authenticated tokens versus anonymous access.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith now supports attaching custom key-value metadata to packages for CI, provenance, compliance, and cost attribution.

• Enables attaching custom key-value metadata to any package to store structured contextual data such as CI build info, Git provenance, compliance evidence, and cost attribution directly alongside the artifact.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith vulnerability detection now matches OSV advisories using ecosystem-native version ranges for Debian, Alpine, PyPI, and more.

• Extends vulnerability scanning to match OSV advisories using ecosystem-native version ranges for Debian, Alpine, PyPI, and other non-SemVer ecosystems.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith's Terraform provider v0.0.75 adds full lifecycle management of policies and policy actions as code.

• Supports full lifecycle management of Cloudsmith policies and policy actions via Terraform (provider v0.0.75), enabling policies-as-code workflows.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith adds two new events that automatically trigger policy evaluations across repositories.

• Adds two new policy evaluation triggers so policies are enforced automatically on additional repository events without manual intervention.

SAST / SCA / Code Security · 2026-07-13

Cloudsmith Terraform provider gains a new resource to define and manage connected repositories as code.

• New cloudsmith_connected_repository Terraform resource enables defining connected repository configurations alongside other Cloudsmith infrastructure as code.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

VNS3 7.1.1 adds AI-assisted IPsec diagnostics and live plugin instance upgrades without disrupting running configurations.

• Introduces Connection Advisor with AI Diagnostics (Beta): an Advice option on VNS3 Controllers lets administrators ask for help configuring the controller or troubleshooting site-to-site IPsec connections (requires Cohesive auth token and active support contract).
• Enables in-place plugin instance upgrades: a running plugin's full configuration can now be migrated to a new instance/version on the same VNS3 controller, starting at the same network address once the old instance is stopped.

Identity & Access Management · 2026-07-13

ConductorOne adds real-time access provisioning, catalog indirect-access search, bulk revoke, visual condition builder, and Terraform connector ownership resources.

• Adds real-time streaming of access profile grants and removals to connected apps, replacing hourly sync cycles.
• New rolling-hour anomaly detector for membership removals, with a viewable and adjustable threshold in automation settings.
• Request catalog now surfaces the role, team, or group that grants access to a searched resource, even when the entitlement name doesn't match the search term.

Identity & Access Management · 2026-07-13

ConductorOne now governs private/air-gapped MCP servers via an outbound bridge agent — no inbound firewall rules required.

• Adds private MCP server connectivity via a lightweight bridge-client agent that maintains an outbound connection to C1, eliminating the need to open inbound firewall rules or expose servers to the public internet.
• Enables full C1 entitlement governance (access requests, approvals, reviews, and auditing) for MCP tools running on-prem, in air-gapped clusters, or behind firewalls.

Identity & Access Management · 2026-07-13

ConductorOne adds single-page role mining, custom email providers, bulk role assignment, and flexible table exports.

• Redesigns role mining as a single-page experience with a token-based filter bar, inline cohort refinements, and a floating action bar for creating or updating access profiles without navigating away.
• Adds early-access custom email provider support (Google Workspace, AWS SES, Microsoft 365, SendGrid) so C1 notifications send from your own domain instead of no-reply@conductorone.com.
• Enables bulk role assignment — select multiple users on the Users page and apply a role change to all of them at once.

Identity & Access Management · 2026-07-13

ConductorOne launches Ask C1AI: a floating AI chat assistant for querying access data and taking action from anywhere in the platform.

• New Ask C1AI floating chat panel available on every page lets practitioners query org access data and take action without navigating away from their current view.
• AI assistant ingests page context — the application, entitlements, or policy currently in view — to deliver more precise answers, with a toggle to include or exclude that context per conversation.

Identity & Access Management · 2026-07-13

ConductorOne adds enterprise-managed authorization for AI agents, issuing short-lived scoped tokens via the open XAA standard.

• New early-access Enterprise-managed authorization enables AI agents (Claude, VS Code, etc.) to access organization-run MCP servers using short-lived, scoped tokens — no per-tool prompts, no persistent secrets.
• Agents receive tokens only after entitlement checks, with every token request recorded for auditability.
• AI agent access follows the same request, approval, review, and revocation workflows used for all other access in ConductorOne.

Runtime Security · 2026-07-13

CubeSandbox v0.5.1 adds a standalone lifecycle manager, three-value timeout semantics, host-mount allowlisting, and a Node.js SDK preview.

• Introduces cube-lifecycle-manager (CLM), a standalone control-plane service extracted from the CubeProxy sidecar, enabling CubeProxy to scale horizontally with Redis-based replica discovery and coordinated auto-pause/resume.
• Adds three-value timeout semantics: omitted inherits cluster default, NEVER_TIMEOUT (-1) disables idle reclaim, 0 triggers immediate reclaim, and N>0 sets an idle TTL in seconds — with server-side defaults in CubeMaster.
• Adds set_timeout() / SetTimeout() to Python and Go SDKs (including NEVER_TIMEOUT sentinel) and exposes timeout on sandbox create in the Web UI.

Data Security & DLP · 2026-07-13

Cyera adds AI-Powered Issue Severity to evaluate alerts in full business context — data sensitivity, identity access, and exposure conditions.

• New AI-Powered Severity engine scores issues using business context including data sensitivity, identity access, and exposure conditions to prioritize what truly matters.
• Provides AI-generated explanations for each severity rating to accelerate confident remediation decisions.

Data Security & DLP · 2026-07-13

Cyera launches Access Trail: near real-time sensitive data activity monitoring with one year of retention.

• New Access Trail capability captures near real-time activity tied to sensitive data, recording access, movement, and exposure over time.
• Supports one year of activity history retention for incident investigations, access pattern validation, and audit support.

Data Security & DLP · 2026-07-13

Cyera launches Automation Center: a centralized hub to turn data security insights into consistent, repeatable remediation workflows.

• New Automation Center module enables teams to define, scope, and execute repeatable data security remediation workflows across the Cyera platform.
• Supports automated delegation of data ownership directly from workflow definitions.
• Enables condition-based enforcement of security controls without manual coordination, scaling consistently as environments grow.

Data Security & DLP · 2026-07-13

Cyera Browser Shield adds real-time AI prompt monitoring and inline blocking to control Shadow AI across the enterprise.

• New Browser Shield capability provides enterprise-wide visibility into approved and unsanctioned browser-based AI tool usage.
• Monitors AI prompts in real time before submission, enabling interception of risky inputs before data leaves the browser.
• Distinguishes between corporate and personal accounts on AI tools, enabling policy enforcement based on account context.

Data Security & DLP · 2026-07-13

Cyera MCP connects any MCP-compatible AI tool to DataPort for natural-language data security queries and agent workflows.

• New Cyera MCP integration enables building custom data security agents by connecting MCP-compatible AI tools to Cyera's DataPort.
• Supports natural-language querying of sensitive data locations, access paths, exposure risks, and classification insights via DataPort.
• Enables AI-driven threat hunting, investigation acceleration, and report generation grounded in live Cyera security intelligence.

Data Security & DLP · 2026-07-13

Cyera Privacy launches with continuous data discovery, RoPA, DSR automation, risk management, and consent management.

• New continuous data discovery and enriched classification engine grounds privacy operations in real-time inventory of personal data locations and usage.
• Adds automated data mapping and Records of Processing Activities (RoPA) built from live data context rather than manual surveys.
• Introduces privacy assessments pre-filled with actual data discovery findings, reducing manual effort in DPIA and similar workflows.

Data Security & DLP · 2026-07-13

Cyera DLP Trends surfaces recurring exposure patterns across users, destinations, and roles instead of single-event alerts.

• New DLP Trends view aggregates repeated exposure events into patterns, showing what keeps happening, where, and who is involved.
• Enables prioritization of recurring risks — such as data repeatedly sent to personal destinations or sharing tied to specific roles — over one-off alert triage.
• Incorporates Cyera's data context to elevate provider severity scores within trend analysis.

Data Security & DLP · 2026-07-13

Cyera adds Data Lineage for Files, tracing how humans and AI move sensitive files across system boundaries.

• New Data Lineage for Files capability traces the full lifecycle of sensitive files as they are moved, transformed, and propagated by humans and AI agents across systems.
• Enables reconstruction of file propagation paths even when files cross system boundaries.
• Turns isolated security events into connected investigation context within a single lineage view.

Data Security & DLP · 2026-07-13

Cyera adds Data Retention Policies to surface overdue and stale sensitive files at scale across cloud environments.

• New Data Retention Policies capability detects files that have exceeded a defined retention period using file age signals combined with Cyera's classification context.
• Identifies sensitive data no longer in active use, enabling teams to reduce audit scope and breach impact without manual review at scale.
• Adds visibility into existing Microsoft Purview retention labels applied to M365 files, supporting audit readiness and compliance assessment for Microsoft customers.

Data Security & DLP · 2026-07-13

Cyera adds Exchange Online coverage, scanning mailboxes, email content, and attachments for sensitive data.

• Supports Exchange Online as a new data source, enabling discovery and classification of mailbox content, email bodies, and attachments.
• Reveals regulated and sensitive data spread across historical email communications to support cleanup and retention enforcement.
• Provides visibility into how sensitive attachments move through email and whether email is used beyond its intended governance scope.

Data Security & DLP · 2026-07-13

Cyera extends identity visibility to on-prem file shares via Active Directory mapping across SMB, NetApp, and Dell PowerScale.

• Adds identity visibility for on-prem file shares by mapping Active Directory access across SMB File Shares, NetApp, and Dell PowerScale.
• Enables teams to see who has access, how permissions were granted, and where sensitive data is overly exposed in on-prem environments.
• Surfaces access paths (rather than individual files) to help teams identify and reduce overly permissive or inherited access at the source.

Data Security & DLP · 2026-07-13

Cyera adds nine new integrations spanning cloud security, NHI, data catalogs, lineage, and vuln prioritization.

• New integration with AWS Security Hub to surface Cyera data risk context alongside cloud security posture findings.
• New integration with Upwind to enrich cloud security workflows with data exposure context.
• New integration with Clutch to bring data risk context into non-human identity remediation workflows.

Data Security & DLP · 2026-07-13

Cyera adds ServiceNow ITSM as a discoverable data source, scanning tickets, incidents, attachments, and free-text fields.

• Adds ServiceNow ITSM as a supported data source, enabling discovery and classification across tickets, incident records, attachments, and free-text fields.
• Detects exposed PII, plain-text credentials, and regulated data within day-to-day ITSM operational workflows that traditional tools overlook.
• Brings ServiceNow under Cyera's DSPM governance, treating it as a managed data store rather than an unmonitored exception.

Data Security & DLP · 2026-07-13

Cyera adds Slack integration to deliver actionable data security alerts directly to data owners.

• New Slack integration sends actionable data security alerts with context and next steps directly to data owners in Slack.
• Enables parallel remediation workflows so data owners can act without routing through security teams.

Data Security & DLP · 2026-07-13

Cyera Topic Exploration groups technical data classifications into business-aligned concepts for clearer policy and faster remediation.

• Introduces Topic Exploration, which aggregates multiple technical data classifications into business-aligned topics that map to how organizations think about their data.
• Enables policy creation, automation, and remediation workflows to be driven by business context rather than raw data labels.
• Allows security and data teams to prioritize and communicate data risk in terms that business leaders understand.

Web Application Security · 2026-07-13

DataDome Terraform provider v2.4.0 adds rate limiting, time-box policies, agentic endpoint types, and new response actions for custom rules.

• Adds rate_limit and time_box policy options for custom rules, enabling threshold-based and time-windowed enforcement.
• Adds six new endpoint_type values for custom rules targeting agentic AI traffic: agentic-general, agentic-account-creation, agentic-login, agentic-cart, agentic-forms, and agentic-payment.
• Adds three new response values for custom rules: device_check, intent_based, and monetize, expanding the range of enforcement actions available.

Web Application Security · 2026-07-13

DataDome iOS SDK for Apollo 4.0.0 adds support for Apollo v2.

• Supports Apollo v2 GraphQL client for iOS, enabling DataDome bot protection on Apollo v2-based apps.

Identity & Access Management · 2026-07-13

Didit June 2026: Document AI custom verification, MCP Server v5, PACE NFC on Android, new transaction rule operators, and brand import.

• New Document AI Verification: define custom document types (contracts, licenses, certificates) with configurable extraction fields — no template required — and results are returned via decision/events endpoints and webhooks.
• Auto-suggest extraction fields by uploading a sample document; the AI proposes fields for you directly in the workflow builder.
• Document AI results surface in a dedicated Console section on session details, showing every extracted field, and full-name fields can be matched against the verified identity.

Data Security & DLP · 2026-07-13

CertCentral's Allowed validity periods setting now controls certificate validity (max 199 days), not order validity, with updated TLS request forms.

• Allowed validity periods setting for TLS products now controls certificate validity instead of order validity, capped at the 199-day maximum.
• Annual plan and Multi-year Plan TLS request forms now show coverage options in years (1-, 2-, 3-year) with custom order validity options removed.
• For non-Annual/non-Multi-year Plan TLS requests, certificate validity and order validity are now unified (e.g., a 47-day cert creates a 47-day order).

Data Security & DLP · 2026-07-13

CertCentral enforces CT logging for all public TLS certs and upgrades MPIC to four remote locations across two RIRs.

• Enforces Certificate Transparency (CT) logging for all newly issued public TLS certificates (DV, OV, EV, QWAC, QWAC PSD2) across all DigiCert brands — opt-out is no longer available.
• Removes CT logging opt-out options from CertCentral, requiring customers who previously excluded certificates from CT logs to reassess their PKI strategy (private PKI hierarchies remain unaffected).
• Upgrades Multi-Perspective Issuance Corroboration (MPIC) to require corroboration from at least four remote network locations spanning at least two different Regional Internet Registry (RIR) regions, aligning with CA/Browser Forum Phase 4 requirements.

Data Security & DLP · 2026-07-13

CertCentral Service Users can now have their first and last names updated via UI or API.

• Enables updating a Service User's first and last name in CertCentral or via the Services API, making it easier to identify API key ownership and assign users to teams or roles.

Data Security & DLP · 2026-07-13

CertCentral adds domain-scoped API keys, expands Manager org validation permissions, and improves Smart Seal accessibility.

• New Domains API key restriction scope lets CertCentral API keys be limited exclusively to domain management actions (add, submit, validate, revalidate domains) with no access to certificate ordering or account management.
• Expands Manager role permissions to include the full organization prevalidation workflow: access the Organizations page, view all organizations, add organizations, and submit them for validation independently of a certificate request.
• Improved DigiCert Smart Seal and Site Seal keyboard accessibility: users can now tab to the seal, activate it with Enter or Space, and receive a visible focus ring — giving keyboard-only users the same hover information as mouse users.

Data Security & DLP · 2026-07-13

CertCentral Service Users now support custom first and last names for clearer API key identification.

• Enables custom first and last name assignment when creating a Service User, replacing the generic Service/'User' defaults to reflect team, integration, or role context.

Data Security & DLP · 2026-07-13

CertCentral adds editable ACME Directory URL limits and automated authorized representative delegation for PKIo certs in Europe.

• Enables editing of domain (SAN) and order limit restrictions on existing ACME Directory URLs — add/remove allowed SANs, adjust order caps, or restore unlimited status without creating a new URL.
• Introduces automated Authorized Representative Delegation in CertCentral Europe for PKIo Private Services Server certificates, allowing PKIo orders to be auto-approved after a one-time delegate setup — eliminating per-order manual approvals.
• Supports delegation of authorized representative authority to administrators, managers, and service users, enabling bulk certificate issuance via CertCentral Europe or the Services API.

Data Security & DLP · 2026-07-13

DigiCert CertCentral now issues public TLS certificates with partitioned CRL Distribution Point URLs, capping each CRL at ~9.5 MB.

• All newly issued public DigiCert TLS certificates include CRLDP URLs pointing to partitioned CRLs (~9.5 MB each) instead of a single monolithic revocation list.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

DNSFilter Partner Portal relaunched with magic-link access and local lesson progress tracking.

• New DNSFilter Partner Portal with modernized experience, magic-link email verification (no account creation or SSO required), and device-local lesson progress saving.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

DNSFilter adds a CyberSight Agent compatibility warning banner to flag outdated Roaming Client versions.

• New compatibility warning banner in CyberSight alerts when the Roaming Client version on a device is incompatible with the current CyberSight feature set, prompting an upgrade before relying on CyberSight data.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

macOS Roaming Client v2.4.2 adds component version mismatch detection to catch post-upgrade inconsistencies.

• Adds component version mismatch detection: alerts users when the menu bar app, system extension, and daemon are running mismatched versions — with an in-menu resolution option.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Windows Roaming Client v3.4.23 adds automatic Loopback mode fallback on Windows Server and more consistent device identification.

• Adds automatic fallback to Loopback filtering mode when installed on Windows Server OS, preventing unexpected behavior on unsupported Server deployments.
• Improves device identification consistency in the dashboard, reducing duplicate entries caused by missing identifiers after upgrades or reinstalls.
• Enhances installer prerequisite validation and upgrade handling so failed upgrades no longer leave endpoints without the Roaming Client.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

macOS Roaming Client v2.4.2 Beta adds component version mismatch detection to surface upgrade and MDM install issues.

• Adds component version mismatch detection that alerts users when the menu bar app, system extension, and daemon are running different versions — with an in-menu resolution option.

Exploitation & C2 · 2026-07-13

Dradis Pro v5.2 adds List fields with multi-column issue sorting, broader ServiceNow module coverage, and a redesigned CVSS Calculator.

• New List field type lets you define ordered value sets (e.g., Critical > High > Medium > Low) for Issue fields, complete with configurable font and cell background colours.
• Multi-column Issue sorting now lets you stack multiple List and numeric fields as ordered sort criteria, so reports emerge in exactly the priority sequence your methodology demands.
• ServiceNow integration now creates Vulnerable Items across the Application, Container, and Vulnerability Response modules automatically — no extra configuration required.

Vulnerability Management · 2026-07-13

Edgescan adds Shared Credentials, Browser Recordings, and MFA-aware scanning workflows (Beta, GA Q2 2026).

• Introduces a central Shared Credentials library at the organisation level, letting practitioners create one credential set and assign it to any number of assets instead of re-entering credentials per asset.
• Adds Browser Recordings that capture real browser login flows — including multi-page, JavaScript-heavy, and MFA-prompted flows — and replay them during authenticated assessments.
• Supports mapping Shared Credential fields (username, password, otp_code) to specific input steps in a browser recording, enabling credential reuse across multiple assets with the same recording.

Vulnerability Management · 2026-07-13

Edgescan adds vulnerability detection history timeline, visible discard notes in reports, and expanded MFA/credential workflow capabilities.

• Adds a Vulnerability detection history timeline view that logs a new entry each time a vulnerability is re-detected during an assessment, providing richer retest audit trails.
• Surfaces discard notes directly in the platform UI and in reports, and allows updating discard notes on already-discarded vulnerabilities.
• Enables event notifications for changes to the superuser notes field.

Vulnerability Management · 2026-07-13

Edgescan adds checkbox-based bulk discard for vulnerability management alongside existing filter-based bulk actions.

• Adds checkbox-based bulk discard option, letting users selectively discard individual findings alongside the existing filter-matched bulk-discard workflow.

Vulnerability Management · 2026-07-13

Edgescan adds recorded login sequence uploads, single insight category views, and dark mode for insight graphs.

• Enables users to record a login sequence and upload it to Edgescan for automated authentication during scanning.
• Supports viewing a single insight category in isolation (e.g., CISO Report) within the Insights dashboard.
• Adds dark mode support for insight graphs in the platform UI.

Vulnerability Management · 2026-07-13

Edgescan adds saveable Asset Export filters, duplicate credential detection, in-asset credential creation, and bulk workflow credential vault support.

• Saves export column selections alongside saved Asset Export filters, eliminating the need to reconfigure columns when switching between filters.
• Adds controls to identify, filter, compare, and merge duplicate credentials directly within the credentials vault.
• Enables credential creation and application from the asset scan configuration view, removing the need to navigate away from the asset page.

Vulnerability Management · 2026-07-13

Edgescan adds asset assessment date filtering, AI Insights UI refresh, scoped token mappings, and a raft of workflow enhancements.

• Adds Date of last assessment column and filter, letting users view and filter assets by the date of a specific assessment type (e.g. last pen-test date, last retest date).
• Refreshes the AI Insights page with a look and feel consistent with the rest of the Edgescan interface.
• Enables scoped scheduled assessment exports to a single organization and its descendants.

Vulnerability Management · 2026-07-13

Edgescan adds tester notes for retests, vulnerability definitions in reports, tag visibility, and new vuln filters.

• Auto-populates the current asset when navigating to the Report section from an asset details page.
• Adds a definitions option in report generation to display each vulnerability's definition inline, immediately after the vulnerability.
• Adds a Tags column to the asset table for at-a-glance tag visibility.

Vulnerability Management · 2026-07-13

Edgescan adds audit trail attribution, bulk asset report selection, and role-based access control.

• Adds audit trail entries that identify which user triggered a retest or vulnerability assessment.
• Enables bulk selection of multiple assets when generating reports.
• Introduces role-based authorization support, allowing created and assigned roles to control access to resources within an Edgescan account.

Vulnerability Management · 2026-07-13

Edgescan adds asset-creation notifications, AI Insights asset filtering, configurable asset exports, and improved CWE/assessment-export filtering.

• Adds a new notification event triggered when an asset is created, enabling teams to react in real time to asset inventory changes.
• Enables filtering of AI Insights data by asset IDs and tags, and supports generating personal Insights without affecting the organization-wide Insight.
• Adds an option to omit risk-over-time graphs from the Asset List section of asset reports for cleaner exports.

Vulnerability Management · 2026-07-13

Edgescan adds webhook note payloads and new CISO AI Insight reporting period and time-unit controls.

• Adds note content to webhook event payloads when the note-added trigger fires, enabling downstream systems to consume full note context.
• Enables setting the CISO AI Insight report's time period to last completed quarter and similar discrete reporting intervals.
• Displays FTE time-saved calculations in hours (instead of minutes) on the CISO AI Insight report for clearer workforce-impact communication.

Vulnerability Management · 2026-07-13

Edgescan reports now surface EXF, EPSS, and CISA KEV scoring metrics alongside each vulnerability.

• Adds EXF, EPSS, and CISA KEV indicators to generated vulnerability reports for richer prioritization context.

Vulnerability Management · 2026-07-13

Edgescan adds UX improvement to Roles permissions dropdowns, keeping selections open for faster multi-item configuration.

• Improves Roles UI so permissions and resources dropdowns stay open after adding items, enabling faster multi-selection without repeated reopening.

Vulnerability Management · 2026-07-13

Edgescan adds Out of Scope discard reason, discard reason in exports, and an automatic retest queue.

• Adds Out of Scope as a selectable discard reason when dismissing vulnerabilities.
• Includes discard reason field in vulnerability exports for audit and reporting workflows.
• New retest queue automatically schedules vulnerability retest requests that cannot fit into the current ongoing retest, eliminating manual retry loops.

Vulnerability Management · 2026-07-13

Edgescan adds pentesting checklists in reports and retest/on-demand assessment start notifications.

• Adds a penetration testing checklist to generated reports, summarising what was tested during an engagement.
• Sends assessment start notifications when a user invokes a retest or on-demand assessment.
• Includes a note in email notifications warning non-registered recipients that report links will not work for them.

Digital Forensics & Incident Response · 2026-07-13

iOS Forensic Toolkit 10.10 enables pairing-free sideloading of the extraction agent via wired or wireless network bridge.

• Supports pairing-free sideloading of the low-level extraction agent, eliminating the need to pair the device before delivery.
• Delivers the extraction agent over a wired or wireless network bridge as alternative sideloading methods.

Digital Forensics & Incident Response · 2026-07-13

Elcomsoft Phone Breaker 11.2 adds support for downloading iCloud backups from iOS/iPadOS 26 and iOS 27 beta.

• Supports downloading iCloud backups created on iOS 26 and iPadOS 26 devices.
• Supports downloading iCloud backups from iOS/iPadOS 27 beta builds.

SIEM · 2026-07-13

Exabeam adds Threat Center API endpoints to retrieve threat timelines by alert ID or case ID.

• New API endpoint to retrieve a threat timeline given a specific alert ID.
• New API endpoint to retrieve a threat timeline given a specific case ID.

Firewalls & Network Defense · 2026-07-13

Fastly CLI v15.4.0 adds compute install-tools command and NGWAF account/workspace timeseries support.

• New compute install-tools command pre-installs the Viceroy binary for local Compute development environments.
• New NGWAF timeseries subcommands support account-level and workspace-level time series data queries.

Firewalls & Network Defense · 2026-07-13

Next-Gen WAF agent 4.80.1 improves CMDEXE, path traversal, and XSS detection with refreshed GeoIP data.

• Improves CMDEXE detection for more accurate command-injection identification.
• Improves TRAVERSAL detection to better catch path-traversal attack patterns.
• Improves XSS detection for broader cross-site scripting coverage.

Firewalls & Network Defense · 2026-07-13

Fastly adds 16 backend Compute error metrics to Historical Stats and Real-Time Analytics APIs for root-cause troubleshooting.

• Adds 16 new backend Compute error metrics to the Historical Stats API and Real-Time Analytics API, categorizing failures by TLS, HTTP, DNS, connection, or other error source.

Firewalls & Network Defense · 2026-07-13

Fastly adds Event Mappings API to control which audit events trigger notifications per service or workspace.

• New Event Mappings API enables creating, managing, and querying which Fastly audit events trigger notifications to configured integrations.
• Supports scoping notification mappings account-wide or to specific CDN (VCL) services, Compute (Wasm) services, or Next-Gen WAF workspaces.
• New discovery endpoint /event-types returns all supported audit event types with their compatible scope types.

Firewalls & Network Defense · 2026-07-13

Fastly adds Routing Configurations API to route traffic by URL path/condition, with Domain API support for multi-domain rule binding.

• New Routing Configurations API enables defining routing rules based on URL paths and conditions to direct traffic to different services.
• Updated Domains API supports associating domains with routing configurations, enabling consistent rule application across multiple domains.

Firewalls & Network Defense · 2026-07-13

Fastly accounts can now be linked to an existing Next-Gen WAF corp for unified control panel and API access.

• Enables connecting a Fastly account to an existing Next-Gen WAF corp, surfacing Next-Gen WAF and Bot Management through the Fastly control panel and Fastly API without losing access to the standalone Next-Gen WAF control panel or API.
• WAF configurations and user accounts are shared and synchronized in real time across both control panels and both APIs after the account is connected.

Firewalls & Network Defense · 2026-07-13

Fastly Notifications API adds Datadog, Jira, OpsGenie, and Splunk On-Call as integration targets.

• Adds five new Notifications API integration types: Datadog, Jira Issue, Jira Service Management, OpsGenie, and Splunk On-Call.
• Enables routing of observability alerts and audit log event notifications directly to incident management and issue tracking platforms.

Firewalls & Network Defense · 2026-07-13

Fastly CLI v15.3.0 adds prefix-based bulk KV store deletion and contentguard bot management support.

• Adds support for deleting multiple KV store entries at once using a key prefix.
• Supports contentguard configuration on the bot_management product under [setup.products] in compute deploy.

Firewalls & Network Defense · 2026-07-13

Fastly control panel now shows account-level request visibility across all workspaces on the Requests page.

• Enables account-level request viewing and filtering across all workspaces from the Requests page in the Fastly control panel.

Firewalls & Network Defense · 2026-07-13

Fastly Go SDK 1.8.0 adds bot detection, VPN/proxy detection, stale-if-error caching, and richer KV store controls.

• Adds bot detection hostcalls via fsthttp, enabling Compute apps to identify bot traffic at the edge.
• Adds ResVPNProxy support in fsthttp to detect and act on requests originating from VPNs or proxies.
• Adds stale-if-error logic to the HTTP caching layer, allowing cached responses to be served when origin errors occur.

Firewalls & Network Defense · 2026-07-13

Next-Gen WAF adds account-level requests endpoint to search across all workspaces in one call.

• New GET /ngwaf/v1/requests endpoint enables searching WAF requests across all workspaces in an account, with each result tagged by workspace_id.

Firewalls & Network Defense · 2026-07-13

Next-Gen WAF Simulate API gains detector_scope field per signal and doubles request body size limit to 200 KB.

• Adds detector_scope field to every signal in Simulate API responses, indicating whether detection came from a system, workspace, account, or unknown scope — matching parity with the /requests/{id} API.
• Increases Simulate API request body size limit from 100 KB to 200 KB to support reconstructed requests in the import flow.

Firewalls & Network Defense · 2026-07-13

Fastly Terraform Provider 9.3.0 adds DNS Zones, TSIG Keys, and an immediate-block NGWAF threshold action.

• Adds Terraform resources for managing DNS Zones and TSIG Keys via the Fastly provider.
• Supports block_immediately as a new action in NGWAF threshold configurations, enabling instant traffic blocking when a threshold is breached.

Firewalls & Network Defense · 2026-07-13

Next-Gen WAF adds block_immediately threshold action to unconditionally block high-risk signals without a rate window.

• New block_immediately threshold action blocks every request carrying a configured signal unconditionally, bypassing any rate window — supported for Pentest, CVE, XXE, and AWS-SSRF signals.

Firewalls & Network Defense · 2026-07-13

Fastly JS SDK 3.43.0 adds stale-if-error support for resilient cache serving during origin failures.

• Adds stale-if-error cache control support, enabling the SDK to serve stale cached responses when origin errors occur.

Firewalls & Network Defense · 2026-07-13

Rust SDK 0.13.0 adds stale-if-error guest caching, async request handoff, and modern Rust lock primitives.

• Adds PendingRequest::send_to_client method to hand off responsibility for sending in-flight async responses back to the client to the host.
• Supports stale-if-error in the HTTP guest cache: serves stale cached responses when Request::send or Request::send_async would otherwise return a SendError.
• Enables configurable stale-if-error duration via Request::set_stale_if_error and CandidateResponse::set_stale_if_error, including opt-out via Duration::ZERO.

Threat Intelligence · 2026-07-13

Feedly now embeds VirusTotal verdicts, WHOIS, certs, and reputation scores directly inside IoC Insights Cards.

• Adds VirusTotal integration: connect your existing VirusTotal API key to surface detection verdicts and reputation scores inside IoC Insights Cards.
• Embeds WHOIS records, certificate data, network attribution, and community votes on IoC Insights Cards for zero-detection domain analysis.
• Enables one-click pivot from an IoC Insights Card directly to the full VirusTotal dataset for deeper investigation.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Firezone macOS/iOS 1.5.18 brings major UDP and TUN throughput upgrades, cutting CPU usage and packet loss on high-traffic connections.

• Adds client-side evaluation of resource traffic filters, dropping disallowed packets locally to prevent repeated flow-creation request loops.
• Batches TUN device reads and writes into a single syscall per batch on macOS and iOS, improving throughput and reducing CPU on high-traffic connections.
• Introduces a per-destination UDP socket pool on macOS and iOS that unlocks Darwin's UDP fast path, enabling send batching and kernel congestion (flow advisory) signals.

Threat Intelligence · 2026-07-13

Flashpoint MCP Server is now GA, exposing threat intelligence to AI assistants via the Model Context Protocol.

• New Flashpoint MCP Server enables AI assistants (e.g., Claude, Gemini) to query Flashpoint intelligence directly via the Model Context Protocol (MCP) standard.
• Supports natural-language retrieval across Communities Intelligence, Finished Intelligence Reports, News, Technical Indicators, Vulnerability Intelligence, Ransomware Activity, Compromised Credentials (Enterprise & Customers), Infected Hosts, and Strategic Entity Data (SED).
• Authenticates via OAuth or API token, automatically inheriting the organization's existing Flashpoint subscription entitlements.

Container & Image Security · 2026-07-13

Gatekeeper v3.23.0 adds structured log fields, remote cluster status routing, and operation-scoped mutation rules.

• Adds structured field markers to semantic log lines for easier machine-parseable log filtering and SIEM ingestion.
• Implements status resource routing for remote cluster mode, enabling multi-cluster Gatekeeper deployments to correctly surface constraint status from remote clusters.
• Adds operations field to mutation ApplyTo spec, allowing mutations to be scoped to specific admission operations (e.g., CREATE, UPDATE, DELETE).

Secrets Detection & Management · 2026-07-13

GitGuardian adds 9 new secret detectors (Amadeus, Kinde, TomTom, Datadog, 5 Azure services) plus Gemfury validity checkers.

• New detector for Amadeus OAuth Credentials.
• New detector for Kinde OAuth Credentials.
• New detector for TomTom API Key.

Secrets Detection & Management · 2026-07-13

GitGuardian extends Generic Password and High Entropy Secret detection to Confluence, Jira, Slack, and Teams — with AI false-positive filtering built in.

• Adds Generic Password and Generic High Entropy Secret detection to non-code sources including Confluence, Jira, Slack, Microsoft Teams, and others — matching the coverage already available for VCS.
• Extends the False Positive Remover (LLM-based model) to non-code source findings, automatically tagging 25–40% of generic findings as false positives before they surface in the dashboard.
• Adds remediation guidance content and detector-specific links as assignable metadata fields in the Jira Notifier integration ticket description template.

Secrets Detection & Management · 2026-07-13

GitGuardian's ServiceNow integration gains Public Monitoring, Honeytoken support, and granular event subscription filters.

• Adds Event Group Selection to the ServiceNow integration: choose to route Internal Monitoring, Public Monitoring, or Honeytoken incidents into ServiceNow tickets.
• Supports Public Monitoring in ServiceNow, so secrets exposed on public sources flow into the same remediation workflow as internal incidents.
• Supports Honeytoken events in ServiceNow, bringing decoy-token alerts into the ticketing and remediation workflow.

Secrets Detection & Management · 2026-07-13

Smart Notifiers lets GitGuardian alert only on incidents that match severity, ML risk, validity, or secret type — no middleware needed.

• Adds Smart Notifiers: per-channel filtering rules for webhooks, Slack, and Microsoft Teams alerts based on severity, ML risk score, validity, secret type, or GitGuardian tag across internal and public monitoring.
• Enables email alerting to filter public monitoring incidents by severity.
• Adds sources health management for Confluence Data Center and Microsoft Teams: auto-pauses ingestion on unreachable sources and auto-resumes when health is restored.

Secrets Detection & Management · 2026-07-13

GitGuardian Self-Hosted 2026.6 adds 20+ new secret detectors, a premium scan retry worker, Teams granular alerting, and open-source AI agent skills.

• New premium scan retry worker (Helm only): routes failed large-repo VCS scans to a dedicated high-memory, scale-to-zero pod, keeping base scanner pods small.
• New open-source agent-skills repository (GitGuardian/agent-skills) teaches AI coding assistants (Claude Code, Cursor) when to scan, how to read findings, and how to guide developers through remediation.
• Secrets Detection Engine v2.163 adds 6 new detectors: Aikido API OAuth2 Credentials, Logflare Access Token, PolyAPI API Key, Apollo.io API Key, AES Cipher Key, and SAP OAuth Credentials.

SIEM · 2026-07-13

Google SecOps introduces Security Tokens for metering agentic SOC consumption across GA agents.

• Adds Security Tokens as a new metering unit for tracking and billing consumption by generally available security agents.
• Supports agent invocation via web interface, CLI, chat, and Model Context Protocol (MCP) — all metered through Security Tokens.
• Excludes assistive features (standard chat panels, automated summaries) and preview agents from Security Token consumption.

SIEM · 2026-07-13

Google SecOps raises event rule limits and launches unified rules interface in public preview.

• Increases multiple event rule limits to 200 for Enterprise customers and 400 for Enterprise+ customers.
• Introduces unified rules interface (public preview) combining custom and curated rule management into a single workflow with a redesigned dashboard, advanced rule editor, and expanded API capabilities.

SIEM · 2026-07-13

Google SecOps adds 15 new log types including MCP, OT, and AI platform sources, plus updates 130+ default parsers.

• Adds new log type CISCO_SECURE_ACCESS_ENROLLMENT for Cisco Secure Access Enrollment ingestion.
• Adds new log type CISCO_SECURE_ACCESS_NETWORK for Cisco Secure Access Network ingestion.
• Adds new log type CYBERARK_CERTIFICATE_MANAGER_SAAS for CyberArk Certificate Manager SaaS audit data.

SIEM · 2026-07-13

Google SecOps adds Gemini Cloud Assist directly in Feed Management for guided feed setup and troubleshooting.

• Adds an Ask Gemini Cloud Assist button in the Feed Management interface, opening an AI assistant panel for feed configuration guidance, ingestion prerequisites, and common setup troubleshooting.

SIEM · 2026-07-13

Google SecOps adds configurable auto-collapse for the query editor to maximize search results screen space.

• New Auto-collapse setting for the query editor automatically hides the editor after a search runs, giving more screen real estate to results.

SIEM · 2026-07-13

Google SecOps launches a monthly documentation changelog to track major doc updates.

• New monthly documentation changelog published to capture major Google SecOps documentation updates.

Malware Analysis · 2026-07-13

GuardDog v3.1.0 adds a PyPI Inspector link for remote findings and a new npm risky_new_dependency metadata rule.

• Displays a PyPI Inspector URL in human-readable output for remote PyPI scans that have findings, making file-level triage faster.
• Adds new npm metadata rule risky_new_dependency that flags packages introducing a risky new transitive dependency.

Malware Analysis · 2026-07-13

GuardDog v3 adds kernel-level sandboxing, S3 scanning, risk-based scoring engine, and removes legacy CLI commands.

• Adds kernel-level sandbox (Linux via Landlock, macOS via Seatbelt) for all scan operations — blocks network access and restricts filesystem during archive extraction and YARA analysis; use --no-sandbox to opt out explicitly.
• Supports scanning packages stored in S3 via s3:// URIs, with AWS credential verification before scan and path-traversal-safe download to a temp directory.
• Introduces a risk-based detection engine that correlates code capabilities with threat indicators in the same file to produce a 0–10 severity score, reducing false-positive alert fatigue.

Malware Analysis · 2026-07-13

GuardDog v3.0.0a2 adds encrypted ZIP scanning, S3/remote archive support, and removes legacy top-level commands.

• Adds --zip-password flag to scan commands for extracting password-protected ZIP, WHL, and EGG archives (pass - to read from stdin).
• Supports scanning remote archives via URL (e.g., GitHub raw links) in addition to local paths and S3 prefixes.
• Breaking change: removes the deprecated top-level scan and verify commands — use ecosystem-prefixed commands (pypi scan, npm scan, etc.) instead.

Digital Forensics & Incident Response · 2026-07-13

Hayabusa v3.10.0 adds Sigma 2.1 |neq field modifiers and per-tactic unique/total alert counts in MITRE ATT&CK output.

• Supports Sigma 2.1 |neq and |fieldref|neq field modifiers, enabling negated comparisons composable with |contains, |startswith, |endswith, and |fieldref in detection rules.
• Adds unique and total alert counts per MITRE ATT&CK tactic in detection results, giving practitioners a clearer picture of tactic coverage across a scan.

AI Agent Frameworks · 2026-07-13

Hermes v2026.7.7 adds session bulk-archive, expanded prune filters, 1Password secrets, one-shot usage reports, and ~80% faster first-token latency.

• Adds hermes sessions archive subcommand to bulk soft-hide sessions without deleting them.
• Expands hermes sessions prune with a full filter surface: time bounds (--started-before/--started-after), model, provider, user/chat origin, git branch, token count, cost, tool calls, and more — filters now match all ages when any attribute filter is supplied, dropping the implicit 90-day cutoff.
• Prune dry-run preview now reports match count plus the oldest and newest matching session's age span.

AI Agent Frameworks · 2026-07-13

Hermes v2026.7.1 adds MoA as a first-class model, /learn, /journey, /prompt, background subagent fan-out, Vertex AI, and scale-to-zero gateway.

• Adds Mixture-of-Agents (MoA) presets as selectable virtual models under a moa provider, available in every model picker across CLI, TUI, desktop, and gateway.
• New /moa command runs a single prompt through the default MoA preset as a one-shot, then restores the previous model.
• Streams each reference model's full reasoning as labelled blocks before the aggregator's live-streamed synthesis, making ensemble deliberation visible.

AI Agent Frameworks · 2026-07-13

Hermes v0.17.0 adds iMessage/Raft/WhatsApp channels, background subagents, image editing, Automation Blueprints, and a major memory tool upgrade.

• Adds iMessage support via Photon Spectrum — no Mac relay or BlueBubbles bridge required; authenticate with hermes photon login and a device code.
• Adds Raft agent network integration as a new gateway channel, letting external Raft agents wake Hermes via a wake-channel bridge with metadata-only payloads.
• Adds official WhatsApp Business Cloud API adapter — Meta's first-party hosted path with no QR-scanning bridge process.

Digital Forensics & Incident Response · 2026-07-13

Hindsight v2026.06 adds full Mozilla Firefox support and expands Chrome extension, download, and Service Worker parsing.

• Adds Mozilla Firefox browser support: parses places.sqlite (history, bookmarks, downloads), cookies.sqlite, formhistory.sqlite, permissions.sqlite, logins.json, extensions.json, sessionstore, favicons, cache2, localStorage, IndexedDB, and bounce-tracking/content-blocking databases.
• Adds Firefox HSTS pin parsing from SiteSecurityServiceState.bin and forensically relevant preferences from prefs.js.
• Adds Firefox bookmark backup parsing from bookmarkbackups/*.jsonlz4, enabling recovery of deleted bookmarks from daily snapshots.

Exploitation & C2 · 2026-07-13

NodeZero June 2026: Rapid Response overhaul, Real-Time View redesign, and External Pentest rebuild with reusable Scopes

• Adds asset-level exploitability status, personalized remediation guidance, and verification feedback to Rapid Response, reducing vulnerability noise.
• Redesigns Real-Time View (RTV) with a visual timeline, event-log summaries, and granular event details to help distinguish NodeZero testing activity from real attacks.
• Rebuilds External Pentesting to replace Asset Groups with reusable Scopes, with improved bulk asset management, uploads, and support for large external attack surfaces.

SIEM · 2026-07-13

Hunters adds unified anomalous login detector, Windows password-change enrichment/scoring, and four new AXON threat hunt reports.

• New detector: Context Unified Anomalous Login detects successful anomalous logins across identity providers, SaaS apps, cloud platforms, VPNs, and other integrated login sources using per-user behavioral baselines spanning geolocation, IP, and user-agent signals.
• New detector: Suspicious User-Agent Observed in Azure Non-Interactive/SPN Sign In Activity flags authentication activity from offensive tooling (Kali Linux, Parrot Linux, Scout Suite, TruffleHog, and others) in SPN and non-interactive sign-in flows.
• New enrichment: Windows Recent Password Change queries Windows Security Event Logs (Event ID 4723 and 4724) to surface last password change time, initiating user, and source computer as lead context.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress Managed SIEM gains GA AI Search, enabling plain-English log queries with automatic ESQL translation.

• Adds AI Search (GA) to Huntress Managed SIEM, allowing natural-language queries against SIEM logs without requiring ESQL or the Query Builder.
• Enables on-demand ESQL translation: after a plain-English search, clicking the ESQL button reveals the generated ESQL query to accelerate analyst upskilling.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress Managed ISPM adds SharePoint/OneDrive/Teams security controls and expands Continuous Enforcement to five new policies.

• New SharePoint Online control: enforces idle session timeout for SharePoint and OneDrive.
• New SharePoint Online control: blocks anonymous sharing links in SharePoint and OneDrive.
• New SharePoint Online control: prevents users from self-creating SharePoint sites.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress Managed EDR for macOS auto-ejects malicious DMGs before payload execution, blocking infostealers.

• Automatically ejects deceptive/malicious DMG installers on macOS before their payloads can execute, blocking infostealer malware.
• Delivers on-screen user notifications explaining why a DMG was ejected.
• Triggers a Huntress SOC investigation on every DMG ejection event to confirm endpoint cleanliness.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress Managed EDR now blocks macOS infostealers at the Gatekeeper-override moment on macOS 14+.

• New macOS infostealer prevention: detects and stops infostealer execution at the moment a user is socially engineered into overriding Apple's Gatekeeper, available on macOS 14 and later.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress Managed ISPM hits GA, delivering continuous M365 identity hardening across Entra ID, Exchange, SharePoint, and Teams.

• Adds Managed ISPM (Identity Security Posture Management) at General Availability, continuously hardening Microsoft 365 environments against misconfigurations and over-permissioned accounts.
• New Huntress-managed security controls span Microsoft Entra ID, Exchange Online, SharePoint, and Teams — covering the most commonly abused identity attack surfaces.
• Adds Conditional Access policy management with recommended templates, giving practitioners a curated baseline for CA enforcement.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress adds OSINT 2 Simulation in GA, teaching learners the risks of oversharing online.

• New OSINT 2 Simulation (fifth simulation) now generally available, covering risks of oversharing personal information online.
• Accompanies July's managed learning assignment for structured security awareness training.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress Managed SAT now offers GA Custom HTML Phishing Scenarios for targeted spearphishing simulations.

• Adds General Availability of Custom HTML Scenarios in Managed SAT, enabling fully customized spearphishing simulations that can impersonate trusted vendors or mimic specific employees' names and communication styles.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress Managed SIEM adds Okta as a GA log source with SOC-built detections for identity-based attacks.

• Adds Okta as a supported identity and authentication log source in Huntress Managed SIEM (generally available).
• New SOC-built detections for Okta covering credential attacks, privilege escalation, MFA bypass and fatigue, account takeover, and federated identity manipulation.
• Extends SIEM visibility to the identity layer for organizations using Okta as their IdP or SSO provider.

Endpoint Security (EDR/XDR) · 2026-07-13

Huntress MDE integration now supports GCC High tenants, routing API traffic to .us endpoints automatically.

• Supports onboarding Microsoft Defender for Endpoint (MDE) tenants in GCC High environments, with login, Graph, and MDE API traffic automatically routed to GCC High .us endpoints.
• Enables GCC High tenants already mapped in ITDR to be onboarded into MDE using the same tenant.

Identity & Access Management · 2026-07-13

iDenfy adds Brazil Digital CNH, new India/Philippines digital IDs, KYB automation API, tax ID fields, Risk Assessment PDF export, and more.

• Supports Brazil Digital CNH (digital driver's license) as a verifiable document type.
• Adds new digital ID support for India and the Philippines.
• New API endpoint to re-run KYB automation workflows programmatically.

Digital Forensics & Incident Response · 2026-07-13

iLEAPP v2026.1.0 adds 10+ new parsers, conversation views, custom artifact paths, and broad LAVA migration.

• Adds new parsers for Zalo Chat and Users, Discord cache, Home Depot app, Oura Ring, App Web Usage (Biome), Biome NotificationUsage, springboard wallpaper, Apple ATX image files, iOS Widgets, and keychain artifacts.
• Adds conversation views to WhatsApp, Viber, Kik, Slack, Life360, TikTok, Discord, Teleguard, Reddit, LinkedIn, and Telegram.
• Adds --custom_artifacts_path CLI flag to load artifact modules from an extra folder, enabling third-party or case-specific parsers without modifying the install.

Data Security & DLP · 2026-07-13

Immuta adds automated Redshift discovery, managed policy groups, Alation OAuth 2.0, Delta Sharing masking, and Teams/Slack notifications.

• Adds automated sensitive data discovery (regex, dictionary, and column name regex identifiers) for the Amazon Redshift viewless integration, auto-tagging matching columns.
• Introduces three built-in Immuta-managed groups — All Agents, All Users, and All Identities — usable in subscription and data policies without manual membership management.
• Enables case-insensitive Starburst (Trino) principal name matching for more reliable user and service account identification (on by default 7/1, mandatory 8/1).

Container & Image Security · 2026-07-13

Inspektor Gadget v0.54.0 adds Cilium NetworkPolicy generation, Helm resource limits, and improved exec arg capture.

• Adds --policy-format cilium option to advise_networkpolicy, enabling generation of Cilium NetworkPolicy resources in addition to the existing Kubernetes NetworkPolicy output.
• Enables CPU and memory requests and limits for the Inspektor Gadget DaemonSet via the Helm chart resources field, so deployments fit within cluster resource quotas.
• Improves trace_exec to read process arguments from the new process address space, capturing more accurate argv data for executed processes.

Threat Intelligence · 2026-07-13

IntelOwl v6.7.0 ships an LLM-powered threat-intel chatbot, two new analyzers, and connector health checks.

• Adds a self-deployed LLM chatbot (powered by Ollama via optional Docker override) that lets analysts query IntelOwl jobs, investigations, analyzers, and playbooks in natural language over WebSocket with token streaming.
• New CVE_Exploitability analyzer combines CISA KEV and FIRST EPSS data to score CVE observables for exploitability.
• New RDAP analyzer enables registration data access protocol lookups for domain and IP observables.

Attack Surface & Exposure Management · 2026-07-13

Intruder adds native Linear integration to push vulnerabilities directly into Linear teams, projects, and backlogs.

• New Linear integration: connect your Linear workspace from Intruder settings to push vulnerabilities without leaving the platform.
• Supports one-click push of any issue to a chosen Linear team and project.
• Enables auto-create rules to automatically raise Linear tickets based on vulnerability severity.

Attack Surface & Exposure Management · 2026-07-13

Intruder adds Docker Hub integration for automated container image vulnerability scanning within the portal.

• Connects multiple personal or organisation Docker Hub accounts via Personal Access Token (PAT) for container image scanning.
• Automatically discovers repositories, including tags and last-pushed dates, with on-demand refresh support.
• Enables adding a custom tag to create a scan target and trigger an immediate vulnerability scan.

Attack Surface & Exposure Management · 2026-07-13

Intruder adds regex tag matching for container image targets, enabling accurate scoping across mixed or non-standard tagging conventions.

• New regex tag-matching rule for container image targets lets you define a custom pattern to consistently resolve the correct image version.
• Supports dynamic targeting: the target automatically follows the latest tag matching the regex as new image versions are pushed.
• Enables accurate scoping across repositories with mixed conventions (e.g., semver, -dev suffixes, or custom schemes) where exact-match and semver rules fall short.

Attack Surface & Exposure Management · 2026-07-13

Intruder launches Attack Surface view: unified perimeter visibility with port, service, and web screenshot coverage.

• New Attack Surface view consolidates every exposed port across all monitored targets into a single list, showing the service and software version behind each.
• Displays screenshots of every exposed web service so practitioners can instantly distinguish forgotten admin panels from intended login pages.
• Enables search and filtering by port, service, or product to identify all targets running a specific service in seconds.

Web Application Security · 2026-07-13

Invicti adds gRPC scanning, bulk scan suspension, collection dashboards, and richer CSV exports in this release.

• Supports scanning of gRPC services by uploading .proto definition files, extending DAST coverage to gRPC-based APIs.
• New Suspend all scheduled scans control lets organization administrators pause all future scheduled scans across the account in one action.
• Adds a dedicated dashboard for Collections, providing at-a-glance security posture visibility at the collection level.

Identity & Access Management · 2026-07-13

JumpCloud Agent 2.138.3 adds JIT URLs for scheduled commands and improves per-user agent reliability on Linux.

• Scheduled and repeating commands with remote files now use just-in-time (JIT) URLs, preventing failures when Amazon S3 presigned links expire before execution.
• Linux per-user agent more reliably runs during user association and login, enabling JumpCloud Go registration and device trust flows without manual intervention.

Identity & Access Management · 2026-07-13

Keycloak 26.7.0 adds SCIM API preview, SSF real-time signals, AuthZen PDP, SAML step-up auth, and a new Admin API v2.

• Adds SCIM API (preview) for automating user and group provisioning and deprovisioning via standard CRUD, PATCH, filtering, pagination, and schema discovery endpoints.
• Adds OpenID Shared Signals Framework (SSF) Transmitter support (experimental), pushing signed Security Event Tokens to relying parties via push (RFC 8935) and poll (RFC 8936) delivery with durable outbox and retry logic.
• Adds AuthZen Evaluation API (experimental) implementing the OpenID AuthZEN Authorization API 1.0, exposing single and batch PDP evaluation endpoints for vendor-neutral authorization decisions.

Identity & Access Management · 2026-07-13

Keycloak gains experimental OpenID Shared Signals Framework (SSF) 1.0 Transmitter support, pushing signed SETs to receivers in seconds.

• Adds experimental SSF 1.0 Transmitter role: Keycloak now pushes signed Security Event Tokens (SETs) to subscribed receivers for identity events such as session revocation, credential change, and account disable.
• Supports CAEP 1.0 and RISC 1.0 event profiles, automatically mapping native Keycloak events (login, logout, credential change, session revocation) to the correct standardised event types.
• Supports both HTTP push (RFC 8935) and HTTP poll (RFC 8936, return-immediately) delivery channels for SET distribution.

AI Coding Agents · 2026-07-13

Claude Sonnet 5 is now available in Kiro IDE, CLI, and Web with 1M context and stronger agentic reasoning.

• Adds Claude Sonnet 5 to the Kiro IDE, CLI, and Web model selector — Anthropic's most agentic Sonnet model with stronger reasoning, tool use, and coding performance approaching Opus 4.8 at Sonnet-class pricing.
• Supports a full 1M token context window with a 1.3× credit multiplier, matching Sonnet 4.6 pricing.
• Available to Kiro Pro, Pro+, Pro Max, and Power customers in AWS US-East-1 (Northern Virginia) and AWS Europe (Frankfurt) with cross-region inference support.

AI Coding Agents · 2026-07-13

Kiro adds live hot-reload for MCP/agent configs and a toggle to block default resource inheritance in custom agents.

• Adds hot-reload for agent and MCP configurations: saving changes to an agent config, a new agent file, or mcp.json takes effect immediately without restarting the session or losing conversation history.
• Adds selective server restart on config change — only affected MCP servers restart, and the config diff is order-independent so reordering environment variables does not trigger unnecessary restarts.
• New chat.disableInheritingDefaultResources setting lets custom agents opt out of automatically inheriting default steering, skills, and AGENTS.md.

AI Coding Agents · 2026-07-13

Enterprise admins can now set per-profile overage caps for Kiro users via AWS Service Quotas.

• Adds custom overage cap controls for Enterprise admins via the AWS Service Quotas console, using the new Maximum allowed overage per Kiro profile quota field.

AI Coding Agents · 2026-07-13

Kiro MCP OAuth now supports pre-registered apps with client secrets, custom redirect URIs, and DCR bypass.

• Supports configuring a clientSecret in MCP OAuth config for servers that require one (e.g., Figma).
• Skips Dynamic Client Registration automatically when a custom clientId is provided, authenticating as your pre-registered app.
• Accepts full URLs with custom paths in the redirectUri field (e.g., http://localhost:7778/oauth/callback) to match exact app registration requirements.

AI Coding Agents · 2026-07-13

Kiro adds hooks on agent file writes, lazy MCP OAuth, and multi-window settings sync.

• Adds hooks that trigger on agent-driven file writes, enabling automated workflows whenever the AI agent modifies files.
• Introduces lazy MCP authentication — OAuth sign-in for MCP servers is triggered automatically on demand rather than requiring manual setup upfront.
• Enables multi-window settings sync so IDE preferences stay consistent across multiple open Kiro windows.

AI Coding Agents · 2026-07-13

Kiro adds AWS IAM role assumption for sandbox tasks and a standardized OAuth flow for third-party service Powers.

• New IAM Role for Sandbox: configure an AWS IAM role that Kiro Web assumes to supply the agent, CLI tools, and MCP servers with auto-refreshing short-lived credentials scoped to each task.
• New standardized authorization flow for Powers: connect third-party services (Figma, Stripe, Supabase, etc.) once via Manage Powers and the agent reuses the encrypted token across all future tasks without re-prompting.
• Instant revocation for third-party service connections: disconnecting a Power immediately revokes access, with tokens encrypted at rest and never exposed to the sandbox or agent.

AI Coding Agents · 2026-07-13

Kiro 1.0.89 adds automatic session restore on launch, idle performance improvements, and prepaid credit packs in the account dashboard.

• Reduces idle resource consumption for improved background performance.
• Adds prepaid credit packs visibility to the account dashboard.

AI Coding Agents · 2026-07-13

Kiro adds MCP OAuth management commands and keyboard shortcuts to control remote server authentication without restarting sessions.

• New /mcp auth command forces re-authentication when an OAuth token has expired or become invalid on a remote MCP server.
• New /mcp cancel-auth command aborts a stuck pending OAuth flow waiting for browser confirmation.
• New /mcp logout command removes stored OAuth credentials for a remote MCP server entirely.

Cloud Security Posture · 2026-07-13

FortiCNAPP adds AI-generated incident reports, FortiGuard IoC feeds, LLM skills scanning, EKS/GKE low-latency audit log alerts, and SAST for Windows across recent releases.

• New Alert Dashboard: View and filter alerts by severity, category, or sub-category with an interactive time chart.
• Integrates FortiGuard IoC feed as a threat intelligence source for detections.
• New Vulnerability Scanner 0.29.0 released with updated scanning capabilities.

Cloud Security Posture · 2026-07-13

FortiCNAPP adds AI-generated incident reports, FortiGuard IoC feeds, LLM Skills Scanner, EKS/GKE low-latency audit alerting, and SAST for Windows across recent releases.

• New Alert Dashboard lets practitioners view and filter alerts by severity, category, or sub-category.
• Integrates FortiGuard IoC feed to enrich threat detection with Fortinet threat intelligence.
• New Vulnerability Scanner 0.29.0 released with updated scanning capabilities.

SAST / SCA / Code Security · 2026-07-13

allow-scripts gains a check command to detect stale allow-lists in CI without making changes.

• Adds a check command that warns when the allow-scripts configuration is out of date, designed for use in CI pipelines without modifying any files.

SIEM · 2026-07-13

Sentinel adds data federation, AI playbook GA, custom detection-as-code, UEBA GCP anomalies, and graph-based MCP exploration.

• Adds custom detection rules as code support in Sentinel Repositories (Preview): manage and sync custom detection rules via GitHub or Azure DevOps using the Microsoft Security BICEP extension or BICEP CLI.
• Enables linking behavior-based query results from the BehaviorInfo table to new or existing incidents in advanced hunting (Preview), enriching incident context with UEBA data and auto-populating alert metadata and entities.
• Introduces a graph tool collection in the Microsoft Sentinel MCP server (Preview) for visual, graph-based exploration of relationships across identities, devices, threats, and signals to assess coverage, dependencies, and configuration gaps.

Data Security & DLP · 2026-07-13

Netskope R131 adds Next-Gen SSPM onboarding for M365/Salesforce, on-demand deep scanning, on-prem detection, and macOS/iOS 26 client support.

• Adds pre-built Ubuntu 22.04 VM image for Hyper-V to simplify Netskope Private Access publisher deployments.
• Supports onboarding Microsoft 365 in Next-Gen SSPM for SaaS security posture visibility.
• Supports onboarding Salesforce in Next-Gen SSPM for SaaS security posture visibility.

Data Security & DLP · 2026-07-13

Netskope R132 adds Universal Reverse Proxy for CASB, Transaction Event visibility in Skope IT, and enhanced SSPM Findings UI.

• Adds Universal Reverse Proxy support under CASB Real-time Protection.
• New Transaction Event support in Skope IT for SaaS visibility.
• Enhanced Findings UI in SaaS Security Posture Management (SSPM).

Data Security & DLP · 2026-07-13

Netskope R133 adds AI Red Teaming, AI Security Guardrails, an AI Gateway, expanded ChatGPT Enterprise protection, and NPA source-IP egress controls.

• New AI Red Teaming capability to test and evaluate AI model resilience against adversarial prompts and attacks.
• New AI Security Guardrails to enforce policy-based controls on AI application usage and outputs.
• New Netskope AI Gateway to provide a centralized security enforcement point for AI service traffic.

Data Security & DLP · 2026-07-13

Netskope R134 adds Enterprise Browser–NPA integration, GitHub 3rd-party app risk scoring, and a new Threat Hunting Module.

• New Next Generation API Data Protection deferred policy action capability.
• New Enterprise Browser and NPA (Network Private Access) integration.
• New SSPM capability to discover and risk-score third-party apps in GitHub.

Data Security & DLP · 2026-07-13

Netskope R135 adds AI Guardrails, AI Red Teaming, Agentic Broker, and new CASB/SSPM integrations.

• New AI Prompt and Response Guardrails for content moderation and protection from AI-based threats.
• New AI Red Team product for adversarial testing of AI systems.
• New Agentic Broker capability in CASB Real-time Protection.

Data Security & DLP · 2026-07-13

Netskope R138.0.0 adds enhanced selection controls for Golden Monthly Releases in Client Steering.

• Adds enhanced selection options for Golden Monthly Releases within Netskope Client Steering configuration.

Data Security & DLP · 2026-07-13

Netskope R139 adds FIPS-140-3 client steering, device deletion, and GA of AI Command Center.

• Adds FIPS-140-3 compliance support for Netskope Client Steering traffic.
• New ability to delete devices from the Netskope management console.
• AI Command Center (AICC) reaches General Availability (GA).

Data Security & DLP · 2026-07-13

Netskope R137 adds SSPM Privileged User Visibility enhancements and a self-service UI for NPA AI Agent App Audit.

• Adds Privileged User Visibility enhancements to SaaS Security Posture Management (SSPM), surfacing elevated-access account risk in SaaS environments.
• Introduces a self-service UI for the NPA AI Agent App Audit, enabling administrators to review and manage AI agent application access without requiring support intervention.

Runtime Security · 2026-07-13

nono v0.67.0 adds a standalone proxy command, AWS SigV4 MitM auth, declarative OAuth capture, resource limiting, exec intercept, and richer sandbox token expansion.

• Adds nono proxy standalone command to run the network-filtering and credential-injection proxy as an independent server, with options for fixed port, no-auth mode, and domain allowlisting.
• Implements AWS SigV4 authentication for the MitM proxy, enabling signed AWS API request interception and credential injection.
• Adds declarative sandboxed OAuth capture, allowing profiles to define OAuth flows without manual credential handling.

Runtime Security · 2026-07-13

nono v0.66.0 adds HTTP/2 proxy support, a @git:common-dir dynamic token, and a simplified self-invocation policy for tool sandboxes.

• Adds --allow-http2 flag to enable HTTP/2 multiplexing (via ALPN) for reverse proxy and credential injection upstream connections.
• Adds @git:common-dir dynamic token for tool-sandbox profiles, allowing policies to reference the Git common directory at runtime.
• Simplifies self-invocation policy for sandboxed tools, reducing boilerplate needed when a tool is permitted to call itself.

Runtime Security · 2026-07-13

nono v0.65.0 introduces tool sandboxing, giving delegated tools their own isolated child sandboxes with separate filesystem, network, and credential policies.

• Adds tool sandbox (ETI): delegated tools such as git, gh, and curl now run in isolated child sandboxes with their own fs_read/fs_write, network rules, credential grants, and argv invocation policies — independent of the agent's session sandbox.
• Enables per-tool credential proxy injection via command_policies.credentials, letting profiles expose a proxied token to a specific tool (e.g. gh) while enforcing L7 endpoint and HTTP-method allow-lists on that token.
• Extends nono why to diagnose tool-sandbox argv policy denials via --command <cmd> -- <args…>, in addition to its existing filesystem and network queries.

Runtime Security · 2026-07-13

nono v0.64.0 adds AWS auth config, structured diagnostics JSON output, CI environment detection, and macOS blocked-grants visibility.

• Adds aws_auth config support, enabling native AWS credential handling in agent sandbox profiles.
• New --diagnostics-json flag on nono run emits structured session diagnostics as JSON on stderr, including proxy diagnostics when present.
• Update-check now detects CI environments, suppressing spurious upgrade prompts in automated pipelines.

Runtime Security · 2026-07-13

nono v0.63.0 adds static env injection, keyring timeout control, $PACK_DIR in session hooks, and XDG state dir support.

• Adds set_vars profile field for static environment variable injection into sandboxed sessions — set fixed env values without exposing them through the agent's environment.
• Adds NONO_KEYRING_TIMEOUT_SECS environment variable to control how long nono waits for keychain/keyring access before timing out.
• Adds $PACK_DIR expansion support in session_hooks, enabling hooks to reference the store pack directory for pack-aware scripts.

Identity & Access Management · 2026-07-13

Nudge Security adds native Jira integration to create, map, and auto-close tickets directly from security findings.

• New Jira integration creates tickets directly from any finding, pre-filled with finding details and fix recommendations.
• Supports mapping tickets to Jira project, work type, priority, assignee, and reporter during creation.
• Maintains a linked audit trail between Nudge Security findings and their associated Jira issues.

Identity & Access Management · 2026-07-13

Nudge Security can now discover AI agents built by employees on platforms without a public API, via its browser extension.

• Discovers AI agents employees create across platforms lacking public APIs — including Cursor automations, Retool, Zapier Agents, ChatGPT workspace agents, OpenAI Agents Workflows, Atlassian Rovo (Jira, Bitbucket), Zoom AI Workflows, and HyperAgent — via the browser extension.
• Surfaces discovered agents in the AI agents inventory under Identities, showing creator, components, and risk insights for each agent.

Identity & Access Management · 2026-07-13

Nudge Security adds Google Drive external file share discovery and revocation in open beta.

• New Google Drive integration surfaces every externally shared file, folder, and Shared Drive across a Google Workspace tenant in a single view.
• Enables filtering external shares by domain to see everything shared with a specific external company for targeted cleanup.
• Per-item access controls let administrators tighten or revoke external share permissions with a confirmation step that details scope before changes are applied.

Identity & Access Management · 2026-07-13

Nudge Security maps security posture findings to SOC 2, NIST CSF 2.0, ISO 27001, HIPAA, and OWASP Top 10 Agentic AI Security frameworks.

• Maps security posture findings to five compliance frameworks: SOC 2, NIST CSF 2.0, ISO 27001, HIPAA, and OWASP Top 10 Agentic AI Security.
• Adds compliance framework filtering on the Security Posture Findings view to surface every control violation across a SaaS estate at a glance.
• Enables drill-down into any finding to view the specific controls it violates alongside guided remediation in the same panel.

Identity & Access Management · 2026-07-13

Nudge Security adds connected app integrations for Automox, BeyondTrust, and Ping Identity

• New Automox connected app enables centralized visibility into accounts, activity, and misconfigurations for the endpoint management platform.
• New BeyondTrust connected app brings privileged access management activity and account data into the Nudge Security SaaS inventory.
• New Ping Identity connected app surfaces identity provider accounts and misconfigurations alongside the rest of your SaaS stack.

Identity & Access Management · 2026-07-13

Nudge Security adds connected app integrations for Clockify, Acronis, and OneLogin.

• Adds connected app integration for Clockify, enabling centralized visibility into accounts, activity, and misconfigurations.
• Adds connected app integration for Acronis, enabling centralized visibility into accounts, activity, and misconfigurations.
• Adds connected app integration for OneLogin, enabling centralized visibility into accounts, activity, and misconfigurations.

Identity & Access Management · 2026-07-13

Nudge Security adds connected app integrations for GitLab, Informatica, and Logz.io

• Adds connected app integration for GitLab, enabling centralized visibility into accounts, activity, and misconfigurations.
• Adds connected app integration for Informatica, extending SaaS security posture coverage to the data integration platform.
• Adds connected app integration for Logz.io, bringing log management and observability tooling into unified SaaS visibility.

Identity & Access Management · 2026-07-13

Nudge Security adds connected apps for Greenhouse, Codacy, MuleSoft, and Oracle Cloud.

• Adds connected app integration for Greenhouse to centralize visibility into accounts, activity, and misconfigurations.
• Adds connected app integration for Codacy to centralize visibility into accounts, activity, and misconfigurations.
• Adds connected app integration for MuleSoft to centralize visibility into accounts, activity, and misconfigurations.

Identity & Access Management · 2026-07-13

Nudge Security adds connected app integrations for LastPass, BambooHR, and Trello.

• Adds connected app integration for LastPass, enabling centralized visibility into accounts, activity, and misconfigurations.
• Adds connected app integration for BambooHR, enabling centralized visibility into accounts, activity, and misconfigurations.
• Adds connected app integration for Trello, enabling centralized visibility into accounts, activity, and misconfigurations.

Identity & Access Management · 2026-07-13

Nudge Security adds connected app integrations for SentinelOne, Druva, GitGuardian, Kong, and Mural.

• New SentinelOne connected app integration for centralized visibility into accounts, activity, and misconfigurations.
• New Druva connected app integration for centralized visibility into accounts, activity, and misconfigurations.
• New GitGuardian connected app integration for centralized visibility into accounts, activity, and misconfigurations.

Identity & Access Management · 2026-07-13

Okta July 2026 brings bot protection GA, AI agent token improvements, native-to-web SSO, and advanced device posture checks.

• Bot protection is now generally available in Production.
• New fields query parameter for Groups, Realms, and Devices list endpoints is now GA in Production, enabling selective field retrieval.
• New IP Service available for enhanced dynamic network zones.

Identity & Access Management · 2026-07-13

Okta Identity Engine adds agent-to-agent connections as Early Access in Preview environments.

• Enables agent-to-agent connections (Early Access, Preview) for AI agent API integration scenarios.

AI Agent Frameworks · 2026-07-13

OpenClaw v2026.6.10 adds /fast auto mode, expanded GLM-5.2 reasoning, new catalog models, and a session-transcript SDK API for plugins.

• Adds /fast auto command to start short conversational calls quickly, then return longer or fallback work to normal mode while keeping effective state visible.
• Shows the effective automatic fast-mode state in status (not just on/off), including through fallback transitions and connected-agent sessions.
• Expands zai/glm-5.2 thinking choices beyond binary on/off — high and max requests now map to the intended Z.AI reasoning effort.

AI Agent Frameworks · 2026-07-13

OpenClaw v2026.6.9 adds Codex Hosted Search, auto plugin approvals, OpenTelemetry log export, standalone provider npm packages, and richer Telegram delivery.

• Adds Codex Hosted Search as a new search provider available without a separate API key.
• Adds automatic plugin approvals and SecretRefs for Codex integrations.
• Exposes remote-node exec as a dynamic tool in Codex when a connected node is available.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds batch test re-runs, Ruby SDK, Gemini/Copilot Studio integrations, and new drift detection.

• Adds batch and manual test re-runs so results can be recalculated retroactively when new data is added.
• Supports automatic threshold configuration for tests built on custom metrics.
• Introduces custom time range selection for filtering test execution history.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds Snowflake integration, new security role, prompt injection tests, and expanded LLM tracing for Bedrock, OpenAI Agents, Pydantic AI, and LangGraph.

• New UI with full light and dark mode support, updated design system, and improved navigation hierarchy.
• Adds priority levels for tests and more data visualizations throughout the product.
• SDK support for tracing Bedrock models.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds custom metrics via openlayer.json, rotating API keys, and 11 new models for direct-to-API evaluation calls.

• Supports custom metrics uploaded via openlayer.json, usable as project-wide metrics or as runnable eval tests alongside standard metrics.
• Enables creation, renaming, and deletion of multiple personal API keys to support API key rotation workflows.
• Adds ability to specify desired metrics directly in openlayer.json for API-driven evaluation runs.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds request annotations, human feedback ratings, data export, and Git integration to LLM quality control.

• Adds per-request annotations with custom values, including step-level annotation for individual trace steps when tracing is enabled.
• Adds thumbs up/thumbs down human feedback ratings on every request to quickly surface good and bad model responses.
• Enables data export from the UI, including filtered cohorts of request data.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds SAML SSO, Azure OpenAI evaluator, Ragas metrics, and an overhauled test diagnosis page.

• Adds SAML SSO support via any major identity provider, enabling teams to enforce org-level authentication for workspace access.
• Supports Azure OpenAI as an LLM evaluator integration.
• Adds additional Ragas metrics — faithfulness and answer correctness — for evaluation.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds Governance mode, A/B testing, new data backends, CLI data sources, and expanded tracing support.

• New Governance mode lets teams define and enforce custom policy frameworks (PII leakage, prompt injection, monitoring requirements, ownership, risk level) across all projects and workspaces, with rule owners, comment threads, and evidence uploads.
• New workspace overview and project inventory gives a birds-eye view of project activity with categorization and labeling across the workspace.
• Adds support for Databricks, Redshift, and Postgres as third-party data backends in Monitoring mode.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds a managed AI gateway, customizable dashboards, Salesforce Agentforce GA, Helm on-prem, new guardrails, governance frameworks, and audit trails.

• New Openlayer Gateway: centralized managed control layer for all LLM calls, with admin portal, API key management, per-key rate limits and freeze, and team-based organization.
• Customizable project home pages: pin metric widgets, view project notifications inline, and navigate alerts from a new sidebar notification center.
• Salesforce Agentforce integration reaches GA, with configurable login domain (production, sandbox, or My Domain) and updated Builder schema capturing every intermediate step.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds Google ADK integration, Snowflake remote execution, pausing tests, duplicate-key checks, and cloud marketplace availability.

• Adds column distribution graphs for LLM projects on the platform.
• New SDK integration with Google Agent Development Kit (ADK) for evaluating multi-agent systems.
• Enables pausing test execution in Monitoring mode.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds project-level secrets, OpenTelemetry tracing, Azure OpenAI for evals, and new platform APIs.

• Adds project-level secrets storage in the Platform so API keys and auth tokens can be securely referenced across tests without hardcoding.
• Enables setting default LLM-as-a-judge API keys for an entire on-premise deployment, eliminating per-workspace/project key configuration.
• Adds SDK support for tracing LLM requests with OpenTelemetry.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds SAML directory sync, Cohere/Vertex AI LLM-as-a-judge models, new RAG metrics, Viewer role, and expanded APIs.

• Supports SAML SSO directory sync so Openlayer workspaces can be governed by existing organizational security groups.
• Adds Cohere and Vertex AI models as judge options for LLM-as-a-judge evaluation tests.
• New Faithfulness and Answer Correctness metrics available for RAG system evaluations.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds MFA, multimodal traces, directory sync, MCP integration, and expanded API/CLI controls for AI governance.

• Adds platform-wide multi-factor authentication (MFA) for enterprise security.
• Supports deployment-wide directory sync with project-level access group support, including a NoAccess group level for finer-grained access control.
• Renders images, audio, and PDFs inline in trace steps and data tables for richer multimodal observability.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds user/session tracking, test tags, LiteLLM support, PII redaction guardrails, and multi-agent LangGraph workflows.

• Adds user and session tracking in the Data section, enabling full session and record history per user for behavioral analysis.
• Adds predefined and custom tags on tests to browse and organize tests by outcome, domain (e.g., safety, data drift), or governance framework (e.g., EU AI Act).
• New API support for user-defined tags on tests and filtering tests by those tags.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds test bundles (EU AI Act, OWASP, agentic), new LLM tests, and expanded Python runtime support.

• Introduces test bundles grouping related tests by policy or use case — pre-built sets for EU AI Act, OWASP, agentic workflows, and data quality.
• Adds new tests to the library: groundedness for LLMs, toxicity score, prompt injection detection, and competitor-recommendation checks.
• Supports new Python runtimes for CLI development mode.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds MCP server, automatic thresholds, BigQuery integration, anomaly detection, and project-level access groups.

• New Openlayer MCP server enables use of Openlayer tests directly inside IDE workflows.
• Supports automatic, data-driven thresholds for tests that adapt over time based on historical patterns — covering cost, data quality, and GPT eval scores.
• Adds anomaly detection to flag test results that deviate from predicted norms.

SAST / SCA / Code Security · 2026-07-13

Openlayer adds Gantt trace timelines, Claude Agent SDK tracing, auto-instrumentation, and Gateway guardrails enforcement.

• New Gantt-style timeline view for traces — every span's start time, duration, and nesting shown side by side, making slow steps and unexpected branches immediately visible.
• Adds project lifecycle stages and evidence document attachments for governance tracking, living alongside tests and results on each project.
• First-party tracing for the Anthropic Claude Agent SDK in Python — captures tool calls, MCP tools, subagent nesting, session continuity, and cost and token counts per run.

Runtime Security · 2026-07-13

OpenShell v0.0.76 adds SELinux bind-mount labels and numeric UID support in sandbox policies.

• Adds SELinux label support for bind mounts in Docker and Podman container runtimes.
• Enables numeric UIDs (in addition to named users) when specifying sandbox process identity in policies.

Runtime Security · 2026-07-13

OpenShell v0.0.75 adds TLS termination for Envoy Gateway ingress and a new manifest-driven gator agent.

• Adds TLS termination support for Envoy Gateway ingress via Helm, enabling encrypted traffic handling at the ingress layer.
• Introduces a manifest-driven gator agent, allowing agent behavior to be defined and driven through declarative manifests.

Runtime Security · 2026-07-13

OpenShell v0.0.74 adds a combined topology config surface for Kubernetes deployments.

• Adds combined topology config surface for Kubernetes, enabling unified topology configuration in a single surface.
• Breaking: removes SandboxTemplate.volume_claim_templates from the API — configurations referencing this field must be updated.

Runtime Security · 2026-07-13

OpenShell v0.0.72 adds AWS SigV4 proxy signing, JSON-RPC/MCP policy enforcement, and Kubernetes agent-sandbox v1beta1 support.

• Adds proxy-side AWS SigV4 credential signing for CONNECT tunnels in sandbox environments.
• Adds L7 policy enforcement for JSON-RPC and MCP traffic.
• Supports Kubernetes agent-sandbox v1beta1 API.

Identity & Access Management · 2026-07-13

Passbolt 5.6.0 adds standalone notes, shared metadata key rotation, and resizable sidebars.

• New standalone notes capability lets users create and store notes independently of password entries.
• New shared metadata key rotation enables teams to rotate the encryption keys used for shared resource metadata.
• New resizable sidebars let practitioners adjust the UI layout to surface more context during investigations or vault management.

Identity & Access Management · 2026-07-13

Passbolt 5.7.0 adds secret history, improved user/group management, and a detailed import summary report.

• New secret history feature lets practitioners review past versions of stored secrets.
• Improved user and group management capabilities in the browser extension and API.
• New detailed import summary report surfaces per-record results after bulk credential imports.

Identity & Access Management · 2026-07-13

Passbolt 5.8.0 adds dynamic RBAC role management, drag & drop group assignment, and maintenance updates.

• New dynamic role management in RBAC, enabling administrators to adjust role permissions without static configuration.
• New drag & drop interface for assigning users to groups, streamlining group membership management.

Identity & Access Management · 2026-07-13

Passbolt 5.9 adds PHP 8.5 support, account-discovery hardening, and DB end-of-life deadline visibility.

• Adds PHP 8.5 support for teams preparing future infrastructure upgrades.
• Strengthens protection against low-effort account discovery attacks.
• Strengthens protection against UI spoofing/trickery attacks.

Identity & Access Management · 2026-07-13

Passbolt 5.11 adds SMTP OAuth for Exchange Online, PingOne SSO, and production-ready SCIM provisioning.

• Adds SMTP OAuth 2.0 support for Microsoft Exchange Online, enabling modern auth mail delivery without stored passwords.
• Introduces PingOne SSO integration, expanding supported identity providers for single sign-on.
• Promotes SCIM user provisioning out of beta, making it generally available for production directory sync.

Identity & Access Management · 2026-07-13

Passbolt 5.13.0 adds in-app edition management, letting admins switch between Community and Pro editions.

• New in-app edition management lets administrators switch between Community and Pro editions directly from within the application.

Identity & Access Management · 2026-07-13

Passbolt 5.12 launches Safari extension GA, adds PIN code resource type, and improves TOTP field detection.

• Safari browser extension is now generally available for all users.
• New dedicated PIN code resource type for storing numeric credentials separately from passwords.
• Improved TOTP field detection for more reliable one-time password autofill.

Identity & Access Management · 2026-07-13

Passbolt 5.10 debuts the first Safari-compatible browser extension, bringing the password manager to Apple's browser.

• New Safari browser extension support: Passbolt is now compatible with Apple's Safari browser for the first time.

Identity & Access Management · 2026-07-13

Ping Identity AIC adds social IdP management, self-service journey mapping, PKCS5S2 migration, and expanded ESV support in the admin console.

• Extends the Evaluator Version selector in the admin console to all remaining next-generation script types: OIDC node, Social Provider Handler node, OAuth2 scripts, and Policy Condition scripts.
• Enables migration of user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm.
• Adds an Account Status column (Active/Inactive) to the Identities page.

SAST / SCA / Code Security · 2026-07-13

Portkey adds vault-backed credentials, weekly rate limits, cross-cloud log delivery, and four new guardrail integrations in March 2026.

• Adds Secret References so Portkey fetches credentials at runtime from AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault via secret_mappings, keeping keys out of Portkey directly.
• Supports weekly budget/usage windows (rpw) and endpoint-scoped rate limits, letting teams cap chat completions, embeddings, and admin routes independently.
• Enables GCS log delivery from AWS-hosted gateways via GCP Workload Identity Federation (GCP_WIF_AUDIENCE / GCP_WIF_SERVICE_ACCOUNT_EMAIL), eliminating long-lived cross-cloud keys.

SAST / SCA / Code Security · 2026-07-13

Promptfoo January 2026 snapshot adds adaptive rate limiting, Transformers.js local inference, telecom red team plugins, and multi-input red team scans.

• Adds Transformers.js provider to run Hugging Face models locally in Node.js or the browser.
• Adds Vercel AI Gateway and Cloudflare AI Gateway providers for request routing.
• Adds AWS Bedrock Video (Nova Reel, Luma Ray 2) and Azure AI Foundry Video (Sora) providers for video generation.

Continuous Control Monitoring (CCM) · 2026-07-13

RegScale 6.32.1.0 adds PIV card authentication architecture for high-assurance identity environments.

• Supports PIV card authentication architecture, enabling organizations with advanced identity requirements (e.g., federal agencies) to integrate Personal Identity Verification-based access into the platform.

Continuous Control Monitoring (CCM) · 2026-07-13

RegScale 6.32.0.0 introduces a redesigned UI navigation experience with new features available exclusively in it.

• New UI navigation experience replaces the legacy layout; most new features and improvements are available only in the new UI going forward.

Continuous Control Monitoring (CCM) · 2026-07-13

RegScale 6.31.1.4 adds Wiz STIG sync via XCCDF Benchmark and pre-flight validation for eMASS exports.

• Supports synchronizing Wiz STIG checks through the XCCDF Benchmark workflow for streamlined Wiz integration.
• Introduces pre-flight validation for eMASS exports to surface potential issues before submission.

Continuous Control Monitoring (CCM) · 2026-07-13

RegScale 6.31.1.3 adds XCCDF TestResults import and enhanced CKL/CKLB ingestion for broader assessment data coverage.

• Supports importing XCCDF TestResults into the assessment pipeline, enabling additional security assessment data sources within RegScale.
• Enhanced CKL/CKLB import capabilities for expanded vulnerability management and assessment data ingestion.

Continuous Control Monitoring (CCM) · 2026-07-13

RegScale CLI 6.35.0 streams Nessus imports and routes STIG/CIS compliance findings to checklists and POA&Ms.

• Nessus scan imports now use a single streaming pass per file, enabling faster and lower-memory processing of large scan files.
• Nessus STIG and CIS compliance results now generate security checklists and POA&M issues instead of vulnerabilities, with re-scans automatically closing remediated compliance findings.

Continuous Control Monitoring (CCM) · 2026-07-13

RegScale CLI 6.34.65 changes compliance scan default behavior and documents vulnerabilityCreation options.

• Changes compliance scan default: failed control assessments no longer auto-create issues; failed controls remain visible on assessments, with opt-in via complianceCreation set to Issue or POAM.
• Documents vulnerabilityCreation configuration options for controlling how vulnerability findings are handled.

Continuous Control Monitoring (CCM) · 2026-07-13

RegScale CLI 6.34.59 adds eMASS API sync commands and automatic artifact upload on XML import.

• New emass_api commands enable synchronization of POA&Ms, controls, milestones, and artifacts directly with eMASS via its API.
• eMASS XML import now automatically uploads referenced artifact files to the System Security Plan when those files are present alongside the export.
• Supports per-asset Issue/POAM creation, allowing findings to be tracked at the individual asset level.

Digital Forensics & Incident Response · 2026-07-13

RT-Extension-AI adds a Queue Creation Assistant that builds queues, workflows, custom fields, groups, and rights from plain-language conversation.

• New Queue Creation Assistant in RT-Extension-AI lets admins describe a queue's purpose in plain language and generates the full configuration — lifecycle/workflow, custom fields, groups, rights, and watchers — for review before applying.
• Conversational setup flow replaces manual multi-step queue configuration: the assistant asks targeted questions about team, ticket types, and workflow, then presents a complete plan for approval before making any changes.
• One-step queue provisioning: after admin approval, the assistant creates the queue and all supporting elements (workflow, custom fields, groups, rights, watchers) atomically in a single action.

Identity & Access Management · 2026-07-13

RoboForm 9.9.4 adds Dashlane Safenotes import capability.

• Adds ability to import Safenotes from Dashlane into RoboForm.

Attack Surface & Exposure Management · 2026-07-13

runZero 5.0.260707.0 adds per-source stale threshold overrides and a software count drill-down link in asset inventory.

• Supports per-integration stale threshold overrides for the stale integration attribute expiration feature, configurable in organization and account settings; integrations without an override continue to use the global setting.
• Software count column in the asset inventory now links directly to the software inventory for faster drill-down.

Attack Surface & Exposure Management · 2026-07-13

Dragos integration gains serial-number-based asset matching with SentinelOne; suppressed vulnerabilities now count as Resolved in Issue status.

• Dragos integration now matches assets with SentinelOne data using asset serial number (bidirectionally).

Attack Surface & Exposure Management · 2026-07-13

runZero 5.0.260630.0 adds valueless tag search to asset inventory queries.

• Supports searching for assets with a tag that has no value (e.g., tag:test=) to distinguish unvalued tags from valued ones like tag:test=example.

Attack Surface & Exposure Management · 2026-07-13

runZero 5.0.260625.0 adds AWS VPC Endpoint asset discovery and external issue sharing.

• Adds AWS VPC Endpoint asset creation to the AWS integration, enabling visibility into VPC Endpoint resources.
• Enables external sharing of issues directly from the issues datagrid.

Attack Surface & Exposure Management · 2026-07-13

runZero 5.0 delivers end-to-end exposure management: remediation tracking, verified closure, recurring reports, and broader OT/IT vulnerability detection.

• New Exposure Management dashboard as the default landing view, surfacing prioritized exposures with separation of OT/IoT streams, MTTR tracking, issue status totals, reopened-issue trends, vulnerability status trends by severity, and a Goals progress widget.
• Adds Remediation Workflows: create a Remediation Issue in one click from an exposure, finding, or vulnerability group, with auto-populated fields and push-to-Jira integration including custom state-to-state mapping.
• Enables verified remediation closure: runZero preserves a compressed snapshot of the original exposure state and compares it against live discovery on scheduled scans to confirm fixes, with automatic reopened-issue tracking.

Attack Surface & Exposure Management · 2026-07-13

runZero 5.0.260618.0 adds all-asset alert queries, on-demand alert runs, expanded GE-SRTP ports, ADB STLS metadata, and richer InsightVM integration.

• Adds option in alert rule queries to cover all assets, not just live assets.
• Enables on-demand execution of alert rules without waiting for a scheduled run.
• Expands scanner coverage to additional default ports for the GE-SRTP protocol.

Attack Surface & Exposure Management · 2026-07-13

runZero 5.0.260617.0 adds issue type and external ticket link columns to the Issues table.

• Adds Type and External Ticket Link columns to the Issues table for quicker triage and cross-tool traceability.

Identity & Access Management · 2026-07-13

SailPoint MCP Server adds a global tenant-agnostic URL and OAuth 2.1/PKCE auth, plus native Cursor IDE support.

• New global MCP endpoint (https://mcp.api.cloud.sailpoint.com/latest/access-requests/mcp) works for all non-FedRAMP tenants — no per-org URL construction needed.
• Replaces manual PAT/token workflow with OAuth 2.1 + PKCE: browser-based login, SSO support, consent screen, and automatic token refresh for up to one month.
• Adds native Cursor IDE support: configure the global URL and Client ID in ~/.cursor/mcp.json, and the full OAuth flow is handled automatically on connect.

Identity & Access Management · 2026-07-13

SailPoint DAS adds a Databricks connector for resource discovery, permission analysis, and data classification.

• New Databricks connector for Data Access Security (DAS) enables discovery of Databricks resources including Tables, Views, and Stored Procedures.
• Supports permission analysis to detect over-permissioned accounts and limit entitlement sprawl across Databricks deployments.
• Ingests data classification labels directly from Databricks (when enabled), surfacing classification forensics within the DAS platform (preview).

Identity & Access Management · 2026-07-13

SailPoint adds BeyondTrust & Delinea PAM discovery connectors and upgrades CyberArk to instance-level application discovery.

• Upgrades CyberArk Privilege Cloud Shared Services PAM Discovery connector to discover individual application instances (e.g., three MySQL instances as three distinct entries) rather than generic platform templates.
• New BeyondTrust Password Safe Cloud PAM Discovery connector retrieves managed systems via the BeyondTrust public API using OAuth 2.0 client credentials, with support for continuous scheduled discovery.
• New Delinea Secret Server PAM Discovery connector discovers secrets and associated metadata (names, IDs, template types, creation dates, active status) from Delinea Secret Server via OAuth 2.0, mapping results into ISC-consumable datasets.

Identity & Access Management · 2026-07-13

ServiceNow Service Catalog for ISC v5.3 adds Additional Owner approvals, questionnaire UX, and faster OAuth.

• Supports Additional Owner approval type, expanding flexibility in organizational approval flow definitions.
• Introduces Additional Info / Questionnaire capabilities for catalog item requests, streamlining the requester experience.
• Reduces total OAuth calls to the Identity Security Cloud API, improving integration response times.

Identity & Access Management · 2026-07-13

SailPoint adds Privilege On Demand (JIT-P v1.0) to shift elevated access from standing to time-bounded, on-demand activation.

• Introduces Privilege On Demand (JIT-P v1.0): an activation-based model where eligible entitlements are requested, then explicitly activated for a bounded duration with automatic expiration — replacing always-on standing access.
• Enables configurable global JIT activation and extension durations via Admin settings, giving IAM teams control over how long elevated access windows last.
• Supports auto-approve or approval-required workflows for JIT entitlement activation, selectable per entitlement.

Identity & Access Management · 2026-07-13

SailPoint DAS adds in-context Permission Path viewer for campaign reviewers, eliminating navigation away from the review screen.

• New View Permission Path action in the Actions column of the Campaign Review screen opens a pop-up showing the full permission path for a user's access, including whether access is actively used.
• Supports visualization of multiple permission paths to a single resource within Permissions-type campaigns.
• Permission Path icon is available for User permission rows and visible-but-disabled for Group permission rows, giving reviewers clear context on scope.

Identity & Access Management · 2026-07-13

Data Access Security gets a redesigned Resource Selector with full-view modal and free-text search.

• Introduces a new Browse and Select Resources overlay in Data Access Security, replacing the previous compact resource picker with a full-view modal.
• Adds free-text search bar (Search by name or path) to the Resource Selector, enabling instant navigation to resources without manually drilling through folder hierarchies.
• New hierarchical tree view supports expanding and collapsing major integrations (AWS, Azure, Box, GDrive, OneDrive) and nested drive structures within the selector.

Identity & Access Management · 2026-07-13

SailPoint ISC enables HTTP/2 via Cloudflare on Jul 27, 2026 — API response headers will shift to lowercase.

• Enables HTTP/2 on all ISC environments via Cloudflare, delivering improved security and performance over HTTP/1.1.
• Breaking change: HTTP/2 lowercases all response header keys (e.g., X-Total-Count becomes x-total-count) — scripts and API clients that match headers case-sensitively must be updated.

Identity & Access Management · 2026-07-13

SailPoint ISC homepage gains Data Access Security widgets and a pre-built DAS dashboard template for unified identity + data risk visibility.

• Adds a suite of Data Access Security (DAS) widgets to the MySailPoint homepage, enabling instant visibility into unstructured data access exposure and high-risk accounts with excessive permissions.
• Introduces a pre-built Data Access Security Dashboard template that bundles all available DAS widgets for quick, one-click setup.
• Enables drill-down from any DAS widget directly into Data Access Security forensics for deeper analysis of flagged metrics.

Identity & Access Management · 2026-07-13

SailPoint ISC adds dedicated tablet support for Certification Reviewers with smart device detection and landscape-mode prompting.

• Adds automatic tablet detection for Certification Reviewers, evaluating screen capabilities to determine if the reviewer UX can be displayed optimally.
• Introduces landscape orientation prompting on tablets, guiding reviewers to rotate their devices for full visibility of access review tables and critical details.
• Delivers an optimized Certification Reviewer UX in landscape mode, presenting a comprehensive view of access items to support informed decision-making on mobile devices.

Identity & Access Management · 2026-07-13

SailPoint ISC Salesforce connector now supports External Client App (ECA) auth; legacy OAuth flows retire Sep 30, 2026.

• Adds support for Salesforce External Client App (ECA) authentication as the new default and only supported auth method for the ISC Salesforce connector (VA and SaaS).
• Supports OAuth 2.0 Authorization Code Grant flow exclusively, replacing JWT Bearer, Refresh Token, Client Credentials, and Basic Authentication.
• New Enable External Client App (ECA) toggle and ECA Authentication section available in the Identity Security Cloud UI Salesforce connector configuration.

Identity & Access Management · 2026-07-13

SailPoint Data Discovery adds configurable Sampling Ratio for faster, lighter sensitive-data classification scans.

• New Sampling Ratio option for Data Classification scans lets you scan a configurable percentage of documents (default 10% for new apps) to rapidly identify sensitive-data hot spots without a full resource-intensive scan.
• New applications are automatically onboarded with 10% sampling enabled by default, accelerating time-to-insight for sensitive data exposure.
• Existing applications with Data Classification enabled retain 100% sampling by default to preserve consistency with prior behavior.

Identity & Access Management · 2026-07-13

SailPoint CIEM now surfaces AWS Tags, Azure Tags, and GCP Labels alongside cloud resource access data.

• Adds native AWS Tags, Azure Tags, and GCP Labels visibility directly within the CIEM effective access view, enabling practitioners to see which identities can access tag-scoped resources.
• Enables ISC Search to query cloud resources by tag/label key and value, supporting ad-hoc access reviews such as 'who can access PII-tagged resources'.
• Surfaces cloud resource tags and labels within CIEM AIC dashboards for reporting and governance validation across cloud environments.

Identity & Access Management · 2026-07-13

Identity Graph UI redesigned with clearer visual hierarchy, elevated Data Table, and consolidated controls rail.

• Colocates help menus, documentation, and the legend into a unified location for faster access.
• Makes the graph's root node more visually apparent, improving at-a-glance orientation.
• Elevates the Data Table to a first-class UI citizen alongside the graph view.

Identity & Access Management · 2026-07-13

Virtual Appliance traffic migrating to SailPoint-hosted URLs for SQS and ECR; new hostnames to allowlist by June 29.

• Introduces SailPoint-hosted endpoints for Virtual Appliance message queue traffic, replacing direct regional Amazon SQS URLs (sqs.<region>.amazonaws.com).
• Introduces SailPoint-hosted endpoints for VA container image updates, replacing direct Amazon ECR paths — new hostnames: va-docker.secure-api.infra.identitynow.com (Commercial) and va-docker.secure-api.saas.sailpointfedramp.com (FedRAMP).
• Sandbox rollout of SailPoint-hosted URLs begins June 15; production rollout begins June 29, 2026.

Compliance Automation & Trust Management · 2026-07-13

Secureframe April 2026 adds a faster Org Picker with role/team visibility and improved Personnel access tables.

• New Org Picker shows role and team size per organization at a glance, with an improved favorites section and built-in sign-out access for faster multi-org navigation.
• Updated Accounts and Devices tables in Personnel add improved sorting, filtering, and navigation to streamline user access and device assignment reviews.

Compliance Automation & Trust Management · 2026-07-13

Secureframe adds 7 new vuln-scanner integrations, Addigy MDM support, C5 compliance, and overhauled vendor review scheduling.

• Centralizes vendor review schedules so frequency, question sets, requested documents, and vendor lists are configured at the review level rather than per vendor.
• Adds requested documents to review schedules, automatically prompting vendors to upload items like SOC 2 reports and spinning up a vendor portal on the review start date.
• New integrations with Rapid7 InsightVM, Tenable VMS, Qualys, Wiz, Microsoft Defender, Aikido, and Snyk automate evidence collection for vulnerability scanning, dependency testing, and SAST.

Compliance Automation & Trust Management · 2026-07-13

Secureframe December 2025 adds a full Audits Module, FedRAMP 20x JSON export, Trust Center versioning, and automated test-status email alerts.

• New Audits Module centralizes the entire audit lifecycle — admins create audits, invite auditors, assign internal stakeholders, and a complete audit history is stored for future reference.
• Auditors can review requests, accept or reject evidence, request additional information, and add new requests directly within the platform.
• Evidence uploads now capture an Activity Completion Date, distinguishing when work occurred from when evidence was submitted to improve audit scoping accuracy.

Compliance Automation & Trust Management · 2026-07-13

Secureframe adds Smart User Mentions, Audit Completion Workflow, multilingual onboarding, and expanded Azure/Sentinel integrations.

• Adds Smart User Mentions: tag customers or auditors with '@' in comments across the platform, triggering email notifications with a direct link back to the relevant comment and test location in the Audit Module.
• Introduces a structured Audit Completion Workflow with a dedicated modal for uploading multiple report versions (drafts, revisions, finals), a built-in comments section with @mentions, a toggle to confirm final report receipt, and the ability for either party to mark the audit complete.
• Supports employee onboarding workflows — including policy acknowledgments and training steps — in French, German, and Spanish for global teams.

Compliance Automation & Trust Management · 2026-07-13

Secureframe adds new audit test statuses, 100% Met progress tracking, log deep-links, and progressive auditor-firm search.

• New test statuses in the Audit Module improve transparency between auditors and admins throughout the audit lifecycle.
• Audit Module progress bar now tracks completion toward 100% Met, giving an at-a-glance readiness indicator.
• Audit Log gains direct links to changed items, enabling users to jump instantly from the log table to any updated record.

Compliance Automation & Trust Management · 2026-07-13

Secureframe launches MCP Server, HubSpot integration, self-service SSO, and a refreshed sidebar in June 2025.

• New Secureframe MCP Server (public beta): a read-only Model Context Protocol server lets AI assistants (ChatGPT, Claude, Cursor) query compliance data — failing controls, high-risk vendors, framework status across SOC 2, ISO 27001, CMMC, and FedRAMP — using natural language in real time.
• New HubSpot integration: scans HubSpot users and access data to support compliance-related requirements, centralizing CRM data into the compliance program.
• New self-service domain and SSO management: customers can claim and verify domain ownership, enable single sign-on, and configure login restrictions entirely within the platform without requiring vendor assistance.

Compliance Automation & Trust Management · 2026-07-13

Secureframe June 2026 adds multi-policy test linking, reopenable reviews, and daily 81–98% faster personnel syncs.

• Supports linking multiple policies to a single test, with draft-policy status surfaced as the failure reason.
• Enables automatic re-running of paired acknowledgement tests when a policy is published, eliminating stale results.
• Adds ability to reopen completed reviews or individual applications to correct mistakes without losing the audit trail.

Compliance Automation & Trust Management · 2026-07-13

Secureframe March 2025 adds an Audit Module, Zendesk integration, CMMC personnel fields, and new auth policies.

• Introduces a new Audit Module designed to streamline the end-to-end audit process for customers and auditors.
• Refreshes the Dashboard with an updated design and a new Action Items widget surfacing expiring evidence, upcoming reviews, and task due dates.
• Adds bi-directional Zendesk integration for task syncing and ticket import, covering incidents, nonconformities, vulnerabilities, system changes, and user access mapped to compliance tests.

Compliance Automation & Trust Management · 2026-07-13

Secureframe adds GA User Access Reviews, guided ComplyAI risk workflows, a dedicated Auditors view, and flexible user onboarding controls.

• Adds User Access Reviews (UAR) — generally available for Comply Complete customers — enabling scheduled or one-time access reviews with approve/revoke/follow-up decisions, bulk actions, CSV uploads for non-integrated apps, and exportable audit-ready evidence across SOC 2, ISO 27001, and CMMC.
• Improves ComplyAI risk assessment workflow with guided field completion (risk description, owner) before AI recommendations are generated, surfacing the next required step dynamically.
• Introduces a dedicated Auditors tab within Personnel, separating auditor accounts into a tailored view aligned to their role.

Compliance Automation & Trust Management · 2026-07-13

Secureframe May 2025 adds AI Evidence Validation, FedRAMP 20x support, Email Log, and new Vercel/Supabase integrations.

• Adds AI Evidence Validation that analyzes uploaded evidence files and metadata in real time, checking document relevance to the control under test and whether timestamps fall within the required testing window.
• Supports the FedRAMP 20x KSI framework out of the box, with Phase One pilot key security indicators pre-mapped to controls and tests for FedRAMP Low KSI requirements — part of the FedRAMP 20x pilot alongside Coalfire.
• New OneSchema-powered device data upload experience provides instant template validation feedback and highlights file issues before submission, with backend performance improvements for faster, more reliable uploads.

Compliance Automation & Trust Management · 2026-07-13

Secureframe May 2026 adds CMMC Scoping Module, Defense Navigator, GCC High automation, AI-populated SSPs, and overhauled evidence management.

• New Scoping Module guides organizations through CMMC scoping questions, auto-marks out-of-scope requirements with audit-ready justifications, disables irrelevant tests, and tailors SSP and policy language accordingly.
• New Microsoft GCC High integration automates CMMC-required configurations and provides step-by-step manual guidance where Microsoft APIs don't permit full automation.
• SSP creation now auto-populates implementation statements from scoping decisions and connected integrations, with bulk or individual acceptance of suggested updates.

Compliance Automation & Trust Management · 2026-07-13

Secureframe adds Gap Assessments, Snowflake & Freshservice integrations, Custom Integrations, GovRAMP Core, and bulk employee scoping.

• Adds Gap Assessments for any supported framework (SOC 2, ISO 27001, NIST 800-171, and more), automatically comparing current posture against requirements and surfacing prioritized remediation actions.
• New Snowflake integration automates continuous compliance testing across authentication, high availability, firewall rules, and alerting for the cloud data platform.
• New Freshservice integration enables bi-directional ticket syncing as a task destination to track compliance for incidents, vulnerabilities, nonconformities, system changes, and user access against SLAs.

Compliance Automation & Trust Management · 2026-07-13

Secureframe adds EU AI Act compliance framework, MongoDB Atlas integration, and Freshdesk bi-directional sync

• Adds full EU Artificial Intelligence Act (EU AI Act) compliance framework with a risk-based approach to categorizing and safeguarding AI systems.
• New MongoDB Atlas integration enables automated compliance testing for authentication, backup and availability, encryption, firewall rules, and logging and alerting.
• New Freshdesk integration with bi-directional syncing automates evidence collection for customer support and ticketing workflows, eliminating manual uploads for audit readiness.

SAST / SCA / Code Security · 2026-07-13

skill-scanner 2.0.12 adds ASCII smuggling detection, jailbreak YARA rule, and repo-name propagation for scans.

• Adds detection of ASCII smuggling via the Unicode Tag Block, catching a covert data-hiding technique used in prompt injection attacks.
• Adds a jailbreak detection YARA rule to the static analysis engine.
• Extends scanner to pass repository name through scan context, improving traceability in multi-repo pipelines.

SAST / SCA / Code Security · 2026-07-13

Snyk API & Web now supports Bruno collections natively, enabling direct import to create API Targets.

• Supports importing Bruno collections directly into Snyk API & Web to create API Targets — no conversion to Postman or OpenAPI required.

SAST / SCA / Code Security · 2026-07-13

Snyk CLI v1.1306.0 adds a new snyk doctor diagnostic command, broader Java/JVM and .NET container scanning, and MCP breakability evaluation on by default.

• New snyk doctor command diagnoses common CLI problems by generating a diagnostic report for your system or analyzing debug log output.
• Container scans now detect the Java runtime version across a wider range of JVM base images.
• Container scans can now find vulnerabilities in .NET application dependencies.

SAST / SCA / Code Security · 2026-07-13

Snyk Code adds 6 new C++ rules, broader C++ native detection, expanded Java library coverage, and a JS/TS Insecure Transmission rule.

• New C++ rule: Log Forging (CWE-117, high) — detects untrusted user input reaching logging sinks, enabling log forgery or corruption.
• New C++ rule: Improper Privilege Management (CWE-269, high) — flags unverified privilege-dropping calls that may leave processes running with elevated privileges.
• New C++ rule: Missing Authorization (CWE-862/CWE-732) — detects world-writable/world-executable file permissions and root UID/GID passed to privilege-escalation or file-ownership functions.

SAST / SCA / Code Security · 2026-07-13

Snyk Learn adds three new AI security lessons on agentic RCE, memory poisoning, and inter-agent communication.

• New AI-Sec lesson: Unexpected Code Execution (RCE) — covers how agentic systems can be tricked into executing unauthorized code.
• New AI-Sec lesson: Memory and Context Poisoning — explains how corrupted agent memory can silently alter AI reasoning and decisions.
• New AI-Sec lesson: Insecure Inter-Agent Communication — teaches exploitation of weak communication protections between agents.

SAST / SCA / Code Security · 2026-07-13

Snyk now auto-closes stale Open Source Fix PRs by default, with a configurable daily closure limit.

• Enables automatic closing of obsolete Open Source Fix PRs for all organizations by default, triggered during recurring tests when the targeted dependency is removed, transitively updated, or manually fixed.
• Adds a configurable maximum number of obsolete PRs Snyk will close per day, giving teams rate control over automated closures.
• Allows administrators to opt out of automatic PR closure via the organization settings page.

SAST / SCA / Code Security · 2026-07-13

Socket now surfaces full commit history for force-pushed Packagist tags, highlighting the current and prior commits.

• Displays full commit history for force-pushed tags on Packagist package pages, with the currently associated commit highlighted.
• Enables review of commits a package version previously referenced before a tag was overwritten.

SAST / SCA / Code Security · 2026-07-13

Socket adds opt-in AI-generated reachability specs to expand vulnerability reachability coverage beyond human-verified rules.

• Adds opt-in AI-reviewed reachability specifications that extend reachability verdicts to vulnerabilities not yet covered by human-verified specs.
• New Specification field in alert details surfaces whether a reachability result was produced by an AI-generated or human-verified specification.

SAST / SCA / Code Security · 2026-07-13

Socket's organization switcher now surfaces Settings and orgs upfront, with a searchable All Organizations view.

• Redesigned organization switcher surfaces Settings and organizations at the top level for faster access.
• New searchable All Organizations view for users belonging to multiple organizations.

SAST / SCA / Code Security · 2026-07-13

Socket CSV exports now include a human-readable Alert Title column and more consistent Upgrade Version values.

• Adds a human-readable Alert Title column to Alerts CSV exports, enabling direct CVE identification without cross-referencing the dashboard.
• Populates Upgrade Version values more consistently in vulnerability alert CSV exports.

SAST / SCA / Code Security · 2026-07-13

Socket Firewall now supports exporting event logs to external data sources via the new Data Export integration.

• Enables export of Socket Firewall telemetry event logs to external data sources through a new Data Export integration.

Endpoint Security (EDR/XDR) · 2026-07-13

Sophos Central adds DNS Protection APIs, Gen-AI web filtering, MFA enforcement, new email tiers, and expanded MDR/XDR capabilities.

• Adds Web Control filtering for Generative AI sites with more granular per-site control and simplified policy management.
• Enables alerts for Account Health Check (AHC) issues, gradually rolling out to surface unaddressed configuration risks.
• Adds categorized Gen-AI app picker in Protected Browser policy creation, plus reporting on file uploads and downloads for risky data flow visibility.

Detection Engineering · 2026-07-13

v6.1.0 adds 34 new detections and 5 analytic stories covering Cisco IOS XE, SD-WAN, Linux kernel abuse, BlueHammer/RedSun, and PTC Windchill exploitation.

• Adds two Cisco Secure Access detections identifying outbound access to anonymizer/privacy services and automated web reconnaissance via abnormal HTTP error patterns.
• Adds new analytic stories and detections for BlueHammer and RedSun exploit families targeting Microsoft Defender for privilege escalation and credential access, including suspicious Defender engine/signature updates, unauthorized file modifications, non-admin password changes, and abnormal password reset bursts.
• Introduces support for Windows Security Event ID 4723 (password change attempts) to improve visibility into credential theft and privilege escalation tradecraft.

Vulnerability Management · 2026-07-13

ssh-audit v3.9.0 adds post-quantum warnings, UNIX socket scanning, SOCKS5 proxy support, and built-in hardening guides.

• Adds warnings on all key exchanges lacking post-quantum protection, flagging exposure to Harvest Now, Decrypt Later attacks.
• New --list-hardening-guides and --get-hardening-guide flags surface built-in hardening guides for common platforms (Debian, Ubuntu, Rocky Linux, OpenSSH) without requiring internet access.
• Supports scanning SSH servers over UNIX sockets (e.g. unix:///path/to/socket), enabling auditing in containerized and CI/CD environments.

SAST / SCA / Code Security · 2026-07-13

StackHawk adds standalone native binary, script validation daemon, org-wide findings table, service keys, and FlightPath AI auth config.

• Adds hawk validate script command to test active and passive HawkScripts against a live URL without running a full scan; pass --watch for daemon mode that re-executes on every file save.
• Adds standalone native HawkScan binary (macOS, Linux, Windows) with bundled JRE — no Java installation required in CI or on developer machines.
• Integrates hawk op directly into the hawk binary, eliminating the need for a separately installed hawkop binary for platform operations.

SAST / SCA / Code Security · 2026-07-13

Dev Machine Guard v1.13.0 makes Device Policy enforcement GA and adds Visual Studio discovery and disk-based package scanning.

• Device Policy enforcement via the DMG agent is now generally available — enforces approved VS Code extension sets on developer machines without requiring MDM, assignable per device or globally from the dashboard.
• New classic Visual Studio installation discovery extends IDE extension inventory beyond VS Code to legacy Visual Studio versions and their extensions.
• New disk-based package scanning for npm (lockfile parsing) and Python (dist-info metadata) with a scan cache and concurrent workers for faster runs; previous method remains available via the use_legacy_package_scan opt-out.

SAST / SCA / Code Security · 2026-07-13

Harden Runner adds egress block mode for macOS/Windows, Bitrise support, and Bun HTTPS monitoring.

• Supports egress-policy: block mode on macOS and Windows GitHub-hosted runners, enabling outbound traffic restriction (not just auditing) on these platforms.
• Adds compatibility with Bitrise-hosted macOS runners for GitHub Actions workflows.
• Enables HTTPS request monitoring for workflows using the Bun runtime on Linux runners (enterprise tier) in the GitHub Action.

SAST / SCA / Code Security · 2026-07-13

Harden-Runner adds Secret Exfiltration Attempt detection to catch toJSON(secrets) supply-chain attacks in real time.

• New Secret Exfiltration Attempt detection type flags workflow runs that combine known attack indicators — malicious workflow name, toJSON(secrets) secret dump, suspicious commit message, and an exfiltration artifact — before stolen secrets can be retrieved.
• Confidence scoring elevates a detection to High when the workflow run, branch, or workflow file is deleted shortly after execution, treating evidence removal as a strong exploitation signal.
• Direct navigation in the Detections page pinpoints the affected repository, matched rule, indicators, workflow file, and the exact job, step, and line where the secret dump occurred.

SAST / SCA / Code Security · 2026-07-13

StepSecurity Maintained Actions — secure drop-in replacements for 500+ GitHub Actions — are now free for public repositories.

• Makes all 500 StepSecurity Maintained Actions (secure drop-in replacements for popular third-party GitHub Actions) free for public repositories, no subscription required.

SAST / SCA / Code Security · 2026-07-13

ARC Harden Runner v2.18.3 adds broker pod customization fields and Cosign keyless image signing.

• Adds broker pod-spec customization via new Helm values under broker.* (volumeMounts, imagePullSecrets, automountServiceAccountToken, serviceAccountName, resources, nodeSelector, tolerations, affinity, topologySpreadConstraints) for scheduling alongside strict workloads.
• Supports Cosign keyless (OIDC) signing for versioned and FIPS arc-harden-runner and broker image manifests published to ghcr.io, enabling supply-chain verification.

SAST / SCA / Code Security · 2026-07-13

Secure Registry gains source attribution, typosquatting blocking, and Sonatype Nexus Repository support.

• Adds Source Attribution to the Policy Evaluations log via two new columns — Source and Source Identifier — tracing every package request to the developer machine or CI pipeline that made it.
• Enables attribution opt-in by appending an identifier suffix to your API key token (::dev: for developer machines, gha: for GitHub Actions pipeline runs).
• New Typosquatting Protection control blocks packages whose names closely resemble popular packages, configurable per ecosystem with a Whitelisted Packages allowlist to clear false positives by exact package name.

SAST / SCA / Code Security · 2026-07-13

StepSecurity adds Maven (Java) ecosystem support to GitHub Checks PR controls and OSS Package Search.

• Adds Maven Package Compromised Updates PR control: blocks pull requests that introduce or update a Maven dependency flagged in StepSecurity's compromised-packages database.
• Adds Maven Package Cooldown PR control: blocks pull requests adding recently published Maven versions until they age past the configured cooldown window.
• Enables Maven ecosystem selection in OSS Package Search, allowing blast-radius analysis of specific Maven packages across pull requests, default branches, and developer machines.

Firewalls & Network Defense · 2026-07-13

Sublime Security Platform v1.85 adds AI-generated explanation variable for user report auto-reply templates.

• Adds {{asa_simple_summary}} template variable that injects a plain-language AI (ASA) classification explanation into user report auto-reply messages.

SIEM · 2026-07-13

Sumo Logic dashboard PDF/PNG exports gain theme selection, up-to-6000px resolution, and per-panel time range support.

• Adds Light or Dark theme selection when exporting dashboards to PDF or PNG and in scheduled reports.
• Supports configurable export resolution from 1,500 to 6,000 pixels for sharper output on large displays.
• Enables per-panel time range in PDF/PNG exports — panels with overridden time ranges now use their own range instead of the dashboard-level range.

SIEM · 2026-07-13

Sumo Logic monitor email notifications can now embed the triggering search query and result set inline.

• Adds includeQuery and includeResultSet flags to monitor email notifications, embedding the search query and results directly in alert emails.

SIEM · 2026-07-13

Sumo Logic adds Notification Settings Standards policy to control timestamp format (Legacy or ISO) in alert payloads.

• New Notification Settings Standards policy lets org admins choose between Legacy and ISO date/time formats for alert and recovery notification payloads.

SIEM · 2026-07-13

Sumo Logic Dashboards now lets you copy any panel to another dashboard without rebuilding the query.

• New Copy to Dashboard action enables copying an existing dashboard panel to another dashboard or a new dashboard, preserving the original query.

SIEM · 2026-07-13

Sumo Logic's Go To search bar now surfaces Library content, Monitors, and SLOs alongside navigation pages.

• Enables Go To search bar to find dashboards, searches, and folders saved in the Library.
• Adds Monitor discovery by name directly from the Go To search bar.
• Adds SLO lookup from the Go To search bar without navigating to the SLO page.

SIEM · 2026-07-13

Sumo Logic Dashboards now show scan estimates at both dashboard and section levels for clearer cost/data visibility.

• Adds dashboard-level scan estimates: click the meter icon to view estimated scan data broken down by active and collapsed panels.
• Adds section-level scan estimates: click the meter icon on any section header to view estimated scan data for panels within that section.

SIEM · 2026-07-13

Sumo Logic Next-Gen apps now support email notifications for future app upgrades, with self-service subscribe/unsubscribe.

• Adds opt-in email notifications for Next-Gen app upgrades, including app name, new version, release notes, and a direct App Catalog link.
• Enables users with the Manage Apps capability to subscribe or unsubscribe from upgrade notifications for apps installed by others.
• Automatically removes upgrade notifications when a Next-Gen app is uninstalled.

SIEM · 2026-07-13

New Sumo Logic users and orgs now onboard directly into the New UI by default.

• New UI is now the default onboarding experience for all new Sumo Logic users and organizations; Classic UI remains accessible via Switch to classic UI in the left navigation menu.

SIEM · 2026-07-13

Sumo Logic adds Amazon Overview app, Next-Gen app migrations, and hashing support in 14 updated Source Templates.

• New Amazon Overview app delivers unified visibility into AWS service activity, performance, and health metrics across your cloud environment.
• Adds new dashboards, monitor alerts, and an IDP category to Active Directory 2012+ (OpenTelemetry), Active Directory 2012+ (JSON), Auth0, Azure Active Directory, JumpCloud Directory Insights, and OneLogin apps.
• Adds a custom_gpt selection variable to the ChatGPT Compliance app dashboard for easier filtering, alongside updated queries aligned to the latest log format.

SIEM · 2026-07-13

Sumo Logic unifies Threat Intelligence source configuration and indicator uploads into a single Data Management hub.

• Centralizes Threat Intelligence management under Data Management > Threat Intelligence, replacing fragmented multi-page navigation.
• New Add Source flow lets analysts select a threat intel source, choose a collector, and complete configuration in one guided workflow.
• New manual indicator upload option allows practitioners to add indicators directly without a separate source integration.

SIEM · 2026-07-13

MSSP admins can now opt child orgs in/out of Sumo Logic features directly from the Organizations UI.

• Adds Manage Features capability for MSSP administrators, enabling opt-in or opt-out of specific Sumo Logic features per child organization directly from the Organizations UI — no support ticket required.

SIEM · 2026-07-13

Sumo Logic launches a new service region in AWS European Sovereign Cloud for strict EU data residency and compliance.

• New Sumo Logic deployment region in AWS European Sovereign Cloud supports EU data residency, sovereignty controls, and compliance requirements.
• Enables organizations operating under strict European regulatory frameworks to run log analytics, security monitoring, and observability workloads with reduced latency.

Cloud Security Posture · 2026-07-13

Agentless Host Scanning now covers Windows, Fedora, and AWS Bottlerocket hosts via snapshot-based scanning.

• Adds agentless snapshot-based host vulnerability scanning for Windows hosts.
• Adds agentless snapshot-based host and container vulnerability scanning for Fedora hosts.
• Adds agentless snapshot-based host and container vulnerability scanning for AWS Bottlerocket hosts.

Cloud Security Posture · 2026-07-13

Registry Scanner v0.12.0 adds OCI image format and multi-architecture bundle scanning across all supported registries.

• Supports scanning of OCI image manifests (application/vnd.oci.image.manifest.v1+json), covering single-platform images published in OCI format.
• Supports OCI image indexes and Docker manifest lists (application/vnd.oci.image.index.v1+json and application/vnd.docker.distribution.manifest.list.v2+json), resolving multi-architecture images to a platform-specific manifest for scanning.
• Recognizes image manifests that omit the optional mediaType field (e.g., those produced by buildah), which were previously skipped as unsupported.

Cloud Security Posture · 2026-07-13

Host Scanner adds Google COS/GKE node vulnerability coverage and improved Ruby gem file-level attribution.

• Supports Google Container-Optimized OS (COS): Host Scanner now identifies installed packages on COS hosts (e.g., GKE nodes), extending vulnerability scanning to those workloads.
• Improves Ruby package detection: Host Scanner tracks source .rb files within installed gems, enabling more precise file-level vulnerability attribution.

Cloud Security Posture · 2026-07-13

Sysdig CLI Scanner v1.27.2 adds detection support for Google Container-Optimized OS (COS) packages.

• Adds detection of Google Container-Optimized OS (COS) packages in vulnerability scans.

Cloud Security Posture · 2026-07-13

Sysdig Secure refreshes the Threats UI with bulk actions and resource focus, and adds Azure Monitor Logs Ingestion API for Sentinel.

• Adds bulk actioning on Threat aggregations, allowing review of multiple occurrences at once from a single pane.
• Threats now scoped to a single resource, surfacing context-aware risk signals per asset.
• New occurrence tabs let practitioners toggle between the latest and prior threat occurrences within the same view.

Cloud Security Posture · 2026-07-13

Sysdig Secure adds end-of-life visibility and policy enforcement for OS and Go runtime components in Vulnerability Management.

• Adds end-of-life (EOL) visibility for operating systems and the Go runtime in Vulnerability Management, surfacing lifecycle status alongside vulnerability data in the Resource Details drawer, Components tab, Findings Details drawer, CVE Details drawer, and scan result side panels.
• New Lifecycle column and filter in the Components tab lets practitioners quickly identify components no longer receiving vendor support.
• CLI scanner JSON output and the scan results API now include lifecycle metadata, enabling pipeline and integration consumers to act on EOL status programmatically.

Cloud Security Posture · 2026-07-13

Sysdig Secure adds Response Actions directly in the resource drawer for hosts, Kubernetes workloads, and AWS resources.

• Enables Response Actions (threat hunting, incident containment) directly from the resource drawer without navigating away from the resource view.
• Supports host, container, and file Response Actions for hosts when Host Shield is configured.
• Supports Kubernetes Response Actions for workloads when Cluster Shield is enabled.

Cloud Security Posture · 2026-07-13

Sysdig CLI Scanner v1.27.0 adds Flashpoint KEV tag and Flashpoint CVSSv3 Temporal score to vulnerability output.

• Adds Flashpoint KEV (Known Exploited Vulnerabilities) tag to CLI Scanner vulnerability output for faster exploit-aware triage.
• Adds Flashpoint CVSSv3 Temporal score to CLI Scanner vulnerability output, surfacing real-world exploitability context alongside base scores.

Cloud Security Posture · 2026-07-13

Sysdig Secure adds Response History page for auditing all Response Actions across events, automations, and APIs.

• New Response History page centralizes all Response Actions taken manually, via Automations, or through APIs — showing what was done, where, when, and by whom.
• Enables retrieval of collected artifacts and reversal of containment actions performed in error from a single audit view.

General Utilities & Libraries · 2026-07-13

SysReptor 2026.50 moves LLM config to the web UI, adds multi-model support, and extends auto-delete to finished projects.

• Moves LLM configuration (AI_AGENT_MODELS) from environment variables into the web UI for easier management.
• Supports multiple LLM models with per-session model selection directly in the UI.
• Extends auto-delete policy (AUTOMATICALLY_DELETE_PROJECTS_AFTER) to cover both finished and archived projects, not just archived ones.

Vulnerability Management · 2026-07-13

Nessus 10.12.0 adds drag-and-drop UI, Sensor Proxy support, FIPS-140.3, OpenSSL 3.5, ARM64, and a new --scan-zones CLI parameter.

• Adds drag-and-drop scan organization: move existing scans into folders directly from the list view in the modernized UI.
• Enables drag-and-drop .nessus file import: drop scan files from your local machine directly into the Nessus UI.
• Adds support for OpenSSL 3.5.

Vulnerability Management · 2026-07-13

Nessus 10.12.1 adds variable support for custom audit files when scanning from Tenable Security Center.

• Supports passing variables to custom audit files when initiating scans from Tenable Security Center, enabling dynamic, reusable compliance checks.

Detection Engineering · 2026-07-13

Tenzir v6.6.0 expands ClickHouse integration with LowCardinality/DateTime64 support and adds a reference date for partial parse_time formats.

• Adds reference date support for partial parse_time format strings, enabling relative time parsing without a full timestamp.
• Supports additional ClickHouse column types in to_clickhouse, including LowCardinality and DateTime64.
• Enables to_clickhouse to tolerate ClickHouse columns that have default values, avoiding pipeline failures on schema mismatches.

Detection Engineering · 2026-07-13

Tenzir Platform v1.35.0 adds optional MFA support and improves pipeline Diagnostics tab performance.

• Adds optional multi-factor authentication (MFA) support for the public Tenzir Platform.
• Improves performance of the pipeline Diagnostics pane.
• Enables graceful shutdown for Docker Compose nodes.

Detection Engineering · 2026-07-13

Tenzir Platform v1.36.0 adds inline UDO expansion in the Explorer, revealing operator bodies with full TQL syntax highlighting.

• Adds inline expansion of User-Defined Operators (UDOs) in the Explorer, letting practitioners expand any UDO call in place to inspect its full TQL body, including nested UDO calls.

Detection Engineering · 2026-07-13

Tenzir Ship v1.11.0 adds project name and version to GitHub release titles with custom format support.

• GitHub release titles now include the project name, version, and release title by default, keeping untitled releases clean.
• Supports custom release title formats via the CLI and Python API.

Detection Engineering · 2026-07-13

Tenzir Skills v3.0.0 renames the docs skill to tenzir and removes the shared review workflow.

• Renames the bundled documentation skill from tenzir-docs to tenzir (breaking change — update any references).
• Removes the opinionated shared review workflow from the bundled skill collection.
• Stabilizes scheduled ASIM updates so that upstream branch movement without content changes no longer triggers unnecessary syncs.

Detection Engineering · 2026-07-13

Tenzir Node v6.5.0 adds map_keys(), expanded metrics, assert_throughput bounds, and hive-partitioned sink column pruning.

• Adds map_keys function to extract keys from record-type fields in pipeline expressions.
• Adds ingress/egress metrics to additional operators, broadening pipeline observability.
• Supports upper bounds in assert_throughput for capping expected throughput ranges.

Detection Engineering · 2026-07-13

Tenzir Ship v1.10.0 adds PR metadata validation controls for changelog projects.

• New require_pr option warns when an unreleased changelog entry is missing its pull request reference.
• Validation now rejects PR and author metadata on entries when the project config sets omit_pr or omit_author, preventing stray metadata from slipping in.
• Agent skill updated to respect omit_pr and omit_author project configuration options.

Detection Engineering · 2026-07-13

Tenzir v6.4.0 adds package constants, ClickHouse JSON column support, and embedded platform control endpoints in tokens.

• Adds package-level constants that any pipeline within the package can reference, enabling reusable configuration across pipelines.
• Supports native ClickHouse JSON columns in the to_clickhouse operator for richer schema flexibility when writing to ClickHouse.
• Embeds platform control endpoints directly in node tokens, simplifying node onboarding without separate endpoint configuration.

Detection Engineering · 2026-07-13

Tenzir v6.3.0 adds graceful pipeline shutdown, ClickHouse source, HTTP proxy support, and automatic input format detection.

• Adds graceful pipeline shutdown with data draining — in-flight events are flushed before a pipeline or node stops, eliminating event loss on shutdown.
• New from_clickhouse source operator enables reading data directly from ClickHouse databases.
• Supports configuring an HTTP proxy for outbound operators.

Detection Engineering · 2026-07-13

Tenzir Platform v1.34.0 adds OpenTelemetry frontend tracing and dedicated Stream view columns for common fields.

• Adds dedicated columns for common fields (e.g., timestamps) in the Stream view for faster at-a-glance triage.
• Adds OpenTelemetry tracing for the Platform frontend, enabling end-to-end visibility into backend request handling.
• Removes direct WebSocket Gateway connection support — operators relying on it must migrate to the new connection path.

Detection Engineering · 2026-07-13

Tenzir Node Helm chart debuts with hardened defaults, flexible networking, and checksum-driven rollouts.

• New Helm chart for deploying Tenzir Node on Kubernetes.
• Supports per-node configuration with checksum-driven rollouts to trigger pod restarts on config changes.
• Two patterns for exposing listener ports to suit different networking topologies.

Detection Engineering · 2026-07-13

Tenzir Skills v2.2.0 adds reference skills for 7 major security schemas: ASIM, Splunk CIM, ECS, CEF, LEEF, FortiSIEM EDM, and Google UDM.

• New Microsoft Sentinel ASIM reference skill for querying and mapping events to the Azure Sentinel schema.
• New Splunk CIM reference skill covering the Common Information Model field mappings.
• New Elastic Common Schema (ECS) reference skill for ECS field definitions and event categorization.

Digital Forensics & Incident Response · 2026-07-13

Timesketch 20260630 adds SecGemini analyzer results to report summaries and enriches OpenTelemetry spans with search metadata.

• Adds SecGemini analyzer report output to the sketch report summary, surfacing AI-driven analysis alongside other analyzer results.
• Updates SecGemini provider to align with the sec-gemini v3 SDK APIs, enabling compatibility with the latest SecGemini capabilities.
• Adds search metadata attributes to OpenTelemetry spans, enabling deeper observability into search query telemetry.

Digital Forensics & Incident Response · 2026-07-13

Timesketch 20260617 enforces cross-sketch ownership on event fact conclusions via the API.

• Enforces cross-sketch ownership validation on event fact conclusions in the API, preventing analysts from applying conclusions across sketches they do not own.

SOAR · 2026-07-13

Tines now lets you trigger app actions directly from within a case, without leaving the case view.

• Enables running apps directly from a case via case actions, keeping response workflows in context.

SOAR · 2026-07-13

Tines adds Record ID filtering and sorting to records tables and charts.

• Enables filtering and sorting of records by Record ID in the records table and charts.

SOAR · 2026-07-13

Tines adds two new tenant permissions for finer-grained user management control.

• Adds User Read and User Manage tenant-level permissions for more granular control over who can view and administer users within a tenant.

SOAR · 2026-07-13

Tines storyboard record action gains a Query mode for running aggregations directly on record types.

• Adds Query mode to the storyboard record action, enabling aggregations to be run directly against a record type without leaving the storyboard.

Endpoint Security (EDR/XDR) · 2026-07-13

On-premises Gateway 1.0.87 adds X-Authenticated-User header support for upstream/downstream proxy auth in Forward proxy mode.

• Supports parsing the X-Authenticated-User header stamped by a downstream proxy as an alternative authentication method in Forward proxy mode.
• Supports stamping the X-Authenticated-User header onto configured upstream proxy requests in Forward proxy mode.
• Updates DLP SDK and built-in compliance templates with new content.

Endpoint Security (EDR/XDR) · 2026-07-13

Trend Vision One Endpoint Security agent now supports Red Hat Enterprise Linux 8 PowerPC (ppc64le) deployments.

• Supports deploying the Endpoint Security agent on Red Hat Enterprise Linux 8 PowerPC (ppc64le) endpoints.
• Enables Server & Workload Protection coverage on RHEL 8 ppc64le systems.
• Enables XDR for Endpoint (EDR) telemetry and detection on RHEL 8 ppc64le systems.

Endpoint Security (EDR/XDR) · 2026-07-13

Trend Vision One AI Scanner adds custom attack prompt support for deterministic, repeatable AI model security testing.

• Supports custom hand-crafted attack payloads in AI Scanner alongside the built-in attack library, enabling testing of known jailbreaks, regression cases, and novel attack variations.
• Runs custom prompts exactly as written with no automatic technique or modifier applied, ensuring deterministic and repeatable results.
• Enables user-defined evaluation criteria per objective for custom prompt tests.

Endpoint Security (EDR/XDR) · 2026-07-13

Agentless Vulnerability & Threat Detection adds configurable scan scheduling for Microsoft Azure environments.

• Enables configuration of scan frequency and start time for Agentless Vulnerability & Threat Detection in Azure subscriptions via Terraform.
• Supports enabling or disabling Azure scanning on-demand without redeploying the Terraform template.

Endpoint Security (EDR/XDR) · 2026-07-13

Trend Vision One opens an Indonesia data center, giving regional users a local service endpoint.

• New Indonesia data center available, enabling regional users to configure service FQDNs to point to a local endpoint.

Endpoint Security (EDR/XDR) · 2026-07-13

Trend Vision One adds centralized backup and restore for Deep Discovery Inspector appliance configs via the console.

• New System Maintenance screen in the Trend Vision One console enables creating, downloading, deleting, and restoring configuration backups for connected Deep Discovery Inspector appliances without logging into each appliance individually.
• Supports backup history management — view past backups and restore an appliance from any previously saved configuration snapshot.
• Requires Deep Discovery Inspector 6.9 or later; accessible via Network Security → Network Inventory.

Endpoint Security (EDR/XDR) · 2026-07-13

Zero Trust Secure Access now logs DLP and AI content snippets (up to 100 bytes) including prompt injection detections.

• Enables content snippet logging (up to 100 bytes) for traffic matching a Data Loss Prevention profile via Internet Access and AI Secure Access.
• Enables content snippet logging for traffic matching an AI content inspection profile.
• Adds prompt injection detection logging within Zero Trust Secure Access Internet Access and AI Secure Access flows.

Endpoint Security (EDR/XDR) · 2026-07-13

Trend Vision One adds email notifications for Detection Model Management changes — new, updated, or deprecated models.

• Enables email notifications for Detection Model Management events, alerting practitioners when models are added, updated, or deprecated.

Endpoint Security (EDR/XDR) · 2026-07-13

Trend Vision One File Security Storage AWS template v4.2.0 adds support for S3 KMS Encryption.

• Supports S3 KMS Encryption for protected S3 buckets scanned by File Security Storage.

Endpoint Security (EDR/XDR) · 2026-07-13

Trend Vision One adds an Internet Access rule simulator to test and validate Zero Trust Secure Access rules before deployment.

• New rule simulator in Zero Trust Secure Access lets administrators test and validate Internet Access rules before pushing them to production, reducing misconfiguration risk.

Endpoint Security (EDR/XDR) · 2026-07-13

Sandbox Analysis reports now surface threat actor and campaign attribution via a new Associated threats tab.

• Adds an Associated threats tab to sandbox object profiles, correlating submitted files/IOCs with known threat actors and emerging threats from Threat Intelligence Hub.
• Enables direct links from sandbox reports to full threat actor and campaign reports in Threat Intelligence Hub, eliminating separate intelligence lookups.

Endpoint Security (EDR/XDR) · 2026-07-13

ZTSA On-premises Gateway 1.0.86 adds OCR-based DLP, Grok inspection, and M365 Copilot Tenant Restriction V2 support.

• Adds OCR integration to DLP and AI content inspection, enabling text extraction and policy enforcement on image-based content.
• Supports Microsoft 365 Tenant Restriction V2 for controlling Copilot access across tenants.
• Adds content inspection support for Grok services.

Endpoint Security (EDR/XDR) · 2026-07-13

Zero Trust Secure Access now enforces tenancy restrictions for Microsoft Copilot, blocking personal-account logins from corporate networks.

• Adds tenancy restriction support for Microsoft Copilot in Internet Access and AI Secure Access rules, limiting access to corporate-domain accounts only and blocking personal accounts (e.g., Gmail, Outlook) from the corporate network.

Endpoint Security (EDR/XDR) · 2026-07-13

Security Playbooks gains a native Collect Evidence action node to trigger forensic collection on endpoints without playbook chaining.

• Adds a Collect Evidence action node to Security Playbooks, enabling automated forensic evidence collection on impacted Windows and Linux endpoints directly within a playbook.
• Supports triggering evidence collection from endpoint response, automated response, and Workbench insight progression update playbook types.
• Enables criteria-based automation (e.g., severity is high or Insight score exceeds 80) to kick off forensics without manual intervention or chaining separate playbooks.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate API keys can now be renamed, have permissions modified, and be disabled/re-enabled after creation.

• Enables editing of existing API keys to rename them, update their permissions, or disable/enable them without generating new keys.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate adds Authentication Audit Logs with exportable success/failure events for logins, resource access, and MFA.

• New Authentication Audit Logs surface per-event success and failure data for Client logins, Resource access attempts, and MFA setup.
• Enables export and sync of authentication event data for SIEM ingestion, compliance auditing, and troubleshooting workflows.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate adds a Billing Admin role that scopes users to plan and payment management only.

• New Billing Admin role lets admins grant billing-only access to users who need to manage plans and payments without exposing the rest of the Admin Console.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate Admin Console adds Connector deployment guides for Ubiquiti, ZimaOS, and CasaOS.

• Adds step-by-step Connector deployment guides for Ubiquiti, ZimaOS, and CasaOS environments in the Admin Console.
• Improves Connector Deployment page UX to make it easier to find the right deployment method for your environment.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate Connectors now export real-time health metrics in Prometheus format for integration with existing monitoring stacks.

• New Connector Health Metrics provide admins visibility into network traffic patterns and connection efficiency via real-time data.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate Admin Console gains multi-term and exact-phrase search across users, Resources, and devices.

• Supports multi-term search across users, Resources, and devices in the Admin Console.
• Enables exact-phrase matching by wrapping search terms in double quotation marks (e.g., Grafana Dashboard).

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate adds Just-in-Time access requests with time-limited grants and optional admin approval workflows.

• New JIT Access Request workflows let admins grant users on-demand, time-limited access to Resources (1 hour to 7 days).
• Supports two approval modes: require explicit admin approval or auto-approve for audit-only tracking.
• Enables break glass incident response protocols by controlling and logging access to sensitive Resources.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate Clients now support simultaneous sign-in to multiple accounts across different networks on macOS, iOS, and Windows.

• Enables simultaneous sign-in to multiple Twingate accounts (e.g., home, work, or multiple admin accounts) from a single client session.
• Supports per-account connection pausing without requiring logout or quitting the client.
• Multi-account support available on macOS, iOS, and Windows clients, with Android and Linux coming soon.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate adds downloadable Network Health Summary reports with per-user metrics for proactive monitoring and troubleshooting.

• New downloadable Network Health Summary reports surface metrics such as data transferred and errors across configurable timeframes.
• Extends existing active user reports with per-user network health data points, enabling admin-level visibility into individual user connectivity.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate adds Privileged Access for SSH: register servers as SSH Resources with IdP auth, cert-based authN, and session recording.

• Adds SSH Resources: register servers and VMs in Twingate and let users connect via existing SSH tools without managing or distributing SSH keys.
• Enables identity-provider authentication for SSH sessions through the Twingate Identity Firewall, eliminating credential sprawl and bastion hosts.
• Gateway handles certificate-based authentication to target servers on behalf of users, removing the need for per-user SSH key management.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate adds per-Resource Approver Groups so non-Admin teams can review and approve JIT access requests.

• Enables delegation of JIT Access Request approvals to designated Groups on a per-Resource basis, without granting full Admin privileges.
• Supports configuring one or more Groups as Resource Approvers, letting resource-owning teams manage their own access requests.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate adds Resource Exclusions to route specific addresses around Twingate infrastructure while keeping audit-log traceability.

• Enables per-address bypass routing so specific addresses within a broader Resource scope (e.g., a public subdomain under a wildcarded corporate domain) go directly via the local OS, skipping Twingate Connectors and Relay.
• Audit-logs every routing-mode change on a Resource, making bypass decisions explicit and traceable rather than invisible gaps.

Secure Access (VPN / SASE / ZTNA) · 2026-07-13

Twingate Linux Client adds userspace networking via HTTP Proxy Mode — no root or elevated privileges required.

• New userspace networking mode for the Twingate Linux Client eliminates the need for root or elevated privileges.
• New HTTP Proxy Mode enables secure access to Twingate-protected resources over standard HTTP/HTTPS connections.
• Supports headless and restricted environments, enabling use in CI/CD pipelines, Docker containers, and developer workstations without admin access.

Data Security & DLP · 2026-07-13

Ubiq adds Access Groups, dataset tagging, advanced structured encryption config, SIEM streaming, and expanded SDK capabilities.

• Introduces Access Groups to manage dataset access for identities (API Keys and IDP users), replacing the previous Dataset Group → Identity hierarchy.
• Adds dataset tagging as a flexible, non-hierarchical replacement for Dataset Groups, allowing grouping by environment, application, or any custom structure.
• Enables advanced structured Dataset configuration in the dashboard UI, allowing encryption behavior for dates, numerics, short fields, and large character sets to be defined at policy level without custom code.

Data Security & DLP · 2026-07-13

Varonis adds a Windows Explorer right-click shortcut so users can request file access without IT intervention.

• New right-click context menu in Windows Explorer lets users request access to files and folders directly, without copying paths or contacting IT.

Data Security & DLP · 2026-07-13

Varonis MDDR dashboard gains a direct link to Varonis Community for centralized escalation contact management.

• Adds a direct referral link to Varonis Community from the MDDR dashboard for one-click escalation contact management.

Data Security & DLP · 2026-07-13

Varonis now lets admins choose between incremental and full rescans when editing classification policies.

• Adds configurable rescan behavior for classification policies: apply edits to new/modified files only, or trigger a full rescan of all files.

Data Security & DLP · 2026-07-13

Varonis lets admins exclude groups from request-based access workflows via the DAG API.

• Enables admins to exclude specific groups from request-based access workflows in the DAG API, reducing operational overhead and preventing misconfiguration.

Data Security & DLP · 2026-07-13

Varonis now propagates group-based permission changes in near real-time, eliminating access management delays.

• Delivers group-based permission updates in near real-time, reducing lag when modifying access group memberships or entitlements.

Data Security & DLP · 2026-07-13

Varonis Data Access Governance request timestamps now display in the customer's local time zone.

• Displays Data Access Governance request timestamps (creation, activation, expiration, and scheduling) in the customer's local time zone.

Data Security & DLP · 2026-07-13

Varonis adds NFS monitoring for Hitachi NAS, covering activity auditing, permissions tracking, and data classification.

• Supports NFS monitoring for Hitachi NAS data sources, enabling file and folder activity auditing.
• Tracks permissions and ownership changes on Hitachi NAS over NFS.
• Enables data classification and labeling for Hitachi NAS NFS content.

Data Security & DLP · 2026-07-13

Varonis adds on-demand prioritized folder rescanning to accelerate classification validation in critical areas.

• Enables on-demand folder rescans with user-defined priority order, so high-value or policy-sensitive folders return updated classification results first.

Data Security & DLP · 2026-07-13

Varonis DAG API now exposes automatic governance rules for governed groups, enabling programmatic visibility and on/off control.

• New DAG API endpoints provide full visibility into automatic governance rules configured on governed groups.
• Enables programmatic enforcement: turn automatic governance rules on or off on demand via the DAG API.

Data Security & DLP · 2026-07-13

Varonis Atlas now secures Cursor AI coding agents with real-time policy enforcement, session logging, and MCP skill inspection.

• Adds direct integration with Cursor, the AI-native coding tool, providing real-time visibility into agent intent, data sensitivity, access patterns, and token usage.
• Enables runtime policies to block, modify, or alert on risky agent actions before they impact sensitive data.
• Introduces detailed session logging capturing prompts, tool usage, and executed actions for incident investigation and response.

SAST / SCA / Code Security · 2026-07-13

Veracode Security Labs adds OWASP LLM 07 lesson and expands eLearning captions for C/C++ memory management course.

• New Security Labs lesson: OWASP LLM 07: Under the Hood (Flask), expanding the OWASP Top 10 for LLM Applications hands-on lab series.
• Adds multilingual caption support (English, Spanish, French, Portuguese, Chinese) to the C/C++ Memory Management Risks and Best Practices eLearning course.

SAST / SCA / Code Security · 2026-07-13

GitHub Workflow Integration v2.0.0 adds platform-based install, scan scheduling, and Apex/VB6/Perl autopackaging support.

• Enables installing and configuring the Veracode GitHub Integration directly from the Veracode Platform, eliminating manual GitHub Marketplace steps.
• Supports updating integration credentials and adding organizations from the Veracode Platform, regardless of original install method.
• Adds autopackaging support for Apex, VB6, and Perl in the GitHub Workflow Integration.

SAST / SCA / Code Security · 2026-07-13

Veracode adds six new built-in policies, OWASP/CWE 2025 auto-updates, OAuth 2.0 credentials UI, CMEK, and expanded Reporting API filters.

• Updates Auto-Update OWASP and Auto-Update CWE Top 25 policy rules to enforce OWASP Top 10:2025 and MITRE CWE Top 25 for 2025 standards.
• Adds six new built-in security policies to the platform, ahead of deprecation of recommended and transitional policies.
• Adds collections_list field to Finding Reporting API responses, returning collection names associated with each application.

SAST / SCA / Code Security · 2026-07-13

Veracode DAST adds Directory Restrictions, enhanced scheduling with breaking API changes, and open-port scanning with new detections.

• Adds Directory Restrictions to DAST target configuration, giving practitioners control over scan scope by limiting which directories are crawled.
• Introduces enhanced DAST Schedule configuration with advanced scheduling options and greater flexibility; all existing schedules are automatically migrated.
• Breaking change: DAST REST API scheduling endpoints have changed — integrations managing schedules via the REST API must be updated to the new endpoints.

SAST / SCA / Code Security · 2026-07-13

Veracode SAST June 2026 engine adds Dart 3.12/Flutter 3.44 and Kotlin 2.4 support, plus new CWE detections across multiple languages.

• Adds support for Dart 3.12 and Flutter 3.44 in static analysis.
• Adds support for Kotlin 2.4.
• Improves classification of first-party .NET assemblies to better distinguish application code from third-party dependencies.

Web Application Security · 2026-07-13

Wallarm launches a redesigned Attacks interface with interactive dashboards, customizable views, and drill-down request inspection.

• New interactive Attacks dashboard lets analysts navigate attack trends, spot anomalies, and apply filters directly from charts, tables, and statistics.
• Customizable Views enable saving preferred columns, filters, time ranges, and groupings as dedicated dashboards scoped to specific attack types, applications, hosts, or incidents.
• Attack Investigation Flow surfaces request-level details — source IP, host, URI, payload, parameters, classifications, headers, and full raw request — from a single drill-down.

Web Application Security · 2026-07-12

DOMPurify 3.4.12 adds support for new SVG attributes alongside hardened handling of declarative partial updates.

• Supports additional SVG attributes, expanding the set of valid SVG markup that passes through sanitization.
• Strengthens handling of declarative partial updates to reduce exposure from incremental DOM mutation patterns.

Web Application Security · 2026-07-12

ffuf v2.2.0 adds audit logging to record all fuzzing activity for compliance and review.

• Adds audit logging functionality to record fuzzing sessions for compliance, review, and reporting purposes.

Web Application Security · 2026-07-12

XSRFProbe v3 rebuilds the CSRF engine with 25 categorized checks, headless-browser SameSite bypasses, and JSON reporting.

• Adds a full battery of 25 named checks (D1–A1) covering token tampering, method/Content-Type overrides, Origin/Referer bypasses, SameSite cookie analysis, and token strength — each with a unique ID, severity rating, and exploitability notes.
• New token-tampering checks (T2–T8) actively probe GET↔POST method switching, token omission, empty values, cross-session replay, double-submit cookies, and custom-header token forgery.
• New Origin/Referer bypass checks (R0–R2c, O1–O3) test header removal, regex tricks, subdomain tricks, and Origin: null against real-world validation implementations.

AI Coding Agents · 2026-07-11

Auto mode goes GA on Bedrock/Vertex/Foundry, Opus 4.8 becomes the default, and plugin config scoping tightens.

• Auto mode is now generally available on Bedrock, Vertex AI, and Foundry without the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in flag; disable it via disableAutoMode in settings.
• Bedrock, Vertex, and Claude Platform on AWS now default to Claude Opus 4.8.
• Auto mode config is now read exclusively from ~/.claude/settings.json; the repo-resident .claude/settings.local.json autoMode key is no longer honored (breaking change for teams using per-repo overrides).

AI Coding Agents · 2026-07-11

GCP Vertex provider gains new Claude models and a free-form model ID entry field.

• Adds new Claude model IDs to the GCP Vertex provider, including claude-sonnet-5, claude-opus-4-x variants, claude-haiku-4-5, and claude-fable-5.
• Enables free-form model ID entry in the Vertex provider's model dropdown, letting practitioners use any Vertex-hosted model without waiting for an extension release.

Firewalls & Network Defense · 2026-07-11

Cloudflare Smart Tiered Cache now supports cloud region hints for AWS, GCP, Azure, and Oracle Cloud anycast origins.

• Adds cloud region hint configuration for anycast origins, letting Smart Tiered Cache select optimal upper tiers for origins on AWS, GCP, Azure, and Oracle Cloud.
• New Origin Configuration table in the dashboard (Caching > Tiered Cache > Origin Configuration) enables per-IP region hint assignment or bulk editing of all origin IPs at once.
• Supports region hint management via Cloudflare API and Terraform for infrastructure-as-code workflows.

Firewalls & Network Defense · 2026-07-11

DLP source code detection targets whole-file uploads only; new Durable Object namespaces must use SQLite backend

• Improves DLP source code detection to evaluate only whole source code file uploads/downloads, reducing false positives from code embedded in chat messages, docs, or code samples.
• Adds a 500-character minimum threshold for DLP source code file evaluation, filtering out small fragments that lack enough context for reliable classification.
• Supports confidence level tuning on DLP source code profiles to balance false-positive reduction against detection coverage in Gateway HTTP policies.

AI Coding Agents · 2026-07-11

Cursor adds side chats, agent transcript search, new cloud agent hooks, and redesigned project/repo pickers.

• New Side Chats: open parallel agent conversations via /side, /btw, or the plus button without interrupting the main agent thread — each is a durable, full agent conversation that can be revisited and @-mentioned.
• Adds agent transcript search in the Agents Window via Cmd+K (command palette), with a local search index that scales to thousands of conversations.
• Adds in-conversation search with Cmd+F, match counter, and jump-between-matches for long agent transcripts.

AI Coding Agents · 2026-07-11

Cursor 3.11 adds side chats, searchable agent transcripts, and new cloud agent hooks for conversation-level control.

• New side chats let you open parallel agent conversations (via /side, /btw, or the plus button) without interrupting the main agent thread, with full context sharing and durable follow-up.
• Adds searchable agent transcript index (Cmd+K from the command palette) that scales to thousands of conversations, plus in-conversation search (Cmd+F) with match counter and jump navigation.
• New cloud agent hooks — beforeSubmitPrompt, afterAgentResponse, afterAgentThought, stop, subagentStart, and more — enable observation and control of prompts, responses, reasoning, subagents, compaction, and turn completion.

Container & Image Security · 2026-07-11

Docker Compose v5.3.0 adds native support for pre-start init containers.

• Supports pre-start init containers, allowing services to declare initialization containers that run and complete before the main service starts.

Container & Image Security · 2026-07-11

Docker Compose v5.2.0 introduces a new reconciliation algorithm and a rawsetenv message type for provider plugins.

• New reconciliation algorithm aligns observed state with expected state more accurately during docker compose up and related operations.
• Adds rawsetenv message type for provider plugins, enabling plugins to set environment variables without shell interpolation.

Runtime Security · 2026-07-11

Docker Sandboxes v0.35.0 adds SOCKS5 proxy support, policy inspection/check commands, secret import, and a daemon management CLI.

• Adds SOCKS5 upstream-proxy transport (socks5:// / socks5h://) for sandbox egress via DOCKER_SANDBOXES_PROXY, HTTP_PROXY, or HTTPS_PROXY, with optional auth and DOCKER_SANDBOXES_NO_PROXY exclusions.
• New sbx policy inspect command to examine policy details.
• New sbx policy check network command to test whether the current policy would allow a network access request before executing.

Runtime Security · 2026-07-11

Docker Sandboxes v0.34.0 adds a native SSH endpoint, kit source allowlisting, OCI v2 streaming, and a new onboarding command.

• New experimental native SSH endpoint in sandboxd: connect with ssh <sandbox-name>@127.0.0.1 -p 2222 (publickey auth, connect-to-create, interactive shell and exec).
• New experimental sbx setup command imports agent credentials from environment variables for smoother first-time onboarding.
• Adds OCI v2 kit artifact streaming that decompresses layers once to a cache directory and uses seek-based random access, reducing memory pressure during kit reads.

Runtime Security · 2026-07-11

sbx v0.33.0 adds named sandbox identity, DNS-gated network policy, wildcard secrets, and Cursor OAuth support.

• New --name flag for sbx run identifies a sandbox independently of the working directory, enabling multiple named sandboxes in the same workspace and re-attachment from any directory.
• sbx ls --json now reports a stable per-sandbox id field for scripting and automation.
• Sandbox DNS resolution is now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039); loopback names remain exempt.

Reverse Engineering · 2026-07-11

jadx v1.5.6 adds graph views with code pane sync, a call graph library, and resource tree improvements.

• Adds graph views with code pane synchronization in the GUI for visual code flow analysis.
• New call graph module/library enables programmatic traversal of method call relationships.
• Collapses single-child directory chains in the resource tree for cleaner navigation.

AI Agent Frameworks · 2026-07-11

LangGraph CLI now supports prebuild images for langgraph deploy.

• Supports prebuild images when running langgraph deploy, enabling faster deployments using pre-built Docker images.

Integrated & IT Risk Management · 2026-07-11

LogicGate Spring 2026 introduces seven AI Workflow Agents, AI Governance module, expanded Spark AI, and enterprise-wide search across GRC use cases.

• Launches seven new AI Workflow Agents in early access spanning Third-Party Risk Management, Enterprise Risk Management, Business Continuity Management, and AI Governance use cases.
• New AI Governance module provides a unified view of AI risk: maps the full AI ecosystem, auto-calculates risk levels using NIST AI RMF categories, and surfaces business-impact indicators aligned to the EU AI Act and NIST frameworks.
• Adds Reporting Insights to Spark AI, enabling analysis of large data volumes within a single report with guided next-action recommendations.

Integrated & IT Risk Management · 2026-07-11

LogicGate unveils Config Newton agentic GRC engineer and four new workflow agents for TPRM and AI governance.

• Introduces Config Newton, an agentic GRC engineer that interprets complex program requirements, navigates Risk Cloud, and autonomously builds complete GRC programs.
• New Third-Party Risk Management Agents automatically route vendors based on risk signals, complete formal assessments, and flag findings for human-led remediation.
• New AI Governance Agents triage incoming AI use cases, score them against your risk framework, and surface recommended mitigations for human review.

Endpoint Security (EDR/XDR) · 2026-07-11

LiveKd 5.65 restricts dump file access to admins; ZoomIt 11.11 adds JPEG and WEBP snip format support.

• LiveKd now protects generated kernel dump files from being read by non-admin users.
• ZoomIt adds JPEG and WEBP format support for snip captures.

AI Coding Agents · 2026-07-11

OpenHands 1.46 adds configurable BYOR key alias patterns and enriched final archive manifests.

• Supports configurable Bring-Your-Own-Router (BYOR) key alias patterns for enterprise deployments.
• Enriches final archive manifests with additional metadata and removes redundant initial snapshots.

AI Coding Agents · 2026-07-11

Pi v0.80.6 adds a max thinking level for GPT-5.6/Claude and input-token pricing tiers for long-context cost accounting.

• Adds max thinking level (above xhigh) for GPT-5.6 and adaptive Claude models, available via CLI, SDK, RPC, and model selection; custom themes can define thinkingMax.
• Adds request-wide input-token pricing tiers for accurate long-context cost accounting (e.g. GPT-5.4/5.5/5.6 rates), configurable in models.json and modelOverrides.
• Supports ~ (home directory) expansion in the shellPath setting.

AI Coding Agents · 2026-07-11

Pi v0.80.3 adds Claude Sonnet 5, Azure Foundry endpoints, new RPC session APIs, and configurable editor/padding settings.

• Adds Anthropic Claude Sonnet 5 support via Anthropic-compatible and Bedrock provider catalogs, with adaptive thinking enabled.
• Supports modern Microsoft Azure Foundry endpoint URLs for the Azure OpenAI Responses provider.
• New get_entries and get_tree RPC commands let clients inspect session entries and tree snapshots programmatically.

AI Coding Agents · 2026-07-11

Pi v0.80.0 adds Ctrl+J newline keybinding and migrates pi-ai's global API to a new compat entrypoint.

• Adds Ctrl+J as a default newline keybinding alongside Shift+Enter.
• Moves pi-ai's legacy global API (stream/complete/completeSimple, getModel/getModels/getProviders, registerApiProvider, getEnvApiKey, etc.) from the @earendil-works/pi-ai root to @earendil-works/pi-ai/compat; extension sources typechecking against pi-ai's published types should update imports accordingly or migrate to the new createModels()/provider-factory API.
• Removes the @earendil-works/pi-ai/base and @earendil-works/pi-agent-core/base selective-provider entrypoints; use the root packages with explicit Models provider factories instead.

AI Coding Agents · 2026-07-11

Extension compaction events gain reason/willRetry context; pi update now pins the exact checked version.

• Adds reason and willRetry metadata to session_before_compact and session_compact extension events, enabling extensions to distinguish manual /compact, threshold auto-compaction, and overflow retry flows.
• Updates pi update to install the exact version returned by the Pi update check and surface the changelog URL in update notices, making upgrade behavior predictable.

AI Coding Agents · 2026-07-11

Pi v0.79.9 adds chat-template thinking support for vLLM/Hugging Face providers like DeepSeek and improves GLM-5.2 routing.

• Adds chat-template thinking support: OpenAI-compatible custom providers can now map Pi thinking levels into chat_template_kwargs, enabling vLLM/Hugging Face models such as DeepSeek to use provider-native thinking controls.
• Enables GLM-5.2 xhigh reasoning on OpenRouter and corrects Fireworks routing to use the OpenAI-compatible Chat Completions endpoint with reasoning_effort support.

AI Coding Agents · 2026-07-11

Pi v0.79.8 adds Mistral prompt caching, OpenRouter Fusion alias, and post-compaction token estimates.

• Adds Mistral prompt caching using the Pi session ID as the cache key, with cached-token usage and cost accounting surfaced per session.
• Adds openrouter/fusion as a built-in OpenRouter model alias for direct use as a provider target.
• Adds estimated post-compaction token counts to compact results and compaction events, letting clients display approximate context reduction.

AI Coding Agents · 2026-07-11

Pi v0.79.7 adds automatic light/dark theme switching, scoped update control, and new extension API exports.

• Adds automatic theme mode in /settings to assign separate light and dark themes that follow terminal color-scheme changes.
• Changes pi update to update only pi by default; new pi update --all updates pi and all extensions together.
• Exports generateDiffString, generateUnifiedPatch, and EditDiffResult from the public API for extensions that produce edit-style diffs.

Detection Engineering · 2026-07-11

Stratus Red Team v2.34.0 adds Azure App Service credential harvesting, a controllable logger API, and a threat-intel coverage mapping skill.

• New Azure attack technique: Retrieve App Service Publishing Credentials (azure.credential-access.app-service-publishing-credentials).
• New pkg/stratus/log package exposes a controllable logger, letting library embedders route Stratus log output through any slog.Handler (e.g., zap, logrus).
• New map-threat-intel-coverage agent skill fetches a threat-intelligence report, extracts cloud TTPs, classifies each against existing Stratus Red Team coverage, and drafts GitHub issues for gaps.

Compliance Automation & Trust Management · 2026-07-11

Vanta June 2026 adds audit commenting, MCP expansion, AIUC-1 pilot, CrowdStrike CSPM, Twilio integration, and 20 new privacy MCP tools.

• Adds threaded, @mention-enabled commenting on individual controls directly within a Vanta audit, replacing out-of-band email and Slack threads.
• Enables one-click export of the full controls table from within a Vanta audit for direct use in audit reports.
• Expands Vanta MCP connectivity to any MCP-capable tool (not just officially supported ones), with a warning banner when the redirect URL is outside Vanta-controlled origins.

AI Coding Agents · 2026-07-11

• Skill permissions: frontmatter definitions now apply to auto-approvals.
• Enterprise login policies are now enforced in the CLI.
• Adds server-level MCP tool permission options: approve all tools on a server for the current session, or permanently.

AI Coding Agents · 2026-07-10

Claude Code v2.1.206 adds smarter /cd suggestions, /doctor CLAUDE.md trimming, broader push-remote support, and faster background agent upgrades.

• Adds directory path tab-completion to /cd, matching the existing /add-dir behavior.
• New /doctor check analyzes checked-in CLAUDE.md files and proposes trimming content Claude can already derive from the codebase.
• Extends /commit-push-pr to auto-allow git push to the repo's configured remote.pushDefault (or the sole remote when only one exists), not just origin.

Firewalls & Network Defense · 2026-07-10

Cloudflare adds dynamic retry delays for Workflows, DNS Firewall dashboard settings, R2 SQL editor, and npm dependency telemetry for Workers.

• Supports dynamic delay functions in Workflows step retries — pass a function to retries.delay to calculate adaptive wait times based on the failed attempt context and thrown error (e.g., wait longer on rate-limit errors, shorter on transient network failures).
• Exposes DNS Firewall cluster settings — attack mitigation, rate limiting, negative TTL, and resolver subnet — directly in the Cloudflare dashboard (previously API-only); also adds a refreshed cluster table with resizable/hideable columns and a modernized create/edit form.
• Adds a built-in R2 SQL editor in the Cloudflare dashboard for querying R2 Data Catalog tables interactively, with syntax highlighting, autocomplete, result export, and EXPLAIN output.

AI Coding Agents · 2026-07-10

Crush v0.84.0 adds session-affinity headers for provider-side prompt caching.

• Sends x-session-affinity and x-session-id headers with every request, enabling supporting providers to pin sessions to a replica and maximize prompt cache hits.

Reconnaissance & OSINT · 2026-07-10

httpx v1.10.0 adds duplicate custom request headers, IP-aware deduplication, and automatic HTTP_PROXY env var support.

• Supports sending duplicate custom request headers in a single request (e.g., multiple X-Forwarded-For values).
• Adds IP-aware deduplication to filter results that resolve to the same IP across different hostnames.
• Automatically honors HTTP_PROXY/HTTPS_PROXY environment variables when -proxy flag is not explicitly set.

AI Coding Agents · 2026-07-10

Kiro adds hooks on agent file writes, lazy MCP OAuth, and multi-window settings sync in v1.0.116.

• New hooks trigger on agent-driven file writes, enabling automation to react to AI-generated file changes.
• Lazy MCP authentication automatically handles OAuth sign-in for MCP servers that require it, removing manual auth steps.
• Multi-window settings sync keeps configuration consistent across multiple open Kiro windows.

AI Coding Agents · 2026-07-10

Kiro MCP OAuth now supports pre-registered apps with client secrets, custom redirect URIs, and DCR bypass.

• Supports clientSecret in MCP OAuth config for servers that require a client secret (e.g., Figma).
• Enables skipping Dynamic Client Registration when a custom clientId is provided, authenticating as your own pre-registered app.
• Accepts full URLs with custom paths in the redirectUri field (e.g., http://localhost:7778/oauth/callback) to match exact registered callback URLs.

AI Coding Agents · 2026-07-10

Codex CLI v0.144.0 adds a writes approval mode, default MCP auth elicitation, Ultra concurrency warnings, and richer usage-limit credit details.

• Adds writes app-approval mode that permits declared read-only actions automatically while prompting only for write operations.
• Enables MCP tool interactive authentication by default — no experimental opt-in required.
• Adds runtime Codex authentication support for app-server hosts, with redirect to a hosted page on successful login.

AI Coding Agents · 2026-07-10

Adds a model-specific system prompt for Meta Muse Spark to improve coding agent responses.

• Adds a tailored system prompt for the Meta Muse Spark model, enabling more accurate and model-optimized responses when using that provider.

AI Coding Agents · 2026-07-10

OpenCode v1.17.17 adds a v2 free-model selector, dismissible tabs intro popup, and refreshed sub-agent task and revert-dock UI.

• Adds a v2 free-model selector with faster access to more providers in the desktop app.
• Introduces a dismissible tabs intro popup and a refreshed help entry point in the desktop UI.
• Updates sub-agent task rows to match the v2 session design, with distinct icon states for running, completed, and resting tasks.

AI Coding Agents · 2026-07-10

OpenHands 1.11.0 adds Agent Profiles, a Budgets dashboard, expanded usage monitoring, and email provider visibility.

• Adds Agent Profiles on the cloud/SaaS backend, enabling enterprise teams to define and manage reusable agent configurations.
• Introduces a Budgets dashboard and expands the Usage Dashboard with new spend and consumption metrics.
• New budgets and usage monitoring UI surfaces cost and utilization data directly in the product.

AI Coding Agents · 2026-07-10

OpenHands 1.45 adds Agent Profiles, a Budgets dashboard, expanded Usage dashboard, and email delivery status surfacing.

• New Agent Profiles support on the cloud/SaaS backend lets enterprises define and manage reusable agent configurations.
• New Budgets dashboard enables teams to set and monitor spending limits across agent usage.
• Expanded Usage Dashboard provides broader visibility into agent activity and resource consumption.

AI Coding Agents · 2026-07-10

OpenHands 1.44.0 adds repository metadata to observability traces for richer pipeline monitoring.

• Includes repository metadata (e.g., repo name, branch, commit) in observability traces, enabling richer filtering and attribution in tracing backends.

CNAPP · 2026-07-10

InsightCloudSec 26.7.7 adds new insights for Auto Scaling Groups, EBS Volumes, and Security Groups, plus CIS Red Hat OpenShift Benchmark v1.9.0.

• Adds new Insights covering Auto Scaling Groups, EBS Volumes, and Security Groups for expanded cloud misconfiguration detection.
• Supports CIS Red Hat OpenShift Container Platform Benchmark v1.9.0 for container platform compliance assessments.

Detection Engineering · 2026-07-10

20 new Sigma detection rules added, including TanStack supply-chain attack coverage, CVE-2026-41089, and NTLM hash leak via Curl.

• New rule: Detects APT malware signatures via antivirus telemetry.
• New rule: Detects remote access tool signatures via antivirus telemetry.
• New rule: Detects AppLocker 'application would have been blocked' audit events.

Container & Image Security · 2026-07-10

Snyk Container expands runtime detection to more JVM base images and adds .NET application dependency scanning.

• Detects Java runtime version across a wider range of JVM base images in container scans.
• Identifies vulnerabilities in .NET application dependencies within container images.

Identity & Access Management · 2026-07-10

SPIRE v1.15.2 adds SPIFFE Broker, PQC curve support, per-caller rate limiting, and TLS-secured Prometheus metrics.

• Adds configurable JTI claim inclusion in JWT-SVIDs at the entry level.
• Introduces experimental per-caller rate limiting for the agent Workload API and Envoy SDS.
• Adds TLS support for the Prometheus metrics endpoint using a SPIRE SVID, with an optional SPIFFE ID allowlist.

Secrets Detection & Management · 2026-07-10

TruffleHog v3.95.9 adds 7 new secret detectors and archived-repo exclusion for GitHub org scans.

• New OpenRouter detector identifies sk-or-v1- API keys and validates them against the OpenRouter API.
• New New Relic Insights Insert Key detector matches NRII- prefixed keys with live verification via the Events API.
• New Duffel Token detector for the Duffel travel API.

AI Coding Agents · 2026-07-10

Devin Desktop snapshot-20260710 adds sandbox exclusion controls, reviewable diffs, ACU usage visibility, and a plugin system for extending Devin Local.

• Adds New session in space option to the session kebab menu for quicker task-scoped session creation.
• Enables auto-reconnect for Devin Cloud sessions when network connectivity is restored.
• Supports copying images from chat via the context menu.

1Password 24 changes

• 1Password for Linux beta 8.12.30-19 (2026-07-15) · Feature · 2026-07-16
• 1Password for Mac beta 8.12.30-19 (2026-07-15) · Feature · 2026-07-16
• 1Password for Windows beta 8.12.30-19 (2026-07-15) · Feature · 2026-07-16
• 1Password in the browser 8.12.30-19 (2026-07-15) · Feature · 2026-07-16
• 1Password CLI Beta 2.38.0-beta.01 (2026-07-14) · Feature · 2026-07-16
• 1Password for Mac 8.12.28 (2026-07-14) · Feature · 2026-07-14
• 1Password for Windows 8.12.28 (2026-07-14) · Feature · 2026-07-14
• 1Password CLI 2.35.0 (2026-07-13) · Feature · 2026-07-14
• 1Password CLI Beta 2.37.0-beta.01 (2026-07-09) · Feature · 2026-07-13
• 1Password for Android beta 8.12.28-17 (2026-07-01) · Feature · 2026-07-13
• 1Password for Linux beta 8.12.28-17 (2026-07-01) · Feature · 2026-07-13
• 1Password for Mac beta 8.12.28-17 (2026-07-01) · Feature · 2026-07-13
• 1Password for Windows beta 8.12.28-17 (2026-07-01) · Feature · 2026-07-13
• 1Password for iOS beta 8.12.28-17 (2026-07-01) · Feature · 2026-07-13
• 1Password in the browser 8.12.28-17 (2026-07-01) · Feature · 2026-07-13
• 1Password for Android 8.12.26 (2026-06-30) · Feature · 2026-07-13
• 1Password for Linux 8.12.26 (2026-06-30) · Feature · 2026-07-13
• 1Password for Mac 8.12.26 (2026-06-30) · Feature · 2026-07-13
• 1Password for Windows 8.12.26 (2026-06-30) · Feature · 2026-07-13
• 1Password in the browser 8.12.26 (2026-06-30) · Feature · 2026-07-13
• 1Password for Android beta 8.12.26-35 (2026-06-23) · Feature · 2026-07-13
• 1Password for Android beta 8.12.26-31 (2026-06-18) · Feature · 2026-07-13
• 1Password for Linux beta 8.12.26-31 (2026-06-18) · Feature · 2026-07-13
• 1Password for Mac beta 8.12.26-31 (2026-06-18) · Feature · 2026-07-13

Acunetix 360 1 changes

• v26.6.1 – 16 June 2026 (2026-06-16) · Feature · 2026-07-13

Aikido Security 14 changes

• #51 - Repository Code Quality scans, Ignore Approval Inbox and Noise Reduction for Secrets & CVE’s · Feature · 2026-07-14
• #41 - Aikido MCP, re-testing AI Pentest findings, and Azure Management Group support · Feature · 2026-07-13
• #42 - Dep Upgrade Analysis, Eclipse IDE, AI Pentest Preview & Real Time Kubernetes Image Scanning · Feature · 2026-07-13
• #43 - Aikido Infinite (Continuous Pentesting), VM Reachability Diagrams & IDE full scan · Feature · 2026-07-13
• #44 - Talk to Aikido Autofix, Pentest Threat Model and support for Alibaba Cloud · Feature · 2026-07-13
• #45 - Aikido × Lovable - Vibe, Fix, Ship and Container Reachability · Feature · 2026-07-13
• #46 - Escalating your AI Pentest and Additional Context for AutoTriage · Feature · 2026-07-13
• #47 - Aikido Device Protection and Aikido AI Chat · Feature · 2026-07-13
• #48 - AI Code Audit, Aikido MCP and ServiceNow Integration · Feature · 2026-07-13
• #49 - Visualize Threat models, Device Protection for Windows and Labels on Repositories & Containers · Feature · 2026-07-13
• #50 - Agentic Dependency AutoFix, Registry Proxy and Device Protection adds Ruby and Rust · Feature · 2026-07-13
• New - Code Audit: Pentest-grade reasoning on your source code, no environment required. 🚀 · Feature · 2026-07-13
• New - Extreme Noise Reduction for Secrets and CVEs 🚀 · Feature · 2026-07-13
• New - Protect Company Devices From Supply Chain Attacks 🚀 · Feature · 2026-07-13

airgeddon 1 changes

• v12.01 · Feature · 2026-07-14

Arcjet 1 changes

• SDK releases, security briefing improvements, new activity view (2026-07-03) · Feature · 2026-07-13

Auth0 8 changes

• Dashboard Search for Roles Now in Beta (2026-07-14) · Feature · 2026-07-14
• Third-Party Apps for Organizations is now Generally Available (2026-07-10) · Feature · 2026-07-13
• Google One Tap Support for Universal Login EA (2026-07-09) · Feature · 2026-07-13
• IPSIE session_expiry Claim Support for Okta and OIDC Enterprise Connections (2026-07-08) · Feature · 2026-07-13
• Automate Downstream Provisioning with Outbound SCIM for Users via Event Streams (2026-07-01) · Feature · 2026-07-13
• Refresh Token metadata is now Generally Available (2026-06-22) · Feature · 2026-07-13
• Google Workspace Directory Sync for Groups - Early Access Updates (2026-06-17) · Feature · 2026-07-13
• Dashboard Search for APIs Now in Beta (2026-06-15) · Feature · 2026-07-13

Automox 3 changes

• Introducing Remote Tools: Remote Command & File Transfer (2026-06-29) · Feature · 2026-07-13
• Slack for Windows has moved to MSIX - how Automox supports the transition (2026-06-19) · Feature · 2026-07-13
• Target patching by real-world risk: KEV & EPSS now on Windows OS and in Advanced Patch policies (2026-06-16) · Feature · 2026-07-13

AVML 1 changes

• v0.19.0 · Feature · 2026-07-13

Axonius 1 changes

• Axonius Release Notes 9.0.2 (2026-07-09) · Feature · 2026-07-13

BeyondTrust 1 changes

• Remote Support 25.3.5 release notes (2026-06-30) · Feature · 2026-07-13

Brinqa 6 changes

• 11.33.98 · Feature · 2026-07-13
• 12.0.248 · Feature · 2026-07-13
• 12.0.321 · Feature · 2026-07-13
• 12.1.118 · Feature · 2026-07-13
• 12.1.403 · Feature · 2026-07-13
• 12.2.201 · Feature · 2026-07-13

Bugcrowd 2 changes

• Savant Vista Public Beta (1.0) (2026-07-14) · Feature · 2026-07-15
• VRT Update (1.19.1) (2026-07-08) · Feature · 2026-07-13

Burp Suite 2 changes

• Professional / Community 2026.7 (2026-07-16) · Feature · 2026-07-16
• DAST 2026.6 (2026-06-16) · Feature · 2026-07-13

Censys 5 changes

• July 13, 2026 (2026-07-13) · Feature · 2026-07-14
• July 6, 2026 (2026-07-06) · Feature · 2026-07-13
• June 29, 2026 (2026-06-29) · Feature · 2026-07-13
• June 22, 2026 (2026-06-22) · Feature · 2026-07-13
• June 15, 2026 (2026-06-16) · Feature · 2026-07-13

checksec.sh 1 changes

• 3.2.0 · Feature · 2026-07-13

CHIPSEC 2 changes

• 2.0.6 · Feature · 2026-07-13
• 2.0.5 · Feature · 2026-07-13

cilium-cli 1 changes

• v0.19.6 · Feature · 2026-07-14

Cisco Duo Desktop 1 changes

• updated · Jul 13, 2026 · Feature · 2026-07-13

Claude Code 5 changes

• v2.1.211 · Feature · 2026-07-16
• v2.1.210 · Feature · 2026-07-14
• v2.1.208 · Feature · 2026-07-14
• v2.1.207 · Feature · 2026-07-11
• v2.1.206 · Feature · 2026-07-10

Clerk 6 changes

• Choose what SAML sends as a login hint (2026-07-15) · Feature · 2026-07-16
• CLI webhooks, impersonation, and a refreshed experience (2026-07-09) · Feature · 2026-07-13
• Disable just-in-time provisioning for SAML connections (2026-07-07) · Feature · 2026-07-13
• Clerk Billing now supports account credits (2026-06-30) · Feature · 2026-07-13
• Self-serve SSO (2026-06-26) · Feature · 2026-07-13
• Customize your OAuth consent page (2026-06-22) · Feature · 2026-07-13

Cline 4 changes

• cli-v3.0.41 · Feature · 2026-07-16
• sdk/sdk/v0.0.61 · Feature · 2026-07-16
• cli-v3.0.40 · Feature · 2026-07-14
• v4.0.8 · Feature · 2026-07-11

cloud-nuke 1 changes

• v0.52.0 · Feature · 2026-07-13

Cloudflare 16 changes

• A broken DNSSEC rollover took down .al. Now 1.1.1.1 tells you when validation is bypassed (2026-07-14) · Feature · 2026-07-16
• A broken DNSSEC rollover took down .AL. Now 1.1.1.1 tells you when validation is bypassed (2026-07-14) · Feature · 2026-07-14
• WAF - WAF Release - 2026-07-14 (2026-07-14) · Feature · 2026-07-14
• WAF - WAF Release - Scheduled changes for 2026-07-20 (2026-07-14) · Feature · 2026-07-14
• Introducing Precursor: detecting agentic behavior with continuous client-side signals (2026-07-13) · Feature · 2026-07-14
• Challenges - Precursor introduces session-based bot detection (2026-07-13) · Feature · 2026-07-14
• WAF - WAF Release - Scheduled changes for 2026-07-13 (2026-07-06) · Feature · 2026-07-13
• Bots - More visibility into bot traffic with BotBase and Attribution Business Insights (2026-07-01) · Feature · 2026-07-13
• Bots - New options to manage AI traffic (2026-07-01) · Feature · 2026-07-13
• WAF - WAF Release - 2026-07-01 (2026-07-01) · Feature · 2026-07-13
• WAF - WAF Release - 2026-06-23 (2026-06-23) · Feature · 2026-07-13
• WAF - Use Cloudforce One threat intelligence in WAF rules (2026-06-15) · Feature · 2026-07-13
• WAF - WAF Release - 2026-06-15 (2026-06-15) · Feature · 2026-07-13
• Improving Smart Tiered Cache for Public Cloud Regions (2026-07-10) · Feature · 2026-07-11
• docs-20260711-dd1b6cfc · Docs · 2026-07-11
• docs-20260710-d2d7e297 · Docs · 2026-07-10

Cloudmersive 3 changes

• Cloudmersive Cloud Virus API v11-9-1 (2026-07-11) · Feature · 2026-07-13
• Cloudmersive Cloud Virus API v11-8-8 (2026-07-04) · Feature · 2026-07-13
• Cloudmersive Cloud Virus API v11-7-3 (2026-06-24) · Feature · 2026-07-13

Cloudsmith 11 changes

• Hardened images tab for configuring upstreams (2026-07-15) · Feature · 2026-07-15
• Cooldown policies now support NuGet (2026-07-07) · Feature · 2026-07-13
• Cloudsmith API keys are now detectable by GitHub secret scanning (2026-07-03) · Feature · 2026-07-13
• Speed up Python builds with PEP-658 support (2026-07-02) · Feature · 2026-07-13
• Cooldown policies now support Go (2026-07-01) · Feature · 2026-07-13
• Set up Docker Hub and DHI upstreams with Cloudsmith-managed authentication (2026-06-29) · Feature · 2026-07-13
• Enrich packages with custom metadata (2026-06-16) · Feature · 2026-07-13
• Vulnerability detection now covers ecosystem-native OSV advisories (2026-06-16) · Feature · 2026-07-13
• Manage policies as code with Terraform (2026-06-16) · Feature · 2026-07-13
• More events now trigger policy evaluations (2026-06-15) · Feature · 2026-07-13
• Create and manage connected repositories with Terraform (2026-06-15) · Feature · 2026-07-13

Cohesive VNS3 Controller 1 changes

• updated · Jul 13, 2026 · Feature · 2026-07-13

ConductorOne 5 changes

• July 10, 2026 (2026-07-10) · Feature · 2026-07-13
• Private bridge for MCP servers (2026-06-26) · Feature · 2026-07-13
• June 26, 2026 (2026-06-26) · Feature · 2026-07-13
• Ask C1AI (2026-06-24) · Feature · 2026-07-13
• Enterprise-managed authorization (2026-06-18) · Feature · 2026-07-13

CrowdStrike 1 changes

• undated-fa98e67b · Feature · 2026-07-16

Crush 2 changes

• v0.85.0 · Feature · 2026-07-16
• v0.84.0 · Feature · 2026-07-10

CubeSandbox 1 changes

• v0.5.1 · Feature · 2026-07-13

Cursor 2 changes

• Side Chats and Conversation Search · Feature · 2026-07-11
• docs-20260711-93d23ead · Docs · 2026-07-11

Cyera 20 changes

• Access Trail for Google Workspace · Feature · 2026-07-14
• Browser Shield Policy Creation · Feature · 2026-07-14
• Latest Integrations - June · Feature · 2026-07-14
• Omni DLP Memories · Feature · 2026-07-14
• Remediation Center · Feature · 2026-07-14
• AI-powered Issue Severity · Feature · 2026-07-13
• Access Trail · Feature · 2026-07-13
• Automation Center · Feature · 2026-07-13
• Browser Shield · Feature · 2026-07-13
• Cyera MCP · Feature · 2026-07-13
• Cyera Privacy · Feature · 2026-07-13
• DLP Trends · Feature · 2026-07-13
• Data Lineage for Files · Feature · 2026-07-13
• Data Retention Policies · Feature · 2026-07-13
• Exchange Online Coverage · Feature · 2026-07-13
• Identity Visibility for On-prem · Feature · 2026-07-13
• Recent Integrations · Feature · 2026-07-13
• ServiceNow ITSM Coverage · Feature · 2026-07-13
• Slack Integration · Feature · 2026-07-13
• Topic Exploration · Feature · 2026-07-13

DataDome 2 changes

• DataDome Terraform provider v2.4.0 (2026-06-30) · Feature · 2026-07-13
• iOS SDK for Apollo 4.0.0 (2026-06-30) · Feature · 2026-07-13

defectdojo 2 changes

• 3.1.101 · Feature · 2026-07-16
• 3.1.100 · Feature · 2026-07-14

Didit 1 changes

• updated · Jul 13, 2026 · Feature · 2026-07-13

DigiCert CertCentral 8 changes

• July 14, 2026 · Feature · 2026-07-14
• July 7, 2026 · Feature · 2026-07-13
• June 1, 2026 · Feature · 2026-07-13
• June 10, 2026 · Feature · 2026-07-13
• June 16, 2026 · Feature · 2026-07-13
• June 30, 2026 · Feature · 2026-07-13
• May 12, 2026 · Feature · 2026-07-13
• September 15, 2026 · Feature · 2026-07-13

DNSFilter 8 changes

• 07/15 July 15 - Identities Connections Release (2026-07-15) · Feature · 2026-07-16
• 7/14 July 14 - iOS Roaming Client v1.4.4 (2026-07-14) · Feature · 2026-07-14
• 07/14 July 14 – Web Application and API Update (2026-07-14) · Feature · 2026-07-14
• 06/30 June 30 – Web Application and API Update (2026-06-30) · Feature · 2026-07-13
• 06/24 June 24 – Web Application and API Update (2026-06-24) · Feature · 2026-07-13
• 06/23 June 23 - macOS Roaming Client v2.4.2 Production (2026-06-23) · Feature · 2026-07-13
• 06/15 June 15 – Windows Roaming Client v3.4.23 Production (2026-06-15) · Feature · 2026-07-13
• 06/15 June 15 – macOS Roaming Client v2.4.2 Beta (2026-06-15) · Feature · 2026-07-13

Docker Compose 2 changes

• v5.3.0 · Feature · 2026-07-11
• v5.2.0 · Feature · 2026-07-11

Docker Sandboxes 3 changes

• v0.35.0 · Feature · 2026-07-11
• v0.34.0 · Feature · 2026-07-11
• v0.33.0 · Feature · 2026-07-11

DOMPurify 1 changes

• 3.4.12 · Feature · 2026-07-12

Dradis 1 changes

• New in Dradis Pro v5.2 (2026-07-09) · Feature · 2026-07-13

Edgescan 15 changes

• Release Notes - 2nd July 2026 · Feature · 2026-07-14
• Introduction to Shared Credentials, Browser Recordings and MFA in Edgescan · Feature · 2026-07-13
• Release Notes - 11th Mar 2026 · Feature · 2026-07-13
• Release Notes - 14th Apr 2026 · Feature · 2026-07-13
• Release Notes - 14th Jan 2026 · Feature · 2026-07-13
• Release Notes - 14th May 2026 · Feature · 2026-07-13
• Release Notes - 15th June 2026 · Feature · 2026-07-13
• Release Notes - 16th Oct 2025 · Feature · 2026-07-13
• Release Notes - 24th Nov 2025 · Feature · 2026-07-13
• Release Notes - 28th May 2026 · Feature · 2026-07-13
• Release Notes - 29th Apr 2026 · Feature · 2026-07-13
• Release Notes - 29th Jan 2026 · Feature · 2026-07-13
• Release Notes - 30th Mar 2026 · Feature · 2026-07-13
• Release Notes - 6th Nov 2025 · Feature · 2026-07-13
• Release Notes - 8th Dec 2025 · Feature · 2026-07-13

ElcomSoft 3 changes

• Elcomsoft Phone Breaker 11.03: universal binary for Macs, SMS two-factor authentication restored (2026-07-16) · Feature · 2026-07-16
• iOS Forensic Toolkit 10.10 adds pairing-free sideloading of the extraction agent (2026-06-24) · Feature · 2026-07-13
• Elcomsoft Phone Breaker 11.2: downloads iOS 26 iCloud backups (2026-06-18) · Feature · 2026-07-13

Exabeam 2 changes

• Enhanced Threat Center Endpoint (2026-07-15) · Feature · 2026-07-16
• New Threat Center Endpoints (2026-06-16) · Feature · 2026-07-13

Fastly 16 changes

• CLI v15.4.0 (2026-07-08) · Feature · 2026-07-13
• Next-Gen WAF agent 4.80.1 (2026-07-08) · Feature · 2026-07-13
• Add Compute backend error metrics to Historical Stats and Real-Time Analytics APIs (2026-06-30) · Feature · 2026-07-13
• Add Notification Service Event Mappings API (2026-06-30) · Feature · 2026-07-13
• Add new Routing Configurations API and associated support for it in the Domains API (2026-06-30) · Feature · 2026-07-13
• Connect your Fastly account to your Next-Gen WAF corp (2026-06-30) · Feature · 2026-07-13
• New integration types for Notifications API (2026-06-30) · Feature · 2026-07-13
• CLI v15.3.0 (2026-06-26) · Feature · 2026-07-13
• Account-level requests for Fastly control panel (2026-06-25) · Feature · 2026-07-13
• Go SDK 1.8.0 (2026-06-23) · Feature · 2026-07-13
• Next-Gen WAF: Add account-level requests endpoint (2026-06-22) · Feature · 2026-07-13
• Next-Gen WAF: Added detector_scope to simulator signal responses (2026-06-22) · Feature · 2026-07-13
• Fastly Terraform Provider 9.3.0 (2026-06-17) · Feature · 2026-07-13
• Next-Gen WAF: New block_immediately threshold action (2026-06-17) · Feature · 2026-07-13
• JavaScript SDK 3.43.0 (2026-06-16) · Feature · 2026-07-13
• Rust SDK 0.13.0 (2026-06-16) · Feature · 2026-07-13

Feedly Threat Intelligence 1 changes

• Triage indicators faster with VirusTotal verdicts in Feedly (2026-07-07) · Feature · 2026-07-13

ffuf 1 changes

• v2.2.0 · Feature · 2026-07-12

Firezone 1 changes

• macOS / iOS 1.5.18 (2026-06-24) · Feature · 2026-07-13

Flashpoint 1 changes

• June 25, 2026: Introducing the Flashpoint MCP Server (2026-06-25) · Feature · 2026-07-13

Fleet 1 changes

• fleet-v4.89.0 · Feature · 2026-07-16

Gatekeeper 1 changes

• v3.23.0 · Feature · 2026-07-13

GitGuardian Detection Engine 1 changes

• Detection Engine Updates Version 2.166 (2026-06-23) · Feature · 2026-07-13

GitGuardian SaaS 3 changes

• Generic Detectors landing on your non-VCS sources, powered by the False Positive Remover (2026-07-07) · Feature · 2026-07-13
• ServiceNow Integration: Event Group Selection, Public Monitoring & Honeytoken Support (2026-06-30) · Feature · 2026-07-13
• Smart Notifiers - filter alerts, tickets, and emails by incident criteria (2026-06-19) · Feature · 2026-07-13