This Week's Highlights — issue 004, July 24, 2026
THE CYBER TOOLCHAIN
NO. 004
The best tooling updates that shipped this week.
The week in numbers · Jul 17–23
Changes per week, last 12 weeks · Jul 17–23
Changes we read in that week's dailies, including docs and API changes. A gap means no daily was published.
Every feature release from the 1309 tools on our watchlist goes into the daily newsletter. Once a week we read the whole field side by side and choose our top picks, judged on two questions: how deep and complete is the single best capability in the release, and how much it changes what you can actually do.
A tool is judged on everything it shipped that week, so a project that releases daily gets credit for the sum — and still only takes one slot. We would rather run a short list than a padded one.
Focus: What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out: Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus: New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out: Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus: Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out: Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus: API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out: Governance, SOC operations, and vendor launches with no developer surface.
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
The picks in full
Agentic AI security tool that applies proactive, attacker-first analysis directly to source code.
Capital One open-sourced VulnHunter, an agentic SAST that maps attacker paths to dangerous sinks and filters findings through a multi-stage falsification pipeline, then runs a test-driven fix loop that writes a failing security test, implements the fix, verifies the exploit is blocked, and opens a reviewable PR. A headless CI/CD runtime and batch benchmarking harness make it deployable beyond the desktop.
Capital One open-sourced VulnHunter v0.1.0, an agentic AI SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. tool built around an attacker-first scanning skill, a falsification pipeline, an automated fix-and-verify loop, and both a CI/CD-ready headless runtime and a batch-scanning harness.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
The /vulnhunt Claude Code skill is an entry-point-forward scanner that maps attacker paths to dangerous sinks and filters findings through a multi-stage falsification pipeline: Recon → Parallel Hunt → Adversarial Disprove → Capability Filter. It is run inside a Claude Code session via claude --model opus --add-dir ~/.claude/skills/vulnhunt --add-dir ~/.claude/skills/vulnhunt/phases followed by /vulnhunt.
$ claude --model opus --add-dir ~/.claude/skills/vulnhunt --add-dir ~/.claude/skills/vulnhunt/phases # Then inside the Claude Code session: /vulnhunt
The /vulnhunt-fix-verify skill is an independent, read-only agent that validates whether a finding was successfully remediated and emits a per-finding verdict. It is invoked with claude --model opus --add-dir ~/.claude/skills/vulnhunt-fix-verify --add-dir ~/.claude/skills/vulnhunt-fix-verify/phases then /vulnhunt-fix-verify repo=<abs_path> report=<abs_path> fixed=VULN-001,... out=<abs_path>.
$ claude --model opus --add-dir ~/.claude/skills/vulnhunt-fix-verify \ --add-dir ~/.claude/skills/vulnhunt-fix-verify/phases # Then inside the Claude Code session: /vulnhunt-fix-verify repo=<abs_path> report=<abs_path> fixed=VULN-001,... out=<abs_path>
The harness/ tooling manages a repo list, resumes interrupted scans, collects findings centrally, and evaluates detection accuracy against a known-vulnerable corpus using LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-judge scoring. It is run via cd harness, python -m local_harness.batch.run scan --resume, and python -m local_harness.batch.run collect.
$ cd harness python -m local_harness.batch.run scan --resume python -m local_harness.batch.run collect
The /vulnhunter-fix skill runs a test-driven remediation loop: it writes an exploit demo, creates a failing security test (RED), implements the fix (GREEN), verifies the exploit is blocked, and opens a reviewable PR.
The vulnhunter-agent/ headless runtime clones target repositories, runs /vulnhunt, publishes results, and opens GitHub issues for confirmed vulnerabilities, making it suitable for use in CI/CD pipelines.
Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface.
Noir now detects CLI application attack surfaces (argv, flags, env vars) across 17 languages, and adds schema-driven API analyzers, built-in HTTP server detection, enterprise legacy stacks (ColdFusion, Classic ASP, WebForms), and order-of-magnitude performance gains. It substantially widens what an attack-surface mapper can enumerate before a scan.
Noir v1.2.0 adds CLI application attack-surface detection and dramatically expands endpoint discovery across new stdlib HTTP servers, schema-driven CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly./backend platforms, enterprise legacy stacks, Terraform IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup., and realtime protocols, alongside a redesigned HTML report and order-of-magnitude performance gains.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds a Terraform/OpenTofu analyzer that extracts AWS API Gateway v1/v2 routes from .tf HCL and .tf.json files, resolved module-wide.
A codebase-wide performance sweep eliminates O(n²) scans, adds precompiled regex unions, and memoizes tree-sitter results, delivering order-of-magnitude speedups — e.g., F#/Giraffe scanning dropped from 31.7s to 1.1s, and Servant from 101s to 4ms.
The -f html report format is redesigned with a dark-tech theme, semantic method/severity colors, path grouping, a table view, and copy URL/curl actions.
Noir now detects CLI application attack surfacesattack surfacesThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. — argv arguments, flags, and environment variables — across 17 languages and 40+ CLI libraries, including Cobra, Click, clap, Commander, Thor, and picocli.
Adds machine-readable output for noir list and documents the noir cache purge subcommand.
Adds analyzers for core/stdlib HTTP servers: Go's net/http, Python's http.server, Node's node:http, Java's com.sun.net.httpserver, C#'s HttpListener, Ruby's WEBrick, plus Crystal, Dart, and Zig.
Adds analyzers for Strapi, Directus, Payload CMS, Supabase/PostgREST, Hasura, and Appwrite that extract routes and params from schema files rather than source-code routes.
Adds analyzers for WordPress (REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., admin-ajax, admin-post), Drupal (*.routing.yml), and Magento (Web API + MVC controller routes).
Adds support for CFML/ColdFusion, Classic ASP, and ASP.NET WebForms, plus CFML frameworks Taffy, ColdBox, Wheels, and FW/1.
Adds specification analyzers for OpenRPC and .http/.rest request files used by VS Code REST Client and JetBrains HTTP Client.
Adds detection for realtime/event endpoints in SignalR, Socket.IO, Phoenix Channels, and Action Cable.
Adds BEAM language support for Erlang (Cowboy, Elli) and Gleam (Wisp).
Adds Claude Sonnet 5, Grok 4.5, and GPT-5.6 to the AI provider token map.
Adds framework analyzers for Django Ninja (Python) and Plumber (R).
Pomerium is an identity-aware proxy that provides secure, clientless access to internal applications by enforcing context-based authentication and authorization policies.
Pomerium Enterprise adds SSH session recording that captures every keystroke and terminal output for privileged connections, stored in portable asciicast format on any S3-compatible bucket with a Console playback UI. Native SSH also gains OAuth Authorization Code login, reverse tunnels, and jump-host mode, plus a revoke and block incident-response option.
Pomerium's biggest window pairs enterprise SSH session recording with a major native-SSH overhaul — a switch to OAuth Authorization Code auth, reverse tunnels, jump-host mode and a routes portal — alongside deeper upstream OAuth support for the MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway, a new hosted identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems., stronger session revocation, and Databroker/DNS performance work.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
The ssh_upstream_tunnel flag lets upstream SSH servers dial out to Pomerium, useful for edge devices, NAT'd networks, and isolated environments, and Pomerium policy now supports these upstream SSH tunnels. The ssh_allow_direct_tcpip flag enables jump-host (ProxyJump) mode so clients can tunnel through Pomerium to an upstream without the upstream trusting Pomerium's User CA. The ssh_routes_portal flag presents an interactive picker of authorized destinations when a client SSHes to Pomerium without specifying a route.
ssh_upstream_tunnel: true
ssh_allow_direct_tcpip: true
ssh_routes_portal: true
Enterprise now captures every keystroke and terminal output for privileged SSH connections and replays it directly from the Console. Recordings can be stored on a local on-disk directory or any S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. bucket, configured per cluster, with a blob-URI builder in the Console (supporting Go CDK driver options and advanced parameters) so admins don't hand-write connection strings. A new Recordings UI lets teams browse, sort, and filter sessions by route, SSH user, target host, duration, and size, and recordings are stored in the open, portable asciinema (.asciicast) format.
Pomerium discovers upstream OAuth metadata, completes authorization flows, caches client and token state, and injects upstream access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. into MCP traffic, using SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly.-safe metadata fetching with path-prefix validation. It includes the iss parameter in authorization flows (returning Pomerium's host as issuer, aligning with the 2026-07-28 MCP spec) and enables auto-discovery for MCP connect, disconnect, and authorize endpoints. Dynamic Client Registration via client ID metadata documents acts as a fallback for tools like MCP Inspector that lack that support, and OAuth refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. keep long-running AI agents and clients connected without repeated interactive logins. Also adds proactive upstream token refresh before forcing reauthentication, upstream auth recovery after late config delivery, clearer errors when upstream tokens can't be resolved, customizable MCP 401 error pages, an optional allowed-client-domains setting, and a proper WWW-Authenticate header on unauthorized responses; the routes portal now shows server indicators and connect/disconnect controls for MCP routes.
Enterprise session revocation gains a Revoke and block future authentication option that prevents SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. re-authentication loops after revocation, enforced via a deny/revocation list so blocked users are rejected on all subsequent requests, not just the current session.
Introduces Databroker indexing and query support, including field-based record lookup, a new GetOptions API, additional filter operators, and order-by. Replaces the in-memory store with Pebble, aligning it with the persistent backend and setting a default path for the file backend. Sync gains a latest stream option and safely aborts calls with invalid record versions, improving resilience for large deployments.
Native SSH auth now uses the OAuth Authorization Code grant instead of Device Code, giving a faster browser login with full telemetry observability. This is breaking: upstream IdPs must have the Authorization Code grant enabled, since v0.31.x and earlier relied on Device Code, which is no longer used.
A new hosted identity provider type lets Pomerium manage authentication without teams configuring an external OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. provider. Built-in refresh handling authenticates session refresh requests and correctly hashes the derived IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configuration for clean session renewal.
Introduces a new pkg/mcp/configapi library that exposes Pomerium's ConfigService as MCP tools, with generated schemas, sensitive-field handling, and update-safety checks.
Supports specifying custom DNS servers for resolving upstream routes, independent of the host system's resolver, and enables tunable DNS refresh rates so record changes are picked up on a schedule matching the environment, giving consistent, centrally configured name resolution across all Pomerium components for dynamic and clustered deployments.
Adds per-key session management and revocation in the Pomerium UI, binding each SSH key to an OAuth user with policy evaluated on every connection.
Adds incremental config diffing for routes — only changed routes are recomputed and applied, reducing churn on large route sets.
- !SSH authentication now uses the Authorization Code grant; upstream IdPs must have the Authorization Code grant enabled (v0.31.x and earlier used Device Code, which is no longer used).
A vulnerability scanner for container images and filesystems
Grype adds Go symbol-based reachability analysis that suppresses false positives by flagging only binaries that actually import the vulnerable symbol, cutting noise on stdlib and third-party Go advisories. It also adds Ubuntu ESM matching and a Chainguard OSV transformer.
Grype v0.116.0 adds Go symbol-based reachability analysis to cut false positives, plus broader distro coverage with Ubuntu ESM matching, a Chainguard OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. transformer, and more complete RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. advisory duplication.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds lightweight Go symbol reachability analysis to suppress false positives for stdlib, golang.org/x, and third-party Go vulnerability advisories — it only flags binaries that actually import the vulnerable symbols.
Deduplicates Go matches that are aliases of each other, i.e. the same CVE reported under both a govulndb GO-* ID and its corresponding GHSA.
Duplicates RHSA advisories across all applicable RHEL minor versions for more complete RHEL vulnerability coverage.
Adds a Chainguard OSV transformer for processing Chainguard vulnerability data.
Adds support for matching vulnerabilities against Ubuntu ESM (Extended Security Maintenance) data.
Wiz Defend is a cloud detection and response platform that identifies and helps remediate real-time threats across cloud environments.
Wiz Agentless Workload Detection now delivers EDR-like visibility into FortiGate appliances, Redis replication abuse, and npm supply-chain compromises by parsing local logs never streamed off the box, and ships detections for actively exploited CVEs including BeyondTrust CVE-2026-1731 and PAN-OS flaws.
Wiz Defend extends Agentless Workload Detection with new visibility into FortiGate firewalls, Redis, npm supply chain activity, and web server access logs, plus fresh detection rules for several actively exploited CVEs.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Extends Agentless Workload Detection to FortiGate appliances by collecting and parsing local FortiOS logs not typically streamed, exposing attacker activity such as super-user account creation and configuration theft. Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. customers.
Adds built-in threat detection rules for Redis replication abuse: Redis suspicious replication target configured, Redis module loaded from unusual path, and Attack Detected and Prevented by Redis.
Provides agentless visibility into HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. access logs (Nginx, Apache, IIS) to detect webshell deployments, unusual executable access, and exploitation of hosted applications such as WordPress via the wp2shell webshell.
Adds detection for PAN-OS CVE-2026-0257 and CVE-2026-0300 exploitation patterns, BeyondTrust Remote Support CVE-2026-1731 (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 9.9 pre-auth RCERCERemote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives.), and MongoBleed CVE-2025-14847, an unauthenticated MongoDB memory leak, each observed in active exploitation and surfaced via agentless log ingestion with real-time alerting.
Enables agentless monitoring of npm package installation logs to detect supply chain compromises, such as malicious versions of @asyncapi/specs, in real time.
Correlates Agentless Workload events with Wiz ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. findings to surface threats like Zabbix instances running from unusual paths with default credentials.
Where each pick stands · Jul 17–23
Tools with changes in each pick's category over the last 12 weeks, including the pick itself.
Each pick's release rhythm · Jul 17–23
Changes per week for the last 12 weeks. The bright bar is this week; a dash marks a week with no daily.
Which categories moved · Jul 17–23
The thick bar is this week. The thin bar is the average of the four weeks before, counting only weeks with a daily.
Who shipped the most · Jul 17–23
Changes per tool this week. Volume is not a quality score.