The week in full · Jul 17–23

Identity & Access Management · 2026-07-23

Auth0 adds Anonymous Sessions beta and self-service SSO third-party access delegation for customer admins.

• New Anonymous Sessions (beta, paid plans): create and manage stateless sessions for unauthenticated users via a new POST /anonymous/token endpoint supporting guest checkout, cart persistence, and pre-login personalization.
• Anonymous sessions can be linked to authenticated users through pre-registration and post-login actions, preserving cross-device activity on the authenticated profile.
• Anonymous session length is now configurable as a tenant-level setting, and anonymous session support can be enabled per Application and API.

AI/LLM Security · 2026-07-23

Backslash adds a Block MCP action to control MCP activity.

• New Block MCP action enables practitioners to block MCP (Model Context Protocol) actions within Backslash.

AI/LLM Security · 2026-07-23

Backslash adds support for Claude Code.

• Adds integration support for Claude Code.

AI/LLM Security · 2026-07-23

Backslash adds PR event notifications to alert teams of security findings at pull request time.

• New PR event notifications surface security findings directly within pull request activity.

AI/LLM Security · 2026-07-23

Backslash now removes PR comments automatically after scans come back clean.

• Automatically removes previously posted PR comments when a subsequent scan returns no findings, keeping pull requests free of stale security noise.

AI/LLM Security · 2026-07-23

Backslash now surfaces selected repositories at the top of the repo list for faster navigation.

• Selected repositories are now pinned to the top of the repository list for quick access.

Web Application Security · 2026-07-23

Burp Suite 2026.7.1 introduces Burp AT, an agentic AI-driven testing capability for Burp Suite Professional.

• Adds Burp AT, an agentic AI-driven capability that autonomously pursues security testing goals using Burp Suite's own tools.

Web Application Security · 2026-07-23

c/side adds a Cmd+K command palette for keyboard-first navigation across domains, features, and settings.

• New Cmd+K command palette enables instant keyboard-driven search and navigation to any domain, feature, or setting in the dashboard.

Web Application Security · 2026-07-23

c/side's Fingerprint Dashboard is now GA — monitor device fingerprints and filter AI agent traffic from a single view.

• Adds generally available Fingerprint Dashboard for monitoring device fingerprints across all traffic.
• Enables filtering by AI agent signals to distinguish automated visitors from real users.
• Provides unified single-view management of fingerprint data, billed within existing c/side subscriptions.

Web Application Security · 2026-07-23

c/side adds JA4 TLS fingerprinting to detect VPN clients masquerading as browsers

• Adds per-connection JA3/JA4 TLS fingerprinting using the full ClientHello (cipher suites, extensions, ALPN, elliptic curves) to detect VPN client software impersonating web browsers.

Web Application Security · 2026-07-23

c/side adds Linear and Jira integrations to automatically create issues from security alerts.

• New Notifications Engine lets you configure which alerts route to which destinations, giving granular control over alert delivery.
• Integrates with Linear to automatically create issues from c/side alerts (Business and Enterprise plans).
• Integrates with Jira to automatically create issues from c/side alerts (Business and Enterprise plans).

Web Application Security · 2026-07-23

c/side adds use-case-guided onboarding for PCI compliance, fraud prevention, AI agent detection, and device fingerprinting.

• New guided setup flow tailors onboarding steps to the team's specific goal — PCI compliance, fraud prevention, AI agent detection, or device fingerprinting — replacing the generic checklist.

Web Application Security · 2026-07-23

c/side adds ad injection detection, flagging client-side scripts that trigger 5+ redirects or suspicious iframe behavior.

• New detections identify ad injection via client-side scripts, including iframe data population and URL resolution.
• Alerts customers when scripts exhibit suspicious redirect behavior (5 or more redirects).

Web Application Security · 2026-07-23

c/side enterprise adds self-service SSO setup for Okta, Microsoft Entra ID, and Duo Security.

• Supports self-service SSO configuration for Okta, Microsoft Entra ID, and Duo Security directly in the cside dashboard — no support ticket required.

Web Application Security · 2026-07-23

c/side now automatically detects bots that spoof browser automation properties to appear as legitimate users.

• Detects bots that spoof browser automation properties to evade fingerprinting, surfacing the signal in fingerprint data.

Identity & Access Management · 2026-07-23

Castle adds Proof-of-Personhood and Payment authentication method types for richer signal classification.

• Adds Proof-of-Personhood (pop) authentication method type for events verified through PoP providers (e.g., Worldcoin, Humanode, etc.).
• Adds Payment authentication method type for events tied to a payment method or provider (e.g., card, bank, wallet variants).

Identity & Access Management · 2026-07-23

Castle Lists can now be exported to CSV, with background processing and email delivery for large datasets.

• Adds CSV export for List entries — click Export in the list toolbar to download; large lists run in the background and deliver a link via email.

Identity & Access Management · 2026-07-23

Castle adds dark mode with automatic system-preference detection and manual Light/Dark/System override.

• Adds dark mode support: the interface automatically adapts to the system color scheme, with a manual Light/Dark/System override available in the user menu.

Identity & Access Management · 2026-07-23

Castle adds a Fraudulent Email Domain signal to detect domains registered specifically for fraud and bot signups.

• New Fraudulent Email Domain signal detects email domains confirmed as actively used in fraud and abuse campaigns, distinct from disposable email services like Mailinator or TempMail.

Identity & Access Management · 2026-07-23

Castle iOS SDK 4.0.0 adds expanded device signals and SDK protection in a major update.

• Collects additional device signals for broader fraud and bot detection coverage.
• Adds SDK protection capabilities.

Identity & Access Management · 2026-07-23

Castle now supports multiple API keys per account, enabling zero-downtime key rotation and per-integration secrets on Enterprise plans.

• Create multiple Publishable API Keys and API Secrets within a single Castle account.
• Rotate or revoke individual keys without disrupting other active integrations.
• Label each key by purpose (e.g., Production Web, Mobile iOS) for clear per-integration tracking.

Identity & Access Management · 2026-07-23

Castle adds phone call detection to catch social engineering attacks during login and transactions.

• Detects when a user is on a phone call during sensitive actions (e.g., login, transactions) to identify potential social engineering attacks.
• Exposes three new fields for phone call state in Castle events.

Identity & Access Management · 2026-07-23

Castle lets you choose which API Secret signs each webhook, enabling independent secret rotation per integration.

• Enables per-webhook API Secret selection for signing, so integrations can be isolated and secrets rotated independently (Enterprise plans).

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Duo Desktop adds Microsoft Defender for Endpoint detection on Linux, Ubuntu 26.04 LTS support, and user-level preferences persistence on macOS.

• Adds detection for Microsoft Defender for Endpoint on Linux (v4.6.0).
• Supports Ubuntu 26.04 LTS on Linux (v4.6.0).
• Adds a configuration option to restrict the app's interaction to certain account keys on Linux (v4.5.0).

Integrated & IT Risk Management · 2026-07-23

CISO Assistant v3.20.2 adds full GDPR processing register export/import and CyFun 2025 Excel import support.

• Adds full export/import support for GDPR processing records, enabling backup and migration of processing register data.
• Supports importing CyFun 2025 assessments via Excel, extending the list of supported frameworks for ingestion.

AI Coding Agents · 2026-07-23

Claude Code v2.1.218 runs /code-review as a background subagent, adds MCP error details, and expands auto-mode intelligence.

• Runs /code-review as a background subagent so review output no longer floods the conversation and stacked slash commands stay on target.
• Adds HTTP status codes and error text to claude mcp list and /mcp when a server fails to connect, plus a warning for MCP config values with hidden leading or trailing whitespace.
• Adds screen-reader announcements of deleted text for word and line deletions (Option+Delete, Ctrl+W, Cmd+Backspace, Ctrl+U, Ctrl+K) in --ax-screen-reader mode.

Identity & Access Management · 2026-07-23

Clerk launches a remote MCP server giving AI agents like Claude, Cursor, and Copilot access to up-to-date SDK snippets and auth patterns.

• New remote Model Context Protocol (MCP) server at https://mcp.clerk.com/mcp lets AI coding agents access Clerk SDK snippets and implementation patterns.
• New clerk mcp install CLI command auto-detects and registers the MCP server across Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Codex, opencode, OpenClaw, Warp, and Hermes Agent.
• New clerk mcp list and clerk mcp uninstall commands manage registered MCP entries; clerk doctor verifies server reachability.

Identity & Access Management · 2026-07-23

Clerk CLI gains clerk mcp commands to connect AI coding clients to Clerk's MCP server for live SDK snippets.

• New clerk mcp install command registers Clerk's MCP server with AI clients detected on the machine (Claude Code, Cursor, VS Code), serving up-to-date Clerk SDK snippets and implementation patterns.
• New clerk mcp list command shows which AI clients have Clerk's MCP server registered.
• New clerk mcp uninstall command removes Clerk's MCP server registration from detected AI clients.

Identity & Access Management · 2026-07-23

Clerk lets you configure default OAuth scopes for dynamic client registration.

• Enables configuration of default OAuth scopes for dynamic client registration (DCR).

Identity & Access Management · 2026-07-23

Clerk MCP server now installs into 10 AI clients with a single command — no manual config required.

• New clerk mcp install command registers the Clerk MCP server across 10 AI clients (including Claude Code, Cursor, and VS Code) via a built-in bridge with zero manual configuration.

Web Application Security · 2026-07-23

Cloudflare adds Agents SDK MCP controls, Code Mode direct APIs, Devin Outposts sandboxes, and new WAF rules for Next.js/ColdFusion/WordPress CVEs.

• Adds includeMcpTools option to @cloudflare/think to opt out of Think's automatic MCP tool exposure when tools are managed externally (e.g., via Code Mode).
• Agents SDK MCP clients now reuse converted input/output schemas across model turns within a live connection, eliminating redundant JSON Schema-to-Zod conversions.
• Adds execute(), search(), and describe() methods to the @cloudflare/codemode durable runtime handle, enabling MCP servers and non-AI-SDK hosts to invoke Code Mode directly.

SAST / SCA / Code Security · 2026-07-23

Cloudsmith cooldown policies now extend to Maven packages for supply-chain protection.

• Supports cooldown policies for Maven packages, blocking newly published versions from being consumed until a configured delay period has elapsed.

SAST / SCA / Code Security · 2026-07-23

Codacy adds GolangCI-Lint as a supported static analysis tool for Go repositories.

• Adds GolangCI-Lint as a supported code analysis tool, enabling automated linting for Go projects within Codacy.

General Utilities & Libraries · 2026-07-23

VS Code enterprise policies gain MCP server allowlist/denylist controls and Copilot Chat OpenTelemetry export settings.

• Adds ChatAllowedMcpServers policy to allowlist which Model Context Protocol servers can be installed or run.
• Adds ChatDeniedMcpServers policy to denylist MCP servers that must be blocked, with deny rules taking precedence over the allow list.
• Adds OpenTelemetry export configuration policies for Copilot Chat, including github.copilot.chat.otel.enabled, exporterType, otlpEndpoint, protocol, serviceName, resourceAttributes, headers, captureContent, and outfile.

General Utilities & Libraries · 2026-07-23

VS Code 1.130: agent sessions in dedicated processes, assisted tool approvals, multi-file diff review, and Git diff file opening.

• Runs agent sessions in a dedicated process for improved isolation and stability.
• Reduces approval interruptions with assisted tool approvals in agent workflows.
• Enables faster multi-file change review directly in the Agents window.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Conveyor Trust Center can now auto-generate signed, dated bridge letters on demand via Smart Documents.

• Adds Smart Documents: admins create a template with a date placeholder and Conveyor auto-generates a fresh, signed, and dated bridge letter each time a visitor downloads it.
• Supports folder organization, access controls, and other existing document settings for Smart Documents.
• Built-in preview lets admins verify the generated output before making a Smart Document live.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Conveyor Trust Center now integrates with Ironclad to auto-approve access and sync signed NDAs based on contract records.

• New Ironclad integration: auto-approve Trust Center access requests when a requester's email or domain matches an existing Ironclad contract record.
• Enables automatic NDA gate bypass for counterparties with a signed NDA already on file in Ironclad.
• Writes signed clickwrap NDAs back to Ironclad as new records with the PDF attached, keeping contract history in sync.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Conveyor Trust Center now supports draft mode — stage layout changes privately and publish when ready.

• Adds draft mode for Trust Center: stage layout and content changes privately, preview with a shareable link, and publish without touching the live site.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Conveyor's v2 questionnaires API now supports assigning questions and writing/updating answers in bulk.

• Assigns questions to individual users or teams via the v2 questionnaires API, individually or in bulk.
• Writes and updates questionnaire answers through a new API endpoint, with full edit history preserved.
• Exposes questionnaire assignment and answer-writing through the MCP interface for AI agent workflows (e.g., Claude).

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Conveyor adds Topic Preferences so admins can set per-topic guardrails controlling how ConveyorAI answers sensitive questions.

• New Topic Preferences feature lets Knowledge Editors, Admins, and Superadmins define per-topic guardrails for ConveyorAI, with actions such as answering verbatim, using specified sources, or flagging whenever a topic surfaces.
• Richer downvote feedback is now available on any ConveyorAI answer, independent of Topic Preferences, enabling more granular quality signals.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Conveyor can now automatically return completed questionnaires to the source system when they meet configurable criteria.

• Adds auto-return for Intake questionnaires: set criteria such as minimum answered rate or no flagged/unanswered questions, and Conveyor returns the questionnaire to the source system without manual review.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Conveyor's AI Connector brings your trust knowledge base into Claude, ChatGPT, Gemini, and any MCP-compatible assistant.

• New AI Connector integrates Conveyor with Claude, ChatGPT, Gemini, and any MCP-compatible AI assistant via a custom connector endpoint.
• Enables sales and trust teams to query approved security answers, pull analytics, and update knowledge in plain language directly from their AI tool.
• Preserves per-user Conveyor permissions through OAuth, so the AI assistant only surfaces data each user is already authorized to see.

Security Data Pipeline · 2026-07-23

Cribl introduces Apps: a sandboxed iframe-based framework letting customers build custom UIs and workflows directly on the Cribl platform.

• Introduces Apps, a new sandboxed application framework that lets customers build and run custom UIs and workflows on the Cribl platform without requiring internal platform privileges.
• Provides built-in managed backend primitives — including state persistence and secure API proxies — so custom apps need no separate backend infrastructure.
• Enforces a strict trust boundary: Apps interact with the Cribl platform only through existing public APIs, never with internal auth tokens or API keys.

Security Data Pipeline · 2026-07-23

Cribl 4.19 adds an app framework, embedded MCP server, multi-region Workspaces, and new Snowflake/BigQuery/Bedrock destinations.

• New app framework lets teams build and install custom UIs, dashboards, and workflow shortcuts directly inside Cribl using Cribl APIs and AI-assisted tools like Cursor, importable via files, URLs, or Git repos.
• Cribl-managed MCP server is now embedded in the Cribl Leader as a first-class platform feature, enabling MCP-compatible AI tools and agents to connect using existing auth and access controls — no separate Docker deployment required.
• Cribl Insights now supports monitoring, metrics, and alerting for non-main Workspaces (dev, test, and production environments), not just the main Workspace.

Attack Surface & Exposure Management · 2026-07-23

Falcon Exposure Management adds KEV-native prioritization, automated exploit detection, attack path analysis, and an AI Exposure Analyst Agent for BOD 26-04 compliance.

• Adds continuous 24/7 discovery and risk scoring of internet-facing assets, shadow IT, and cloud workloads via external attack surface management (EASM).
• Integrates the CISA KEV catalog natively with endpoint telemetry, automatically flagging affected hosts with remediation guidance and zero-config KEV visibility.
• Adds Network Vulnerability Assessment (NVA) leveraging existing Falcon sensors to assess unmanaged devices without dedicated scanning appliances.

AI Coding Agents · 2026-07-23

Cursor Router brings intelligent per-request model routing to Auto mode with Cost/Balance/Intelligence optimization modes and admin controls.

• Introduces Cursor Router: an intelligent model router that classifies each request by task type and complexity and dispatches it to the appropriate model automatically.
• Adds three optimization modes under Auto — Cost, Balance, and Intelligence — letting users trade off token spend against model capability on a per-session basis.
• Adds admin controls to enable Cursor Router per team or group, restrict which optimization modes members can use, set the default mode, and maintain model allow/block lists.

AI/LLM Security · 2026-07-23

Daytona adds docs search, Git clone support, and improved API 400 error handling.

• Adds documentation search capability.
• Adds Git clone support.
• Adds API 400 error responses for improved developer feedback.

AI/LLM Security · 2026-07-23

Daytona introduces SDK simplification and per-sandbox resource limits for finer workload control.

• Simplifies the SDK surface to reduce integration complexity.
• Adds per-sandbox resource limits enabling granular CPU/memory control per sandbox.

AI/LLM Security · 2026-07-23

Daytona adds sandbox forking via SDK and organization-level metrics.

• Adds sandbox forking capability accessible through the SDK.
• Introduces organization-level metrics for monitoring sandbox usage.

SAST / SCA / Code Security · 2026-07-23

DeepSource adds MCP Server, BYOK inference, Kubernetes Gateway API, monorepo SCA, and expanded AI Review language support.

• Adds DeepSource MCP Server exposing 30 tools across 8 categories so AI coding agents can access code review results, vulnerability data, and repository metrics via the Model Context Protocol.
• Supports Bring Your Own Key (BYOK) model provider credentials for Enterprise Server AI Review, routing inference directly to Azure OpenAI or GCP Vertex AI without passing through DeepSource Cloud.
• Expands AI Review to ten additional programming languages that lack a DeepSource static analyzer.

Endpoint Security (EDR/XDR) · 2026-07-23

Devicie introduces App Protection Policies, now live for all users.

• Adds App Protection Policies, enabling enforcement of data protection rules on managed and unmanaged apps.

Endpoint Security (EDR/XDR) · 2026-07-23

Devicie adds an in-portal bespoke app request form for streamlined custom app submissions.

• New in-portal Bespoke App Request Form lets users submit custom app requests directly within the Devicie portal.

Endpoint Security (EDR/XDR) · 2026-07-23

Devicie adds CIS 4.0 Reporting support for up-to-date benchmark compliance visibility.

• Supports CIS Benchmark 4.0 as a reporting framework for compliance assessments.

Endpoint Security (EDR/XDR) · 2026-07-23

Devicie adds a direct deep link from Device Spotlight to the corresponding device record in Microsoft Intune.

• Adds a deep link from Device Spotlight to the corresponding Microsoft Intune device record, enabling one-click pivoting into Intune for deeper investigation.

Endpoint Security (EDR/XDR) · 2026-07-23

Devicie adds multi-account login so practitioners can switch between accounts without signing out.

• Supports simultaneous login to multiple Devicie accounts with fast switching between them.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

DNSFilter macOS Roaming Client v2.4.4 Beta adds live local domain and resolver sync without daemon restarts.

• Enables live sync of local domain and resolver configuration changes from the dashboard without requiring a daemon restart.

Container & Image Security · 2026-07-23

DockerScan v2.1.0 overhauls CVE detection with MITRE cvelistV5 (~125K CVEs), dpkg-accurate version matching, and optional NVD CVSS enrichment.

• Switches CVE database source to MITRE cvelistV5 daily snapshots, eliminating NVD API keys and rate limits while growing coverage from ~1,500 to ~125,000 CVEs.
• Rewrites package-to-CVE matching with a dpkg-style version comparator (Debian Policy 5.6.12) and per-(vendor, product) version ranges for accurate results.
• Adds vendor_verified metadata to findings, distinguishing vendor-confirmed matches from heuristic name-only matches (which now include explicit remediation caveats).

AI-Powered Offensive Security · 2026-07-23

Dreadnode AIRT Report Builder goes GA with templates, DOCX export, new AI red-teaming skills, and a major CLI overhaul.

• AIRT Report Builder is now generally available for all users, with saved templates (load/save/rename/delete), custom branding (logo, company name, title, confidentiality footer), DOCX export, and a live structural preview panel.
• New trace-analysis advisor skill surfaces attack-effectiveness analysis, transform recommendations, and vulnerability pattern identification from historical run data directly inside the agent.
• New GuardSessionPolicy gates every agent tool call through an LLM judge before execution, with a built-in safety rubric and optional custom rules.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds ATLAS multi-agent attack framework, 170 multimodal red-team transforms, LiteLLM on-prem inference, E2B sandbox, and a full slash-command/@ palette in web chat.

• Adds ATLAS multi-agent attack framework (dreadnode.airt.atlas) running campaigns across eight attack modes using a MDP+Hedge router, with tool calls captured per-trial and surfaced in findings across the UI, API, and SDK.
• Ships 130+ image, audio, and video perturbations for red teaming vision/audio/video models, covering ImageNet-C corruptions, AugLy augmentations, SpecAugment, FigStep, and DolphinAttack techniques.
• Exposes 131 multimodal transforms in the AI red-teaming TUI (up from 26), including 57 image, 52 audio, and 22 video transforms.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds web chat for project runtimes, persistent web-security agent memory, and a refreshed analytics UX.

• Adds empty states, a stats summary strip, loading skeletons, inline error banners, schema column insertion, and example query chips to the analytics query and notebook pages.
• Enables the web-security agent to persist reconnaissance findings, gadgets, leads, defense bypasses, and discoveries across sessions using structured project memory.
• Allows revealed images in tool results and logged outputs to be re-hidden, freeing the decoded blob from memory.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds Android APK static analysis, Jira/GitHub issue-tracker connectors, artifact logging, and admin model controls for web-security agents.

• Adds android-apk-research capability bundle: a 10-tool MCP server with four skills for static semantic vulnerability research on Android APKs.
• Adds Jira Cloud MCP connector for web-security agents to export validated findings directly as remediation tickets.
• Adds GitHub MCP connector for web-security agents to file findings as GitHub issues and post follow-up comments from within the agent workflow.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds cross-platform binary analysis, Android APK research, AEM/Sling web testing, and bulk evaluation log downloads.

• New binary-analysis capability supports PE, ELF, and Mach-O formats with an expanded Ghidra MCP server and a consolidated 8-phase analysis skill.
• New android-apk-research capability ships a 10-tool MCP server and four skills for static semantic vulnerability research on Android APKs.
• Automated web-security testing now covers Adobe Experience Manager and Apache Sling, surfacing selector-abuse, dispatcher-bypass, and XSS weaknesses.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds Claude Code engine, Task Sets, per-role environment model selection, eval sample search, and two new offensive security skills.

• Adds pluggable agent execution engines with Claude Code as the first built-in option, running Claude's agentic loop as a governed, session-backed agent with full trace viewer support.
• Introduces Task Sets — named, versioned collections of tasks runnable as a single evaluation target via the API, dn task-set CLI commands, or the Environments UI.
• Enables user-controlled task-environment models: choose which model each environment role uses via --env-model role=id (CLI), model_overrides in evaluation.yaml, or the API, independently of solver and judge models.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds compound eval verification, agentic outcome judging, 6 new web pentesting skills, and expanded AIRT goal categories.

• New script_and_judge and flag_and_judge verification methods chain a mechanical check (script or flag) with an LLM judge to close reward-hacking gaps in eval tasks — no custom rubric required.
• New outcome_judge verification method lets eval tasks use an agentic LLM to inspect agent trajectories and emit pass/fail verdicts, exposed via the new dn outcome-judge run CLI subcommand.
• New opt-in intent_plus_outputs_summary guard strategy replaces raw tool outputs with LLM-generated summaries in judge prompts, reducing prompt-injection surface while preserving tool-call context.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds end-to-end multimodal AI red teaming, custom HTTP targets, Task Sets, and a SecurityContext MCP server.

• New multimodal AI red teaming: probe LLMs with text, image, audio, and video inputs; apply per-modality transforms; score with the new multimodal_judge scorer; view full message parts inline in findings, traces, and parquet exports (schema v3 with base64 media columns).
• Cross-product prompt_matrix mode runs N prompts × M media items = N×M trials for systematic multimodal attack coverage.
• Nova Sonic speech-to-speech target support added to the TUI capability picker and build_target SDK factory.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds free-text search in evaluation trajectories, session rewind, cross-org share links, and sandbox dependency auto-install.

• Adds free-text search in hosted evaluation trajectories — matches are highlighted inline and tool calls auto-expand when their content matches the search term.
• Adds session rewind via /rewind or double-Esc in the TUI, rolling back a conversation to any prior user message while preserving full session history.
• Enables cross-org capability share links so Capability Hub links automatically redirect recipients to the correct page regardless of their org slug.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds media playback in session views, ASM capability, HTTP/2 WAF bypass, GraphQL pentesting, and a sandbox runtime hierarchy.

• Adds inline display of agent-captured images, audio, and video in session transcripts and trace details, with an explicit Show media click to prevent auto-decoding of hostile artifacts.
• New attack surface management capability combining BBOT scanning, Shodan enrichment, Neo4j graph analysis, screenshot triage, and a multi-agent ASM pipeline.
• New h2-waf-bypass skill covering 6 HTTP/2 WAF bypass classes: delayed DATA frame timing, body size truncation, Extended CONNECT, ForwardAuth body stripping, path normalization, and JSON content-type gaps.

AI-Powered Offensive Security · 2026-07-23

Dreadnode adds ProjectMemory, inline media in transcripts, new DoS/path-traversal/EXIF skills, and a unified LiteLLM admin proxy.

• Adds ProjectMemory tools so agents can persist and retrieve durable project-scoped memory across runs.
• Screenshots and media logged via dn.log_output() inside tools now render inline in the session transcript next to the producing tool call.
• New unified LiteLLM admin proxy lets admins manage model deployments and credentials directly from the platform; platform models are now always org-allowlist-scoped.

Digital Forensics & Incident Response · 2026-07-23

Elcomsoft Phone Breaker 11.03 adds universal binary for macOS and restores SMS-based iCloud two-factor authentication.

• Ships as a universal binary for macOS, running natively on both Apple Silicon and Intel Macs.

Firewalls & Network Defense · 2026-07-23

Fastly Terraform Provider 9.4.0 exposes computed certificate_id on TLS subscriptions and enriches API error messages with subscription context.

• Exposes computed certificate_id on fastly_tls_subscription_validation, enabling issuance-dependent resources to be chained in a single terraform apply.
• Includes subscription ID and domains in fastly_tls_subscription API error messages, making it easier to identify failing resources when managing many subscriptions at once.

Firewalls & Network Defense · 2026-07-23

Domain Inspector APIs now expose TLS and HTTP version distribution metrics for incoming requests.

• Adds TLS version and HTTP version distribution metrics to the Historical Domain Inspector API and Real-Time Domain Inspector API.

Secrets Detection & Management · 2026-07-23

• Updated Hume AI API key checker endpoint.

Secrets Detection & Management · 2026-07-23

• Adds @mention support in incident notes and feedback — type @name or @team-name to notify individual members or entire teams via email, linked directly to the incident.

SIEM · 2026-07-23

Google SecOps adds Advanced Filtering with dynamic YARA-L query variables in dashboards, plus Security Tokens for agentic consumption metering.

• Adds Advanced Filtering in dashboards (Public Preview): security analysts can define Token Variables to inject dynamic values, complex regular expressions, or boolean logic directly into YARA-L queries at runtime.
• Token values can be generated dynamically from YARA-L query results or entered as a static manual list.
• Customizable prefix/suffix wrappers on token values enable advanced patterns such as inline regular expressions within dashboard queries.

Threat Intelligence · 2026-07-23

Hudson Rock adds a new Company Search endpoint to its API.

• New Company Search endpoint enables programmatic lookup of companies within the Hudson Rock platform.

Threat Intelligence · 2026-07-23

Hudson Rock adds a Search by PC Name endpoint to query compromised credentials tied to a specific machine.

• New API endpoint enables searching the compromised-credentials database by PC name to identify infected machines.

Threat Intelligence · 2026-07-23

Hudson Rock adds a new Search by Term endpoint to its API.

• New Search by Term API endpoint enables querying Hudson Rock data by arbitrary search terms.

Threat Intelligence · 2026-07-23

Hudson Rock adds subdomain filtering to narrow infostealer data queries by subdomain.

• Adds subdomain filtering capability to scope intelligence queries to specific subdomains.

Threat Intelligence · 2026-07-23

Hudson Rock adds a Directory Tree field to expose file system structure from infostealer compromises.

• Adds a new Directory Tree field surfacing the file/folder structure captured from compromised machines in infostealer data.

Reconnaissance & OSINT · 2026-07-23

Hunter adds managed email account provisioning and automated inbox warm-up to support full outreach setup.

• Adds managed email account provisioning: buy domains and create pre-configured email accounts (with SPF, DKIM, and DMARC) directly within Hunter, ready within ~1 hour.
• New Inbox Protection add-on automates a 30-day email warm-up, progressively increasing sending volume via real replies and positive engagement signals.
• Inbox Protection dashboard tracks warm-up progress including interactions, open rates, reply rates, and spam placement.

Reconnaissance & OSINT · 2026-07-23

Hunter ships a free, no-auth Company Logo API returning logos for 16M+ companies by domain.

• New free endpoint https://logos.hunter.io/{domain} retrieves a company logo via plain GET — no signup, no API key, no setup required.
• Covers 16M+ company logos, enabling CRM enrichment, dashboard branding, and report generation without adding a separate provider.

Reconnaissance & OSINT · 2026-07-23

Hunter Discover gains a smarter AI Assistant with one-click refinements and a filter to exclude already-saved companies.

• Adds improved AI Assistant in Discover that translates plain-language audience descriptions into ready-to-use lead searches — no manual filter configuration required.
• AI Assistant now jumps from company results to specific contacts when job titles are mentioned in the search query.
• After each search, the Assistant analyzes results and surfaces one-click suggestions to narrow, expand, or sharpen targeting with filters like recent funding or job functions.

Reconnaissance & OSINT · 2026-07-23

Hunter launches Email Accounts Center and Global Health Score for centralized sender account management and deliverability monitoring.

• New Email Accounts Center consolidates all connected sender accounts in Sequences into a single view with status, daily sending progress, scheduled emails, health score, and Inbox Protection status.
• Adds bulk actions across multiple accounts: run health checks, edit sending limits, update sender names, enable Inbox Protection, or disconnect accounts simultaneously.
• New Domains tab provides per-domain health scores and detailed domain reports.

Reconnaissance & OSINT · 2026-07-23

Hunter Sequences now report open, click, reply, and unsubscribe rates per unique recipient, not per email sent.

• Open, click, reply, and unsubscribe rates in Sequences now count distinct recipients who engaged divided by recipients who received, reflecting true audience reach.
• Recipient-based rates surface across all reporting surfaces: Sequences list, sequence stats, CSV export, reporting overview and detail tabs, the API, and MCP tools.

Reconnaissance & OSINT · 2026-07-23

Hunter adds Progressive Sending to automatically ramp up daily email volume for new or reactivated inboxes without manual adjustments.

• New Progressive Sending feature automatically and gradually increases daily email volume in Sequences until a user-defined target limit is reached.
• Supports newly connected email accounts and accounts inactive for 30+ days, covering the most deliverability-vulnerable ramp-up phase.
• Volume progression is conditional: the daily cap only increases when the previous day's limit was hit and bounce rate remains healthy.

Reconnaissance & OSINT · 2026-07-23

Hunter Discover now lets you partially reveal leads up to your available credit balance instead of blocking the entire dataset.

• Enables partial lead reveals in Discover's people-finding workflow, revealing up to the exact number of leads your current credit balance allows rather than blocking the full dataset.
• Adds a prompt in Discover to either proceed with the partial reveal or obtain more credits (upgrade or buy an extra credits pack) when a dataset exceeds available credits.

Reconnaissance & OSINT · 2026-07-23

Hunter Sequences gains A/B testing with automatic winner selection and per-variant step metrics.

• Adds A/B testing for each step in Sequences, letting you test subject line and email content variants against split recipient groups.
• New step-level metrics surface opens, clicks, replies, and bounces per variant for direct comparison.
• Enables automatic promotion of the winning variant to all remaining scheduled sends once a winner is selected.

Identity & Access Management · 2026-07-23

iDenfy Risk Assessment now integrates with KYB (Know Your Business) workflows.

• Adds KYB with Risk Assessment integration, enabling business entity risk reviews alongside identity verification workflows.

Identity & Access Management · 2026-07-23

iDenfy dashboard adds PDF generation, blocklist setup, bank card verification, and new workflow steps

• Adds PDF Generation configuration option in dashboard setup.
• Adds Blocklist Setup for managing blocklisted identities via the dashboard.
• Adds Sole Proprietorship Workflow Step for business verification flows.

Identity & Access Management · 2026-07-23

iDenfy adds Bank Card Verification, Face Authentication in Dashboard, questionnaires, and expanded KYB/AML features.

• New Bank Card Verification confirms the bank card used during onboarding belongs to the verified user.
• New Face Authentication capability available directly in the Dashboard.
• Supports setting up Questionnaires for both KYC and KYB workflows.

Identity & Access Management · 2026-07-23

iDenfy dashboard adds SMS/Phone Verification and Bank Card Verification as new KYC identity checks.

• Adds SMS and Phone Verification as a supported KYC identity check in the dashboard.
• Adds Bank Card Verification as a supported KYC identity check in the dashboard.

Identity & Access Management · 2026-07-23

iDenfy dashboard gains custom rule blocklists, email template setup, and system notifications for webhooks and emails.

• New Custom Rule Blocklist configuration available in dashboard settings.
• New Email Template Setup for customizing outbound email content.
• New System Notifications supporting both webhooks and email delivery channels.

Identity & Access Management · 2026-07-23

iDenfy adds eIDAS compliance, Zapier webhook integration, and Shopify support alongside a new Quickstart guide.

• Supports eIDAS compliance for identity verification workflows meeting EU electronic identification standards.
• New Zapier Webhooks integration enables no-code automation of iDenfy verification events.
• New Shopify integration allows merchants to embed iDenfy identity verification directly into their store flows.

Identity & Access Management · 2026-07-23

iDenfy Dashboard gains Bank Verification, Magic Link, Branding (KYC), multi-company support, and update requests.

• Adds Bank Verification capability accessible directly from the Dashboard.
• Introduces Magic Link feature for streamlined user authentication flows in the Dashboard.
• Adds Branding (KYC) configuration, enabling customization of the KYC experience from the Dashboard.

Identity & Access Management · 2026-07-23

iDenfy launches an MCP server giving AI assistants read-only access to its full KYC/KYB/AML documentation

• New MCP server at https://documentation.idenfy.com/mcp connects AI assistants (Claude, Cursor, ChatGPT, Gemini, Perplexity, Zed, Windsurf, VS Code) to the full iDenfy documentation.
• Exposes search_idenfy_documentation tool: searches all guides and API references, returning page titles, paths, and short snippets.
• Exposes get_page_idenfy_documentation tool: retrieves full page content by path (e.g. kyc/generate-token) for deep reference lookup.

Identity & Access Management · 2026-07-23

iDenfy Sprint 131 adds Bank Card Verification, KYB shared identity, a Blocklist API endpoint, and PNG logo uploads.

• New Bank Card Verification capability for validating payment card ownership during onboarding flows.
• New KYB shared identity verification allows a verified identity to be reused across multiple companies.
• New Blocklist API endpoint for programmatically managing blocklisted identities.

Identity & Access Management · 2026-07-23

iDenfy adds bank card ownership verification, KYC blocklist APIs, and new status-handling and browser-support docs.

• New Bank Card Verification step confirms the card used during onboarding belongs to the verified user, configurable as an additional stage in the KYC workflow.
• New POST /kycidentifications/blocklists API endpoint enables adding entries to the KYC blocklist programmatically.
• New DELETE /kycidentifications/blocklists API endpoint enables removing entries from the KYC blocklist programmatically.

Identity & Access Management · 2026-07-23

iDenfy adds Zapier Webhooks integration for connecting identity verification events to automation workflows.

• Supports Zapier Webhooks integration, enabling identity verification events to trigger automated workflows across thousands of connected apps.

Identity & Access Management · 2026-07-23

iDenfy adds Zapier Webhooks integration for automated verification event routing.

• Supports Zapier Webhooks as a new integration, enabling automated workflows triggered by iDenfy verification events.

Identity & Access Management · 2026-07-23

iDenfy adds Arabic/RTL IDV support, KYC multi-theme branding, KYB dynamic workflows, Companies House integration, and new Digital ID support across sprints.

• Adds Arabic language and RTL layout support for identity verification (IDV) flows (Sprint 127).
• Adds KYC multi-theme branding, enabling different visual themes per verification workflow (Sprint 127).
• Adds KYB sole proprietorship identity verification (Sprint 127).

Data Security & DLP · 2026-07-23

Immuta adds separate access/masking request forms, managed groups for policies, Redshift viewless discovery, and OAuth 2.0 for Alation.

• Adds separate access and masking exception request forms for data products, allowing stewards to configure independent questions and data use agreements per request type.
• Introduces three built-in system-managed groups (All Agents, All Users, All Identities) for writing subscription and data policies without manual membership management.
• Enables automated sensitive data discovery for Amazon Redshift viewless integration, supporting regex, dictionary, and column name regex identifiers with automatic tag application.

Endpoint Security (EDR/XDR) · 2026-07-23

Iru now delivers managed configuration profiles (PPPC, background items) during Setup Assistant for ADE Mac enrollments.

• Delivers Iru managed configuration profiles (PPPC, background items, etc.) during Setup Assistant when using ADE customization for Mac, so Auto Apps and Okta Verify with Okta Device Trust are fully functional before the end user is released.

Endpoint Security (EDR/XDR) · 2026-07-23

Iru extends Apple beta program enrollment and version enforcement to iOS and iPadOS, with new device-record visibility.

• Adds Apple beta program enrollment and version enforcement for iOS and iPadOS in Managed OS and ADE Library Items.
• Surfaces beta program enrollment status on the device record details tab for any enrolled Apple device.
• New optional Prism column displays Apple beta program enrollment status across device listings.

Endpoint Security (EDR/XDR) · 2026-07-23

Iru now reports public IP addresses for Apple devices via device records, Prism, and the enterprise API.

• Adds public IP address reporting for Apple devices, visible on the device record Details tab, as an optional Prism column, and via the enterprise API device details endpoint.

Endpoint Security (EDR/XDR) · 2026-07-23

Iru now supports AppleCare enhanced log collection requests from iOS and iPadOS 27 beta devices.

• Enables AppleCare enhanced log collection requests from devices running iOS and iPadOS 27 beta.

Endpoint Security (EDR/XDR) · 2026-07-23

Iru adds new macOS 27 beta restrictions and expands visionOS 27+ support for four existing restrictions.

• Adds ForceCaptivePortalConnectionFromLockScreen restriction for devices running the macOS 27 Apple beta.
• Adds ForceWifiConfigurationOnLockScreen restriction for devices running the macOS 27 Apple beta.
• Extends allowAutomaticAppDownloads, allowCamera, allowListedAppBundleIDs, and blockedAppBundleIDs restrictions to visionOS 27 and later.

Endpoint Security (EDR/XDR) · 2026-07-23

Iru Vulnerability Management adds Bulk Device Exclusion to remove multiple devices from scope in a single action.

• Adds Bulk Device Exclusion to exclude multiple devices from Vulnerability Management at once, hiding them from all vulnerability views, detection counts, and alerts.
• Supports bulk removal of exclusions with the same single-action workflow.

Endpoint Security (EDR/XDR) · 2026-07-23

Iru adds Windows Managed OS, three new Compliance Automation frameworks, and proactive ServiceNow updates.

• Adds Managed OS support for Windows, expanding automated OS lifecycle management beyond Apple devices.
• Introduces updates to Managed OS for Apple Library Items.
• Adds three new Compliance Automation frameworks for automated compliance coverage.

Endpoint Security (EDR/XDR) · 2026-07-23

Iru adds MSP multi-client management, a Policy Management module, and EDR wildcard support.

• New purpose-built features for MSPs managing multiple clients.
• New Policy Management module within the Compliance Automation suite.
• Adds wildcard support for Endpoint Detection and Response.

Web Application Security · 2026-07-23

Levo Q4 2025 adds web app scanning, AI security capabilities, a rebuilt notification system, and expanded API discovery.

• New refreshed dashboard experience for improved operational visibility.
• Completely rebuilt notification system for security alerts and events.
• First wave of web application scanning capabilities.

Web Application Security · 2026-07-23

Levo May 2026: redesigned Policy Hub, AI traffic tagger with agent attribution, and Streamable HTTP for MCP server.

• Redesigned Policy Hub with identity-aware policies for finer-grained security controls.
• Next-generation AI traffic tagger attributes traffic to individual agents and sessions.
• New Agent Detail view surfaces per-agent activity and session context.

Web Application Security · 2026-07-23

Levo adds AI agent/model/MCP discovery, AI Policies with guardrail alerting, and AI-driven DAST authentication.

• Discovers AI agents, models, and MCP tools from cloud providers in the API catalog.
• Introduces AI Policies with guardrail alerting for AI security enforcement.
• Adds AI-driven authentication support for web application (DAST) scanning.

Web Application Security · 2026-07-23

Levo adds scheduled DAST scans, AI-driven auth, live AI Gateway guardrails, and a new application comparison report.

• Adds scheduled and on-demand DAST scan modes to the web application scanning engine.
• Introduces AI/LLM-driven authentication for automated crawling of login-protected applications.
• Enables smarter crawling in the DAST engine for broader application coverage.

Web Application Security · 2026-07-23

Levo February 2026: CLI-driven DAST, AI Guardrails policies, agentless API discovery, and tagging across findings

• Adds CLI-driven web application (DAST) scans for triggering scans from pipelines or the command line.
• Includes evidence capture in DAST findings for proof-of-exploitation documentation.
• Supports DOCX report export for DAST scan results.

Web Application Security · 2026-07-23

Levo ships Vigil AI firewall, DAST scanning, and external attack surface management in January 2026

• Introduces Vigil, an AI-native firewall for AI apps and MCP servers.
• Launches web application scanning (DAST) capabilities.
• Adds external attack surface management (EASM) capabilities.

Compliance Automation & Trust Management · 2026-07-23

Mondoo's Executive Reports is now GA — export live VM data as board-ready PowerPoint or PNG slides.

• Enables Executive Reports for all customers, turning live Mondoo vulnerability management data into board-ready presentations.
• Supports export of Executive Report slides to PowerPoint and PNG formats.

Compliance Automation & Trust Management · 2026-07-23

Mondoo previews Executive Reports: board-ready ROI slides exportable to PowerPoint or PNG.

• New Executive Reports feature (Preview) converts live Mondoo vulnerability management data into board-ready ROI presentations.
• Supports export of individual report slides to PowerPoint or PNG formats.

Compliance Automation & Trust Management · 2026-07-23

Mondoo June 2026 brings smarter internet-exposure detection, AI infrastructure inspection, six new platforms, and 145 new checks.

• Adds internet-exposure detection across cloud environments to surface attacker-visible attack surface.
• Adds AI infrastructure inspection capabilities.
• Supports six new platforms for security policy coverage.

Compliance Automation & Trust Management · 2026-07-23

Mondoo May 2026 debuts a redesigned UI with Risk Dimensions scoring, remediation context, new dashboards, and executive reports.

• Introduces Risk Dimensions, a transparent five-dimension scoring model for evaluating security risk.
• Adds remediation context alongside findings to help practitioners prioritize and act on issues.
• Delivers redesigned dashboards surfacing risk data through the new scoring model.

Compliance Automation & Trust Management · 2026-07-23

Mondoo April 2026 adds shadow AI detection, seven new platforms, expanded IaC scanning, and the largest MQL update yet.

• Adds shadow AI detection capabilities.
• Supports seven brand-new platforms for asset scanning.
• Expands infrastructure as code (IaC) scanning coverage.

Compliance Automation & Trust Management · 2026-07-23

Mondoo March 2026 adds network security scanning, hundreds of new cloud resources/checks, IaC scanning for Terraform and CloudFormation variants, and new CIS benchmarks.

• Adds network security scanning capabilities.
• Introduces hundreds of new cloud resources and security checks.
• Supports IaC scanning for Terraform and CloudFormation variants.

Compliance Automation & Trust Management · 2026-07-23

Mondoo February 2026 brings broader vulnerability detection, new policy checks, resource-level cloud findings, and MQL expansion.

• Expands vulnerability detection coverage across infrastructure.
• Adds hundreds of new policy checks.
• Introduces resource-level findings for cloud assets.

Compliance Automation & Trust Management · 2026-07-23

Mondoo November 2025 adds new security advisories, broader vuln detection, NPM supply chain coverage, and network security capabilities.

• Adds new Mondoo Security Advisories to surface emerging threats.
• Expands vulnerability detection coverage to additional applications and operating systems.
• Includes guided remediation steps alongside vulnerability findings to accelerate patching.

Compliance Automation & Trust Management · 2026-07-23

Mondoo October 2025 adds end-of-life OS detections, a known ransomware use risk factor, and new CIS benchmark policies.

• Adds detections for end-of-life operating systems to surface legacy assets in security posture.
• Introduces a new known ransomware use risk factor for prioritizing vulnerability remediation.
• Delivers new and enhanced CIS benchmark policies.

Compliance Automation & Trust Management · 2026-07-23

Mondoo September 2025 adds new OS/app vuln detections, DORA & BSI SYS 1.5 compliance, and experimental MCP security.

• Adds vulnerability detection support for new operating systems.
• Adds vulnerability detection for an expanded list of third-party applications.
• Supports EU/German compliance frameworks DORA and BSI SYS 1.5.

Compliance Automation & Trust Management · 2026-07-23

Mondoo August 2025 expands vulnerability detections, adds remediation snippets for Ansible/Bash/Terraform, and ships new CIS benchmarks.

• Expands vulnerability detection coverage with new findings.
• Adds Ansible, Bash, and Terraform remediation snippets to speed up risk resolution.
• Includes latest CIS benchmarks for updated security and compliance coverage.

Runtime Security · 2026-07-23

nono v0.69.0 adds SPIFFE/SPIRE workload identity auth for upstream proxy routes and profile-declared no_proxy bypass support.

• Adds SPIFFE/SPIRE workload identity authentication for upstream proxy routes, supporting both JWT-SVID bearer injection and OAuth2 client assertion (RFC 7523) flows; all flows are fail-closed if the SPIRE socket is unreachable.
• Adds profile-declared no_proxy bypass support, letting profiles specify hosts that skip the nono proxy.

SAST / SCA / Code Security · 2026-07-23

npq now suggests a proven-older semver when a package version fails the 30-day recency check.

• Adds an alternative-version suggestion to version-maturity failures, surfacing the highest older semver published outside npq's 30-day recency window so practitioners have an actionable candidate to audit next.
• Renders the suggestion in rich, plain, and JSON output without affecting issue counts, and suppresses it automatically for packages flagged as malicious.

SAST / SCA / Code Security · 2026-07-23

npq now corroborates expired-domain warnings with authoritative RDAP lookups to reduce false positives.

• Adds RDAP corroboration for expired-domain warnings: a warning is only emitted when DNS returns NXDOMAIN *and* the authoritative RDAP service confirms no active registration, reducing false positives from DNS-only failures.
• Routes RDAP lookups through the official IANA DNS bootstrap registry with HTTPS enforcement, 3-second timeouts, no redirects, and process-lifetime caching.
• Reports inconclusive RDAP evidence (unsupported TLDs, timeouts, rate limits, multipart suffixes, malformed names) as not evaluated rather than blocking installs.

SAST / SCA / Code Security · 2026-07-23

npq v3.21.0 adds authenticated custom registry support, routing all audits through your configured npm registry.

• Supports authenticated custom registries: reads standard npm registry configuration (auth, proxies, TLS, client certs) from .npmrc and routes all package metadata, manifest, signing-key, and attestation lookups through a shared authenticated registry client.
• Adds --registry, --userconfig, and --globalconfig CLI flags to explicitly set the registry and npm config paths per invocation.
• Reports signing, provenance, and download-count capabilities as NOT EVALUATED (rather than failures) when the selected registry does not expose those services.

SAST / SCA / Code Security · 2026-07-23

npq v3.20.0 refreshes its typosquatting detection dataset for more accurate supply-chain threat coverage.

• Updates the typosquatting package dataset to replace stale entries, improving detection of malicious lookalike packages.

Identity & Access Management · 2026-07-23

Nudge Security adds admin audit log export, inherent/residual risk scores, and automatic business criticality tiers for SaaS and AI apps.

• Exports a complete admin activity log as CSV, capturing OAuth revocations, role changes, field/setting updates, and app connect/disconnect events (Settings > Audit event).
• Introduces inherent and residual risk scores (Low/Medium/High/Critical) for every SaaS and AI vendor, with transparent factor breakdowns covering vendor security posture, internal deployment risk, and compensating controls — now in open beta.
• Continuously recalculates risk scores as conditions change (e.g., new MCP server connections, vendor breach disclosures) and surfaces recommended actions ranked by projected residual risk reduction.

Runtime Security · 2026-07-23

OpenShell v0.0.90 adds config key support to provider create/update forms in the TUI.

• Adds config key support to provider create and update forms in the terminal UI.

Identity & Access Management · 2026-07-23

Ory Network moves to fine-grained, bucket-based rate limiting instead of fixed per-endpoint-path limits.

• Introduces bucket-grouped project rate limits, replacing fixed per-endpoint-path rate limiting for more granular control.

Identity & Access Management · 2026-07-23

Ory Hydra now accepts OpenID Connect prompt=select_account in OAuth 2.0 authorization requests.

• Supports the OpenID Connect prompt=select_account parameter in OAuth 2.0 authorization requests, enabling clients to request account selection UI.

Identity & Access Management · 2026-07-23

Ory Network now accepts workspace API keys on GET /identity-schemas, enabling programmatic schema listing.

• Supports workspace API keys on GET /identity-schemas, allowing automated/service-account access to list identity schemas without a user session.

Identity & Access Management · 2026-07-23

Ory Network v26.3.2 enforces DNS-label boundaries on wildcard return URLs and CORS origins.

• Enforces DNS-label boundary on wildcard return URLs and CORS origins, so a * in a URL or origin now matches only within a single DNS label.

Identity & Access Management · 2026-07-23

Ory Network SCIM endpoints now support enterprise user attribute provisioning.

• Supports provisioning of enterprise user attributes via SCIM endpoints.

Identity & Access Management · 2026-07-23

Ory Network adds per-identity data region selection directly from the Console identity details page.

• Enables changing an individual identity's data region via a new region selector on the identity details page in the Ory Console.

Identity & Access Management · 2026-07-23

Ory Network event streams can now be paused and resumed without losing configuration.

• Adds pause and resume support for event streams, with a new status field (active or paused) indicating stream state — a paused stream retains its full configuration.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q1'23 adds third-party inventory, endpoint detection, questionnaire collaboration, risk policy controls, remediation management, and automated reevaluation.

• Adds Third-Party Inventory: a single consolidated view to classify, manage, and upload security documentation for all third parties regardless of tier or evaluation type.
• Introduces Endpoint Detection as a new external attack surface assessment category, giving visibility into third-party endpoint security posture and its impact on cyber risk ratings.
• Adds Questionnaire Conversations, enabling real-time in-platform collaboration with third parties and internal team members on individual questionnaire questions before submission.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q1'24 adds AI-powered answer validation, asset-based segmentation, richer supply chain discovery, and automatic remediation reminders.

• New Smart Validation AI automatically parses third-party documents (questionnaire attachments or Files & Documentation uploads), correlates them with specific questions, and generates confidence scores plus supporting/contradicting evidence.
• New Segments feature lets you group third parties into subsets by domain or geolocation assets, generating a focused attack surface assessment for those specific assets.
• Supply Chain Discovery now surfaces detailed evidence and navigation controls for direct and unregistered Nth parties, with the ability to select which to add for assessment and continuous monitoring.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q1'25 adds supply-chain risk insights, customizable executive reports, a new dashboard widget, and custom integrations.

• New Risk Insights and Response Portal gives a single-page view of cyber event impact across direct and indirect third parties for faster, data-driven response.
• Adds customizable executive reports with mix-and-match widgets and export capability, tailored for board and management audiences.
• New Live Dashboards Criterion Summary widget surfaces unresolved criteria with criticality, sources, and affected third parties in one consolidated view.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q2'23 adds Supply Chain Discovery, Risk Insights portal, KEV prioritization, and enriched Asset Details.

• New Supply Chain Discovery maps direct and indirect suppliers automatically, surfaces Shadow IT, assigns cyber posture and Commonality ratings, and lets users add discovered suppliers to their inventory in one click.
• New Risk Insights and Response Portal delivers real-time alerts on vulnerabilities, breaches, news, and zero-day events across the digital supply chain, identifies affected direct and indirect suppliers, and enables immediate breach-questionnaire dispatch.
• CISA Known Exploited Vulnerabilities (KEVs) are now ingested and automatically prioritized as Critical findings within technology-vulnerability detection.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q2'23 adds Smart Match, an AI feature that suggests pre-answered responses to streamline questionnaire completion.

• Adds Smart Match, an AI-powered capability that surfaces previously answered questions ranked by similarity score while completing a questionnaire, accelerating response time and ensuring answer consistency.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q2'24 adds internal questionnaires, AI answer lookup, SEC 8-K cyber news, CSP findings, live dashboards, and custom risk factors.

• New Internal Questionnaires feature lets admins circulate questionnaires within their own organization to gather third-party information from relationship owners at any assessment stage (due diligence, SLA reviews, etc.).
• New Risk Policy Custom Factors lets admins add or reduce points from a supplier's bottom-line risk rating based on external factors (offline questionnaires, SOC2 completion, trusted vendor status), with per-supplier configuration and mandatory evidence requests.
• New Live Dashboards enable customizable reporting dashboards built from selectable data-visualization widgets, tailored for management and board reporting.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q2'25 adds Gemini-powered answer suggestions, simplified supplier onboarding, richer AI business snapshots, and Cyber News webhooks.

• New AI Answer Advisor powered by Google Gemini generates intelligent questionnaire answer suggestions drawn from publicly available data, complementing SmartMatch's existing scan of prior responses.
• Redesigned Add Supplier flow enables onboarding suppliers without prior background knowledge, with automatic cyber posture assessment initiated upon addition.
• Enhanced Business Snapshot aggregates a broader spectrum of public data sources using advanced AI to enrich supplier profiles with company identifiers, financial attributes, and improved compliance accuracy.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q3'23 adds Workflow Automation, Smart Match questionnaire uploads, and Internal References for reviewers.

• New Workflow Automation feature lets you define preset rules to automatically approve or reject third parties, generate remediation tasks, and assign responsibilities to multiple stakeholders — triggered by Questionnaire Ratings, Cyber Posture Ratings, Risk Ratings, business impact, and third-party risk status.
• Smart Match now accepts uploaded questionnaires from outside Panorays, improving auto-answer accuracy for new questionnaires based on previously completed responses.
• New Internal References capability lets reviewers leave internal notes on questionnaires to surface company policy and compliance context, accelerating the review process.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q3'24 adds DORA reporting, third-party portfolios, activity logging, dark web CTI alerts, and task management.

• New DORA File Generator add-on module generates a complete DORA Register of Information report as a ready-to-send file for Supervisory Authorities, with built-in questionnaire templates pre-coded for DORA's Excel format.
• New Portfolios feature lets you organize third parties into distinct groups segmented by criticality, sensitivity, geolocation, company department, and more for risk-based prioritization.
• New Activity Center provides a consolidated log of all supplier activities on Panorays, with filtering and export for reporting and audit trails.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q3'25 adds supplier inventory management, per-supplier Live Dashboard reports, enhanced tag management, and questionnaire re-submission.

• New Inventory view provides a centralized location to manage your supplier list, view automatic risk indicators, and move suppliers into tiered assessments based on risk level or priority.
• Live Dashboards now support single-supplier reports, letting you build and save multiple tailored report versions per supplier using interactive widgets.
• New Tags Management page lets you group and label vendors by characteristics such as location, department, or risk level, and manage all tagged vendors from a single centralized view.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q4'23 adds supplier intake forms, archival status, AI-powered cyber news, internal notes, and an expanded API v2.0.

• New Intake Form lets internal stakeholders add suppliers via a one-time verification process without requiring a Panorays sign-in.
• New Archived status pauses cyber assessments for inactive or terminated third parties while preserving their files and documents.
• Cyber News enriched with additional data sources and an AI-based categorization and classification system for business-specific risk exposure.

Third-Party & Vendor Risk (TPRM) · 2026-07-23

Panorays Q4'24 adds SIG 2025 support, task consolidation, drill-down dashboards, and security event audit trails.

• Adds SIG 2025 evaluation with mapping to DORA and NIS2, per-supplier scoping by material risk, and seamless third-party SIG uploads across all SIG versions.
• Adds Inherent Risk Questions to questionnaires, enabling business impact assessments with internal and external stakeholder collaboration.
• Adds Task Management Consolidation — a single centralized view to find, track, and manage all tasks assigned to suppliers and internal teams.

Identity & Access Management · 2026-07-23

LDAP gateway 4.4.0 adds group LDAP filter support for selective inbound provisioning to PingOne.

• Supports group LDAP filters for inbound provisioning, enabling selective sync of LDAP groups into PingOne based on configurable filter criteria.

Identity & Access Management · 2026-07-23

LDAP gateway 4.4.0 adds group LDAP filter support for selective inbound provisioning into PingOne.

• Supports group LDAP filters for inbound provisioning, allowing selective sync of LDAP groups into PingOne based on configurable filter criteria.

Identity & Access Management · 2026-07-23

Advanced Identity Cloud adds emailService binding for next-gen scripts, managed secret references in custom nodes, and a new secret validation endpoint.

• Custom scripted nodes can now reference managed secrets from a secret store using a SECRET property type, keeping API keys and passwords out of script code.
• Custom scripted nodes now support combining multivalued: true with options to create multi-select list properties in the journey designer.
• New validate action on the secrets endpoint lets operators confirm whether a secret mapping resolves to a valid secret in the configured secret store.

Cloud Security Posture · 2026-07-23

Plexicus adds Multifactor Priority Scoring v2, activates Registry Scanning, and overhauling Reticulum accuracy.

• Introduces Multifactor Priority Scoring v2 for vulnerability prioritization.
• Activates Registry Scanning as a new scanning capability.
• Delivers a Reticulum accuracy overhaul improving detection precision.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Pomerium v0.32.0 adds configurable DNS resolvers with custom servers and tunable refresh rates for upstream hostname resolution.

• Supports specifying custom DNS servers for resolving upstream routes, independent of the host system's resolver.
• Enables tunable DNS refresh rates so Pomerium picks up record changes on a schedule matching your environment.
• Delivers consistent, centrally configured name resolution across all Pomerium components for dynamic and clustered deployments.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Pomerium v0.32.0 adds incremental route diffing, a new Databroker query/index engine, and Pebble-backed in-memory storage.

• Adds incremental config diffing for routes — only changed routes are recomputed and applied, reducing churn on large route sets.
• Introduces Databroker indexing and query support, including field-based record lookup, a new GetOptions API, additional filter operators, and order-by.
• Replaces the in-memory store with Pebble, aligning it with the persistent backend and setting a default path for the file backend.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Pomerium v0.32.0 adds a hosted identity provider so teams can authenticate without standing up their own OIDC server.

• New hosted identity provider type lets Pomerium manage authentication without requiring teams to configure an external OIDC provider.
• Built-in refresh handling authenticates session refresh requests and correctly hashes the derived IdP configuration for clean session renewal.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Pomerium MCP gateway gains OAuth refresh tokens, dynamic client registration, and customizable error pages.

• Adds OAuth refresh token support for MCP sessions, keeping long-running AI agents and clients connected without repeated interactive logins.
• Supports dynamic client registration via client ID metadata documents, letting MCP clients register with Pomerium automatically.
• Enables customizable MCP 401 error pages with clearer messaging for unauthorized client domains.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Pomerium's MCP gateway gains upstream OAuth with token caching, Dynamic Client Registration, and route auto-discovery.

• Adds upstream OAuth support for MCP routes: Pomerium discovers upstream OAuth metadata, completes authorization flows, caches client and token state, and injects upstream access tokens into MCP traffic.
• Adds Dynamic Client Registration (DCR) as a fallback for upstream OAuth flows, enabling tools like MCP Inspector that lack Client ID Metadata Document support.
• Includes the iss parameter in MCP authorization flows, returning Pomerium's host as the issuer to align with the upcoming 2026-07-28 MCP spec.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Pomerium v0.32.0 adds OAuth Authorization Code flow, reverse tunnels, jump-host mode, and an interactive routes portal for native SSH.

• Switches SSH authentication to the OAuth Authorization Code flow (replacing Device Code), delivering a faster browser login with full telemetry observability.
• Adds reverse tunneling via ssh_upstream_tunnel flag, letting upstream SSH servers dial out to Pomerium — ideal for edge devices, NAT'd networks, and isolated environments.
• Adds jump-host (ProxyJump) mode via ssh_allow_direct_tcpip flag, letting clients connect through Pomerium to upstreams without requiring the upstream to trust Pomerium's User CA.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Pomerium Enterprise adds Revoke and block future authentication to permanently lock out users during incident response.

• Adds a Revoke and block future authentication option to the session revocation dialog, preventing SSO re-authentication loops after revocation.
• Enforces blocks via a deny/revocation list so blocked users are rejected on all subsequent requests, not just the current session.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Pomerium Enterprise adds SSH session recording with full keystroke capture, S3-compatible storage, and a Console playback UI.

• Adds full SSH session capture and playback: every keystroke and terminal output for privileged SSH connections is recorded and replayable directly from the Enterprise Console.
• Supports flexible recording storage: point recordings at a local on-disk directory or any S3-compatible bucket, configured per cluster.
• Introduces a blob-URI builder in the Enterprise Console so admins can configure recording storage without hand-writing connection strings, with support for Go CDK driver options and advanced parameters.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

ShareFile adds Forms Notifications support.

• Adds Forms Notifications, enabling alerts tied to form activity within ShareFile.

Vulnerability Management · 2026-07-23

Qualys releases QID coverage for CVE-2026-64600 (RefluXFS), a critical XFS kernel privilege-escalation vulnerability affecting RHEL, Oracle Linux, Amazon Linux, and Fedora.

• New QID 387841 detects the RefluXFS local privilege escalation (CVE-2026-64600) via XFS reflink direct-I/O race condition.
• New QID coverage added across VULNSIGS-2.6.651-2 through 2.6.656-2 for vendor kernel advisories on RHEL, Oracle Linux, AlmaLinux, Rocky Linux, and Fedora addressing CVE-2026-64600.
• Existing QID 45097 (Linux Kernel Version Running) can be used to identify the active kernel version and assess exposure to RefluXFS across Linux endpoints.

CNAPP · 2026-07-23

InsightCloudSec 26.7.21 adds Runtime Sensor health monitoring, unified compliance rule mapping, new API endpoints, and a CIS Azure Storage pack.

• Adds real-time Runtime Sensor health status (Healthy, Disconnected, or Degraded) on the Kubernetes Clusters page and Resources Listing for customers with a Runtime license.
• Introduces a unified Map to Compliance Pack row and bulk action in the Insights Library, replacing the separate Edit Metadata and Add to Custom Pack actions.
• Enables cascading dropdown selection of one or more compliance rules when mapping an Insight to a compliance pack.

Continuous Control Monitoring (CCM) · 2026-07-23

RegScale 6.37.45 adds eMASS full-system sync and AWS Inspector tag-based exclusion filtering.

• New eMASS sync_system command synchronizes all structural records (assets, controls, POAMs, milestones, artifacts) between a RegScale SSP and its linked eMASS system in a single dependency-ordered invocation.
• New --exclude_tags option for AWS Inspector sync to skip resources carrying specified tags.

AI-Powered Offensive Security · 2026-07-23

Strix v1.3.0 adds a Feedback & support tab and a prominent scan switcher with pentest terminology to the local viewer UI.

• Adds a Feedback & support tab to the local viewer UI.
• Adds a prominent scan switcher to the local viewer with renamed pentest terminology.
• Shrinks the sandbox Docker image from 7.2 GB to 3.8 GB via cache cleanup, multi-stage Go build, and dropping ZAP — enabling use on disk-constrained environments.

Cloud Security Posture · 2026-07-23

Sysdig Secure adds multi-bucket Custom Storage support and a redesigned Posture Overview & Findings experience.

• Adds Custom Storage: connect multiple S3 or S3-compatible buckets (MinIO, Google Cloud Storage, etc.) for use across Captures, Response Actions, and Rapid Response — replacing the previous single shared S3 Capture Storage configuration.
• Supports AWS access keys, AWS role delegation (AssumeRole), and S3-compatible endpoints for bucket authentication, with connection testing on save and per-bucket failure history.
• Introduces a new Posture Overview page surfacing passing scores, 30-day trends, and hotspots across weakest categories, resources, and high-severity controls.

Detection Engineering · 2026-07-23

• Adds a Splunk search input operator, enabling Tenzir nodes to pull data directly from Splunk searches.

Data Security & DLP · 2026-07-23

Ubiq overhauls dataset access control with Access Groups, adds SIEM streaming, SSO, and expands SDK type support.

• Introduces Access Groups to replace Dataset Groups for identity-to-dataset access control, separating organization from access management.
• Adds Dataset Tagging as a flexible, non-hierarchical replacement for Dataset Groups, supporting grouping by environment, application area, or custom structure.
• Adds advanced Dataset Configuration wizard enabling policy-level definition of encryption behavior for dates, numerics, short fields, and large character sets without custom code.

SAST / SCA / Code Security · 2026-07-23

Veracode DAST adds custom host-to-IP mappings, directory restrictions, enhanced scheduling, and open-port scanning with new detections.

• Adds custom host-to-IP address mapping configuration for DAST scans when DNS lookup is unavailable or not desired.
• Adds Directory Restrictions in DAST target configuration to control scan scope.
• Enhances DAST Schedule feature with advanced scheduling capabilities and greater configuration flexibility; all existing schedules are automatically migrated.

SAST / SCA / Code Security · 2026-07-23

Veracode SAST adds PySpark/Flask/Django/FastAPI Python support, Pipeline Scan exploit levels, and Android 17 detection in July 2026 updates.

• Adds enhanced Python scanner with improved taint tracking, cross-file analysis, and pattern recognition — applies automatically to all Python scans from July 22, 2026.
• Adds Python framework support for PySpark, Flask, Django, and FastAPI in the enhanced scanner.
• Adds Python support for httplib to detect CWE-295 and CWE-297 SSL/TLS flaws in v2026.07.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA now detects Claude Code's auto and bypassPermissions modes as unsafe AI configurations alongside the legacy flag.

• Extends Unsafe AI Mode detection to flag Claude Code's auto and bypassPermissions values in permissions.defaultMode within ~/.claude/settings.json (or ~/.claude/settings.local.json).
• Devices configured with either flagged mode now appear in the Unsafe AI Mode check with remediation guidance surfaced to end users in the in-app guide.
• Treats bypassPermissions as equivalent to --dangerously-skip-permissions and auto as the same risk class — both auto-approving all tool calls including shell commands and network requests.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA adds live Enforcement policy timing previews and a redesigned Discovery connection flow with provider picker.

• Adds a threshold timeline and live timing summary to Enforcement policy editing, so you can see exactly when a device would be warned or blocked before saving.
• Adds suggestion chips for common warn and block windows when configuring Enforcement policies.
• Redesigns the Discovery overview with a two-column layout and a provider picker that routes directly to a step-by-step setup page for Microsoft, Google, or Okta.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA dashboard gains a compliance status bar for at-a-glance policy-based device security health.

• New compliance status bar on the dashboard surfaces compliant, warned, blocked, and uncovered devices at a glance.
• Enables admins to identify devices with missing information that require verification before compliance status is finalized.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA now supports custom messages on onboarding and sign-in cards, configurable per application from the Dashboard.

• Adds custom text messages to the bottom of XFA's device onboarding and sign-in cards, with separate messages for each flow.
• Enables configuration of onboarding and sign-in messages from the Applications page in the Dashboard.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA adds Device Snooze to pause checks, notifications, and optionally MFA for individual devices with a time-limited exception.

• Adds Device Snooze to grant individual devices a temporary exception, pausing device checks and awareness notifications for a chosen preset or custom date/time window.
• Snoozed devices are hidden from overviews and analytics by default, with a Show snoozed devices filter to surface them on demand.
• Supports optional reason logging per snooze, and allows updating or removing a snooze from the same device action menu.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA Linux installation now requires a single curl command instead of manual package selection.

• Adds a one-line bootstrap installer for Linux, eliminating the need to manually select and download a package.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA adds guided setup, device posture overview cards, rebuilt Statistics trends, and unattended remote access detection.

• New Getting Started page walks through four tracked setup steps — from device discovery to compliance enforcement — so admins always know what to configure next.
• Devices page now opens with Discovery, Awareness, and Enforcement status cards showing real-time counts (devices discovered, alerts sent, successful sign-ins) at a glance.
• Statistics Trends rebuilt out of BETA: four metric tiles as tabs, unified chart with period/OS filter/chart-type controls inline, and custom date range support.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA adds a Lost connection device status with filtering and verification requests to surface endpoints that stopped reporting.

• New Lost connection status highlights devices where the XFA agent has stopped reporting a verified status in the Devices overview.
• Filter by Lost connection status in both the Devices and People views to quickly identify affected endpoints.
• Request verification directly from the Dashboard to prompt users to reconnect the XFA app and resume device security status sharing.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA adds Microsoft Teams integration to deliver device risk alerts, enrollment invites, and sign-in verification directly to end users.

• Connects XFA to a Microsoft Teams tenant so end users receive device risk alerts, new-device enrollment invitations, and sign-in verification requests as direct messages — no email required.
• Enables per-category notification toggles so admins can independently enable or disable each message type.
• Supports sending a test message per notification section to verify delivery before rolling out to users.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA Linux disk-encryption checks now recognize TCG OPAL 1.x/2.x self-encrypting drives alongside LUKS.

• Detects TCG OPAL 1.x and 2.x self-encrypting drives (via sedutil-cli) as encrypted on Linux when drive locking is enabled, enabling accurate compliance reporting for hardware-encrypted devices.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA policy detail pages now show a live compliance summary sidebar alongside policy settings.

• Adds a compliance summary sidebar to policy detail pages, showing compliant, non-compliant, and missing-information device counts while editing policy settings.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA adds screen lock timeout enforcement so admins can cap idle-lock delays on macOS, Windows, and Linux.

• Adds maximum screen lock timeout enforcement: admins can set a maximum allowed timeout duration (in minutes) in their organization's policy, and XFA verifies the device's configured timeout does not exceed it.
• Supports platform-specific timeout detection on macOS, Windows, and Linux.
• Combines timeout check with existing screen lock enable/disable check — both must pass for a device to be compliant.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA adds Slack integration to deliver device risk alerts, enrollment invites, and sign-in verification requests directly to end users.

• Connects XFA to a Slack workspace so end users receive device risk alerts as direct messages without email.
• Sends new-device enrollment invitations via Slack DM to streamline onboarding.
• Delivers sign-in verification requests and safe-browsing policy notifications through Slack.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA now warns or blocks risky mobile devices (jailbroken, rooted, dev-mode, rebooted) at sign-in, matching existing desktop policy enforcement.

• Extends jailbreak, root, developer-mode, and recent-reboot signals from mobile devices into the access decision at sign-in, so risky mobile devices are warned or blocked per policy — matching existing desktop behaviour.
• Adds a Watch demo action in the Dashboard for Discovery and Enforcement sections, opening a guided tour without leaving the dashboard.

Endpoint Security (EDR/XDR) · 2026-07-23

XFA now detects VeraCrypt system-drive encryption on Windows, reporting those devices as compliant automatically.

• Supports VeraCrypt system (boot-drive) encryption on Windows as a compliant disk-encryption state, alongside BitLocker.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

ZeroTier New Central gains the full rules engine: micro-segmentation via capabilities, tags, and custom flow rules.

• Adds Custom Flow Rules to New Central, enabling network micro-segmentation policies using capabilities, tags, and the full ZeroTier rule definition language (Scale and Enterprise plans).
• New Flow Rules interface supports both templated and custom rule modes with a rule editor featuring syntax highlighting and validation.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

ZeroTier Central adds webhooks for real-time notifications on network, member, and organization events.

• New Webhooks feature lets you subscribe to real-time event notifications for network changes, member activity, and organization updates.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

ZeroTier Central API v2 launches with full programmatic access to orgs, networks, members, and new service accounts for CI/CD.

• New Central API v2 provides RESTful programmatic access to organizations, network groups, networks, members, and access controls.
• Adds Service Accounts with scoped API tokens for automated workflows and CI/CD pipelines, with customizable token expiration dates.

Secure Access (VPN / SASE / ZTNA) · 2026-07-23

Zscaler adds Agentic SecOps with closed-loop remediation and ZDX Network Intelligence for per-hop ISP visibility.

• Introduces Agentic SecOps solution (limited availability) — an AI-driven security operations layer that connects telemetry across the Zscaler platform, endpoints/EDR, identity, and cloud to detect threats and orchestrate automated closed-loop remediation.
• Adds ZDX Network Intelligence dashboard with global route visualization color-coded by severity, enabling NetOps teams to pinpoint last-mile and transit ISP degradation across hybrid workforces.
• Enables BGP Autonomous System Number (ASN)-level aggregation of probe telemetry within ZDX, surfacing per-ASN latency and packet loss to identify which carrier is responsible for user experience degradation.

Identity & Access Management · 2026-07-22

Auth0 Self-Service Enterprise Configuration lets customer admins control third-party app SSO access during their own setup wizard.

• Enables delegation of the third-party application access decision to customer admins during Self-Service Enterprise Configuration ticket setup, surfacing a new wizard step where they can allow or skip third-party SSO access.

Identity & Access Management · 2026-07-22

BeyondTrust Pathfinder now supports IdP metadata file import for SAML setup with Entra ID, Okta, and PingOne.

• Adds IdP metadata file import in Pathfinder to streamline SAML configuration for Microsoft Entra ID, Okta, and PingOne, reducing manual entry errors.
• Supports domainless IdP configuration in Pathfinder, enabling administrators to test SAML authentication with a local account before binding an email domain.
• Automatically sets ACS URL and Service Provider Entity ID to the same value when importing IdP metadata, simplifying SP configuration.

Identity & Access Management · 2026-07-22

BeyondTrust Pathfinder adds SAML SSO identity provider support with group claims, default access rules, and IdP-initiated provisioning.

• Supports connecting any SAML-compatible identity provider (e.g., Entra/Azure, Okta) to BeyondTrust Pathfinder for centralized SSO authentication.
• Adds IdP-initiated authentication flow to auto-provision Pathfinder accounts for users not pre-created locally, suited for large-scale onboarding.
• Introduces default access rules to automatically assign roles (Standard User or Administrator) and site/application access to users on their first SAML login.

Identity & Access Management · 2026-07-22

BeyondTrust introduces multi-site management for grouping applications by team, region, or org structure.

• New Sites feature lets administrators group BeyondTrust applications by company structure (e.g., IT vs. Engineering) or region (e.g., North America vs. Europe) for isolated user access control.
• Supports switching between sites from the top-right site name drop-down on the BeyondTrust Home page.
• Enables renaming a site via Administration > Edit Site without disrupting access.

Identity & Access Management · 2026-07-22

BeyondTrust Pathfinder unifies Password Safe, PRA, Remote Support, EPM, Identity Security Insights, and Entitle under a single pane of glass at app.beyondtrust.io.

• New Pathfinder platform provides a single pane of glass across all BeyondTrust SaaS products — Password Safe, Privileged Remote Access, Remote Support, Endpoint Privilege Management for Windows & Mac, Endpoint Privilege Management for Linux, Identity Security Insights, and Entitle.
• Supports shared single sign-on across all BeyondTrust SaaS products via a central authentication source at app.beyondtrust.io.
• Enables multi-site organization so administrators can group SaaS applications into isolated sites that mirror organizational or regional structure (e.g., Engineering vs. IT, or North America vs. Europe), with per-site user access controls.

Identity & Access Management · 2026-07-22

BeyondInsight + EPM now supports OAuth-based agent enrollment, eliminating client-certificate deployment for endpoint attachment.

• Supports OAuth-based communication between EPM agents and BeyondInsight (starting in BeyondInsight 24.1 and EPM 24.3), removing the need to distribute client authentication certificates to endpoints.
• Adds OAuth support for EPM for Mac starting in version 25.2, with Activation ID and Activation Key provisioned via the Rapid Deployment Tool.
• Adds Installer Activation Keys UI in BeyondInsight (Configuration > Authentication Management > Installer Activation Keys) for generating and managing OAuth-based agent enrollment credentials.

Reverse Engineering · 2026-07-22

Capstone 6.0.0-Alpha10 adds AArch64 explicit wide-immediate printing, RISC-V FP rounding mode details, and a RISC-V v5 compat macro.

• Adds CS_OPT_SYNTAX_AARCH64_EXPLICIT_WIDE_IMM flag to print MOVN/MOVZ instructions in explicit shifted form instead of MOV aliases.
• RISC-V instruction details now expose the FP rounding mode via cs_riscv.rounding_mode.
• New CAPSTONE_RISCV_COMPAT_HEADER define restores the CS_MODE_RISCVC alias for codebases targeting the v5 API.

Integrated & IT Risk Management · 2026-07-22

CISO Assistant v3.20.0 adds technical posture management, SSO single logout, MCP maturity scores, domain export, and a library builder.

• New technical posture management capability for tracking and assessing technical security posture.
• Implements Single Logout (SLO) for both OIDC and SAML authentication providers.
• MCP integration now exposes maturity scores, enabling AI-driven access to assessment data.

AI Coding Agents · 2026-07-22

Claude Code v2.1.217 adds emoji autocomplete, subagent concurrency controls, and AWS gateway deployment assets.

• Adds emoji shortcode autocomplete in the prompt input (type :heart: to insert or :hea for suggestions); disable with the emojiCompletionEnabled setting.
• Adds visible warnings when transcript writes are failing (e.g. disk full) or when session saving is disabled via an inherited environment variable, preventing silent transcript loss.
• Adds a cap on concurrently-running subagents (default 20), overridable with CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS, preventing unbounded agent fan-out from a single message.

AI Coding Agents · 2026-07-22

Cline Code desktop app launches for macOS with signed/notarized builds for Apple Silicon and Intel, plus automatic background updates.

• New native macOS desktop app for running and inspecting Cline agent sessions, signed and notarized for both Apple Silicon and Intel.
• Adds automatic update mechanism: checks on launch and every 2 hours, downloads new versions in the background, and prompts for a one-click restart.

Security Data Pipeline · 2026-07-22

Cribl AI gains an MCP server for external agent access and Guard recommendations for actionable detection guidance.

• New MCP server lets external AI clients (Cursor, Claude Code, Codex) connect to Cribl environments and interact with Sources, Destinations, Pipelines, and Search Notebooks via natural language.
• Guard recommendations surface a suggested action (create a rule, mark mitigated, or ignore) for each detection so practitioners can act on findings without leaving the UI.
• MCP Integrations setting allows Cribl to call tools from an approved list of external agents via MCP.

Security Data Pipeline · 2026-07-22

Cribl 4.19 embeds an MCP Server natively in the Leader, letting AI clients like Claude Code, Cursor, and OpenAI Codex CLI query configs, metrics, and Search Notebooks directly.

• Adds a native, embedded MCP Server in the Cribl Leader — no separate container or service required to connect MCP-compatible AI clients.
• Supports MCP-compatible clients including Claude Code, Cursor, and the OpenAI Codex CLI via remote HTTP, with no additional proxy to install.
• Enables AI clients to retrieve Sources, Destinations, Worker Groups, Pipelines, metrics, and alerts directly from the Cribl environment.

Endpoint Security (EDR/XDR) · 2026-07-22

CrowdStrike adds detections for SANDWORM_MODE, a multi-stage npm supply chain worm targeting AI coding assistants and LLM toolchains.

• Adds indicators-of-attack (IOA) coverage for SANDWORM_MODE, detecting a multi-stage npm supply chain worm that targets AI-augmented CI/CD pipelines including GitHub Actions, Cursor, Claude Code, and Windsurf.
• Deploys process-tree-ancestry-based detections for Node.js runtime behaviors characteristic of SANDWORM_MODE, including obfuscated loader execution, in-memory payload staging via /dev/shm, and rogue MCP server registration.
• Extends detection coverage to AI toolchain compromise behaviors: rogue MCP server injection into Claude Desktop, Cursor, VSCode, and Windsurf configuration files, and LLM API key harvesting from environment variables and .env files.

Endpoint Security (EDR/XDR) · 2026-07-22

Falcon Insight XDR adds SANDWORM_MODE detection surfaced in the Endpoint Detections UI.

• Introduces SANDWORM_MODE detection, now visible as a customer-facing alert in the Falcon Endpoint Detections UI.

Firewalls & Network Defense · 2026-07-22

Fastly adds virtual patch for WordPress RCE chain CVE-2026-63030/CVE-2026-60137 (wp2shell) in WAF and control panel.

• New virtual patch for CVE-2026-63030 (wp2shell) detects and blocks the WordPress remote code execution vulnerability chain also covering CVE-2026-60137, available in both the Next-Gen WAF and Fastly control panel.

Threat Intelligence · 2026-07-22

Feedly's Vulnerability Intel Agent now ingests Apple security releases in minutes, with CVE filtering by exploitation, product, and patch policy.

• Ingests each Apple security release into the Vulnerability Intel Agent within minutes of publication.
• Supports filtering Apple release CVEs by exploitation activity (exploited, PoC, weaponized, CISA KEV).
• Enables product-level filtering to scope CVEs to only the Apple products in your environment.

Threat Intelligence · 2026-07-22

Feedly Threat Intelligence adds Apple security release enrichment and triage in the Vulnerability Intel Agent.

• Enables enrichment and triage of Apple security releases directly within the Vulnerability Intel Agent.

Threat Intelligence · 2026-07-22

Feedly's Vulnerability Intel Agent now ingests Apple security releases within minutes, with enrichment and filtering by exploitation, product, and patch policy.

• Adds Apple security release ingestion to the Vulnerability Intel Agent, with each CVE appearing in the output table within minutes of publication.
• Supports filtering CVEs by exploitation activity (exploited, PoC, weaponized, CISA KEV) to surface the highest-priority items from a release.
• Enables product-level filtering so practitioners can scope a release to only the Apple products they actually run (e.g., macOS only).

Secrets Detection & Management · 2026-07-22

GitGuardian v2.167 adds 11 new secret detectors spanning Azure, AI/LLM platforms, and developer tools, plus expanded validity checking.

• New detector for LiteLLM API Key (without host capture).
• New detector for Azure SQL Credentials (Assignment).
• New detector for Azure Machine Learning keys.

AI Coding Agents · 2026-07-22

Kiro adds global hooks, searchable session history, proxy reliability, and dynamic MCP tool refresh.

• Adds user-level global hooks that apply across all projects without per-project configuration.
• New searchable session history panel lets practitioners quickly locate and revisit past agent sessions.
• Agent now recovers automatically from interrupted responses in corporate proxy environments.

Identity & Access Management · 2026-07-22

Nudge Security adds exportable admin audit log capturing OAuth revocations, role changes, and app connect/disconnect events.

• New audit log records every administrative action — OAuth revocations (with reason), role changes, field and setting updates, and app connect/disconnect events — exportable as CSV for SOC 2 and compliance evidence.

Identity & Access Management · 2026-07-22

Nudge Security adds continuously updated inherent and residual risk scores for every SaaS and AI vendor, now in open beta.

• Adds inherent and residual risk scores for every SaaS and AI vendor, mapped to Low/Medium/High/Critical levels and recalculated automatically as risk factors change.
• Surfaces a transparent breakdown of risk drivers: vendor security posture, internal deployment/usage factors (e.g., critical downstream connections, AI agents), and compensating controls.
• Provides recommended actions ranked by projected residual risk reduction so teams know what to remediate first.

Identity & Access Management · 2026-07-22

Nudge Security adds automatic business criticality tiers and 27 data-type filters for SaaS/AI inventory, now in open beta.

• Automatically assigns each app a business criticality tier (Low, Medium, High, or Critical) based on inferred data types the vendor typically handles.
• Filters SaaS and AI inventory across 27 distinct data types with no manual research required.
• Enables customization of data sensitivity tiers to match your organization's data governance model via Settings > Risk.

AI Coding Agents · 2026-07-22

Codex CLI adds Codex Auto Review model metadata, session headers for realtime conversations, and routes LM Studio traffic through the shared HTTP client.

• Configures Codex Auto Review with an action-risk review prompt template, default generic security policy, approval rules, and permission messages for danger_full_access, workspace_write, and read_only modes.
• Includes session-id and thread-id headers when starting realtime conversations over WebSocket or WebRTC.
• Routes LM Studio server requests through the shared route-aware HTTP client pool, adding connection-timeout support scoped to connection establishment.

AI Coding Agents · 2026-07-22

• Adds app/read app-server API endpoint for fetching metadata for up to 100 app IDs with optional tool summaries, deduplication, and caching.
• Adds audio input support forwarded to the Responses API, gated by model input modalities.
• Adds API for reading installed app runtime state.

AI Coding Agents · 2026-07-22

Codex CLI alpha.30 adds Esc-key session interruption and parallel stdin writes across unified-exec sessions.

• Runs write_stdin in parallel across unified-exec sessions for faster multi-session I/O.
• Updates bundled model catalog with GPT-5.6 context windows set to 272,000 tokens and new personality instruction variables.

AI Coding Agents · 2026-07-22

Codex CLI v0.145.0 adds paginated thread history, Amazon Bedrock support, audio inputs, multi-agent V2 GA, and /import for Cursor/Claude settings.

• Adds experimental paginated thread history with resume, search, persisted thread names, sub-agent support, and memories.
• Expands /import to migrate settings, MCP servers, plugins, sessions, commands, and project-scoped memories from Cursor and Claude Code.
• Adds experimental Amazon Bedrock login with custom endpoint and authentication support; sets GPT-5.6 Sol as the default Bedrock model.

Threat Intelligence · 2026-07-22

OpenCTI adds app:uri_deny_list config option to block specific URIs at the application level.

• New app:uri_deny_list configuration setting enables administrators to block specific URIs from being accessed within the OpenCTI application.

Threat Intelligence · 2026-07-22

OpenCTI adds APP__URI_DENY_LIST config option to block specific URIs at the application level.

• New APP__URI_DENY_LIST configuration parameter lets operators block specific URIs from being accessed within OpenCTI.

Threat Intelligence · 2026-07-22

OpenCTI 7.260722.0 adds a faceted connector marketplace, workflow reset, webhook deny-lists, admin-forced password changes, and auto-reloading public dashboards.

• Redesigns the connector catalog into a faceted marketplace experience for easier discovery and filtering.
• Adds ability to fully reset a workflow to its initial state.
• Adds a configurable deny-list of URIs for webhooks to block outbound calls to restricted endpoints.

AI Coding Agents · 2026-07-22

Pi RPC adds retry-lifecycle events for compaction and branch-summary summarization failures.

• New summarization_retry_scheduled, summarization_retry_attempt_start, and summarization_retry_finished RPC events expose the full retry lifecycle when compaction or branch-summary summarization hits a transient provider error.

AI Coding Agents · 2026-07-22

Pi adds OpenRouter as an OAuth provider, minting a user-controlled API key billed from OpenRouter credits.

• Adds OpenRouter as a sign-in provider via PKCE OAuth flow, creating a user-controlled API key billed from OpenRouter credits that does not expire automatically.

AI Coding Agents · 2026-07-22

Pi adds Google Gemini 3.5 Flash Lite, Gemini 3.6 Flash, and Poolside Laguna S 2.1 to its model catalog.

• Adds Google Gemini 3.5 Flash Lite (google/gemini-3.5-flash-lite) as a new available model.
• Adds Google Gemini 3.6 Flash (google/gemini-3.6-flash) as a new available model.
• Adds Poolside Laguna S 2.1 (poolside/laguna-s-2.1) and a free tier variant (poolside/laguna-s-2.1:free) as new available models.

AI Coding Agents · 2026-07-22

Pi 0.81.1 adds verifiable release source archives and resilient compaction with retry lifecycle events.

• Adds deterministic, checksummed source archives to GitHub releases with documented instructions for rebuilding standalone binaries.
• Transient provider failures during compaction and branch summaries now follow the configured retry policy, with retry lifecycle events exposed to interactive, JSON, RPC, and SDK consumers.

AI Coding Agents · 2026-07-22

Pi v0.81.1 adds verifiable, checksummed release source archives for reproducible standalone binary builds.

• Adds deterministic, checksummed source archives to GitHub releases with documented instructions for rebuilding standalone binaries, supporting supply-chain verification.

Secure Access (VPN / SASE / ZTNA) · 2026-07-22

ShareFile adds AI-powered Request Lists, conditional Forms, and full lifecycle management for document collection workflows.

• New Request Lists feature replaces legacy Request List with full lifecycle management: create, send, manage users, review, approve, and delete/restore.
• Supports creating Request Lists from blank, from a template, or using AI-powered generation (Beta).
• Adds Request List templates: save any Request List as a reusable template.

Secure Access (VPN / SASE / ZTNA) · 2026-07-22

ShareFile adds AI-powered Request Lists, conditional Forms, and a full document-request workflow with templates, approvals, and activity reports.

• Adds Request Lists with full lifecycle management: create from blank, template, or AI generation (Beta), send to recipients, manage users, and restore deleted lists.
• Supports Request List due dates with automated due-date reminders and configurable notifications.
• Enables per-Request-List filters and activity report generation for audit and tracking purposes.

SAST / SCA / Code Security · 2026-07-22

Promptfoo snapshot-20260722 adds adaptive rate limiting, Transformers.js local inference, telecom red team plugins, and video generation providers.

• Adds Transformers.js provider to run Hugging Face models locally in Node.js or the browser.
• Adds Vercel AI Gateway and Cloudflare AI Gateway providers for request routing.
• Adds AWS Bedrock Video (Nova Reel and Luma Ray 2) and Azure AI Foundry Video (Sora) providers for video generation.

Vulnerability Management · 2026-07-22

Qualys VMDR adds QID coverage for Oracle's July 2026 Critical Patch Update across 10+ Oracle products.

• Adds QID detections for Oracle July 2026 Critical Patch Update (CPUJUL2026) covering JDeveloper, Java SE, Coherence, VirtualBox, HTTP Server, Solaris 11.4, WebLogic Server, E-Business Suite, and MySQL Server.

Firewalls & Network Defense · 2026-07-22

Rspamd 4.1.2 adds composite Lua conditions, static_embed neural provider, neural training freeze, external rspamadm command discovery, and WebUI Tabulator migration.

• Adds composite Lua conditions: rspamd_config:add_composite() now accepts a conditions map of synchronous Lua functions gating atom evaluation, with optional depends_on for cross-pass symbol access.
• Introduces policy = "implicit_allow" in settings apply blocks, allowing symbols_enabled to unlock explicit_enable symbols without switching the task into whitelist mode.
• Adds static_embed neural provider: a Model2Vec-style, mmap-shared float32 token-embedding backend requiring no neural forward pass, no FFI, and no new dependencies, with a get_token_vectors() method for external consumers.

Firewalls & Network Defense · 2026-07-22

Rspamd 4.1.2 adds sender-identity preservation for DMARC/SPF, composite Lua conditions, and WebUI Tabulator migration.

• Preserves sender identity through DMARC/SPF processing pipelines.
• Supports composite Lua conditions for more expressive rule authoring.
• Migrates the WebUI to the Tabulator library for improved table rendering.

Firewalls & Network Defense · 2026-07-22

Rspamd 4.1.2 tightens selector parsing, glob map anchoring, explicit_enable gating, alias rewriting, and secretbox nonce handling.

• Invalid selectors now fail configuration load with an error pointing at the offending token, preventing silently truncated selector chains in multimap, rbl, ratelimit, settings, reputation, and the WebUI.
• Glob map patterns are now compiled anchored (^(?:...)$) at load time, closing a subdomain evasion vector where bare entries like *.bit.ly previously matched foo.bit.ly.evil.com.
• Symbols carrying the explicit_enable flag are now strictly gated: they run only when listed in symbols_enabled of applied settings, with a new policy = "implicit_allow" option to unlock symbols additively without whitelisting.

Firewalls & Network Defense · 2026-07-22

Rspamd 4.1.2 adds per-symbol Lua composites, a static embedding Neural provider, new Settings policies, and external Rspamadm command discovery.

• Adds per-symbol Lua conditions and explicit dependencies in Composites rules.
• Adds static_embed Neural provider with a WordPiece subword tokenizer over a static embedding matrix and per-token vector access.
• Adds Neural train.frozen control to halt automatic training and a forced-learn minimal-scan fast path.

SAST / SCA / Code Security · 2026-07-22

StepSecurity adds Agent Skills support for developer machines.

• New Agent Skills capability for developer machines enables automated security skill execution in agentic workflows.

SAST / SCA / Code Security · 2026-07-22

StepSecurity Workflow Run Policies gain allow-list enforcement, container blocking, bulk-secret detection, and richer per-run evaluation visibility.

• Adds Currently known compromised actions display in the Compromised Actions Policy editor, showing affected versions, with the list snapshotted per evaluation for auditability.
• New 'Block only when a workflow accesses all secrets at once' mode in Secret Exfiltration Policy blocks bulk patterns like ${{ toJSON(secrets) }} while allowing targeted references, reducing false positives.
• New Analyze default branch runs option in Secret Exfiltration Policy extends coverage to the default branch.

SAST / SCA / Code Security · 2026-07-22

Dev Machine Guard adds fleet-wide AI agent skills inventory with executable content flagging and provenance tracking.

• New Agent Skills page in the Dev Machine Guard dashboard inventories every AI agent skill (Claude Code, Codex, GitHub Copilot) detected across your fleet, with per-device installation details and scope (Global, Project, or System).
• Flags skills that contain executable script files, declare lifecycle hooks, or inject shell commands that run with developer privileges — surfacing supply chain risk from AI coding agent skill folders.
• Traces provenance of skills installed via the skills.sh CLI back to their source GitHub repository, plugin, and upstream folder hash; standalone skills are marked as authored on device.

AI-Powered Offensive Security · 2026-07-22

Strix v1.2.0 adds recon asset-discovery skill, AD/Kerberos testing, Docker resource limits, shared-network port resolution, and a local run viewer with email reports.

• Adds a recon asset-discovery skill for automated attack surface enumeration.
• Adds an Active Directory / Kerberos domain testing skill for enterprise network assessments.
• Adds a Grafana/Prometheus observability pivot skill to identify exposed monitoring infrastructure.

SIEM · 2026-07-22

Sumo Logic Monitors now support Searchable Time, letting alerts evaluate logs based on when they became searchable.

• Supports Searchable Time for Monitors, enabling alert evaluation based on when logs became searchable in Sumo Logic rather than event time.

Detection Engineering · 2026-07-22

Tenzir v6.8.0 adds a Splunk search input operator and improves ClickHouse batching and JSON column support.

• New from_splunk operator runs bounded searches against a Splunk Search Head and emits results as events, with support for time-bounded queries using native Splunk relative-time syntax, secret-valued authorization headers, TLS, timeouts, and retries.
• The to_clickhouse operator now internally re-batches events before inserting, accumulating events per target table and flushing at max_batch_rows (default 65536) or batch_timeout (default 1s) for more efficient inserts with heterogeneous input like OCSF.
• The to_clickhouse operator can now write string values directly into a ClickHouse JSON column when the string is a valid JSON object, enabling single-schema insert workflows for heterogeneous events.

Detection Engineering · 2026-07-22

Tenzir v6.8.0 adds a Splunk search input for ingesting data from Splunk.

• New Splunk search input enables pulling data from Splunk into Tenzir pipelines.

Detection Engineering · 2026-07-22

Tenzir v6.8.0 adds Splunk search input and improves ClickHouse throughput with JSON column support.

• New from_splunk operator runs bounded searches against a Splunk Search Head and emits results as events.
• to_clickhouse re-batches events before insert for higher throughput and supports writing directly into JSON columns.
• Workspace and node ID are now included in platform connection logs for better traceability.

Detection Engineering · 2026-07-22

Tenzir v6.8.0 adds a Splunk search input for ingesting data from Splunk.

• New Splunk search input enables pulling data from Splunk into Tenzir pipelines.

Detection Engineering · 2026-07-22

Tenzir v6.8.0 adds a Splunk search input operator and improves ClickHouse throughput with JSON column support.

• New from_splunk operator lets nodes run bounded searches against a Splunk Search Head and emit results as events.
• Upgraded to_clickhouse operator re-batches events before insert for higher throughput.
• Adds support in to_clickhouse for writing directly into JSON columns.

SOAR · 2026-07-22

Tines Records now supports a JSON field type for storing structured data alongside other record fields.

• Adds a JSON field type to Records, enabling structured data to be stored directly within a record.

Endpoint Security (EDR/XDR) · 2026-07-22

Trend Vision One AI Secure Access can now chain with third-party secure web gateways (e.g., Zscaler, Netskope) for AI-specific inspection.

• Enables chaining AI Secure Access with existing third-party secure web gateways or CASB solutions (such as Zscaler or Netskope) to layer AI-specific inspection and access control on top of general web traffic inspection.

Firewalls & Network Defense · 2026-07-22

Vectra AI v9.13 expands detections for Windows post-exploitation, HTTP attack tools, covert tunneling, and credential/data exfiltration techniques.

• New detections for SMB-based lateral movement, malicious named pipe activity, and Cobalt Strike SMB beaconing across Windows environments.
• Expanded HTTP-based behavioral signatures covering malicious file downloads/uploads, certificate abuse, and offensive framework activity using trusted Windows utilities.
• New detection coverage for web-based tunnels, public tunneling services, and custom BackConnect protocols used to bypass perimeter controls.

Firewalls & Network Defense · 2026-07-22

Vectra AI v9.13 expands ERSPAN support to 8-core+ virtual Sensors and 16 IPs per capture interface.

• Supports 8-core and higher virtual Sensors for ERSPAN-based monitoring deployments.
• Supports up to 16 IPs per capture interface in ERSPAN environments.
• Increases processing efficiency for encapsulated traffic workloads in ERSPAN deployments.

SAST / SCA / Code Security · 2026-07-22

Veracode Static Analysis July 2026 engine adds Android 17, .NET 10 enhancements, Python httplib SSL detection, and pnpm module support.

• Adds support for Android 17 in the static analysis engine.
• Enhances support for .NET 10, including improved analysis of applications using Saturn.dll.
• Adds support for Python httplib to detect CWE-295 and CWE-297 (SSL/TLS certificate validation) flaws.

Threat Intelligence · 2026-07-22

Watcher v3.5.2 adds a Connectors dashboard for centralizing integrations, Fernet-encrypted credentials, and SSO auto-provisioning control.

• New /connectors dashboard (superuser only) centralizes configuration, live overrides, and health-check testing for all external integrations (SMTP, Slack, TheHive, MISP, LDAP, OIDC, MISP, CertStream, SearxNG, CyberWatch, WIPO UDRP, MySQL).
• Per-connector live connectivity tests report Healthy / Unhealthy / Not tested yet status alongside Configured / Incomplete / Disabled state.
• Scheduled job automatically tests every connector each Monday at 06:00 and raises a Pending Action alert only for configured connectors that fail, without duplicating alerts on repeated failures.

CNAPP · 2026-07-22

Wiz adds a Threat Actors page listing historical threat actors that have targeted Fortinet products.

• New Threat Actors page surfaces a comprehensive list of threat actors that have historically targeted Fortinet products.

Runtime Security · 2026-07-22

Wiz Agentless Workload Detection gains EDR-like visibility into FortiGate appliances, Redis, npm supply chain, and more virtual appliance threats.

• Extends Agentless Workload Detection to FortiGate firewalls, collecting and parsing local FortiOS logs not typically streamed to expose attacker activity including super-user account creation and configuration theft.
• Adds Cloud Event page visibility for FortiGate authentication logs, enabling real-time monitoring of login activity and admin account changes for agentless EDR customers.
• Adds built-in threat detection rules for Redis replication abuse: Redis suspicious replication target configured, Redis module loaded from unusual path, and Attack Detected and Prevented by Redis.

Identity & Access Management · 2026-07-21

Auth0 launches Anonymous Sessions beta: stateless guest sessions with seamless linking to authenticated users

• New POST /anonymous/token endpoint creates, refreshes, and retrieves access tokens for unauthenticated (anonymous) sessions.
• Supports seamless session linking — anonymous sessions can be tied to authenticated users via pre-registration and post-login Actions.
• Activity Preservation carries anonymous session data across devices onto the authenticated user profile upon login.

Endpoint Security (EDR/XDR) · 2026-07-21

Automox Policy Results Report gains Partial status, per-package failure reasons, and raw log side panel.

• Adds Partial as a new policy run result status when some patches succeed and others encounter errors, replacing a single pass/fail outcome.
• Adds per-package breakdowns in the device table for Successful, Failed, or Partial runs, showing plain-language failure reasons (e.g., The application is currently running, Pending system restart).
• Raw logs for individual packages now open in a side panel via View Raw Logs, keeping detail accessible without cluttering the table.

Attack Surface & Exposure Management · 2026-07-21

Axonius adds Cyber Physical Assets module for passive OT/ICS device discovery, protocol-based enrichment, and network communication monitoring.

• Passively discovers devices and vulnerabilities on the wire via new Cyber Physical Assets capability.
• Queries OT devices for protocol-based enrichment of asset data.
• Monitors network communications for operational technology environments.

Attack Surface & Exposure Management · 2026-07-21

Axonius adds Cyber Physical Assets module for passive OT device discovery, protocol-based enrichment, and network communication monitoring.

• Passively discovers devices and vulnerabilities on the wire for OT/ICS environments via new Cyber Physical Assets capability.
• Queries OT devices for protocol-based enrichment to surface detailed asset context.
• Monitors network communications across cyber-physical environments.

Attack Surface & Exposure Management · 2026-07-21

Axonius adds Cyber Physical Assets module for passive OT/ICS device discovery, vulnerability detection, and network monitoring.

• Passively discovers devices and vulnerabilities on the wire for OT/ICS environments.
• Queries OT devices using protocol-based enrichment to gather richer asset context.
• Monitors network communications for cyber-physical asset visibility.

Attack Surface & Exposure Management · 2026-07-21

Axonius 9.0.1 adds 5 new adapters, SAML advanced role/scope mapping, custom compliance values, and dozens of adapter enhancements.

• New Bold Security adapter: inventories endpoints, agent status, and browser extension protection.
• New EasyDNS adapter: fetches domain registrations, zone management, and DNS record configurations.
• New Google Threat Intelligence ASM adapter: discovers internet-facing assets including domains, networks, network services, and aggregated security findings.

Attack Surface & Exposure Management · 2026-07-21

Censys adds Argo CD scanner, three AI tool fingerprints, and three Microsoft SharePoint RCE risks to ASM.

• Adds new endpoint scanner for Argo CD (ARGOCD), available to Starter, Search, and Core users.
• Adds fingerprints for three AI/no-code tools: Anything LLM, Capacity, and Softr.
• Adds three new ASM risks for Microsoft SharePoint Server covering CVE-2026-45659 (authenticated deserialization RCE, CISA KEV-listed), CVE-2026-50522, and CVE-2026-58644 (both unauthenticated deserialization RCE).

AI Coding Agents · 2026-07-21

Claude Code v2.1.216 adds sandbox filesystem-isolation bypass, smarter /context warnings, and improved /fork, /ultrareview, and /code-review ultra feedback.

• Adds sandbox.filesystem.disabled setting to skip filesystem isolation while keeping network egress control active.
• Adds explicit context-window overflow warning to /context and surfaces failed /compact as a visible error.
• Improves /fork confirmation to include the new session name, claude attach id, and whether the copy shares the checkout.

Web Application Security · 2026-07-21

Cloudflare Realtime launches with RealtimeKit SDKs, a global SFU, and a managed TURN relay for WebRTC apps

• New RealtimeKit SDK suite adds high-level APIs and pre-built UI components for live video/voice (meetings, breakout rooms, recording, chat, polls, virtual backgrounds, transcription) in just a few lines of code.
• New Realtime SFU (Selective Forwarding Unit) provides a low-level, unopinionated WebRTC media server running on Cloudflare's global network for developers who need full control over media routing.
• New managed TURN service acts as a public relay for WebRTC traffic, ensuring connectivity for users behind restrictive firewalls or NATs, with Anycast routing to the nearest Cloudflare location.

Web Application Security · 2026-07-21

Cloudflare adds WAF rules for Adobe ColdFusion & WordPress CVEs, browser login for HTTP private apps, and Durable Object SQLite storage monitoring.

• New WAF rules target Adobe ColdFusion path traversal vulnerabilities (CVE-2026-48276, CVE-2026-48282) blocking unauthenticated file upload and filesystem access attacks.
• New WAF rules cover WordPress SQL injection (CVE-2026-60137) and unauthenticated remote code execution (CVE-2026-63030).
• New emergency detection rules deployed for Generic Rules - Unauthenticated RCE, Generic Rules - Authentication Bypass (Auth Bypass - 2), and Generic Rules - Information Disclosure.

Web Application Security · 2026-07-21

Cloudflare API gains broad CloudForce One threat-intel endpoints, Magic Connector interrupts, and AI Audit robots.txt controls

• Adds Magic Connector Interrupts API: list and create interrupt events per connector (/accounts/{account_id}/magic/connectors/{connector_id}/interrupts).
• Adds bulk DOS event creation with relationships and indicators via CloudForce One (/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships).
• Adds CloudForce One event aggregation by single or multiple columns with optional date filtering (/accounts/{account_id}/cloudforce-one/events/aggregate).

Web Application Security · 2026-07-21

Cloudflare adds browser-based login for plaintext HTTP private apps and SQLite storage tracking for Durable Objects.

• Enables browser-based Access login flow for plaintext HTTP private applications, matching the existing HTTPS app experience instead of relying on Cloudflare One Client notifications.
• Adds total SQLite storage usage tracking over time for Durable Object namespaces in the Cloudflare dashboard.
• New WAF managed ruleset changes released 2026-07-21 and scheduled for 2026-07-27.

Web Application Security · 2026-07-21

Cloudflare adds browser-based login for plaintext HTTP private apps and SQLite storage tracking for Durable Objects

• Enables in-browser Access login flow for plaintext HTTP private applications, matching the experience already available for HTTPS apps.
• Adds total SQLite storage usage tracking over time for Durable Object namespaces in the Cloudflare dashboard.

Web Application Security · 2026-07-21

Cloudflare WAF adds new SSRF, LFI, XSS obfuscation, Adobe ColdFusion, and WordPress rules plus generic RCE/Auth Bypass/Info Disclosure detections.

• Adds two new SSRF detection rules blocking restricted-protocol and obfuscated-host request forgery attempts.
• Adds a new LFI path traversal detection rule to the Cloudflare Managed Ruleset.
• Adds three new XSS rules targeting JavaScript bracket-concatenation obfuscation across body, headers, and URI.

Web Application Security · 2026-07-21

Cloudflare WAF adds three new/improved managed rules for SSRF, command injection obfuscation, and generic DoS detection.

• New detection rule for Command Injection - Obfuscation (rule ID ...761e7a4c), deploying in Log mode on 2026-07-27.
• New detection rule for Generic Rules - DoS (rule ID ...90dcdb0a), deploying in Log mode on 2026-07-27.
• Improved SSRF - Cloud - Beta detection rule (rule ID ...c2e84e2d), deploying in Log mode on 2026-07-27.

AI Agent Frameworks · 2026-07-21

CrewAI 1.15.5 adds authentication support for skill registry downloads.

• Supports authenticated downloads from the skill registry, enabling access to private or restricted skills.

AI Coding Agents · 2026-07-21

Crush v0.86.0 adds LSP rename/replace tools, scrollable sidebar, removable attachments, and SSH-friendly OAuth URL copy.

• Adds lsp_rename tool: renames a symbol and all its references across the project via LSP.
• Adds lsp_replace_symbol tool: replaces, inserts before/after, or deletes an entire function, method, or class by name via LSP.
• Enables scrollable sidebar with keyboard (l/h/j/k/g/G/arrows) and mouse-wheel navigation when sidebar content overflows.

Web Application Security · 2026-07-21

DataDome Envoy module now supports logging enriched Protection API headers via Envoy dynamic metadata.

• Enables logging of DataDome enriched headers (e.g. x-datadome-isbot) in Envoy access logs by referencing the <DATADOME_TENANT_NAME>-datadome dynamic metadata namespace.

Web Application Security · 2026-07-21

DataDome adds MCP-aware payload fields and Session-by-Header (X-DataDome-ClientID) support to its Validate Request API.

• Supports Session by Header: integrations can now supply the client ID via the X-DataDome-ClientID request header as a higher-priority alternative to the datadome cookie, enabling session tracking for non-browser clients.
• Adds X-DataDome-X-Set-Cookie: true signaling so integrations using header-based client IDs receive the updated session value in X-Set-Cookie instead of Set-Cookie.
• Introduces Enriched Headers: the X-DataDome-request-headers pointer header lets integrations selectively inject upstream bot-signal headers (e.g., X-DataDome-isbot, X-DataDome-botname) into requests reaching the origin server.

Web Application Security · 2026-07-21

DataDome Envoy module 2.7.0 exposes enriched headers as Envoy dynamic metadata for downstream logging.

• Adds DataDome enriched headers to Envoy dynamic metadata, making bot-detection signals available for use in access logs and observability pipelines.

Vulnerability Management · 2026-07-21

DefectDojo 3.1 adds granular deduplication execution modes for import/reimport and a configurable OS promo banner setting.

• New deduplication_execution_mode setting (per-user profile and per-request override) controls whether import/reimport deduplication runs async, async-with-wait, or fully inline sync.
• New async_wait mode makes the import/reimport API response wait for deduplication to complete, so response statistics and scan_added notifications reflect the deduplicated finding count.
• New deduplication_complete boolean field in import/reimport API responses indicates whether deduplication had finished before the response was produced.

Vulnerability Management · 2026-07-21

DefectDojo Pro adds nested Asset Hierarchy (Beta): parent/child relationships between Products with scoped RBAC and visual diagram.

• Enables parent/child relationships between Assets (formerly Products), allowing unlimited nesting to model branches, mono-repo components, or isolated pen-test groups.
• Adds an Asset Hierarchy diagram view — filterable table of Assets that renders an interactive hierarchy diagram with zoom, drag, and node-level actions.
• Supports per-node actions in the diagram: navigate to Asset view, edit Asset, add a Child Asset, change Parent Asset, or remove a parent relationship.

Digital Forensics & Incident Response · 2026-07-21

dfvfs 20260717 switches to pyfsfat as the default FAT file-system back-end.

• Promotes pyfsfat to the default back-end for FAT file-system parsing, replacing the previous default.

Secure Access (VPN / SASE / ZTNA) · 2026-07-21

DNSFilter redesigns the Query Log with multi-select filters, cross-org toggling, second-level timelines, and shareable URLs.

• Redesigned DNS Query Log with a top-level filter bar supporting multi-select across Sites, Roaming Clients, Relays, and Users.
• MSP admins can now toggle between organizations directly from the Query Log without losing active filters, enabling faster cross-org investigation.
• New custom timeline picker lets analysts narrow Query Log search windows down to the second.

Reverse Engineering · 2026-07-21

EMBA v2.0.3 adds legacy SSL/TLS support to reach end-of-life devices modern OpenSSL can no longer connect to.

• Supports legacy SSL/TLS ciphers during live analysis, enabling vulnerability detection on old embedded devices that modern OpenSSL rejects.
• Expands CSV log output across additional modules for richer machine-readable reporting.
• Adds entropy file checking to aid detection of encrypted or compressed firmware regions.

Secrets Detection & Management · 2026-07-21

GitGuardian roadmap adds incident routing, Sonatype Nexus scanning, and full encoded-secret insights

• New incident routing (phase 1) automatically assigns a Lead (accountable) and Participants (doing the work) to every incident at creation.
• Supports scanning Sonatype Nexus Repository package and container image registries for hardcoded secrets.
• Displays full encoded insights — persists and surfaces analyzer feedback including decoded base64 and JWT detector results.

Secrets Detection & Management · 2026-07-21

GitGuardian adds @mentions in incident notes, perimeter source status filtering, and oversized PR scanning for Business plans.

• Adds @mentions in incident notes and feedback — type @name or @team-name to notify individuals or entire teams via email, linking directly to the incident; works on both Internal and Public Monitoring incidents.
• Extends source health management (auto-pause, auto-resume, and actionable recovery steps) to ServiceNow, JFrog Container Registry, JFrog Package Registry, and Microsoft OneDrive.
• Introduces perimeter source status indicators (Monitored, Unmonitored, Unreachable, Archived, Deleted) filterable from the perimeter page and incident list, with saveable views.

Secrets Detection & Management · 2026-07-21

GitGuardian adds @mention notifications in incident notes, source health for new integrations, and oversized PR scanning on Business plan.

• Adds @mention support in incident notes and feedback — type @ to tag a member by @name or an entire team by @team-name, triggering email notifications that link directly to the incident.
• Extends source health management (auto-pause, auto-resume, and recovery guidance) to ServiceNow, JFrog Container Registry, JFrog Package Registry, and Microsoft OneDrive sources.
• Introduces per-source status indicators (Monitored, Unmonitored, Unreachable, Archived, Deleted) on the perimeter page and incident list, with filterability and saveable views.

AI Agent Frameworks · 2026-07-21

Hermes Agent launches with CLI install, multi-platform support, desktop app, and Tool Gateway integration.

• Adds hermes setup --portal one-command onboarding that logs in, sets Nous as the LLM provider, and enables the Tool Gateway (web search, image generation, TTS, cloud browser).
• Supports install across Linux, macOS, WSL2, Windows (native PowerShell), Android (Termux), and NixOS with a single installer script that auto-provisions Python 3.11, Node.js v22, ripgrep, and ffmpeg.
• Adds root-mode FHS layout (/usr/local/lib/hermes-agent/, /usr/local/bin/hermes) for shared-machine and system-service deployments.

AI Agent Frameworks · 2026-07-21

Hermes CLI gains a token command to rotate access tokens with optional Bitwarden validation.

• New token command rotates the access token, validating it against Bitwarden before storing; rejected tokens leave the existing token unchanged.
• Supports --no-verify flag to skip the Bitwarden probe for non-interactive or automated use.

AI Agent Frameworks · 2026-07-21

Hermes v2026.7.20 slashes first-token latency 80%, adds password-manager secret sources, live subagent transcripts, and terminal subscription management.

• Cuts cold-start first-turn latency ~80% (4.3s → 0.9s) across CLI, TUI, gateway, desktop, and cron.
• Streams reasoning model thinking live by default (display.show_reasoning on) — no more waiting at a spinner.
• Adds /subscription and /topup commands to manage your Nous plan and billing directly from the terminal or TUI.

Attack Surface & Exposure Management · 2026-07-21

Intruder now surfaces Microsoft 365 configuration risks across Entra ID, Exchange Online, SharePoint, and Teams within Azure cloud scans.

• Adds Microsoft 365 configuration security checks covering Entra ID, Exchange Online, SharePoint, and Teams as part of existing Azure cloud security scans.
• Automatically runs a subset of M365 checks with existing Azure integrations, with full coverage unlocked by updating integration permissions.

Identity & Access Management · 2026-07-21

JumpCloud Agent 2.147.7 adds SMS OTP MFA support across all OSes and reduces SIEM noise on Linux.

• Adds SMS OTP authentication factor support for MFA on logins and password changes across all managed device OSes.
• Self Service App Catalog now processes state changes only for applications the user interacts with, eliminating unnecessary retries and speeding up app management.
• Removes unnecessary sudo usage from Linux agent operations, reducing SIEM security alerts and improving system audit log clarity.

Digital Forensics & Incident Response · 2026-07-21

mac_apt v1.33.2 adds Biome and Trash plugins, compressed DMG support, SFL4 in RECENTITEMS, and richer bookmark metadata.

• New BIOME plugin parses Apple Biome data from macOS artifacts.
• New TRASH plugin extracts deleted file/folder metadata from .DS_Store files in the .Trash folder.
• Supports compressed DMG images (based on dmgwiz), expanding disk image compatibility.

Malware Analysis · 2026-07-21

malcontent v1.25.4 adds --ignore-rules to suppress specific YARA rules from scan and diff reports.

• Adds --ignore-rules flag to exclude specific YARA rules from scan and diff report output.

AI Coding Agents · 2026-07-21

Adds route-aware HTTP client pooling and system proxy support across daemon, plugins, and remote backends.

• Adds a route-aware HTTP client pool (RouteAwareClientPool) that selects the correct outbound proxy route per request URL, reusing clients by resolved route with a bounded cache of 16 routes.
• Honors system proxy settings in the daemon updater, remote plugins, and cloud environment discovery.
• Supports CARGO_HTTP_CAINFO as a custom CA source in managed proxy/MITM environments.

AI Coding Agents · 2026-07-21

Codex CLI gains concurrent terminal stdin, audio input/output, Amazon Bedrock custom transports, and incremental Markdown streaming.

• Enables parallel write_stdin tool calls across independent terminal sessions, serializing per-session I/O for safety.
• Supports custom transports for Amazon Bedrock provider connections.
• Adds audio output support to dynamic tools and code mode.

AI Coding Agents · 2026-07-21

Codex CLI adds Esc key to interrupt running sessions and updates bundled model metadata including GPT-5.6 context windows.

• Enables pressing Esc to interrupt a running agent session mid-task, with Esc now documented as an interrupt key in the status indicator.
• Updates bundled GPT-5.6 model variants with 272,000-token context windows and refreshed model instructions.
• Adds personality instruction variables for GPT-5.6 model variants and includes a GPT-5.5 availability notice in the bundled catalog.

AI Coding Agents · 2026-07-21

OpenCode v1.18.4 adds adaptive thinking for Kimi models and desktop UI improvements including inline file browser tabs.

• Adds adaptive thinking controls for Kimi models on Anthropic-compatible providers, with summarized reasoning output by default.
• Syncs the embedded terminal theme with the active app theme in the desktop app.
• Rewrites the v2 prompt input for more reliable command, context, shell, attachment, and history interactions.

AI Coding Agents · 2026-07-21

OpenHands cloud-1.47.0 gates Agent Canvas behind SaaS authentication.

• Protects the Agent Canvas behind SaaS authentication, restricting access to authenticated cloud users.

Runtime Security · 2026-07-21

OpenShell v0.0.88 adds a workspace resource model with scoping and membership controls.

• Adds a workspace resource model with scoping and membership support, enabling structured multi-tenant workspace management.

AI Coding Agents · 2026-07-21

Pi RPC adds get_available_thinking_levels command and cost tracking fields across session and tool usage.

• New get_available_thinking_levels RPC command returns the reasoning/thinking levels supported by the current model (e.g. off, minimal, low, medium, high).
• Session-level usage now includes a cost object (input, output, cacheRead, cacheWrite, total) covering the full session including compaction and branch-summary generation.
• Tool usage responses now support an optional usage field reporting nested LLM token and cost totals contributed by the tool to session-wide accounting.

AI Coding Agents · 2026-07-21

Pi adds Qwen Token Plan provider support, including a China-region variant.

• Adds qwen-token-plan as a new provider, configured via QWEN_TOKEN_PLAN_API_KEY.
• Adds qwen-token-plan-cn as a China-region Qwen Token Plan provider, configured via QWEN_TOKEN_PLAN_CN_API_KEY.

AI Coding Agents · 2026-07-21

Pi 0.81.0 adds llama.cpp model management, full provider extensions, Qwen Token Plan support, and expanded usage accounting.

• Adds local llama.cpp router integration: connect to a router, search and download Hugging Face models, and explicitly load or unload models with live progress.
• Enables extensions to register complete pi-ai providers with native authentication, model refresh, filtering, and custom streaming behavior.
• Adds built-in Qwen Token Plan and Qwen Token Plan China providers with regional endpoints and API-key authentication.

AI Coding Agents · 2026-07-21

Pi v0.81.0 adds local llama.cpp model management, full provider extensions, Qwen Token Plan support, and expanded usage accounting.

• Adds built-in llama.cpp router support via /login connection setup and /llama subcommand for Hugging Face model search, download, explicit load/unload, and live progress.
• Enables extensions to register complete pi-ai providers with native authentication, model refresh, filtering, and custom streaming behavior.
• Adds Qwen Token Plan and Qwen Token Plan China as built-in providers with regional endpoints and API-key authentication.

Identity & Access Management · 2026-07-21

DaVinci flow timeout analytics now expose errorType, errorCode, and errorMessage in analytics and webhook events.

• Adds errorType, errorCode, and errorMessage properties to analytics and webhook events for flow executions that time out (when logging level is Error or Debug).

Identity & Access Management · 2026-07-21

Ping Identity adds Rich Authorization Requests (RFC 9396) support, per-client authorization detail types, and a new Patch Object node v2.0.

• New realm-level OAuth2 Provider setting Enable Rich Authorization Requests with RCS enables processing of authorization_details requests when an RCS is configured and controls advertisement of authorization_details_types_supported on the well-known endpoint.
• Supports configuring Authorization Detail Type(s) on individual OAuth 2.0 clients to control which RFC 9396 Rich Authorization Request detail types each client can request.
• Dynamic client registration requests can now include authorization_details_types to declare the authorization detail types a client supports.

SAST / SCA / Code Security · 2026-07-21

Portkey's GET /v1/models now supports provider-backed proxying and a new header to force Model Catalog results.

• Adds provider-backed mode to GET /v1/models: pass x-portkey-provider: @<provider-slug> or a config with provider/targets to proxy the request to the upstream provider's /v1/models and receive a response normalized to OpenAI models list format.
• Adds x-portkey-fetch-integrated-models: true header (and fetch_integrated_models: true config field) to force GET /v1/models to return your workspace's Model Catalog models even when a provider header or config is present.
• Model Catalog results are automatically filtered to only the provider slugs referenced in your routing config when fetch_integrated_models is active; passthrough: true targets return the full unfiltered list.

SAST / SCA / Code Security · 2026-07-21

Portkey adds a Models API endpoint to retrieve the list of available models.

• New Models API endpoint lets you programmatically retrieve the list of models available in your Portkey account.

SAST / SCA / Code Security · 2026-07-21

Portkey adds vault-backed credentials, weekly rate limits, cross-cloud GCS logging, and four new guardrail integrations in March 2026.

• Introduces weekly rate and budget windows (rpw) so spend caps align with team planning cycles, not just per-minute or monthly aggregates.
• Adds endpoint-scoped rate limits so chat completions, embeddings, and admin routes can each carry independent limits instead of a single global rule.
• Enables GCP Workload Identity Federation log storage (gcs_assume) from AWS-hosted gateways via GCP_WIF_AUDIENCE and GCP_WIF_SERVICE_ACCOUNT_EMAIL, eliminating static GCP keys in AWS.

Vulnerability Management · 2026-07-21

Qualys TruRisk Eliminate adds AI-Powered Patch Reliability Score and zero-touch automation for low-risk application patching.

• New AI-Powered Patch Reliability Score uses crowd-sourced signals from patch deployments across the internet to assess whether a patch is safe to deploy before rollout.
• New zero-touch patch automation enables low-risk applications (e.g., browsers and standalone software) to receive patches automatically after a one-time job setup, with no manual intervention required.
• Supports autonomous remediation workflow: high-reliability patches deploy with confidence while low-reliability patches are flagged for review, balancing speed and production safety.

Vulnerability Management · 2026-07-21

Qualys VMDR adds QID coverage to detect CVE-2026-8933, a high-severity LPE in snap-confine on Ubuntu 24.04/25.10/26.04.

• New QID detection(s) for CVE-2026-8933, a high-severity Local Privilege Escalation in snap-confine affecting default Ubuntu Desktop 24.04, 25.10, and 26.04 installations.

Identity & Access Management · 2026-07-21

SailPoint ISC admins must now specify an approved integration when creating API or Personal Access Tokens.

• Requires admins to select an approved integration when creating API or Personal Access Tokens, enabling per-integration traffic visibility.
• Introduces the Unified Platform Access Program, enabling deeper product integrations tied to specific tokens.

Identity & Access Management · 2026-07-21

SailPoint admins can now view, edit, and bulk-manage all Personal Access Tokens org-wide, plus a new Bulk update PAT expiration API.

• New admin screen under Admin → Security Settings → Personal Access Tokens lets admins view and manage all PATs in the environment, not just their own.
• Admins can edit individual PATs or modify multiple tokens at once using bulk operations.
• Admins can change or remove expiration dates on any PAT across the organization.

Container & Image Security · 2026-07-21

Syft v1.49.0 adds support for OCI image index manifests in root OCI layouts.

• Supports application/vnd.oci.image.index.v1+json manifests in root OCI layout directories, enabling SBOM generation from multi-platform OCI index artifacts.

General Utilities & Libraries · 2026-07-21

SysReptor 2026.58 adds plugin management UI, SSO identity API token auth, and AI agent delete confirmation.

• Enables enabling/disabling plugins directly from the settings web UI.
• Supports SSO identity API for API token authentication.
• AI agent now prompts for confirmation before reverting changes (delete).

SOAR · 2026-07-21

Tines extends change control to cover all case elements defined in the storyboard.

• Enables change control tracking for every change across case elements defined in the storyboard.

SOAR · 2026-07-21

Tines cases now support formulas across every case property, primitive, and case content field from the storyboard.

• Enables formula expressions across all case properties, primitives, and case content when defining cases from the storyboard.

SOAR · 2026-07-21

Tines lets you visually configure case creation and write rich-text descriptions directly in the storyboard editor.

• Enables visual definition of all case fields when building with the create case tile in the storyboard.
• Supports rich-text formatting for case descriptions and block content within the storyboard editor.

AI/LLM Security · 2026-07-21

ToolHive v0.40.0 adds RFC 8693 token exchange for agentic delegation and early MCP 2026-07-28 revision support.

• Adds RFC 8693 OAuth 2.0 Token Exchange grant handler to the embedded authorization server, enabling agents to exchange a user token for a delegated token carrying both the user (sub) and the acting agent (act.sub) — the foundation for agentic delegation.
• Adds request-parsing support for the upcoming MCP 2026-07-28 (Modern) stateless revision, including a revision classifier, Mcp-Method/Mcp-Name headers, _meta vocabulary, and server/discover/subscriptions/listen authz registration (dormant until wired into proxy routing).
• Migrates MCP protocol handling from mark3labs/mcp-go to the official modelcontextprotocol/go-sdk via the toolhive-core/mcpcompat compatibility shim.

Endpoint Security (EDR/XDR) · 2026-07-21

File Password Analysis now covers all inbound security functions—spam, content filtering, and DLP—not just virus scanning.

• Extends File Password Analysis to all inbound security functions, including spam filtering, content filtering, and DLP, so password-protected attachments are fully inspected across every enabled policy layer.

Endpoint Security (EDR/XDR) · 2026-07-21

Agentless Vulnerability & Threat Detection now supports AWS eu-south-2 (Spain) region for scanning and VPC Flow Log detections.

• Supports deploying Agentless Vulnerability & Threat Detection in the AWS eu-south-2 (Spain) region.
• Supports Cloud Detections for AWS VPC Flow Logs in the AWS eu-south-2 (Spain) region.

Endpoint Security (EDR/XDR) · 2026-07-21

Zero Trust Secure Access on-premises gateway can now stamp user identity into the X-Authenticated-User header for upstream proxies.

• Enables the on-premises gateway to pass user identity to an upstream proxy via the X-Authenticated-User header.

Endpoint Security (EDR/XDR) · 2026-07-21

Trend Vision One AI Scanner adds LLM-driven agentic red-teaming that dynamically adapts attack prompts based on target AI app responses.

• New agentic attacks capability in AI Scanner uses an LLM-driven attacker model that generates and iterates attack prompts dynamically based on target AI application responses, rather than a static prompt library.
• Agentic attacks are configured through the TrendAI Artifact Scanner and can run alongside existing attack presets, attack objectives, and custom prompts in the same scan.
• Enables continuous red-team validation of AI defenses — guardrails, system prompts, and model behavior — against evolving, adaptive adversarial techniques.

AI/LLM Security · 2026-07-20

AI-Infra-Guard v4.1.15 adds optional model token in scan APIs, 6 new llama.cpp CVE rules, and 3 new MCP threat detection rules.

• Supports omitting the model token in mcp_scan and ai_infra_scan API calls, falling back to the system default model.
• Adds 6 new llama.cpp CVE detection rules to the llama-cpp vulnerability pack.
• Adds 3 new MCP threat detection rules covering tool poisoning, credential exfiltration, and command injection.

Identity & Access Management · 2026-07-20

authentik 2026.5.5 adds number and boolean support in AKQL queries on JSON fields and licensing usage totals in the admin UI.

• Adds number and boolean type support in AKQL queries on JSON fields via the API search interface.
• Adds usage totals display to the licensing section in the admin web UI.

Identity & Access Management · 2026-07-20

authentik 2026.2.5 adds SCIM discovery support and in-process per-IP rate throttling.

• Adds discovery support to the SCIM provider, enabling automatic capability negotiation with SCIM endpoints.
• Introduces in-process per-IP rate throttling to limit abusive request rates without an external component.

Reconnaissance & OSINT · 2026-07-20

BBOT 3.0 brings new HTTP/DNS engines, unified findings, 10+ new modules, and pydantic-validated config.

• New in-process, rate-limited HTTP engine (blasthttp) replaces the external httpx subprocess for all web traffic.
• New DNS resolution engine (BlastDNS) with bounded LRU caches and noisy PTR flood filtering.
• Pydantic-validated config and preset system catches typos and type errors before a scan starts.

Integrated & IT Risk Management · 2026-07-20

CISO Assistant v3.19.2 adds asset sync for ServiceNow, reworked risk acceptance workflow, expanded documents management, and Slovak localization.

• Supports attaching evidences to data breach records.
• Adds extra status options for findings tracking and exceptions.
• Adds an autologin page capability.

Integrated & IT Risk Management · 2026-07-20

CISO Assistant v3.19.1 adds applied control progress as a selectable column and multiple import improvements.

• Adds applied control progress as a selectable column in list views, surfacing remediation status at a glance.
• Delivers multiple import improvements for loading controls and frameworks.

Integrated & IT Risk Management · 2026-07-20

CISO Assistant v3.19.0 adds SCIM provisioning, offline AI embedding, managed portals, and admin MFA reset

• Adds SCIM provisioning and IdP groups mapping for automated user lifecycle management.
• Pre-bakes embedding and reranker models into the image for fully offline AI assistant operation (expect larger image size).
• Introduces managed portals feature.

Integrated & IT Risk Management · 2026-07-20

CISO Assistant v3.18.3 adds evidence visibility within domains and centralized domain field rendering in forms.

• Displays evidence items within their domain view, making it easier to review evidence by organizational scope.
• Centralizes folder/domain field rendering across model forms for a consistent UI experience.

AI Coding Agents · 2026-07-20

Claude Code v2.1.215 makes /verify and /code-review user-invoked only — no more automatic runs.

• The /verify and /code-review slash commands now run only on explicit user invocation, giving practitioners full control over when those checks execute.

AI Coding Agents · 2026-07-20

Cline CLI v3.0.45 adds Kimi K3 model, halves install size, and surfaces version numbers in hub/doctor status output.

• Adds Kimi K3 as an available ClinePass model.
• Reduces npm i -g cline install footprint from ~640 MB to ~285 MB by making Claude Code and Codex provider packages optional, loaded on demand.
• Hub status output now includes CLI and core version numbers.

AI Coding Agents · 2026-07-20

Cline SDK v0.0.65 adds Kimi K3 model support, on-demand provider loading, and new @cline/ui chat components.

• Makes Claude Code and Codex provider SDKs optional peer dependencies loaded on demand, dramatically reducing install size.
• Adds Kimi K3 to the bundled ClinePass model fallback list.
• Enables automatic one-time retry after refreshing expired OAuth credentials on runs.

SOAR · 2026-07-20

Cortex 4.1.0 adds audit logging for user actions in analyzer/responder catalogs.

• User actions in catalogs are now recorded in the audit log, improving traceability of analyzer and responder configuration changes.

Web Application Security · 2026-07-20

DataDome Fastly Compute 1.4.0 adds MCP protocol support with HTTP message signature collection per RFC 9421.

• Adds Model Context Protocol (MCP) support with new datadome_mcp_endpoint configuration parameter (defaults to /mcp) to specify the MCP endpoint.
• Collects Signature, Signature-Agent, and Signature-Input headers to support HTTP message signatures as defined by RFC 9421.
• Collects Skyfire-Pay-ID header from incoming requests.

Web Application Security · 2026-07-20

DataDome JS Tag 5.9.0 adds challengeType to event payloads and the displayDataDomeResponsePage function for style adaptation.

• Adds challengeType parameter to event payloads, exposing the type of challenge triggered in downstream event handling.
• Accepts challengeType in the displayDataDomeResponsePage function, enabling style adaptation based on the challenge type being displayed.

AI/LLM Security · 2026-07-20

Giskard Scan adds LIDAR and DeepTeam third-party integrations for broader AI vulnerability coverage.

• Integrates LIDAR scan as a third-party scan provider via third_party_scan.
• Integrates DeepTeam as a third-party scan provider for additional red-teaming coverage.

AI/LLM Security · 2026-07-20

Giskard Checks v1.0.2b5 adds LiDAR and DeepTeam third-party scan integrations to the vulnerability scanner.

• Integrates LiDAR scan into the third-party scan pipeline via third_party_scan.
• Adds DeepTeam as a third-party scan integration for agent vulnerability scanning.

AI/LLM Security · 2026-07-20

Giskard adds crescendo/GCG/do-not-answer/sycophancy scan generators, HarmBench dataset, vulnerability scan API, singleturn/multiturn mode, and new checks.

• Adds crescendo-like multi-turn adversarial scenario generator for red-teaming LLM agents.
• Adds GCG (Greedy Coordinate Gradient) injection scenario generator for adversarial suffix attacks.
• Adds do-not-answer scan generator to probe refusal behavior.

Reverse Engineering · 2026-07-20

HyperDbg v0.22 adds linked-list traversal commands, struct support in the script engine, and a pname filter for !pt.

• New dl command traverses linked lists in virtual address space directly from the debugger.
• New !dl command traverses linked lists using physical addresses.
• New SDK API exports for linked-list traversal over both virtual and physical memory.

Reverse Engineering · 2026-07-20

HyperDbg v0.21 adds Intel PT parameter parsing, TID/PID helpers, hyperperf infrastructure, and an SDK load-state API.

• Adds user-mode and kernel-mode Intel PT parameter parser for fine-grained control of processor trace configuration.
• Adds thread (TID) and process (PID) helper functions for Intel PT, enabling per-thread and per-process tracing workflows.
• Introduces the hyperperf (Hardware Performance Counter) project structure as a new HyperDbg SDK module.

Digital Forensics & Incident Response · 2026-07-20

iLEAPP v2026.2.0 adds Biome, C2PA AI provenance, and United Airlines artifacts with full iOS 26 and Python 3.13/3.14 support.

• Adds 14+ new Biome database artifacts parsing SQLite stores under Library/Biome/databases/ (app openings, cable plug events, backlight events, CarPlay activity, intelligence platform entities, and more).
• Adds Biome Set.db artifacts for installed apps and other syncable streams under Library/Biome/sets/.
• Adds Biome stream artifacts for harvested mail/messages, reads, screen time, and keyboard data.

Data Security & DLP · 2026-07-20

Immuta adds managed groups for agentic policies, Redshift viewless discovery, Delta Sharing enforcement, and OAuth 2.0 for Alation.

• Adds three built-in system-managed groups (All Agents, All Users, All Identities) usable in subscription and data policies to enforce system-wide access rules without manual group management.
• Supports row filtering and column masking on Unity Catalog managed, external, and foreign tables in Databricks Delta Sharing shares.
• Adds OAuth 2.0 authentication option for Immuta's Alation integration, eliminating recurring API key rotation requirements.

Detection Engineering · 2026-07-20

Laurel v0.8.0 adds SHA-256 exec hashing, UNIX socket logging, env-var prefix matching, and unified process spawning tracking.

• New SYSCALL.SPAWNED_BY field unifies process-lineage tracking across both single-exec and fork/exec scenarios.
• Supports prefix matching for environment variables, enabling selective capture of env vars by prefix.
• Adds logging output to a UNIX domain socket for integration with local log consumers.

Malware Analysis · 2026-07-20

malcontent v1.25.0 adds guarddog v3 rules and refreshes third-party YARA rule sets for improved supply-chain threat detection.

• Adds guarddog v3 detection rules, expanding coverage of malicious package behaviors.
• Updates bundled third-party YARA rules (Avast, Elastic, FireEye, Mandiant, Nextron, ReversingLabs) to June 2026 snapshots.
• Upgrades yara-x engine to v1.19.0, improving underlying rule evaluation performance.

AI/LLM Security · 2026-07-20

NeMo Guardrails v0.23.0 adds tool-call rails, HF classifier rails, PII masking, context bloat detection, and a /v1/checks endpoint.

• Adds streaming and non-streaming tool calling to IORails, with local rails that validate model-emitted tool calls and application-returned tool results.
• New /v1/checks endpoint on the OpenAI-compatible server runs input or output rails standalone, returning passed, modified, or blocked status without generating a model response.
• Adds lightweight Hugging Face classifier rails for input, output, and retrieval, backed by local Transformers, vLLM, KServe, and FMS.

SAST / SCA / Code Security · 2026-07-20

Noir v1.2.0 adds CLI app surface detection, 9 stdlib HTTP servers, schema-driven APIs, enterprise legacy stacks, and major perf gains.

• Detects CLI application attack surfaces (argv, flags, env vars) across 17 languages and 40+ libraries including Cobra, Click, clap, Commander, Thor, and picocli.
• Adds built-in HTTP server analyzers for Go (net/http), Python (http.server), Node (node:http), Java (com.sun.net.httpserver), C# (HttpListener), Ruby (WEBrick), Crystal, Dart, and Zig.
• Adds schema-generated API analyzers for Strapi, Directus, Payload CMS, Supabase/PostgREST, Hasura, and Appwrite — extracting routes and params from schema files rather than source routes.

AI Coding Agents · 2026-07-20

Codex CLI gains audio input support, inline visualization links in TUI, and remembered working directory for resumed sessions.

• Adds audio input variants (remote and local) to user input protocols, enabling audio to be forwarded to the Responses API.
• Renders inline visualization links in the TUI — ::codex-inline-vis{file="..."} directives in assistant Markdown become browser-openable links to generated artifacts.
• Enables users to remember the working directory when resuming sessions (tui_resume_cwd).

Threat Intelligence · 2026-07-20

OpenCTI 7.260715.0 adds connector log TTL and ingestion history in Redis, plus authentication validity policy improvements.

• Adds connector logs TTL and ingestion history storage in Redis for improved connector observability.
• Improves the authentication validity policy update workflow.

Threat Intelligence · 2026-07-20

OpenCTI 7.260710.0 adds admin-forced password resets, Custom Views date ranges & attribute widgets, OAuth SMTP dynamic tokens, and security coverage custom views.

• Enables admins to force a password change for users via a new authentication capability.
• Adds date range configuration directly within Custom Views on entity pages.
• Adds an attribute widget for Custom Views.

Threat Intelligence · 2026-07-20

OpenCTI 7.260309.0-lts.6 improves automatic enrichment on element creation/update and enhances JSON mapper regex extraction.

• Improves automatic enrichment triggered on creation or update of elements.
• Enhances JSON mapper extraction with improved regexp support.

Threat Intelligence · 2026-07-20

OpenCTI 7.260706.0 ships a native MCP server, STIX security-coverage export, custom newsfeed views, and richer telemetry.

• Adds a native Model Context Protocol (MCP) server with Streamable HTTP transport, exposed through XTM One and surfaced in the user profile.
• Enables export of security coverage data to STIX format.
• Supports custom views as a resource type in the newsfeed.

Threat Intelligence · 2026-07-20

OpenCTI 7.260701.0 adds XTM Hub custom view deployment, stream URI deny lists, ES health monitoring, and workflow transition comments.

• Enables deploying custom views received from XTM Hub directly into OpenCTI.
• Adds a configurable deny list of URIs to block during stream ingestion.
• Adds an Elasticsearch engine health monitor to surface ES issues proactively.

Threat Intelligence · 2026-07-20

OpenCTI 7.260626.0 adds draft filtering in dashboards, a new text editor, and tightened AI playbook agent controls.

• Adds drafts as filterable entities in dashboard widgets, enabling visualizations and metrics over draft workspaces.
• Restricts the AI agent run as selection in playbooks to the current user and service accounts only, tightening execution scope.
• Replaces the legacy text editor with a new editor solution across the platform.

Threat Intelligence · 2026-07-20

OpenCTI 7.260624.0 adds bulk playbook enrollment, has/not-changed stream filters, CTEM shortcut, and trust-proxy IP whitelisting config.

• Adds trust proxy configuration for IP whitelisting, enabling accurate client IP resolution when OpenCTI sits behind a reverse proxy.
• Adds a CTEM Command Center shortcut to the top bar when XTM One is connected.
• Adds a feature flag to revert to the old rich text editor alongside the new @filigran/rich-text-editor component.

Vulnerability Management · 2026-07-20

OpenCVE 3.0.0 ships Automations — trigger-driven alert and report workflows with conditions, actions, and webhooks.

• New Automations engine lets teams define CVE workflows with triggers, conditions, and actions (notifications, assignments, status changes, webhooks).
• Alert automations react to matching CVEs and execute configurable actions including notifications, assignments, status changes, or webhooks.
• Report automations deliver daily or weekly CVE digests with configurable conditions and timezone support.

SAST / SCA / Code Security · 2026-07-20

Portkey adds hybrid deployment architecture option.

• Supports hybrid deployment architecture, enabling mixed on-premises and cloud configurations.

SAST / SCA / Code Security · 2026-07-20

• Adds Secret References so Portkey fetches credentials at runtime from AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault via secret_mappings, keeping keys out of Portkey config entirely.
• Enables GCP Workload Identity Federation log delivery from AWS-hosted gateways to Google Cloud Storage via GCP_WIF_AUDIENCE and GCP_WIF_SERVICE_ACCOUNT_EMAIL, eliminating long-lived GCP keys in AWS.
• Adds customHost support on the Bedrock Guardrails plugin so guardrail evaluation hits private or regional Bedrock-compatible endpoints instead of default public URLs.

Continuous Control Monitoring (CCM) · 2026-07-20

RegScale 6.32.2.0 expands AI provider support to Azure OpenAI, AWS Bedrock, and OpenAI-compatible endpoints.

• Supports Azure OpenAI, AWS Bedrock, and OpenAI-compatible endpoints as AI providers, broadening deployment options for enterprise environments.

Endpoint Security (EDR/XDR) · 2026-07-20

Sophos Central adds Network Map, Live Discover for AP6, DNS Protection APIs, Protected Browser extension, and a wave of new alerts and email capabilities.

• New Network Map provides a visual topology of all Sophos firewalls, switches, and AP6 access points with search and relationship views.
• Live Discover queries now support AP6 Series access points, enabling on-demand SQL queries against wireless data in the Sophos data lake.
• New Protected Browser extension lets admins apply security policies and monitor user activity in Chrome and Edge without requiring migration to the full Protected Browser.

AI-Powered Offensive Security · 2026-07-20

Strix v1.1.0 adds 9 new security skills, SARIF 2.1.0 output, budget controls, and multi-target list scanning.

• Adds weak-password detection and LLM prompt-injection security skills.
• Adds GCP and Auth0 reconnaissance skills.
• Adds five new security skills covering OAuth, AWS, prototype pollution, deserialization, and Django.

AI/LLM Security · 2026-07-20

ToolHive v0.40.1 adds per-session prompt serving in vMCP and audit logging for authorization denials on the proxy runner path.

• Serves MCP prompts on a per-session basis in VirtualMCP (vMCP), enabling session-scoped prompt isolation.
• Audits authorization denials on the proxy runner path, giving operators a log trail of rejected requests.
• Respects DCR-negotiated token endpoint authentication methods, improving standards-compliant OAuth flows.

AI/LLM Security · 2026-07-20

ToolHive v0.39.0 adds AWS Bedrock compatibility flag to the LLM setup command.

• Adds a Bedrock compatibility flag to thv llm setup, enabling AWS Bedrock as an LLM backend.

AI/LLM Security · 2026-07-20

ToolHive v0.38.0 adds Codex App LLM setup support.

• Adds Codex App LLM setup support for configuring ToolHive with the Codex App.

AI/LLM Security · 2026-07-20

ToolHive v0.37.0 adds podTemplateSpec support for MCPRemoteProxy and exposes --allow-docker-gateway in the workload API.

• Adds spec.podTemplateSpec support to MCPRemoteProxy, enabling Kubernetes-native pod customization for remote MCP proxies.
• Exposes --allow-docker-gateway option in the workload API, allowing workloads to reach the Docker host gateway network.
• Adds runtime-stage environment variables to protocol Dockerfiles, enabling environment configuration at container runtime.

AI/LLM Security · 2026-07-20

ToolHive v0.36.0 adds OpenAI Codex CLI direct-mode support to the thv llm setup command.

• Adds Codex CLI direct-mode support to thv llm setup, enabling direct LLM connections alongside existing proxy-mode configurations.

AI/LLM Security · 2026-07-20

ToolHive v0.35.0 adds rate-limiting observability, HTTP OIDC issuer support, and new backend discovery APIs.

• Adds metrics and tracing for rate limiting, enabling observability into throttling behavior.
• Supports HTTP upstream OIDC issuers for in-cluster development environments.
• Adds ListBackends and LookupBackend methods to the vMCP core interface for programmatic backend discovery.

AI/LLM Security · 2026-07-20

ToolHive v0.34.0 adds plugin lifecycle management, Claude Desktop gateway support, and Cedar nested-map claim authorization.

• Adds plugin install/list/info/uninstall commands plus a MaterializationAdapter for managing ToolHive plugins.
• Adds Claude Desktop as a supported LLM gateway client.
• Supports nested map claims in Cedar authorization for the act claim, enabling richer policy evaluation.

AI/LLM Security · 2026-07-20

ToolHive v0.33.0 adds rate limiting on VirtualMCPServer and XAA auth strategy CRD support.

• Supports configuring rate limits on VirtualMCPServer via the new rate-limit configuration.
• Adds XAA authentication strategy support as a CRD for MCP server access control.

AI/LLM Security · 2026-07-20

ToolHive v0.32.0 adds XAA cross-app auth, OBO strategy seam, upstream ID-token propagation, OpenAI-compatible embeddings, and Origin/DNS-rebind protection.

• Adds XAA (Cross-Application Access) outgoing auth strategy implementing the ID-JAG two-step token exchange (RFC 8693 → RFC 7523) for per-backend cross-application access tokens.
• Surfaces upstream ID tokens through the auth middleware, consolidating access and ID token retrieval into a single bulk lookup.
• Adds the vMCP OBO (on-behalf-of) strategy seam — a new optional OBO field on BackendAuthStrategy with strategy registration and override hook.

Endpoint Security (EDR/XDR) · 2026-07-20

Trend Vision One extends max inactivity and session timeout limits from 8 hours to 12 hours.

• Raises the configurable ceiling for Max session timeout from 8 hours to 12 hours, allowing administrators to keep analysts signed in longer during extended investigations.
• Raises the configurable ceiling for Inactivity timeout from 8 hours to 12 hours (capped at the Max session timeout value), reducing re-authentication interruptions during complex tasks.

Firewalls & Network Defense · 2026-07-20

• Adds behavioral signatures for HTTP-based attacker tooling, including malicious file downloads/uploads and certificate-related abuse via trusted Windows utilities and offensive frameworks.

Threat Intelligence · 2026-07-20

Watcher v3.5.0 adds a Timeline audit trail, UDRP approval workflow, a reworked ThreatsWatcher dashboard, and auto-fit table pagination.

• Adds a full Timeline audit trail module that records every create, update, and delete action across all Watcher modules, with per-object history panels, field-level diffs, and actor avatars visible in every table row.
• New /api/timeline/events/ endpoint lets practitioners query the full history of any tracked object by content type and object ID.
• Introduces a PendingActions approval workflow for UDRP case transfers: when a case is marked won, a PendingAction is queued for admin review instead of automatically calling transfer_to_legitimate_domains().

AI Coding Agents · 2026-07-20

Devin Desktop v3.5.17 adds inline network policy controls, Fast Context in Local sessions, and instant worktree-backed sessions.

• Adds type-specific icons to @-mention pills in Cascade for clearer context at a glance.
• New worktree-backed sessions open instantly and remain interactive while the worktree is created in the background.
• Enables configuring a session's network policy and granting or denying network access requests inline from chat, without switching to the web app.

Malware Analysis · 2026-07-20

YARA-X v1.19.0 adds missing PE machine types and new compiler warnings for single-byte and duplicate patterns.

• Adds missing machine architecture types to the pe module, expanding PE header analysis coverage.
• New compiler warning when a rule defines a single-byte pattern, helping authors catch low-specificity signatures early.
• New compiler warning when a rule contains duplicate patterns, surfacing redundant definitions at compile time.

Threat Intelligence · 2026-07-20

Yeti 2.5.1 adds structured JSON logging, agentic functionalities, and a new session-retrieval endpoint.

• Adds structured JSON logging support for the console output.
• Introduces agentic functionalities to Yeti.
• New API endpoint to retrieve a session by user and session ID.

AI Coding Agents · 2026-07-18

Claude Code now runs in the browser and mobile app with --cloud flag for remote, parallel, and local-setup-free tasks.

• New --cloud flag runs Claude Code sessions remotely in the browser with no local setup required.
• Supports long-running async tasks — kick off work and check back when done.
• Enables working on repos not cloned locally via cloud-hosted sessions.

AI Coding Agents · 2026-07-18

Claude Code adds a cloud/browser mode for running long-running tasks without local setup, accessible on desktop and mobile.

• New --cloud flag launches Claude Code in-browser with no local environment required, enabling long-running async tasks and parallel workstreams.
• Supports working on repos you don't have checked out locally via the cloud runtime.
• Cloud sessions are accessible from the Claude mobile app on iOS and Android, letting you kick off tasks on desktop and check back from mobile.

AI Coding Agents · 2026-07-18

Claude Code v2.1.214 adds EndConversation tool, OTel message correlation attributes, docker daemon-redirect permission prompts, and more.

• Adds the EndConversation tool so Claude can autonomously terminate sessions involving highly abusive users or jailbreak attempts.
• Adds a periodic progress heartbeat for long-running tool calls that previously went silent.
• Adds an ISO modified timestamp to memory file frontmatter.

Web Application Security · 2026-07-18

Cloudflare adds Privacy Pass support, letting users prove claims without revealing identity or enabling cross-request tracking.

• Supports Privacy Pass tokens, enabling users to prove claims (e.g., human verification) without exposing identity or being tracked across requests.

Web Application Security · 2026-07-18

Cloudflare adds email preview in Activity log, browser RDP bulk PDF print, Wrangler CLI for Flagship, and Internal DNS GA

• Adds HTML, text, headers, attachments, and raw-source preview of sent emails directly in the Email Service Activity log.
• Enables bulk printing of multiple PDF files as a single print job from browser-based RDP sessions.
• New wrangler flagship CLI commands let you create Flagship apps, bind them to Workers, switch feature flags, and run rollouts from the command line.

Web Application Security · 2026-07-18

Cloudflare WAF deploys two new managed rules blocking critical WordPress RCE (CVE-2026-63030) and SQL injection (CVE-2026-60137) for all plan tiers.

• New WAF managed rule detects and blocks SQL injection attempts targeting WordPress 6.8+ (CVE-2026-60137) before crafted parameter values reach the application.
• New WAF managed rule detects and blocks unauthenticated RCE attempts via the WordPress REST API batch endpoint (CVE-2026-63030) affecting WordPress 6.9+.
• Both rules are automatically active for free-plan customers via the Free Ruleset and deployed with the default Block action for Pro, Business, and Enterprise Managed Ruleset customers.

Web Application Security · 2026-07-18

Emergency WAF release adds new managed rules blocking unauthenticated RCE and SQLi exploits in popular web frameworks.

• New detection rule (7dfb2bd4708d4b88b9911dc0550664b6) added to Cloudflare Managed Ruleset to block unauthenticated RCE via malicious path sequences at Block action.
• New detection rule (1c060d3a371549219ee290d7ed933fcc) added to Cloudflare Managed Ruleset to block SQLi via unsanitized request parameters at Block action.
• New detection rule (ebd3f2df15c74ddcbf6220c9b5ec246a) added to Cloudflare Free Ruleset to block unauthenticated RCE at Block action.

Container & Image Security · 2026-07-18

cosign v3.1.2 adds a bundle inspect command and a --base-config flag for signing-config overrides.

• Adds cosign bundle inspect command to examine cosign bundle files.
• Adds --base-config flag to the signing-config command to override services from a base config.

AI Coding Agents · 2026-07-18

Cursor in Slack adds upfront planning, multi-repo environment support, and cross-channel read/write workflows.

• Cursor now shares a plan before starting a task in Slack, letting you redirect it before work begins.
• Live status updates show each step as Cursor works through a task in Slack.
• Supports named multi-repo environments from Slack, letting Cursor access frontend, backend, and shared code across separate repos in a single session.

Data Security & DLP · 2026-07-18

• Supports automated sensitive data discovery (regex, dictionary, and column-name regex identifiers) for the Amazon Redshift viewless integration.
• Embeds Immuta documentation and an AI-powered chatbot directly in the Immuta UI for in-product search.

Endpoint Security (EDR/XDR) · 2026-07-18

• New Microsoft Defender Experts Threat Intelligence service delivers continuous, curated, expert-led intelligence tailored to an organization.
• Microsoft Defender Experts MDR extended with third-party and multicloud coverage.

AI Coding Agents · 2026-07-18

Codex CLI alpha.22 stabilizes the memories feature, adds managed Bedrock login, and imports plugins from known marketplaces.

• Stabilizes the memories feature flag, making it generally available in the CLI.
• Adds a managed Bedrock login API for authenticating with AWS Bedrock as a provider.
• Imports enabled plugins automatically from known marketplaces.

Compliance Automation & Trust Management · 2026-07-18

Vanta adds control assessments in audits, MCP support for Commitments, Issues API, 764 FedRAMP Rev 5 automated tests, dark mode, and 20+ more capabilities.

• Enables auditors to formally assess controls in Vanta for IRL audits, assigning framework-specific statuses (Conforming/Non-conformity for ISO; Satisfied/Not Satisfied for FedRAMP) with mandatory justification comments.
• Adds an Internal Auditor Role, letting an internal employee take on an auditor-scoped view of IRL, request tracker, and population views without requiring an external audit firm.
• Introduces Custom Commitment Types, allowing users to define named commitment types with definitions and example clauses; Vanta retroactively extracts them from all previously uploaded contracts.

Compliance Automation & Trust Management · 2026-07-18

Vanta adds control assessments in audits, MCP support for Commitments, Issues API, 700+ FedRAMP Rev 5 tests, dark mode, and 20+ more capabilities.

• Adds ability to select a specific policy version when attaching it as evidence to an information request during audits.
• Enables auditors to formally assess controls in Vanta for internal and external IRL audits, with framework-specific statuses (Conforming/Non-conformity for ISO, Satisfied/Not Satisfied for FedRAMP) and required justification comments.
• Introduces an Internal Auditor Role, allowing an internal employee to be designated as auditor on an internal audit engagement with a scoped auditor view.

Compliance Automation & Trust Management · 2026-07-18

Vanta July 2026 adds internal auditor roles, control assessments, Dropbox deprovisioning, MCP support, and 8 more capabilities.

• Adds version-specific policy selection when attaching policies as evidence to information requests, giving auditors precise control over which policy version is submitted.
• Enables auditors to formally assess controls directly in Vanta for internal and external IRL audits, with framework-specific statuses (Conforming/Non-conformity for ISO; Satisfied/Not Satisfied for FedRAMP) and required justification comments.
• Introduces an Internal Auditor Role, allowing an internal employee to be designated as auditor on an internal audit engagement with a scoped IRL, request tracker, and population views without requiring an external audit firm.

SAST / SCA / Code Security · 2026-07-18

Capital One open-sources VulnHunter: agentic AI SAST with attacker-first analysis, falsification engine, and automated fix-verify loop.

• Adds /vulnhunt Claude Code skill: entry-point-forward scanner that maps attacker paths to dangerous sinks and filters findings through a multi-stage falsification pipeline (Recon → Parallel Hunt → Adversarial Disprove → Capability Filter).
• Adds /vulnhunter-fix skill: test-driven remediation loop that writes an exploit demo, creates a failing security test (RED), implements the fix (GREEN), verifies the exploit is blocked, and opens a reviewable PR.
• Adds /vulnhunt-fix-verify skill: independent, read-only agent that validates whether a finding was successfully remediated and emits a per-finding verdict.

Secure Access (VPN / SASE / ZTNA) · 2026-07-18

Zscaler launches Zero Trust Enterprise Browser and Browser Detection and Response (BDR) extension to bring Zero Trust into the browser itself.

• Introduces Zero Trust Enterprise Browser: a purpose-built, fully managed Chromium browser with Zero Trust security integrated directly into the browsing experience.
• Adds Browser Detection and Response (BDR) via the Zero Trust Browser Extension, delivering browser-native threat detection and response inside existing browsers for threats that evade upstream network and endpoint controls.
• Delivers three Zero Trust Browser deployment form factors — Cloud Browser Isolation, Browser Extension, and Enterprise Browser — allowing organizations to mix and match based on user, device, and workflow requirements.

Identity & Access Management · 2026-07-17

BeyondTrust Base 8.3.0 brings OCSF-structured syslog, a unified patch inventory view, and upload progress visibility.

• Remote syslog output now follows OCSF structure, enabling richer, standardized event forwarding to SIEM platforms with new log categories for on-premises appliances.
• Local file uploads now show an estimated progress bar instead of a generic spinner, giving clearer visibility into upload duration.
• Removes the opt-in default certificate mechanism, simplifying certificate configuration.

Identity & Access Management · 2026-07-17

BeyondTrust Remote Support 26.2.1 adds multi-group Jump Client installs, FIDO2 Group Policy enforcement, AI session summaries, syslog streaming, and ARM-native support.

• Assigns a Jump Client to multiple Jump Groups at installation time via a comma-separated JC_JUMP_GROUP installer parameter, eliminating post-deployment API calls to reassign group membership.
• Enforces FIDO2 phishing-resistant MFA at the Group Policy level, using the same model as existing TOTP enforcement; FIDO2 is also now supported on Pathfinder deployments.
• Adds search, filtering, CSV export, and API access to the Duplicate Jump Clients report for programmatic duplicate detection and resolution at scale.

Web Application Security · 2026-07-17

BunkerWeb v1.6.13 adds global rate limiting, per-URI country check bypass, and post-challenge redirect control.

• Adds USE_LIMIT_REQ_GLOBAL and LIMIT_REQ_GLOBAL_RATE settings to cap the total aggregate request rate for a service across all clients and URLs, evaluated before per-IP and per-URL limits.
• Adds COUNTRY_IGNORE_URI to skip country whitelist and blacklist checks for URIs matching a list of PCRE expressions, matched against both the request path and the full URI including query string.
• Adds ANTIBOT_SUCCESS_URI to redirect clients to a fixed URI after successfully completing a challenge, rather than returning them to the originally requested page.

AI Coding Agents · 2026-07-17

Claude Code v2.1.212 adds background /fork, auto-mode reset, per-session WebSearch/subagent caps, and auto-backgrounding slow MCP calls.

• Redesigns /fork to copy the current conversation into a new background session (visible in claude agents) rather than an in-session subagent; the old in-session subagent behavior is now /subtask.
• Adds claude auto-mode reset command to restore default auto-mode configuration, with an optional --yes flag to skip the confirmation prompt.
• Adds a per-session WebSearch call cap (default 200, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) to prevent runaway search loops.

AI Coding Agents · 2026-07-17

Cline SDK v0.0.63 emits task.mistake_limit_reached telemetry across all hosts when the consecutive-mistake limit is hit.

• Adds task.mistake_limit_reached telemetry event emitted by the session runtime whenever the consecutive-mistake limit is reached, captured uniformly across CLI, VS Code extension, and hub daemon — including unattended auto-stops.

AI Coding Agents · 2026-07-17

Cline v4.0.9 adds GPT-5.6 ChatGPT subscription models to the provider lineup.

• Adds GPT-5.6 ChatGPT subscription models as selectable options in the OpenAI provider.

AI Agent Frameworks · 2026-07-17

CrewAI 1.15.4 promotes the Skills Repository to stable, making AI coding-agent guidance an officially supported feature.

• Promotes the Skills Repository out of experimental status, making structured coding-agent instructions (for Claude Code, Cursor, Windsurf, etc.) a stable, supported capability.

AI Agent Frameworks · 2026-07-17

CrewAI 1.15.3 adds step interception hooks with @on, org ID support in PlusAPI, and declarative Flow execution in the TUI.

• Adds step interception points and a generic hook dispatcher, enabling fine-grained execution-boundary callbacks via @on decorators.
• Adds organization_id parameter to the PlusAPI client for multi-org deployments.
• Supports running declarative Flows on the TUI with headless terminal fallback.

AI Agent Frameworks · 2026-07-17

CrewAI 1.15.3a1 adds step interception hooks via @on, declarative flow support in the TUI, and an organization ID parameter for the PlusAPI client.

• Adds step interception points and a generic hook dispatcher, enabling @on-decorated callbacks at execution boundaries for fine-grained observability and control.
• Supports running declarative flows on the TUI with a headless terminal fallback.
• Adds an organization ID parameter to the PlusAPI client for multi-org deployments.

Reconnaissance & OSINT · 2026-07-17

dnsx v1.3.0 adds automatic wildcard detection, custom output templates, query timing, and inline host input.

• Adds -auto-wildcard flag for automatic wildcard DNS detection, supporting multiple registrable roots and A/AAAA-based filtering.
• Adds -output-template / -ot flag for customizable output using template fields such as {{host}}, {{a}}, {{aaaa}}, {{ip}}, and {{query-time}}.
• Adds query-time response field to expose per-query DNS timing in output.

Secrets Detection & Management · 2026-07-17

GrantGuard v0.1.0 launches: audit and clean up risky Claude Code standing permissions from the CLI.

• New audit command scans Claude Code settings files and classifies every allow rule by risk — inline credentials, credential-store reads, destructive wildcards, unprompted remote pushes, and overbroad wildcards.
• New ui command opens a local browser UI for interactive review and one-click removal of flagged permission grants.
• Supports --scan for shallow discovery of .claude/settings*.json under target directories, and --deep-scan for broad recursive discovery.

Container & Image Security · 2026-07-17

Grype v0.116.0 adds Go symbol-based reachability analysis, Ubuntu ESM support, architecture-aware matching, and Chainguard OSV integration.

• Adds lightweight Go symbol reachability analysis to suppress false positives for stdlib, golang.org/x, and third-party Go vulnerability advisories — only flags binaries that actually import the vulnerable symbols.
• Deduplicates Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA).
• Supports Ubuntu ESM (Extended Security Maintenance) vulnerability matching.

Endpoint Security (EDR/XDR) · 2026-07-17

Managed ITDR now supports IP- and CIDR-based Expected Unwanted Access rules to suppress known-good login escalations.

• Adds IP-based Expected Unwanted Access rules in Managed ITDR, letting partners and customers suppress escalations for individual IPs or entire CIDR ranges without disabling other detections.

Data Security & DLP · 2026-07-17

Immuta adds managed groups for system-wide policies, automated Redshift discovery, OAuth 2.0 for Alation, and Delta Sharing row/column enforcement.

• Automated sensitive data discovery now available for Immuta's Amazon Redshift viewless integration, supporting regex, dictionary, and column-name-regex identifiers.
• Row filtering and column masking now enforced for Databricks Delta Sharing recipients on Unity Catalog managed, external, and foreign tables.
• Manual data policy resync in Snowflake data source health checks now resyncs both data policies and subscription policies.

Identity & Access Management · 2026-07-17

Keycloak 26.7 adds stateless mode preview, moving auth sessions and brute-force counters to the DB to enable simpler multi-cluster deployments.

• New stateless preview feature stores authentication sessions, action tokens, and brute-force counters in the database instead of distributed Infinispan caches.
• Enables Multi-Cluster v2: two or more independent Keycloak clusters connected only through a synchronously replicated database, with no external Infinispan cluster required.
• Cross-cluster cache invalidation now uses a database outbox/queuing table with a default polling interval of 100 ms, eliminating direct network connections between clusters.

AI Coding Agents · 2026-07-17

Kiro CLI v3 gains an Introspect subagent for in-line feature guidance and global hooks that fire across all workspaces.

• New Introspect subagent answers questions about Kiro's features, explains custom agents, hooks, and steering files, and suggests workflow configurations — all inline (v3 only).
• Global hooks defined in ~/.kiro/hooks/ now automatically apply to every workspace, eliminating per-project duplication for cross-cutting behaviors like linting on save or pre-commit security checks (v3 only).

Identity & Access Management · 2026-07-17

Okta adds cross-app access for AI agents, GA agent-to-agent connections, and new device OS account endpoints.

• Enables cross-app access for AI agents and applications.
• Agent-to-agent connections reaches General Availability in Production.
• New endpoints for device OS accounts now available in Early Access (Preview).

Local LLM Runtimes · 2026-07-17

Ollama v0.32.1 adds CWD-aware agent context, actionable web-auth guidance, and MLX load-timeout support.

• Adds current working directory to the interactive agent's system prompt for better project context.
• Agent web search and fetch now surface an actionable ollama signin prompt when authentication is required, instead of a generic error.
• MLX text model loading now respects the OLLAMA_LOAD_TIMEOUT environment variable.

AI Coding Agents · 2026-07-17

Codex CLI gains persistent chat sessions with save, resume, and cloud-offload capabilities.

• Supports returning to a saved chat from the current repository or searching across local past chats.
• Enables browsing active and completed chats, submitting work to a configured environment, and applying results to the local repo from the terminal.
• Allows launching a cloud chat and returning to the terminal later, decoupling long-running sessions from the local shell.

AI Coding Agents · 2026-07-17

Amazon Bedrock provider now supports custom transports: override base_url, auth, and HTTP headers alongside AWS profile and region.

• Enables custom base_url, auth, and http_headers overrides on the built-in amazon-bedrock provider for custom transport scenarios.
• Supports command-based bearer authentication and configured endpoints for Bedrock without requiring AWS request signing.
• Replaces the Bedrock account credentialSource enum with the usesCodexManagedCredentials boolean for consistent reporting of managed and externally authenticated configurations.

AI Coding Agents · 2026-07-17

Codex CLI alpha.19 adds concurrent terminal session writes and an app-server metadata API

• Enables parallel write_stdin tool calls across independent terminal sessions, with per-session serialization to keep output buffers consistent.
• Adds experimental app/read API for fetching metadata for up to 100 app IDs, with optional tool summaries, deduplication, caching, and partial-miss reporting.
• Validates reasoning effort against model metadata after agent roles override model settings, catching unsupported combinations at spawn time.

AI Coding Agents · 2026-07-17

Codex CLI alpha.18 unifies multi-agent config under agents, adds encrypted MCP content support, and improves skill-selection with BM25, n-gram, and multi-query methods.

• Adds agents.enabled config key and unifies multi-agent settings (concurrent thread limit, subagent model, reasoning effort) under a single [agents] section, with resolved values visible in TUI debug-config output.
• Adds agents.max_concurrent_threads_per_session (with agents.max_threads as an alias) to control the spawned-thread limit across both multi-agent backends.
• Adds agent_default_subagent_model and agent_default_subagent_reasoning_effort config fields so spawned agents honor configured model defaults.

AI Coding Agents · 2026-07-17

OpenCode v1.18.3 adds Up Arrow to close the subagent picker and lets the command palette search sessions from the home page.

• Adds Up Arrow shortcut to close the subagent picker when the first item is selected, enabling faster keyboard-only navigation.
• Enables the home page command palette (Cmd+K) to find and open existing sessions, filtered by the currently selected server.

Runtime Security · 2026-07-17

OpenShell v0.0.86 adds AWS STS AssumeRole refresh, network egress middleware, and TUI panel navigation.

• Adds AWS STS AssumeRole refresh strategy and aws-s3 profile support for cloud provider integrations.
• Introduces supervisor middleware framework (RFC-0009) enabling extensible sandbox lifecycle hooks.
• Adds network egress middleware via the supervisor middleware layer for controlling outbound sandbox traffic.

AI Coding Agents · 2026-07-17

Pi v0.80.9 adds Kimi K3 support with deferred tool loading across five providers and switches xAI default to Grok 4.5.

• Adds Kimi K3 model support across Kimi Coding, Moonshot AI, Moonshot AI China, OpenRouter, and Vercel AI Gateway.
• Adds Kimi deferred tool loading for progressive, extension-driven tool activation via Kimi's native protocol.
• Changes the default xAI model to Grok 4.5 and updates xAI login to use a prefilled device-authorization link labeled Sign in with SuperGrok or X Premium.

Identity & Access Management · 2026-07-17

Ping Identity AIC adds optional custom report parameters, ordered promotions API results, and multi-line journey annotations.

• Supports marking parameters in custom reports as optional, enabling more flexible report execution.
• Promotions API now returns report metadata ordered by creation date, most recent first.
• Journey annotation notes now render multi-line formatting in view mode, consistent with edit mode.

SAST / SCA / Code Security · 2026-07-17

Portkey adds vault-backed credentials, weekly rate limits, cross-cloud GCS logging, and four new guardrail integrations in March 2026.

• New Secret References let you point Portkey at credentials stored in AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault via secret_mappings, so keys are fetched at runtime from vaults you already control.
• Adds weekly rate and budget windows (rpw) so spend caps align with weekly planning cycles rather than only per-minute or monthly aggregates.
• Adds endpoint-scoped rate limits so chat completions, embeddings, and admin routes can each carry independent limits instead of a single global rule.

SAST / SCA / Code Security · 2026-07-17

Promptfoo snapshot-20260717 adds adaptive rate limiting, Transformers.js local inference, telecom red team plugins, and video generation providers.

• Adds Transformers.js provider to run Hugging Face models locally in Node.js or the browser.
• Adds Vercel AI Gateway and Cloudflare AI Gateway providers for request routing.
• Adds AWS Bedrock Video (Nova Reel, Luma Ray 2) and Azure AI Foundry Video (Sora) for video generation.

Cloud Security Posture · 2026-07-17

Prowler 5.35.0 adds Lighthouse AI side chat and actions, one-step AWS Org onboarding, scan exclusions, and a redesigned sidebar.

• Adds Lighthouse AI side panel: open a context-aware AI chat from anywhere in the app without leaving the current page, with tabs to switch between finding details and the chat (Prowler Cloud/Private Cloud).
• Enables Lighthouse AI to take actions: connect/remove providers, trigger and schedule scans, update scan settings, and manage mute rules via chat, gated by RBAC (Prowler Cloud/Private Cloud).
• Adds one-step AWS Organizations onboarding: a single CloudFormation quick-create link deploys the management account role and a service-managed StackSet to every member account (Prowler Cloud/Private Cloud).

Continuous Control Monitoring (CCM) · 2026-07-17

RegScale 6.37.39 adds eMASS asset inventory sync and expanded stakeholder address fields in the API.

• New eMASS API hardware and software baseline sync commands pull asset inventory from eMASS, create or update RegScale assets, and push new assets back to eMASS.

Identity & Access Management · 2026-07-17

SailPoint previews next-gen mainframe connectors for RACF, ACF2, and Top Secret that eliminate the Connector Gateway layer.

• Introduces direct connectivity from SailPoint Identity Management products to the SailPoint agent on the mainframe, removing the requirement to deploy and maintain a Connector Gateway.
• Adds new security and maintainability improvements to the RACF, ACF2, and Top Secret integrations on z/OS.
• Includes migration tooling to help transition existing configurations and customizations from the legacy connector to the new architecture.

Firewalls & Network Defense · 2026-07-17

Sublime Security adds Advanced Graymail Protection (Beta) with ML-based detection, user preference learning, and automated remediation for M365 and Google Workspace.

• New dedicated Graymail view separates high-volume non-malicious mail (marketing, newsletters, subscriptions) from other detections across Microsoft 365 and Google Workspace.
• Adds bi-directional User Preferences: Sublime learns per-user sender preferences when users move messages into or out of Promotions or Junk/Spam and applies them to future messages.
• Introduces Fuzzy Attack Score, a new ML model that identifies unwanted bulk mail without relying on rigid signatures or sender-specific rules.

Firewalls & Network Defense · 2026-07-17

Sublime Security adds four REST API endpoints to create, list, and manage child organizations and their licenses at scale.

• New GET /v0/organizations/mine/child-organizations endpoint lists all child organizations with license and usage data, supporting status filtering, name search, pagination, and depth traversal.
• New POST /v0/organizations/mine/child-organizations endpoint creates child organizations and optionally assigns licenses in a single API call.
• New PUT /v0/organizations/mine/child-organizations/{id}/licensing endpoint updates the license on an individual child organization.

Attack Surface & Exposure Management · 2026-07-17

Tenable ASM adds a built-in subscription to identify external-facing Microsoft SharePoint Server assets.

• Adds built-in subscription Microsoft Sharepoint Server - v1 to detect and inventory external-facing SharePoint Server assets.

Firewalls & Network Defense · 2026-07-17

Vectra AI v9.13 adds expanded detections for Windows post-exploitation, HTTP attack tools, covert tunneling, credential theft, and cloud exfiltration.

• New detections for SMB-based lateral movement, malicious named pipe activity, and Cobalt Strike SMB beaconing across Windows environments.
• Expanded HTTP-based detection coverage for malicious downloads, uploads, certificate abuse, and offensive framework activity using trusted Windows utilities.
• New detection coverage for tunneling frameworks and covert channels, including web-based tunnels, public tunneling services, and custom BackConnect protocols.

Firewalls & Network Defense · 2026-07-17

Vectra AI v9.13 expands ERSPAN support with 8- and 16-core virtual Sensor options and improved encapsulated traffic performance.

• Supports 8- and 16-core virtual Sensors for ERSPAN-based monitoring deployments.
• Improved configuration handling for ERSPAN capture interface addressing simplifies virtual and physical Sensor setup.
• Performance optimizations increase processing efficiency for encapsulated traffic workloads in ERSPAN environments.

SAST / SCA / Code Security · 2026-07-17

Veracode adds OAuth for XML APIs, six new built-in policies, OWASP/CWE 2025 standards, and a new Firewall Analytics dashboard.

• Supports OAuth Client Credentials authentication for Veracode XML APIs, not just REST APIs.
• Adds six new built-in security policies to the Veracode Platform, ahead of planned deprecation of recommended and transitional policies.
• Auto-Update OWASP and Auto-Update CWE Top 25 policy rules now enforce OWASP Top 10:2025 and MITRE CWE Top 25 for 2025 standards.

AI-Infra-Guard 1 changes

• v4.1.15 · Feature · 2026-07-20

Auth0 3 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23
• Self-Service Enterprise Configuration: Customer admins can now configure third-party application access during SSO setup (2026-07-22) · Feature · 2026-07-22
• Anonymous sessions are now in beta! (2026-07-20) · Feature · 2026-07-21

authentik 2 changes

• version/2026.5.5 · Feature · 2026-07-20
• version/2026.2.5 · Feature · 2026-07-20

Automox 1 changes

• Now live: Partial Policy Success and Per-Package Visibility in the Policy Results Report (2026-07-20) · Feature · 2026-07-21

Axonius 4 changes

• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• Axonius Release Notes 9.0.1 (2026-06-25) · Feature · 2026-07-21

Backslash 5 changes

• Block MCP action · Feature · 2026-07-23
• Claude Code support · Feature · 2026-07-23
• PR Event Notifications · Feature · 2026-07-23
• Remove PR comment after successful scans · Feature · 2026-07-23
• Selected repos shown in top · Feature · 2026-07-23

bbot 1 changes

• v3.0.0 · Feature · 2026-07-20

BeyondTrust 7 changes

• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• Base 8.3.0 release notes (2026-07-16) · Feature · 2026-07-17
• Remote Support 26.2.1 release notes (2026-07-16) · Feature · 2026-07-17

BunkerWeb 1 changes

• v1.6.13 · Feature · 2026-07-17

Burp Suite 1 changes

• Professional / Community 2026.7.1 (2026-07-23) · Feature · 2026-07-23

c/side 8 changes

• Cmd+K command palette · Feature · 2026-07-23
• Fingerprint Dashboard is now generally available · Feature · 2026-07-23
• JA4 TLD fingerprinting · Feature · 2026-07-23
• New Notifications Engine supporting Linear and Jira · Feature · 2026-07-23
• Onboarding that matches your use case · Feature · 2026-07-23
• Script Ad Injection Detection · Feature · 2026-07-23
• Self-service SSO for enterprise customers · Feature · 2026-07-23
• We now detect when bots try to hide · Feature · 2026-07-23

Capstone 1 changes

• 6.0.0-Alpha10 · Feature · 2026-07-22

Castle 8 changes

• Additional Authentication Method types · Feature · 2026-07-23
• CSV export for Lists · Feature · 2026-07-23
• Dark mode · Feature · 2026-07-23
• Fraudulent Email Domain signal · Feature · 2026-07-23
• IOS SDK 4.0.0 Release · Feature · 2026-07-23
• Multiple API keys · Feature · 2026-07-23
• Phone call detection · Feature · 2026-07-23
• Webhook API Key selection · Feature · 2026-07-23

Censys 1 changes

• July 20, 2026 (2026-07-20) · Feature · 2026-07-21

Cisco Duo Desktop 1 changes

• updated · Jul 23, 2026 · Feature · 2026-07-23

CISO Assistant 6 changes

• v3.20.2 · Feature · 2026-07-23
• v3.20.0 · Feature · 2026-07-22
• v3.19.2 · Feature · 2026-07-20
• v3.19.1 · Feature · 2026-07-20
• v3.19.0 · Feature · 2026-07-20
• v3.18.3 · Feature · 2026-07-20

Claude Code 8 changes

• v2.1.218 · Feature · 2026-07-23
• v2.1.217 · Feature · 2026-07-22
• v2.1.216 · Feature · 2026-07-21
• v2.1.215 · Feature · 2026-07-20
• docs update · Docs · 2026-07-18
• docs update · Docs · 2026-07-18
• v2.1.214 · Feature · 2026-07-18
• v2.1.212 · Feature · 2026-07-17

Clerk 4 changes

• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• Configurable default OAuth scopes (2026-07-22) · Feature · 2026-07-23
• Connect your AI tools to Clerk MCP with one command (2026-07-22) · Feature · 2026-07-23

Cline 5 changes

• desktop-v0.0.2 · Feature · 2026-07-22
• cli-v3.0.45 · Feature · 2026-07-20
• sdk/sdk/v0.0.65 · Feature · 2026-07-20
• sdk/sdk/v0.0.63 · Feature · 2026-07-17
• v4.0.9 · Feature · 2026-07-17

Cloudflare 12 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23
• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• WAF - WAF Release - 2026-07-21 (2026-07-21) · Feature · 2026-07-21
• WAF - WAF Release - Scheduled changes for 2026-07-27 (2026-07-21) · Feature · 2026-07-21
• docs update · Docs · 2026-07-18
• docs update · Docs · 2026-07-18
• Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities (2026-07-17) · Feature · 2026-07-18
• WAF - WAF Release - 2026-07-17 - Emergency (2026-07-17) · Feature · 2026-07-18

Cloudsmith 1 changes

• Cooldown policies now support Maven (2026-07-23) · Feature · 2026-07-23

Codacy 1 changes

• Adding GolangCI-Lint as new supported tool January, 2026 · Feature · 2026-07-23

code-oss 2 changes

• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23

Conveyor 7 changes

• 📄 Auto-Generate Bridge Letters in Your Trust Center with Smart Documents · Feature · 2026-07-23
• 📜 New Integration: Automate Trust Center Access with Ironclad · Feature · 2026-07-23
• 📝 Draft Changes to Your Trust Center Before They Go Live · Feature · 2026-07-23
• 🔌 Assign Questions and Write Answers Through the API · Feature · 2026-07-23
• 🛡️ Topic Preferences: Set Guardrails for How ConveyorAI Answers Sensitive Topics · Feature · 2026-07-23
• 🤖 Auto-Return Completed Questionnaires, No Human Touch Required · Feature · 2026-07-23
• 🤖 Bring Your Customer Trust Program To Any AI Assistant with the AI Connector · Feature · 2026-07-23

Cortex 1 changes

• 4.1.0 · Feature · 2026-07-20

cosign 1 changes

• v3.1.2 · Feature · 2026-07-18

CrewAI 4 changes

• 1.15.5 · Feature · 2026-07-21
• 1.15.4 · Feature · 2026-07-17
• 1.15.3 · Feature · 2026-07-17
• 1.15.3a1 · Feature · 2026-07-17

Cribl 4 changes

• Architecting for the speed of "vibe coding": Introducing Apps (2026-07-23) · Feature · 2026-07-23
• What’s New! We heard you like AI. (2026-07-22) · Feature · 2026-07-23
• docs update · Docs · 2026-07-22
• Cribl MCP Server: Interact with Cribl using the AI tools you already use (2026-07-22) · Feature · 2026-07-22

CrowdStrike 1 changes

• undated-6a01ac0f · Feature · 2026-07-22

CrowdStrike Falcon Exposure Management 1 changes

• undated-41a947f6 · Feature · 2026-07-23

CrowdStrike Falcon Insight XDR 1 changes

• undated-6cd80cac · Feature · 2026-07-22

Crush 1 changes

• v0.86.0 · Feature · 2026-07-21

Cursor 2 changes

• Cursor Router · Feature · 2026-07-23
• Improvements to Cursor in Slack · Feature · 2026-07-18

DataDome 5 changes

• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• Envoy module 2.7.0 (2026-07-21) · Feature · 2026-07-21
• Fastly Compute module 1.4.0 (2026-07-20) · Feature · 2026-07-20
• JavaScript Tag 5.9.0 (2026-07-20) · Feature · 2026-07-20

Daytona 3 changes

• Docs Search, Git Clone & API 400s · Feature · 2026-07-23
• SDK Simplification & Per-Sandbox Resource Limits · Feature · 2026-07-23
• Sandbox Forking SDK & Org Metrics · Feature · 2026-07-23

DeepSource 1 changes

• AI Review on more programming languages · Feature · 2026-07-23

defectdojo 2 changes

• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21

Devicie 5 changes

• App Protection Policies Go Live · Feature · 2026-07-23
• Bespoke App Request Form (In-Portal) · Feature · 2026-07-23
• CIS 4.0 Reporting · Feature · 2026-07-23
• Device Spotlight to Intune Deep Link · Feature · 2026-07-23
• Multi-Account Login & Fast Switching · Feature · 2026-07-23

dfvfs 1 changes

• 20260717 · Feature · 2026-07-21

DNSFilter 2 changes

• 07/22 July 22 – macOS Roaming Client v2.4.4 Beta (2026-07-22) · Feature · 2026-07-23
• 07/21 July 21 – Web Application and API Update (2026-07-21) · Feature · 2026-07-21

dnsx 1 changes

• v1.3.0 · Feature · 2026-07-17

dockerscan 1 changes

• v2.1.0 · Feature · 2026-07-23

Dreadnode 11 changes

• AIRT Report Builder now generally available with templates, branding, and DOCX export · Feature · 2026-07-23
• Agent Output available in beta for all orgs · Feature · 2026-07-23
• Analytics query and notebook UX overhaul · Feature · 2026-07-23
• Android APK research capability and issue-tracker connectors for web-security · Feature · 2026-07-23
• Binary analysis capability replaces windows-reversing with cross-platform PE/ELF/Mach-O support · Feature · 2026-07-23
• Claude Code engine — run Claude's agentic loop as a governed, session-backed agent · Feature · 2026-07-23
• Compound eval verification — script_and_judge and flag_and_judge · Feature · 2026-07-23
• End-to-end multimodal AI red teaming — probe vision, audio, and video models with full media rendering in findings and traces · Feature · 2026-07-23
• Free-text search in evaluation trajectories · Feature · 2026-07-23
• Session and Trace Views Now Display Agent-Captured Images, Audio, and Video · Feature · 2026-07-23
• Tool media evidence in session transcript · Feature · 2026-07-23

ElcomSoft 1 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23

EMBA 1 changes

• v2.0.3-legacy-time · Feature · 2026-07-21

Fastly 3 changes

• Fastly Terraform Provider 9.4.0 (2026-07-22) · Feature · 2026-07-23
• Add HTTP and TLS metrics to historical and real-time Domain Inspector APIs (2026-07-21) · Feature · 2026-07-23
• Added virtual patch for CVE-2026-63030 (wp2shell, also covers CVE-2026-60137) (2026-07-21) · Feature · 2026-07-22

Feedly Threat Intelligence 3 changes

• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• Enrich and triage Apple security releases in the Vulnerability Intel Agent (2026-07-21) · Feature · 2026-07-22

Giskard 3 changes

• giskard-scan/v1.0.0b3 · Feature · 2026-07-20
• giskard-checks/v1.0.2b5 · Feature · 2026-07-20
• giskard-core/v1.0.1b5 · Feature · 2026-07-20

GitGuardian Detection Engine 2 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23
• Detection Engine Updates Version 2.167 (2026-07-07) · Feature · 2026-07-22

GitGuardian SaaS 4 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23
• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• Mention members and teams in incident notes (2026-07-20) · Feature · 2026-07-21

Google SecOps 1 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23

GrantGuard 1 changes

• v0.1.0 · Feature · 2026-07-17

Grype 1 changes

• v0.116.0 · Feature · 2026-07-17

Hermes 3 changes

• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• v2026.7.20 · Feature · 2026-07-21

Hudson Rock 5 changes

• { New } - Company Search Endpoint · Feature · 2026-07-23
• { New } - Search by PC Name Endpoint · Feature · 2026-07-23
• { New } - Search by Term Endpoint · Feature · 2026-07-23
• { New } - Subdomain Filtering Feature · Feature · 2026-07-23
• { New} - Directory Tree Field · Feature · 2026-07-23

Hunter 8 changes

• Buy domains, create email accounts, and protect your sender reputation · Feature · 2026-07-23
• Company Logo API (free) · Feature · 2026-07-23
• Discover: smarter AI Assistant & saved companies filter · Feature · 2026-07-23
• Email Accounts Center & Sender Health · Feature · 2026-07-23
• Engagement rates are now recipient-based · Feature · 2026-07-23
• Progressive Sending: gradually scale your outbound volume · Feature · 2026-07-23
• Reveal emails in Discover based on remaining credits · Feature · 2026-07-23
• Sequences: A/B testing is here · Feature · 2026-07-23

Huntress 1 changes

• IP-Based Expected Rules Now Available in Managed ITDR · Feature · 2026-07-17

HyperDbg 2 changes

• v0.22 · Feature · 2026-07-20
• v0.21 · Feature · 2026-07-20

iDenfy 13 changes

• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• updated · Jul 23, 2026 · Feature · 2026-07-23

iLEAPP 1 changes

• v2026.2.0 · Feature · 2026-07-20

Immuta 4 changes

• updated · Jul 23, 2026 · Feature · 2026-07-23
• updated · Jul 20, 2026 · Feature · 2026-07-20
• updated · Jul 18, 2026 · Feature · 2026-07-18
• updated · Jul 17, 2026 · Feature · 2026-07-17

Intruder 1 changes

• Microsoft 365 security checks for Azure integrations (2026-07-21) · Feature · 2026-07-21

Iru 8 changes

• ADE customization for Mac: Managed profile delivery · Feature · 2026-07-23
• Continued improvements to Apple beta release management · Feature · 2026-07-23
• Public IP address now reported for Apple devices · Feature · 2026-07-23
• Request AppleCare enhanced logging from iOS and iPadOS devices testing Apple betas · Feature · 2026-07-23
• Restrictions improvements for Apple beta releases · Feature · 2026-07-23
• Vulnerability Management Enhancements · Feature · 2026-07-23
• What's New in Iru | July 10th · Feature · 2026-07-23
• What's New in Iru | July 17th · Feature · 2026-07-23

JumpCloud 1 changes

• JumpCloud Agent Release Notes for July 20, 2026 (2026-07-20) · Feature · 2026-07-21

Keycloak 1 changes

• Multi-Cluster v2 and Stateless Mode now in Preview (2026-07-17) · Feature · 2026-07-17

Kiro 2 changes

• Global Hooks, Session Search, and Reliability Fixes · Feature · 2026-07-22
• Introspect Subagent and Global Hooks · Feature · 2026-07-17

Laurel 1 changes

• v0.8.0 · Feature · 2026-07-20

Levo 6 changes

• Release Notes — Q4 2025 · Feature · 2026-07-23
• Release Notes — May 2026 · Feature · 2026-07-23
• Release Notes — April 2026 · Feature · 2026-07-23
• Release Notes — March 2026 · Feature · 2026-07-23
• Release Notes — February 2026 · Feature · 2026-07-23
• Release Notes — January 2026 · Feature · 2026-07-23

mac_apt 1 changes

• v1.33.2 · Feature · 2026-07-21

malcontent 2 changes

• v1.25.4 · Feature · 2026-07-21
• v1.25.0 · Feature · 2026-07-20

Microsoft Defender 1 changes

• changelog · Jul 17, 2026 · Feature · 2026-07-18

Mondoo 11 changes

• Executive Reports is generally available · Feature · 2026-07-23
• Executive Reports is in Preview · Feature · 2026-07-23
• Mondoo Release Highlights June 2026 · Feature · 2026-07-23
• Mondoo Release Highlights May 2026 · Feature · 2026-07-23
• Mondoo Release Highlights April 2026 · Feature · 2026-07-23
• Mondoo Release Highlights March 2026 · Feature · 2026-07-23
• Mondoo Release Highlights February 2026 · Feature · 2026-07-23
• Mondoo Release Highlights November 2025 · Feature · 2026-07-23
• Mondoo Release Highlights October 2025 · Feature · 2026-07-23
• Mondoo Release Highlights September 2025 · Feature · 2026-07-23
• Mondoo Release Highlights August 2025 · Feature · 2026-07-23

NeMo Guardrails 1 changes

• v0.23.0 · Feature · 2026-07-20

noir 1 changes

• v1.2.0 · Feature · 2026-07-20

nono 1 changes

• v0.69.0 · Feature · 2026-07-23

npq 4 changes

• v3.23.0 · Feature · 2026-07-23
• v3.22.0 · Feature · 2026-07-23
• v3.21.0 · Feature · 2026-07-23
• v3.20.0 · Feature · 2026-07-23

Nudge Security 4 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23
• Export a complete log of admin activity · Feature · 2026-07-22
• Know your real vendor risk with inherent and residual risk scores, now in open beta · Feature · 2026-07-22
• Prioritize your SaaS and AI inventory automatically with data types and business criticality tiers, now in open beta · Feature · 2026-07-22

Okta Identity Engine 1 changes

• Weekly release 2026.07.2 (2026-07-15) · Feature · 2026-07-17

Ollama 1 changes

• v0.32.1 · Feature · 2026-07-17

OpenAI Codex CLI 13 changes

• rust-v0.146.0-alpha.2 · Feature · 2026-07-22
• rust-v0.146.0-alpha.1 · Feature · 2026-07-22
• rust-v0.145.0-alpha.30 · Feature · 2026-07-22
• rust-v0.145.0 · Feature · 2026-07-22
• rust-v0.145.0-alpha.29 · Feature · 2026-07-21
• rust-v0.145.0-alpha.28 · Feature · 2026-07-21
• rust-v0.145.0-alpha.27 · Feature · 2026-07-21
• rust-v0.145.0-alpha.24 · Feature · 2026-07-20
• rust-v0.145.0-alpha.22 · Feature · 2026-07-18
• docs update · Docs · 2026-07-17
• rust-v0.145.0-alpha.20 · Feature · 2026-07-17
• rust-v0.145.0-alpha.19 · Feature · 2026-07-17
• rust-v0.145.0-alpha.18 · Feature · 2026-07-17

OpenCode 2 changes

• v1.18.4 · Feature · 2026-07-21
• v1.18.3 · Feature · 2026-07-17

OpenCTI 10 changes

• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• 7.260722.0 · Feature · 2026-07-22
• 7.260715.0 · Feature · 2026-07-20
• 7.260710.0 · Feature · 2026-07-20
• 7.260309.0-lts.6 · Feature · 2026-07-20
• 7.260706.0 · Feature · 2026-07-20
• 7.260701.0 · Feature · 2026-07-20
• 7.260626.0 · Feature · 2026-07-20
• 7.260624.0 · Feature · 2026-07-20

OpenCVE 1 changes

• v3.0.0 · Feature · 2026-07-20

OpenHands 1 changes

• cloud-1.47.0 · Feature · 2026-07-21

OpenShell 3 changes

• v0.0.90 · Feature · 2026-07-23
• v0.0.88 · Feature · 2026-07-21
• v0.0.86 · Feature · 2026-07-17

Ory 7 changes

• New rate limit model for Ory Network · Feature · 2026-07-23
• Ory Hydra, Ory Kratos v26.2.16 released · Feature · 2026-07-23
• Ory Network v26.2.21 released · Feature · 2026-07-23
• Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper v26.3.2 released · Feature · 2026-07-23
• Ory Network, Ory Kratos v26.2.17 released · Feature · 2026-07-23
• Ory Network, Ory Kratos, Ory Polis v26.2.19 released · Feature · 2026-07-23
• Ory Network, Ory Kratos, Ory Polis, Ory Elements v26.2.18 released · Feature · 2026-07-23

Panorays 12 changes

• Q1’23 · Feature · 2026-07-23
• Q1’24 · Feature · 2026-07-23
• Q1’25 · Feature · 2026-07-23
• Q2’23 · Feature · 2026-07-23
• Q2’23 AI Release · Feature · 2026-07-23
• Q2’24 · Feature · 2026-07-23
• Q2’25 · Feature · 2026-07-23
• Q3’23 · Feature · 2026-07-23
• Q3’24 · Feature · 2026-07-23
• Q3’25 · Feature · 2026-07-23
• Q4’23 · Feature · 2026-07-23
• Q4’24 · Feature · 2026-07-23

Pi 10 changes

• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• v0.81.1 · Feature · 2026-07-22
• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• v0.81.0 · Feature · 2026-07-21
• v0.80.9 · Feature · 2026-07-17

Ping Identity 6 changes

• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-23
• 21 Jul 2026 (2026-07-22) · Feature · 2026-07-23
• docs update · Docs · 2026-07-21
• 20 Jul 2026 (2026-07-21) · Feature · 2026-07-21
• 16 Jul 2026 (2026-07-17) · Feature · 2026-07-17

Plexicus 1 changes

• Plexicus 2026.7.17: Multifactor Priority Scoring v2, Registry Scanning Activated & Reticulum Accuracy Overhaul · Feature · 2026-07-23

Pomerium 8 changes

• Configurable DNS Resolvers · Feature · 2026-07-23
• Faster Config Updates & a New Databroker Query Engine · Feature · 2026-07-23
• Hosted Identity Provider · Feature · 2026-07-23
• MCP: Refresh Tokens, Dynamic Client Registration & Friendlier Errors · Feature · 2026-07-23
• MCP: Upstream OAuth, Dynamic Client Registration & Route Discovery · Feature · 2026-07-23
• Native SSH: Authorization Code Flow, Reverse Tunnels & Jump-Host Mode · Feature · 2026-07-23
• Revoke and Block: Stronger Session Revocation (Enterprise) · Feature · 2026-07-23
• SSH Session Recording (Enterprise) · Feature · 2026-07-23

Portkey 6 changes

• docs update · Docs · 2026-07-21
• docs update · Docs · 2026-07-21
• updated · Jul 21, 2026 · Feature · 2026-07-21
• docs update · Docs · 2026-07-20
• updated · Jul 20, 2026 · Feature · 2026-07-20
• updated · Jul 17, 2026 · Feature · 2026-07-17

Progress ShareFile 3 changes

• docs update · Docs · 2026-07-23
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22

Promptfoo 2 changes

• updated · Jul 22, 2026 · Feature · 2026-07-22
• updated · Jul 17, 2026 · Feature · 2026-07-17

Prowler 1 changes

• 5.35.0 · Feature · 2026-07-17

Qualys 1 changes

• changelog · Jul 22, 2026 · Feature · 2026-07-23

Qualys Patch Management 1 changes

• changelog · Jul 21, 2026 · Feature · 2026-07-21

Qualys VMDR 2 changes

• changelog · Jul 22, 2026 · Feature · 2026-07-22
• changelog · Jul 21, 2026 · Feature · 2026-07-21

Rapid7 InsightCloudSec 1 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23

RegScale 3 changes

• CLI 6.37.45 (2026-07-22) · Feature · 2026-07-23
• RegScale 6.32.2.0 (2026-07-20) · Feature · 2026-07-20
• CLI 6.37.39 (2026-07-16) · Feature · 2026-07-17

Rspamd 4 changes

• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• 4.1.2 · Feature · 2026-07-22

SailPoint 3 changes

• Enhancement: Support for Stronger Integrations (2026-07-20) · Feature · 2026-07-21
• New Capability: Personal Access Token Management for Admins (2026-07-20) · Feature · 2026-07-21
• Closed Preview: Next-Generation Mainframe Connectors for RACF, ACF2, and Top Secret (2026-07-16) · Feature · 2026-07-17

Sophos Central 1 changes

• updated · Jul 20, 2026 · Feature · 2026-07-20

StepSecurity 3 changes

• docs update · Docs · 2026-07-22
• Workflow Run Policies: allow-list enforcement, runner constraints, and richer policy insight (2026-07-21) · Feature · 2026-07-22
• Agent Skills Inventory for Developer Machines (2026-07-17) · Feature · 2026-07-22

Strix 3 changes

• v1.3.0 · Feature · 2026-07-23
• v1.2.0 · Feature · 2026-07-22
• v1.1.0 · Feature · 2026-07-20

Sublime Security 2 changes

• Platform v1.86 (Advanced Graymail Protection - Beta) (2026-07-16) · Feature · 2026-07-17
• Platform v1.85.57 (Multi-Tenant Provisioning APIs) (2026-07-16) · Feature · 2026-07-17

Sumo Logic 1 changes

• Searchable Time Support for Monitors (Alerts) (2026-07-22) · Feature · 2026-07-22

syft 1 changes

• v1.49.0 · Feature · 2026-07-21

Sysdig Secure 1 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23

SysReptor 1 changes

• 2026.58 · Feature · 2026-07-21

Tenable Attack Surface Management 1 changes

• changelog · Jul 16, 2026 · Feature · 2026-07-17

Tenzir 6 changes

• changelog · Jul 23, 2026 · Feature · 2026-07-23
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• docs update · Docs · 2026-07-22
• Tenzir Node v6.8.0: Splunk search input (2026-07-21) · Feature · 2026-07-22

Tines 4 changes

• JSON in records (2026-07-21) · Feature · 2026-07-22
• Track cases with change control in the storyboard (2026-07-20) · Feature · 2026-07-21
• Formula support for case details (2026-07-20) · Feature · 2026-07-21
• Visually create cases in the storyboard (2026-07-20) · Feature · 2026-07-21

ToolHive 10 changes

• v0.40.0 · Feature · 2026-07-21
• v0.40.1 · Feature · 2026-07-20
• v0.39.0 · Feature · 2026-07-20
• v0.38.0 · Feature · 2026-07-20
• v0.37.0 · Feature · 2026-07-20
• v0.36.0 · Feature · 2026-07-20
• v0.35.0 · Feature · 2026-07-20
• v0.34.0 · Feature · 2026-07-20
• v0.33.0 · Feature · 2026-07-20
• v0.32.0 · Feature · 2026-07-20

Trend Vision One 6 changes

• Integrate AI Secure Access with a third-party proxy (2026-07-20) · Feature · 2026-07-22
• Extend file password analysis to all inbound security functions (2026-07-21) · Feature · 2026-07-21
• Agentless Vulnerability & Threat Detection version 1.636.06121414 - AWS eu-south-2 (Spain) Region support (2026-07-20) · Feature · 2026-07-21
• On-premises gateway supports passing user information to upstream proxy (2026-07-20) · Feature · 2026-07-21
• Agentic red-teaming with AI Scanner (2026-07-16) · Feature · 2026-07-21
• Extended inactivity and max session timeout to 12 hours (2026-06-30) · Feature · 2026-07-20

Ubiq Security 1 changes

• updated · Jul 23, 2026 · Feature · 2026-07-23

Vanta 3 changes

• docs update · Docs · 2026-07-18
• docs update · Docs · 2026-07-18
• July 2026 · Feature · 2026-07-18

Vectra AI 5 changes

• v9.13 - Observe (2026-07-23) · Feature · 2026-07-22
• v9.13 - Platform (2026-07-23) · Feature · 2026-07-22
• v9.13 - Observe (2026-07-21) · Feature · 2026-07-20
• v9.13 - Observe · Feature · 2026-07-17
• v9.13 - Platform · Feature · 2026-07-17

Veracode 4 changes

• DAST updates (2026-07-22) · Feature · 2026-07-23
• Static Analysis updates (2026-07-22) · Feature · 2026-07-23
• Static Analysis updates (2026-07-21) · Feature · 2026-07-22
• Platform updates (2026-07-15) · Feature · 2026-07-17

VulnHunter 1 changes

• v0.1.0 · Feature · 2026-07-18

Watcher 2 changes

• v3.5.2 · Feature · 2026-07-22
• v3.5.0 · Feature · 2026-07-20

Windsurf 1 changes

• updated · Jul 20, 2026 · Feature · 2026-07-20

Wiz Cloud 1 changes

• changelog · Jul 22, 2026 · Feature · 2026-07-22

Wiz Defend 1 changes

• changelog · Jul 22, 2026 · Feature · 2026-07-22

XFA 15 changes

• Claude Code 'Auto' mode flagged as unsafe AI configuration · Feature · 2026-07-23
• Clearer policy settings and a redesigned Discovery · Feature · 2026-07-23
• Compliance Status Bar · Feature · 2026-07-23
• Custom onboarding and sign-in messages · Feature · 2026-07-23
• Device Snooze · Feature · 2026-07-23
• Easier Linux installation · Feature · 2026-07-23
• Guided setup, device posture at a glance, and rebuilt Statistics trends · Feature · 2026-07-23
• Lost connection status for devices · Feature · 2026-07-23
• Microsoft Teams (awareness) connection · Feature · 2026-07-23
• OPAL/SED hardware disk encryption detection on Linux · Feature · 2026-07-23
• Policy Compliance Summary · Feature · 2026-07-23
• Screen lock timeout enforcement · Feature · 2026-07-23
• Slack (awareness) connection · Feature · 2026-07-23
• Stronger mobile checks at sign-in, and a smoother dashboard · Feature · 2026-07-23
• VeraCrypt system encryption detection (Windows) · Feature · 2026-07-23

YARA-X 1 changes

• v1.19.0 · Feature · 2026-07-20

Yeti 1 changes

• 2.5.1 · Feature · 2026-07-20

ZeroTier 3 changes

• June 15, 2026 · Feature · 2026-07-23
• May 6, 2026 · Feature · 2026-07-23
• April 15, 2026 · Feature · 2026-07-23

Zscaler 2 changes

• changelog · Jul 22, 2026 · Feature · 2026-07-23
• changelog · Jul 17, 2026 · Feature · 2026-07-18

Cisco Duo Desktop updated · Jul 23, 2026 · 2026-07-23

Dropped support for Ubuntu 23.04 and 20.04 LTS on Linux (v4.6.0).

Claude Code v2.1.218 · 2026-07-23

Agent markdown files with names containing : are now rejected; any agent whose name includes : must be renamed before it will load.

Claude Code v2.1.218 · 2026-07-23

Skills with context: fork now run in the background by default; skills that must run in the foreground need background: false added to their frontmatter.

Cloudflare changelog · Jul 23, 2026 · 2026-07-23

The Account Roles API is deprecated and replaced by the Permission Groups API; integrations must obtain Permission Group IDs from the new API and use them in Account Members API policies — legacy Role IDs must be remapped.

Cloudflare changelog · Jul 23, 2026 · 2026-07-23

The PermissionGroup response replaces the legacy Role top-level description and permissions object (keyed by resource type with edit/read flags) with a meta object containing label and scopes; individual permissions are no longer returned as part of the permission group.

DNSFilter 07/22 July 22 – macOS Roaming Client v2.4.4 Beta (2026-07-22) · 2026-07-23

macOS 12 Monterey is no longer supported; v2.4.4 requires macOS 13 Ventura or later.

Dreadnode AIRT Report Builder now generally available with templates, branding, and DOCX export · 2026-07-23

The Export PDF Report button on the AIRT overview page has been removed; the Reports tab now handles PDF and all other export formats.

Dreadnode AIRT Report Builder now generally available with templates, branding, and DOCX export · 2026-07-23

The default GuardSessionPolicy transcript strategy is now intent_plus_calls (previously unspecified/different), which changes what context is sent to the LLM judge for existing GuardSessionPolicy configurations.

Dreadnode Agent Output available in beta for all orgs · 2026-07-23

The Structured Output nav item and route are renamed to Agent Output at /agents/agent-outputs/; any bookmarks or integrations referencing the old route or label will break.

Dreadnode Binary analysis capability replaces windows-reversing with cross-platform PE/ELF/Mach-O support · 2026-07-23

The windows-reversing capability bundle is replaced by binary-analysis; any configuration referencing windows-reversing must be updated to use binary-analysis.

Dreadnode Claude Code engine — run Claude's agentic loop as a governed, session-backed agent · 2026-07-23

The --session <name> flag is now required for concurrent web-security agents; omitting it will cause agents to clobber each other's browser state.

Dreadnode Compound eval verification — script_and_judge and flag_and_judge · 2026-07-23

The AIRT workspace path structure has changed to ~/.dreadnode/airt/[org]/[workspace]/, replacing the previous env-var-based path system — existing setups relying on the old env-var paths will need to be updated.

Dreadnode End-to-end multimodal AI red teaming — probe vision, audio, and video models with full media rendering in findings and traces · 2026-07-23

The items key in capability manifests is replaced by a unified produces key that configures built-in item types, custom types, and disablement — existing manifests using items will need to be updated.

ElcomSoft changelog · Jul 23, 2026 · 2026-07-23

The pre-login 2FA status check is removed, as Apple no longer supports it.

Google SecOps changelog · Jul 23, 2026 · 2026-07-23

From October 26, 2026, new Google SecOps instances will no longer accept legacy Backstory API or Ingestion API calls; only Chronicle API endpoints will be supported.

Google SecOps changelog · Jul 23, 2026 · 2026-07-23

From July 20, 2027, all requests to legacy Backstory API and Ingestion API endpoints will fail for all existing instances as the legacy APIs are completely turned down.

Hunter Engagement rates are now recipient-based · 2026-07-23

For API users: per-step counts no longer sum to the recipient-based totals at the sequence level — any downstream logic that aggregated step-level counts to derive sequence-level rates will now produce incorrect results.

Immuta updated · Jul 23, 2026 · 2026-07-23

Immuta will update Snowflake policy role names used to grant users access to Snowflake data sources as part of the architecture rollout beginning July 23, 2026; policy roles will be recreated under new names (user role names remain unchanged).

Immuta updated · Jul 23, 2026 · 2026-07-23

Integration error banners for Snowflake integration validation failures will no longer be displayed in the UI; error messages will instead be available through the connections experience.

Nudge Security changelog · Jul 23, 2026 · 2026-07-23

Previously tagged data types are no longer in the main Data Types field; they now appear under Data Types (Legacy), separate from the new automatically populated Data Types field.

Ory Ory Network, Ory Hydra, Ory Kratos, Ory Keto, Ory Oathkeeper v26.3.2 released · 2026-07-23

Wildcard * in return URLs and CORS origins is now honored only when the * is within a single DNS label — previously accepted wildcards that spanned multiple DNS labels will no longer match, potentially blocking requests that worked before.

Pomerium Native SSH: Authorization Code Flow, Reverse Tunnels & Jump-Host Mode · 2026-07-23

SSH authentication now uses the Authorization Code grant; upstream IdPs must have the Authorization Code grant enabled (v0.31.x and earlier used Device Code, which is no longer used).

Rapid7 InsightCloudSec changelog · Jul 23, 2026 · 2026-07-23

The Edit Metadata and Add to Custom Pack actions in the Insights Library have been replaced by the single Map to Compliance Pack action; any workflows or documentation referencing those actions must be updated.

Rapid7 InsightCloudSec changelog · Jul 23, 2026 · 2026-07-23

The query filter Snapshot Accessible To Public is deprecated (renamed to Snapshot Accessible To Public (Deprecated)); its functionality is now split across Snapshot Public Access and Database Snapshot Public Access.

Rapid7 InsightCloudSec changelog · Jul 23, 2026 · 2026-07-23

The Insight Snapshot Available to the Public is deprecated (targeted removal in version 27.1); it should be replaced with Snapshot Is Accessible to the Public and Database Snapshot Is Accessible to the Public.

Sysdig Secure changelog · Jul 23, 2026 · 2026-07-23

The previous single shared S3 Capture Storage configuration is replaced by the new Custom Storage system; existing Capture Storage settings will need to be reconfigured under Data Sources > Storage.

Ubiq Security updated · Jul 23, 2026 · 2026-07-23

Dataset access is now managed through Access Groups instead of Dataset Groups; the identity-to-dataset relationship has changed from Dataset → Dataset Group → Identity to Identity → Access Group → Dataset.

Ubiq Security updated · Jul 23, 2026 · 2026-07-23

Existing Dataset Groups have been converted to Tags; workflows relying on Dataset Groups as an access control mechanism must be updated to use Access Groups.

Veracode DAST updates (2026-07-22) · 2026-07-23

The DAST REST API scheduling endpoints have changed; integrations that use the REST API to manage schedules must be updated to use the new endpoints.

BeyondTrust docs update · 2026-07-22

Deleting a site is an unrecoverable operation that immediately removes all associated user permissions and configured connectors.

Capstone 6.0.0-Alpha10 · 2026-07-22

Alpha architecture enum names are renamed from Alpha_-prefixed mixed-case to ALPHA_-prefixed uppercase (e.g., Alpha_REG_Foo → ALPHA_REG_FOO); any code referencing the old names will fail to compile.

Capstone 6.0.0-Alpha10 · 2026-07-22

CS_MODE_RISCVC was renamed to CS_MODE_RISCV_C; builds not using the new CAPSTONE_RISCV_COMPAT_HEADER workaround will break.

Capstone 6.0.0-Alpha10 · 2026-07-22

aarch64_op_mem.disp changed from int32_t to int64_t; code that stores or passes this field as a 32-bit integer may break.

Claude Code v2.1.217 · 2026-07-22

Subagents no longer spawn nested subagents by default; existing workflows that relied on nested subagent spawning will stop working unless CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH is set to permit deeper nesting.

Nudge Security Prioritize your SaaS and AI inventory automatically with data types and business criticality tiers, now in open beta · 2026-07-22

Previously tagged data types are moved to a Data Types (Legacy) field, separate from the new automatically populated Data Types field.

Progress ShareFile docs update · 2026-07-22

Legacy Request List is transitioning to read-only mode; existing setups using the legacy Request List will no longer be editable (see FAQ - Legacy Request List Read-Only Mode and Transition to Request Lists).

Rspamd docs update · 2026-07-22

task:get_from({'mime', 'orig'}) now returns only the preserved original addresses when a rewrite exists, no longer appending rewritten addresses to the same list.

Rspamd docs update · 2026-07-22

Symbols carrying the explicit_enable flag now run only when listed in symbols_enabled or force-enabled via task:enable_symbol(); previously they ran whenever any settings were applied.

Rspamd docs update · 2026-07-22

The vendored FooTable library is removed from the WebUI; any customisation or external code depending on FooTable will break.

Rspamd docs update · 2026-07-22

Selectors with a syntax error after a valid prefix (e.g. from("smtp"):domain:lower) now cause configuration load to fail instead of silently evaluating the truncated prefix — affects multimap, rbl, ratelimit, settings, reputation, and WebUI selectors.

Rspamd docs update · 2026-07-22

Glob map entries now match the whole subject: bare entries like t.co no longer match walmart.com, and *.bit.ly no longer matches foo.bit.ly.evil.com — affects multimap glob/glob_multi types, url_redirector redirector_hosts_map, dkim_signing and arc signing_table/key_table, mx_check exclusions, and rbl glob returncodes matchers.

Rspamd docs update · 2026-07-22

Symbols with the explicit_enable flag no longer run when *any* settings are applied; they must be listed in symbols_enabled of the relevant settings entry or enabled via task:enable_symbol().

Rspamd docs update · 2026-07-22

task:get_from({'mime', 'orig'}) now returns only the wire addresses when an alias rewrite preserved originals, instead of the combined originals-plus-rewritten list — code relying on the combined list must query both flavours separately.

Rspamd docs update · 2026-07-22

From-domain maps or statistics keyed on gmail.com will now see googlemail.com for those senders, since cross-domain alias rewrites on the From address are silently discarded.

Rspamd docs update · 2026-07-22

Ciphertexts produced by rspamd_cryptobox secretbox with nonces shorter than 24 bytes under earlier versions were never reliable and will most likely fail to decrypt after upgrading; persisted secretbox data must be re-encrypted.

Rspamd 4.1.2 · 2026-07-22

In lua_task, the orig address flavour now returns only the wire (transmitted) addresses when a rewrite preserved the originals — code expecting rewritten addresses under orig will receive different values.

Rspamd 4.1.2 · 2026-07-22

WebUI: FooTable has been removed and all tables are now Tabulator-based; any customizations or integrations targeting FooTable will break.

Rspamd 4.1.2 · 2026-07-22

Maps: glob map patterns are now anchored to match the whole subject; entries relying on substring matching must be updated to use explicit wildcards or they will stop matching.

Watcher v3.5.2 · 2026-07-22

This release includes database schema changes — run python manage.py migrate after updating or connector credential storage and new settings will not function correctly.

Axonius Axonius Release Notes 9.0.1 (2026-06-25) · 2026-07-21

HPE Aruba Networking ClearPass Policy Manager: the Extended Info Fetch Window (Days) value is now constrained to 0–90; existing configurations with values outside this range must be updated.

Axonius Axonius Release Notes 9.0.1 (2026-06-25) · 2026-07-21

Microsoft Defender for Endpoint: the default value for vulnerability aggregation has changed to True, which may alter existing fetch behavior on upgrade.

dfvfs 20260717 · 2026-07-21

pyfsfat is now the default FAT back-end; setups relying on the previous default FAT back-end behavior may see differences in FAT volume parsing on upgrade.

OpenAI Codex CLI rust-v0.145.0-alpha.27 · 2026-07-21

The auto_review and permissions message fields and the legacy supports_reasoning_summary_parameter flag are removed from the bundled model catalog.

Ping Identity docs update · 2026-07-21

DaVinci response headers will be changed to lower case beginning July 20 — any downstream logic that matches on mixed-case response header names may break.

SailPoint Enhancement: Support for Stronger Integrations (2026-07-20) · 2026-07-21

When creating an API or Personal Access Token, admins must now specify the approved integration — existing token-creation workflows that do not supply an integration will require updating.

SailPoint New Capability: Personal Access Token Management for Admins (2026-07-20) · 2026-07-21

Any Personal Access Token created before February 5, 2026 that has never had an expiration date added or removed will automatically be assigned an expiration date 6 months (180 days) from the release date (production rollout: 7/28/2026), which may break long-lived integrations relying on those tokens remaining non-expiring.

SysReptor 2026.58 · 2026-07-21

Forgot password functionality via email is disabled when ALLOWED_HOSTS is unset.

ToolHive v0.40.0 · 2026-07-21

The stdio bridge now forwards only progress/message notifications; tools/list_changed and similar notifications are dropped, so dynamic-capability servers may show stale capability lists until clients re-list.

bbot v3.0.0 · 2026-07-20

-s now means --seeds (not --silent); scripts passing -s for quiet output will instead add a seed with no error. Silent output moved to -S/--silent.

bbot v3.0.0 · 2026-07-20

--whitelist was removed; use -t/--targets to define scope.

bbot v3.0.0 · 2026-07-20

--allow-deadly was removed.

bbot v3.0.0 · 2026-07-20

The noisy flag was renamed to loud (and other flags were similarly renamed).

bbot v3.0.0 · 2026-07-20

Module options are now pydantic-validated; the legacy per-module options dict hard-fails on upgrade.

bbot v3.0.0 · 2026-07-20

Some event types, event attributes, and config keys were renamed or removed.

bbot v3.0.0 · 2026-07-20

Modules wappalyzer, smuggler, digitorus, sitedossier, passivetotal, and wpscan were removed.

Claude Code v2.1.215 · 2026-07-20

Claude no longer automatically runs the /verify and /code-review skills; any workflow that relied on Claude triggering these autonomously must now invoke /verify or /code-review explicitly.

Immuta updated · Jul 20, 2026 · 2026-07-20

Snowflake policy role names will be renamed as part of the back-end architecture update rolling out beginning July 23, 2026; existing policy roles will be recreated under new names (user role names remain unchanged).

Immuta updated · Jul 20, 2026 · 2026-07-20

Integration error banners for Snowflake integration validation failures will no longer be displayed in the existing location; errors are now only available through the new connections experience.

Immuta updated · Jul 20, 2026 · 2026-07-20

When a data source is disabled in Immuta, data owners' Immuta-managed grants in the data platform will be revoked (behavior change release: on by default 8/1, enabled for all 9/1).

NeMo Guardrails v0.23.0 · 2026-07-20

Pydantic >=2.5,<3.0 is now required; environments pinned to Pydantic 1.x must upgrade before installing v0.23.0.

ToolHive v0.34.0 · 2026-07-20

The --allow-docker-gateway flag now actively grants host-level network access rather than merely unblocking it, which changes the effective network permissions for containers using this flag.

ToolHive v0.34.0 · 2026-07-20

The Amp editor extension clients have been removed.

ToolHive v0.32.0 · 2026-07-20

ToolHive now validates the HTTP Origin header and removed Access-Control-Allow-Origin: * from the legacy SSE transport; browser clients on a non-http://localhost origin must pass the new --allowed-origins flag to thv run or thv proxy.

ToolHive v0.32.0 · 2026-07-20

pkg/vmcp/server.New dropped its discovery.Manager parameter (7 → 6 args) and the pkg/vmcp/discovery package was removed; out-of-tree Go code calling server.New must remove the discovery.Manager argument, ensure Config.Aggregator is non-nil, and pair Config.AuthzMiddleware with Config.Authz or receive ErrInvalidConfig.

Watcher v3.5.0 · 2026-07-20

The new timeline Django app requires a database migration (python manage.py migrate) and must be present in INSTALLED_APPS with its URLs registered — pull the updated settings.py and urls.py or add them manually before starting the service.

Windsurf updated · Jul 20, 2026 · 2026-07-20

The status bar is now hidden by default in the Agent Command Center; set "workbench.statusBar.visible": true in user settings to restore it.

Claude Code v2.1.214 · 2026-07-18

Single-segment dir/** hook if: conditions now match only <cwd>/dir; write **/dir/** to match at any depth.

Claude Code v2.1.214 · 2026-07-18

file commands using -m/--magic-file or -f/--files-from now require permission instead of being auto-allowed as read-only.

Claude Code v2.1.214 · 2026-07-18

SessionStart hooks now report source "fork" when a session begins as a fork instead of "resume".

Cursor Improvements to Cursor in Slack · 2026-07-18

In-message buttons are removed and replaced by compact footer links, which will change existing interaction patterns for users who relied on those buttons.

Immuta updated · Jul 18, 2026 · 2026-07-18

When a data source is disabled, Immuta will revoke data owners' Immuta-managed grants in the data platform (opt-in 6/30–7/31, on by default 8/1, enforced for all 9/1) — workflows that depend on owners retaining access after disabling a source will break.

BeyondTrust Base 8.3.0 release notes (2026-07-16) · 2026-07-17

The ability to opt out of seamless (no-downtime) critical security updates is removed; these updates now apply automatically on on-premises appliances.

BeyondTrust Base 8.3.0 release notes (2026-07-16) · 2026-07-17

If an appliance has not successfully communicated with the update server within a defined time window, key functionality is degraded or disabled.

BeyondTrust Remote Support 26.2.1 release notes (2026-07-16) · 2026-07-17

The ability to opt out of seamless (no-downtime) critical security updates is removed; these updates are now applied automatically on upgrade.

BeyondTrust Remote Support 26.2.1 release notes (2026-07-16) · 2026-07-17

RADIUS authentication provider is deprecated: existing configurations can be edited but new ones cannot be created — migrate to SAML or LDAP before future versions remove the provider entirely.

Claude Code v2.1.212 · 2026-07-17

The Task tool's mode parameter is now ignored; subagents inherit the parent session's permission mode by default.

Immuta updated · Jul 17, 2026 · 2026-07-17

Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake architecture update beginning July 23, 2026; existing policy roles will be recreated under new names.

Immuta updated · Jul 17, 2026 · 2026-07-17

When a data source is disabled in Immuta, Immuta-managed grants for data owners in the data platform will be revoked (behavior change release: on by default 8/1, enabled for all 9/1).

OpenAI Codex CLI rust-v0.145.0-alpha.20 · 2026-07-17

The Bedrock account credentialSource enum is replaced by the usesCodexManagedCredentials boolean; any configuration or code referencing credentialSource will break.

OpenShell v0.0.86 · 2026-07-17

The openshell policy prove command and Z3 dependency have been removed; any workflow or script invoking openshell policy prove will break.

Pi v0.80.9 · 2026-07-17

Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 have been removed from the built-in xAI model catalog — any configuration referencing these models will break.

Sublime Security Platform v1.86 (Advanced Graymail Protection - Beta) (2026-07-16) · 2026-07-17

The Flagged view has been replaced; Needs Remediation is its closest equivalent for reviewing messages awaiting action.

Veracode Platform updates (2026-07-15) · 2026-07-17

The /healthcheck/status endpoint has been removed and now returns a 404 error; use the v2/principal endpoint in the Identity REST API to check authenticated connectivity instead.

Veracode Platform updates (2026-07-15) · 2026-07-17

Success events have been removed from the Firewall dataset in Firewall Analytics.