The week in full · Jul 24–30

AI/LLM Security · 2026-07-30

AI-Infra-Guard v4.5.1 adds multi-turn jailbreak attacks, 6 new OWASP agent-scan skills, and 4 new MCP security detection rules.

• Adds Many-Shot, PAIR, GOAT, and ActorAttack multi-turn jailbreak attack methods to PromptSecurity.
• Adds 5 new OWASP-aligned Agent-Scan detection skills: agentic-supply-chain, cascading-failure, human-agent-trust, inter-agent-comm, and unexpected-code-execution.
• Adds web-exfiltration-detection skill to Agent-Scan.

Identity & Access Management · 2026-07-30

BeyondTrust Identity Security Insights launches with True Privilege Graph, threat detection, and cross-domain identity risk visibility.

• Introduces the True Privilege Graph — maps direct and indirect access paths, revealing hidden privilege escalation routes across hybrid environments.
• Adds real-time posture tracking for privilege reduction, MFA adoption, and dormant account cleanup.
• Enables threat detection for session hijacking, unauthorized changes, and misuse of service principals.

Identity & Access Management · 2026-07-30

BeyondTrust introduces PathfinderAI, an AI-powered natural language assistant for exploring security data.

• Adds PathfinderAI, an AI-powered assistant that lets users query and explore security data through natural language conversations directly in the BeyondTrust Pathfinder UI.
• PathfinderAI integrates with Identity Security Insights, surfacing data from configured connectors through a conversational interface accessible from the main navigation menu.

Identity & Access Management · 2026-07-30

BeyondTrust launches PathfinderAI, a natural-language GenAI assistant for querying identity and privilege data across all connected Insights providers.

• Adds PathfinderAI, a GenAI chat assistant embedded in Pathfinder that answers natural-language questions about your identity environment using live Insights data.
• Supports privilege analysis queries — ask who holds specific roles or can reach them via privilege paths, with breakdowns by account type (human, service, application).
• Supports stale/dormant account queries, surfacing inactive privileged accounts with days-inactive counts, password age, and risk context.

Identity & Access Management · 2026-07-30

BeyondTrust adds a Pathfinder MCP prompt library for AI-agent queries across PRA, EPM, Password Safe, Entitle, and Insights.

• New Pathfinder MCP prompt library provides ready-to-use prompts for querying BeyondTrust products (PRA, EPM Win/Mac, EPM Linux, Entitle, Password Safe, Identity Security Insights) through any MCP-compatible AI agent.
• Adds multi-product identity risk brief prompt that orchestrates PRA sessions, EPM JIT admin sessions, and Insights recommendations into a single user-scoped narrative.
• Adds EPM JIT anomaly detection prompt that identifies hot endpoints, repeat elevators, and unusual session durations across a date range.

Identity & Access Management · 2026-07-30

BeyondTrust Pathfinder adds MCP gateway (Early Access) so AI agents can securely query Identity Security Insights, Password Safe, EPM, PRA, and Remote Support through a single endpoint.

• New Pathfinder MCP (Model Context Protocol) gateway lets AI agents securely query data across BeyondTrust products through a single authenticated endpoint.
• Administrators can enable or disable MCP per site via Site Feature Configuration > Platform AI Features.
• Users can self-serve MCP access tokens with configurable expiration (30, 60, 90 days, or custom up to one year) from their profile.

Identity & Access Management · 2026-07-30

BeyondTrust launches Pathfinder MCP Gateway — a single MCP-compatible endpoint for AI agents to query data across all BeyondTrust products

• Introduces the Pathfinder MCP Gateway, a single JSON-RPC 2.0/MCP endpoint (https://mcp.beyondtrust.io/mcp) that lets AI agents discover and query data across Identity Security Insights, Entitle, Password Safe, EPM, Privileged Remote Access, Remote Support, and Platform without building individual product integrations.
• Supports any MCP-compatible AI agent or client, including VS Code with MCP extension, Claude Code/Claude Desktop, Cursor, custom internal agents, and Microsoft Security Copilot.
• Exposes namespaced read-only tools per product (e.g., insights___, password-safe___, pra___, entitle___) discoverable via tools/list, returning structured JSON responses.

Identity & Access Management · 2026-07-30

BeyondTrust Pathfinder gains Audit Logs for user management actions, accessible via the Administration console.

• New Audit Logs page in Pathfinder tracks user management actions including password resets, IDP config changes, auth events, machine/PAT token changes, permission changes, and user sign-ins.
• Supports filtering audit events by date range, user email (partial match), and action keyword (partial match) to narrow investigation scope.
• Expandable event rows reveal additional detail about each audit event.

Identity & Access Management · 2026-07-30

BeyondTrust Pathfinder gains SCIM 2.0 provisioning support for Okta, Microsoft Entra ID, and SailPoint IdentityNow

• Adds SCIM 2.0 provisioning integration to Pathfinder, enabling automated user and group lifecycle management from external identity providers.
• Supports Okta, Microsoft Entra ID, and SailPoint IdentityNow as SCIM-capable identity providers.
• New SCIM token generation workflow in the Pathfinder administration console with configurable expiration dates.

Identity & Access Management · 2026-07-30

BeyondTrust Pathfinder gains LDAP/Active Directory authentication support via Privileged Remote Access or Remote Support as proxy.

• Supports LDAP and Active Directory authentication on Pathfinder, proxied through a connected Privileged Remote Access or Remote Support product instead of direct directory access.
• New Directory Authentication configuration page in Pathfinder administration lets admins register directory providers with label, provider type, domain/server, proxy site, and product settings.
• Enables automatic provisioning of Active Directory and LDAP user accounts on first sign-in via the organization-specific login URL.

Post-Exploitation · 2026-07-30

BloodHound adds a Data Quality page with object count trends, privileged collection completeness charts, and OpenGraph ingest validation.

• New Data Quality page (Administration > Data Quality) lets practitioners validate ingested data with aggregate object counts, source-specific breakdowns, and historical count trends after each collection run.
• Local Group Completeness Over Time and Session Completeness Over Time charts show SharpHound privileged-collection coverage across active computers.
• Structured OpenGraph object counts and historical trends (v9.5.1+, early access) allow validation of OpenGraph ingest by extension and source_kind without writing custom Cypher queries.

Post-Exploitation · 2026-07-30

BloodHound v9.5.1 adds ADCS ESC14 Scenario A attack paths, OpenGraph entity panels, and a new Attack Path Findings API.

• Adds ADCS ESC14 Scenario A attack path coverage: identifies certificate-mapping takeover paths via write access to altSecurityIdentities or the Public-Information property set (WriteAltSecurityIdentities, WritePublicInformation).
• Adds OpenGraph Entity Info: extension-defined context for OpenGraph nodes and relationships displayed directly in the Entity Panel as custom accordions and markdown content.
• Adds OpenGraph Data Quality Statistics: node-count statistics for OpenGraph environments and aggregate counts across extension kinds.

Post-Exploitation · 2026-07-30

BloodHound adds new attack path edges, data quality APIs, and client management operation notifications.

• New WriteAltSecurityIdentities edge documents the attack path from principals with write access to the altSecurityIdentities attribute.
• New WritePublicInformation edge captures abuse of write access to public information attributes as an attack path.
• New API endpoints to notify BloodHound of client management operation start and end, enabling better orchestration of data collection sessions.

AI Coding Agents · 2026-07-30

Cline CLI v3.0.47 adds free-model support, persistent settings, and agentic compaction as the new default.

• Adds support for free Cline models end-to-end, displayed with a (free) label and a dedicated card showing the reset time when the free usage limit is reached.
• Persists /settings general toggles — plan/act mode, tool auto-approve, and compaction mode — across CLI restarts.
• Expands built-in provider coverage, now generated from models.dev, with an updated bundled model catalog.

SAST / SCA / Code Security · 2026-07-30

Codacy now respects ShellCheck configuration files in your repository.

• Supports ShellCheck configuration files, allowing per-repository ShellCheck rule customization without modifying Codacy settings.

AI Agent Frameworks · 2026-07-30

CrewAI 1.15.9 surfaces tool failures explicitly, emits FlowFailedEvent on flow errors, and adds progressive disclosure for skills.

• Surfaces tool failures as actual failures instead of silently reporting them as success, enabling agents to react correctly to tool errors.
• Emits a new FlowFailedEvent when a flow execution fails, allowing event-driven error handling and observability hooks in Flows.
• Adds progressive disclosure for skills, surfacing contextually relevant skill guidance incrementally rather than all at once.

AI Coding Agents · 2026-07-30

Cursor launches native iPad app with split-screen reviews, Apple Pencil markup, Inbox, and Bitbucket/Azure DevOps support.

• Adds native iPad app (available on all paid plans) with a rebuilt layout featuring pinned sidebar chats for monitoring multiple agents simultaneously.
• Supports split-screen mode on iPad, keeping a PR review open alongside an active chat with full file diff rendering.
• Enables Apple Pencil markup on screenshots: tap to drop a comment at a specific point or draw directly on an image.

Vulnerability Management · 2026-07-30

DefectDojo Pro adds 33 new findings connectors, FIPS 140-3 image variants, Opsgenie/ServiceNow outbound integrators, and SAML/LDAP/OIDC attribute-mapping editors.

• Adds 33 new findings connectors in v3.1.302: AppCheck, CyCognito, Picus, Red Hat Satellite, ImmuniWeb, Trustwave Fusion, Scantist, Black Duck Continuous Dynamic, Finite State, SOOS, Ostorlab, Automox, Qwiet AI, HiddenLayer, Nozomi Networks, NetRise, Uptycs, Klocwork, Parasoft DTP, CI Fuzz, Akto, BigID, Action1, ManageEngine Vulnerability Manager Plus, Zimperium, Dragos, CyberArk Certificate Manager, Calico Cloud, Rapid7 InsightCloudSec, Holm Security, Wazuh SCA, Fleet, and Elastic Security.
• Adds nine parser-backed findings connectors in v3.1.301: Google Artifact Analysis, Zora, PingCastle, Promptfoo, Alert Logic, Cyberwatch, WebInspect Enterprise, TruffleHog, and Chef Automate — each sharing its existing parser mapping and deduplication config with file imports.
• Connector syncs can now stream findings in chunks, preventing memory exhaustion on very large syncs.

Vulnerability Management · 2026-07-30

DefectDojo 3.1.302 adds login rate limiting to API token auth and expands scanner protocol support.

• Applies login rate limiter to the API token authentication endpoint, reducing brute-force exposure on token-based logins.
• Adds additional scanner protocols to the whitelist, broadening supported import sources.
• Updates Fortify parsers to extract and populate CWE data from scan results.

Data Security & DLP · 2026-07-30

CertCentral automated delegation approval expands to EV TLS, EV Code Signing, Verified Mark, and PKIo products globally and in Europe.

• Extends automated delegation approval to EV TLS, EV Code Signing, Code Signing, Verified Mark, and Common Mark certificates in CertCentral global and Europe.
• Adds automated delegation approval support for a broad set of CertCentral Europe products including EU Qualified eSeal (PSD2), EU Qualified Website Authentication Certificate (PSD2), PKIo Personal Organisation, PKIo Qualified eSeal, PKIo Private Person, and multiple PKIo Authentication/Encryption and Private Services Server variants.
• Simplifies the delegation request workflow: a single request now covers all organizations the selected approver represents and all certificate products they are authorized to approve, removing the previous per-organization selection step.

Firewalls & Network Defense · 2026-07-30

Next-Gen WAF Apache module now logs failed-open requests for better visibility into bypass events.

• Logs failed-open requests, giving practitioners visibility into traffic that bypassed WAF inspection.

Threat Intelligence · 2026-07-30

Feedly adds Cyberattack Intel Agent with AI-powered filtering, Insights Cards, and real-time Threat Graph monitoring.

• New Cyberattack Intel Agent continuously monitors thousands of OSINT sources — including SEC filings and regional stock exchanges — to surface relevant attacks in real time.
• Precision filtering lets analysts narrow large attack sets (e.g., 1,098 attacks → 48 relevant) by attack chain, victim, attribution, and more.
• Insights Cards provide full attack context — aggregated from thousands of sources via the Real-Time Threat Graph — in a single unified view.

Threat Intelligence · 2026-07-30

Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks via the Threat Graph

• Adds a Cyberattack Intel Agent that discovers and monitors relevant cyber attacks through the Feedly Threat Graph

Threat Intelligence · 2026-07-30

Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks.

• New Cyberattack Intel Agent enables practitioners to discover and monitor cyber attacks relevant to their environment.

Threat Intelligence · 2026-07-30

Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks.

• New Cyberattack Intel Agent continuously discovers and monitors cyber attacks relevant to your environment.

Threat Intelligence · 2026-07-30

Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks.

• New Cyberattack Intel Agent continuously discovers and monitors cyber attacks relevant to your organization.

Threat Intelligence · 2026-07-30

Feedly adds a Cyberattack Intel Agent for discovering and monitoring relevant cyber attacks.

• New Cyberattack Intel Agent lets practitioners discover and continuously monitor cyber attacks relevant to their environment.

Threat Intelligence · 2026-07-30

Feedly adds a Cyberattack Intel Agent to discover and monitor relevant cyber attacks in real time.

• New Cyberattack Intel Agent continuously discovers and monitors relevant cyber attacks for your organization.

Secrets Detection & Management · 2026-07-30

GitGuardian Detection Engine 2.168 adds 4 new detectors, 2 new validity checkers, and extends HTML/Markdown scanning to 5 token types.

• New detector for Azure Immersive Reader Key credentials.
• New detector for Alibaba Cloud Model Studio (Qwen / DashScope) Coding Plan API keys.
• New detector for Alibaba Cloud Model Studio (Qwen / DashScope) Token Plan API keys.

AI Coding Agents · 2026-07-30

Goose adds offline documentation skill and Azure AI Foundry integration for OpenAI, Anthropic, and partner models.

• New goose-doc-guide skill reads official Goose documentation before answering, enabling offline/air-gapped doc lookups.
• Adds Azure AI Foundry integration, supporting OpenAI, Anthropic, and partner model deployments from an Azure AI Foundry project.

AI Coding Agents · 2026-07-30

Goose v1.45.0 adds tab completion for model switching, air-gapped docs support, disabling built-in skills, and Gemini/Opus5 model support.

• Adds tab completion and inline provider switching to the model command.
• Supports latest Gemini models and Opus5 (including adaptive thinking).
• Adds GOOSE_DOCS_ROOT environment variable for air-gapped / offline documentation access.

AI Agent Frameworks · 2026-07-30

HolmesGPT 0.38.0 adds remote tool call approval workflows and cuts prompt token usage by 50–60%.

• Implements remote tool call approval workflows, allowing human review and authorization of agent-initiated tool calls before execution.
• Reduces system prompt and tool description sizes by ~50–60%, significantly cutting prompt token consumption per investigation.
• Makes conversation-worker slot exhaustion visible and bounds reconnect sign-in, improving observability of capacity limits.

Data Security & DLP · 2026-07-30

• Expands automated sensitive data discovery (regex, dictionary, and column-name regex identifiers) to Immuta's Amazon Redshift viewless integration.
• Snowflake integration error messages are moved out of error banners and into the connections experience.

Secrets Detection & Management · 2026-07-30

Infisical v0.162.15 adds SCEP support for Microsoft Intune, NKP Helm chart, PAM connection testing, and improved machine identity template visibility.

• Adds SCEP (Simple Certificate Enrollment Protocol) support for Microsoft Intune, enabling certificate-based device enrollment flows.
• New Helm chart (infisical-nkp) for deploying Infisical in Nutanix Kubernetes Platform (NKP) partner catalog environments.
• Adds connection test capability for PAM (Privileged Access Management) accounts, allowing validation of account connectivity before use.

Endpoint Security (EDR/XDR) · 2026-07-30

Iru adds Elgato Stream Deck as a new Auto App integration in the catalog.

• Adds Elgato Stream Deck Auto App integration, now available to all customers via the Library Items catalog.

Endpoint Security (EDR/XDR) · 2026-07-30

Iru adds Screen Studio as a new Auto App, now available to all customers in the catalog.

• Adds Screen Studio to the Iru Auto App catalog, making it available for automated deployment to all customers.

Endpoint Security (EDR/XDR) · 2026-07-30

Iru Endpoint adds 9 new Windows Auto Apps including Cisco Webex, Claude, GitHub CLI, and Node.js.

• Adds Cisco Webex Meetings to the Windows Auto Apps catalog for automated endpoint deployment.
• Adds Claude to the Windows Auto Apps catalog for automated endpoint deployment.
• Adds GitHub CLI to the Windows Auto Apps catalog for automated endpoint deployment.

AI/LLM Security · 2026-07-30

AgentMesh shifts to freemium with tiered API access, including a free signed-in API trial and paid tiers bundling Kirin endpoint licenses.

• Introduces anonymous (no-login) free tier with access to 100 items per category via the Web UI.
• Adds free signed-in tier unlocking 300 items per category plus trial API access (capped at 20 calls/month, 1/day) for engineers and security researchers.
• Launches Premium tier ($15/user/month) with full catalog access, 300 API calls/month (20/day cap), and a bundled Kirin endpoint agent license.

Compliance Automation & Trust Management · 2026-07-30

Mondoo launches a hosted MCP server, enabling Claude Desktop, Claude Code, and VS Code to query spaces, findings, and policies in plain language.

• New hosted MCP server lets AI tools (Claude Desktop, Claude Code, VS Code) connect to Mondoo using a read-only API token.
• Enables natural-language exploration of Mondoo spaces, findings, and policies directly from AI-powered clients.

Identity & Access Management · 2026-07-30

Nudge Security adds a ServiceNow integration to route security findings directly into ServiceNow tickets.

• New ServiceNow integration lets you create a ticket from any security finding, map it to the appropriate ServiceNow table and fields, and keep both systems in sync.

Identity & Access Management · 2026-07-30

Nudge Security AI conversation monitoring now detects sensitive data entered into Amazon Quick Suite chats.

• Detects secrets, PII, financial data, and health data shared in Amazon Quick Suite (Amazon's agentic AI platform) via AI conversation monitoring.

Identity & Access Management · 2026-07-30

Nudge Security now discovers AI agents built on Amazon Quick, surfacing creator, components, and risk insights in your AI agents inventory.

• Discovers AI agents your team builds on Amazon Quick (AWS's agentic AI platform) via browser extension, adding them to the AI agents inventory under Identities with creator, components, and risk insights.

AI Coding Agents · 2026-07-30

Codex CLI adds MCP 2026 protocol support, cloud-managed sandbox profiles, persisted thread sections, and model-owned token budget defaults.

• Adds MCP 2026-07-28 discovery support and completes MCP 2026 client support, enabling use of the latest Model Context Protocol spec.
• Exposes cached MCP tools to inference before the MCP server finishes initializing, reducing startup latency for tool-heavy workflows.
• Routes MCP OAuth requests through configured HTTP clients, enabling proxy-aware MCP authentication.

AI Coding Agents · 2026-07-30

OpenCode gains Tavily integration for web search, extraction, crawling, and deep research.

• Adds opencode-tavily integration, enabling web search, content extraction, crawling, and deep research via the Tavily CLI.

AI Coding Agents · 2026-07-30

OpenCode v1.18.10 adds automatic Modal model discovery and desktop UX improvements.

• Automatically discovers available Modal models, removing the need to manually configure them.
• Always shows the new session button in the desktop app for faster session creation.
• Prevents duplicate attachments from being added in the desktop composer.

AI Coding Agents · 2026-07-30

OpenHands v1.7.0 adds persistent agent memory, always-visible LLM selector, and secret overwriting from the edit form.

• Adds a persistent agent memory toggle so agents can retain context across sessions.
• LLM selector is now always visible in the UI; agent-profile switching moves to the tools menu.
• Enables overwriting an existing secret's value directly from the secret edit form.

AI Coding Agents · 2026-07-30

Pi extensions gain ctx.scopedModels to expose session-scoped model lists in custom UIs.

• Adds ctx.scopedModels read-only property to the extension context, exposing the session-resolved list of scoped models (including optional thinkingLevel per entry) for building custom model pickers.

AI Coding Agents · 2026-07-30

Pi's interactive TUI gains an alternate-screen viewport with keyboard, mouse, and hyperlink support via --alt.

• Adds --alt interactive mode with a full alternate-screen TUI viewport supporting keyboard scrolling (page up/down, top, bottom), two-finger trackpad and mouse-wheel scrolling, OSC 8 hyperlink click-to-open, and primary-button drag-to-copy text selection.

AI Coding Agents · 2026-07-30

Pi adds --alt flag for alternate-screen TUI with Kitty graphics protocol inline image support.

• Adds --alt flag to launch Pi in an alternate-screen TUI with application-owned scrolling in interactive mode.
• Supports inline images via the Kitty graphics protocol (Kitty and Ghostty terminals) when --alt is active.

AI Coding Agents · 2026-07-30

Pi 0.83.0 adds credential export commands, headless OpenRouter sign-in, Claude Opus 5 via Copilot, and richer provider stream metadata.

• New pi auth print-api-key and pi auth print-bearer-token commands export configured credentials to external clients with automatic OAuth refresh and configurable minimum token validity.
• Headless OpenRouter sign-in now supports remote/SSH environments by accepting a manually pasted redirect URL or authorization code when the loopback callback is unavailable.
• Supports Claude Opus 5 through GitHub Copilot with adaptive thinking and a 1M context window.

AI Coding Agents · 2026-07-30

Pi v0.83.0 adds credential export commands, headless OpenRouter login, and Claude Opus 5 via GitHub Copilot.

• Adds pi auth print-api-key and pi auth print-bearer-token commands to export configured credentials (with automatic OAuth refresh and minimum-validity enforcement) for use by external clients.
• Enables headless OpenRouter login by accepting a manually pasted redirect URL or authorization code when the loopback callback is unavailable (e.g., over SSH).
• Adds Claude Opus 5 support through the GitHub Copilot provider, with adaptive thinking and a 1 million-token context window.

SAST / SCA / Code Security · 2026-07-30

Portkey Enterprise adds configurable custom Gateway URLs for self-hosted AI and MCP gateway deployments.

• Adds organisation-level Gateway URL setting so self-hosted AI gateway deployments replace Portkey's cloud endpoint (https://api.portkey.ai/v1) in code snippets, Model Catalog, and playground completions.
• Adds organisation-level MCP Gateway URL setting to point MCP server endpoint construction at a self-hosted MCP gateway instead of https://mcp.portkey.ai.
• Dashboard auto-normalises trailing /v1 on the Gateway URL field, saving automatically on focus-out with no separate save button.

SAST / SCA / Code Security · 2026-07-30

Portkey adds vault-backed secret references, weekly/endpoint-scoped rate limits, two new guardrail integrations, and broader provider coverage.

• Introduces weekly rate/budget windows (rpw) and endpoint-scoped rate limits, letting teams cap spend per API surface (chat completions, embeddings, admin routes, etc.) independently.

General Utilities & Libraries · 2026-07-30

pipx 1.16.5 honors version specifiers in upgrade --install; 1.16.4 ships colorama in zipapp and adds log pruning via PIPX_MAX_LOGS=0

• Respects version specifiers when pipx upgrade --install installs a missing package, so pinned versions are enforced correctly.
• Bundles colorama in the zipapp, enabling the single-file pipx to work on Windows and Python 3.10 without extra dependencies.
• Setting PIPX_MAX_LOGS=0 now prunes all pipx log files instead of retaining them indefinitely.

Attack Surface & Exposure Management · 2026-07-30

runZero 5.0.260728.1 adds Jira issue-owner sync, Git Smart Protocol scanning, Purdue level search, and multi-sensor Tanium support.

• New site details page lets users with organization access view site details and subnet definitions.
• Adds ability to sync issue owners with Jira from runZero.
• Goals widget now includes a Pending metric showing baseline assets that don't match the target query, with click-through to those assets in inventory.

Attack Surface & Exposure Management · 2026-07-30

runZero 5.0 adds Jira issue-owner sync, Git Smart Protocol scanning, Purdue-level search terms, and multi-sensor Tanium support.

• New site details page lets organization-level users view site details and subnet definitions.
• Adds ability to sync issue owners with Jira.
• Goals widget now includes a Pending metric showing baseline assets that don't match the target query, with click-through to those assets in inventory.

Network Analysis & Monitoring · 2026-07-30

Security Onion 3.2.0 adds agentic AI (Gemma-backed Investigator/Engineer), Sigma playbooks, ES|QL defaults, data stream lifecycle management, and UEK8 kernel support.

• Adds agentic AI capability with Gemma-backed Investigator and Detection Engineer agents for automated analysis workflows.
• Supports Sigma playbooks (including airgap environments), enabling SigmaHQ rules against Elastic Defend logs.
• Adds data stream lifecycle management support for Elasticsearch index management.

Cloud Security Posture · 2026-07-30

Sysdig CLI Scanner v1.28.0 adds NixOS and Arch Linux package detection plus dnf/microdnf support.

• Adds detection of NixOS (nix) packages in the CLI Scanner.
• Adds detection of Arch Linux packages in the CLI Scanner.
• Adds dnf and microdnf to the package manager detection policy rule.

Secure Access (VPN / SASE / ZTNA) · 2026-07-30

New alpha API lets you programmatically create, list, and delete API-only tailnets in your organization.

• Adds a tailnet creation API (alpha) to programmatically create, list, and delete API-only tailnets within an organization.

Endpoint Security (EDR/XDR) · 2026-07-30

Container Security inventory gains resource-level drill-down, 24-hour trend indicators, and direct log links.

• Drill down to individual Kubernetes nodes/pods or Amazon ECS services/tasks in the Container Security inventory overview, scoping all security findings to that single resource.
• Each security finding type now displays a 24-hour trend indicator comparing the last 24 hours against the previous 24 hours.
• Selecting a finding count in the inventory overview opens the corresponding log page directly for event-level review.

SAST / SCA / Code Security · 2026-07-30

Veracode integrations gain platform-driven GitHub install/uninstall, scheduled scans, new API pagination, and broader language autopackaging support.

• Adds a new uninstallation workflow on the Veracode Platform to remove the Veracode app from GitHub organizations.
• Enables installing, configuring, and updating credentials for the Veracode GitHub Integration directly from the Veracode Platform, bypassing manual GitHub Marketplace steps.
• Adds autopackaging support for Apex, VB6, and Perl in the GitHub Workflow Integration.

SAST / SCA / Code Security · 2026-07-30

Veracode adds Custom PDF REST API, OAuth for XML APIs, six new built-in policies, and expanded Reporting API filters in its 2026 platform updates.

• New Custom PDF REST API enables programmatic generation of custom PDF reports.
• XML APIs now support OAuth Client Credentials authentication, in addition to REST APIs.
• Auto-Update OWASP and CWE Top 25 policy rules now enforce OWASP Top 10:2025 and MITRE CWE Top 25 for 2025 standards.

SAST / SCA / Code Security · 2026-07-30

Veracode SAST adds Pipeline Scan support for >200 MB artifacts, exploit-level scoring in results.json, and an enhanced Python scanner with PySpark/Flask/Django/FastAPI support.

• Pipeline Scan now supports packaged artifacts larger than 200 MB with no integration changes required.
• Pipeline Scan results.json now includes a numeric exploit level (-2 to 2) for each finding, surfacing exploitability likelihood alongside vulnerability data.
• Static Analysis Engine v2026.07 adds support for Android 17 and enhances .NET 10 support.

AI Coding Agents · 2026-07-30

Windsurf v3.6.21 adds browser preview for remote ACP agents, Cascade Migration Wizard, Plan mode for Devin Local, and editable command approvals.

• Adds a unified notifications setting that posts native OS notifications when any agent session finishes or needs input.
• Codemaps now open in their own editor tabs in agent window mode, and codemap @-mentions now work in Devin Local.
• New Add to chat button (⌘L / Ctrl+L) lets users select text in a message transcript and append it to chat input.

Identity & Access Management · 2026-07-29

1Password for Android now saves logins on multi-screen username/password flows.

• Offers to save logins when a site splits username and password entry across separate screens.

Identity & Access Management · 2026-07-29

1Password for Linux now respects your system date format for item date fields.

• Item date fields now use the date format configured in system settings, with per-language override when a different language is set in 1Password.

Identity & Access Management · 2026-07-29

1Password for Mac beta adds Claude AI agent sign-in support via MCP, letting Claude fill logins with user approval.

• Adds 1Password for Claude integration: Claude can sign in to websites on your behalf, with per-request approval before credentials are filled — credentials are never shared with Claude.
• Shows a clear error message when attempting to move or duplicate an item with a custom icon while file storage is disabled by an admin policy.
• Item date fields now respect the date format chosen in system settings, or the language set in 1Password when it differs from the system language.

Identity & Access Management · 2026-07-29

Auto-Type now prompts before filling untrusted apps, and window picker gains app icons for easier targeting.

• Auto-Type now requests confirmation before filling credentials into unsigned or untrusted apps, replacing silent failure.
• The Type in window window selection menu now displays an app icon alongside each open window for easier identification.
• Item date fields now respect the date format configured in system settings, or the language set in 1Password when it differs from the system language.

Identity & Access Management · 2026-07-29

1Password iOS beta adds cellular-data warnings for large file uploads and smarter multi-account Home screen switching.

• Warns users before uploading large files over cellular or metered connections when drag-and-dropping into a Document item.
• Home screen automatically switches to All Accounts when a second account is unlocked, and returns to single-account view when only one account is active.
• Updated buttons throughout the app to use the iOS 26 Liquid Glass style.

Identity & Access Management · 2026-07-29

1Password adds Claude AI agent sign-in support, Secret Key paste blocking, and reorganized phishing/security settings.

• Adds 1Password for Claude integration, letting Claude sign in to websites on your behalf — filling logins and one-time codes after your explicit approval, without sharing credentials with Claude.
• New setting in Settings > Autofill & save lets you choose whether 1Password offers to save API credentials for shell plugins.
• Shell plugin credential saves now use the same autosave notification as standard logins for a consistent experience.

Identity & Access Management · 2026-07-29

1Password for Linux adds a local MCP server so AI assistants can access Developer tools directly from the app.

• New local MCP server in the Developer tab lets AI assistants access 1Password Developer tools.
• Watchtower descriptions now surface plaintext secrets scanning coverage, including .env files and SSH keys, on the Developer homepage and in Watchtower.

Identity & Access Management · 2026-07-29

1Password for Mac adds a local MCP server for AI assistant access to Developer tools and expands Watchtower secret-scanning descriptions.

• Adds a local MCP server launchable from the Developer tab, enabling AI assistants to access 1Password Developer tools.
• Watchtower descriptions now surface plaintext secret scanning coverage, including .env files and SSH keys, on the Developer homepage and in Watchtower.

Identity & Access Management · 2026-07-29

1Password for Windows adds a local MCP server so AI assistants can access Developer tools directly from the app.

• Adds a local MCP server launchable from the Developer tab, enabling AI assistants to access 1Password Developer tools.
• Watchtower descriptions now explicitly mention scanning for plaintext secrets, including .env files and SSH keys.

Identity & Access Management · 2026-07-29

1Password in the browser adds toggleable extension diagnostic logging in Settings.

• Adds a toggle in Settings > Help > Share diagnostic logs with 1Password to turn extension diagnostic logging on or off.

Identity & Access Management · 2026-07-29

Auth0 Dashboard gains real-time search for Organization members by name, email, ID, and blocked status (Public Beta).

• Search Organization members in real time by name, email, or ID directly from the Auth0 Dashboard — no more paginating through full member lists.
• Filter Organization members by blocked status from the Dashboard member search interface.

Identity & Access Management · 2026-07-29

Auth0 adds organization-scoped roles in Early Access, enabling per-org RBAC without tenant-wide role sharing or custom workarounds.

• Adds organization-scoped roles so each Auth0 Organization can have its own independent role definitions and permission assignments.
• Supports creating, updating, and deleting org-scoped roles via the Management API or Dashboard.
• Enables assigning org-scoped roles to users and enterprise groups within a specific organization.

Identity & Access Management · 2026-07-29

Auth0 adds native Organization-to-Application Entitlement, letting you restrict which apps org members can access without custom code.

• Adds Organization-to-Application Entitlement (Early Access): natively enforce which applications members of an organization can access, with automatic denial on unauthorized login attempts — no Actions, metadata checks, or custom logic required.
• Supports per-org, opt-in enforcement so entitlements can be configured and tested before going live, with no risk of disrupting existing login flows.

Secure Access (VPN / SASE / ZTNA) · 2026-07-29

Duo Desktop adds Microsoft Defender for Endpoint detection on Linux, Ubuntu 26.04 LTS support, and user-level preference persistence on macOS.

• Adds detection for Microsoft Defender for Endpoint on Linux (v4.6.0).
• Adds support for Ubuntu 26.04 LTS on Linux (v4.6.0).
• Adds fallback to /etc/machine-id for Trusted Endpoints identifier when the primary identifier is unavailable on Linux (v4.7.0).

Integrated & IT Risk Management · 2026-07-29

CISO Assistant v3.20.4 adds full TPRM domain export/import, evidence on exceptions, batch asset BIA, AI file uploads, and posture management enhancements.

• Includes the full Third-Party Risk Management (TPRM) ecosystem in domain export/import operations.
• Enriches the ENISA Cyber Resilience Assessment framework with recommended controls.
• Enables batch-adding assets to Business Impact Analyses (BIA).

Identity & Access Management · 2026-07-29

Clerk Expo SDK adds hosted authentication via Account Portal in-browser sessions alongside prebuilt native UI and custom flow options.

• Adds hosted authentication flow for Expo apps via useHostedAuth from @clerk/expo/hosted-auth, opening Account Portal in a browser session without building custom UI.
• Supports native prebuilt UI option rendering with SwiftUI on iOS and Jetpack Compose on Android for authentication screens.

Identity & Access Management · 2026-07-29

Clerk now supports hosted authentication via Account Portal for Expo, iOS, and Android apps.

• Enables browser-based sign-in and sign-up flows through Clerk's Account Portal for mobile apps built with Expo, iOS, and Android.

AI Coding Agents · 2026-07-29

Cline v4.0.12 adds free model support with limit-reached error cards showing reset time.

• Adds free Cline models (marked as (free) in the model picker) with a dedicated error card that displays the reset time when the free usage limit is reached.

AI Coding Agents · 2026-07-29

Cline SDK v0.0.66 adds free-tier models, persistent settings, connector session auto-reconnect, and broader provider coverage.

• Adds support for cline-free models, labeled (free) and priced at zero, with a dedicated rate-limit error that includes the free-tier reset time.
• Makes agentic compaction the default context-compaction strategy.
• Persists plan/act mode, tool auto-approve, and compaction mode to global settings with cross-process-safe writes, so CLI TUI toggles survive restarts.

Web Application Security · 2026-07-29

Cloudflare AI adds 13 new models: Anthropic Claude Opus 5, ByteDance video/image gen, ElevenLabs TTS/music, Gemini 3.5/3.6, Inkling MoE reasoning, and xAI Grok 4.5.

• Adds Claude Opus 5 (Anthropic) with 1M-token context and adaptive reasoning for complex agentic coding and enterprise workloads.
• Adds Seedance 2.0 Mini (ByteDance) for high-volume text-to-video, image-to-video, reference video, and reference-audio background music generation.
• Adds Seedream 5 Pro (ByteDance) for high-quality image generation and editing with up to 10 reference images and 1K/2K/explicit pixel-size output controls.

Web Application Security · 2026-07-29

Run Devin AI coding sessions in isolated Cloudflare containers via Devin Outposts.

• Supports deploying Devin Outposts on Cloudflare, running each Devin session in an isolated container for secure AI-assisted development.

Web Application Security · 2026-07-29

Cloudflare adds Gateway DNS max-TTL cap, Workers tracing spans, Browser Run human-handoff, MCP 2026-07-28 support, and WAF SSRF/injection rules

• Adds maximum TTL setting for Cloudflare Gateway DNS caching, capping upstream TTLs at account or per-location level to enforce faster policy propagation; two new DNS log fields (upstream_record_ttls and applied_max_ttl) are available in logs and Logpush datasets.
• New Workers runtime APIs tracing.startActiveSpan() and span.end() enable custom open-ended tracing spans that stay active beyond a single callback, supporting instrumentation of stream pipelines and other async workflows.
• Browser Run now supports structured Human in the Loop handoff via Cloudflare-specific CDP commands (Cloudflare.handoff, Cloudflare.getLiveView, Cloudflare.handoffComplete), letting agents formally pause for human intervention and resume automatically.

Web Application Security · 2026-07-29

Cloudflare adds Gateway DNS TTL controls, Workers custom tracing spans, Browser Run human handoff, and MCP 2026-07-28 spec support.

• Adds maximum TTL setting for Cloudflare Gateway DNS caching, configurable at the account level and overridable per DNS location.
• New tracing.startActiveSpan() and span.end() runtime APIs let Workers developers write custom tracing spans for long-lived operations like stream pipelines.
• Browser Run now supports structured handoff, enabling automation scripts to formally request human intervention and resume when complete.

Web Application Security · 2026-07-29

Cloudflare adds Gateway DNS max-TTL control, Workers custom tracing spans, Browser Run human handoff, and MCP 2026-07-28 spec support

• Adds maximum TTL setting for Cloudflare Gateway DNS caching, configurable at the account level and overridable per DNS location.
• New tracing.startActiveSpan() and span.end() runtime APIs let Workers developers write custom tracing spans for operations that outlive a single callback, such as stream pipelines.
• Browser Run now supports structured handoff, enabling automation scripts to formally request human intervention and resume execution when complete.

General Utilities & Libraries · 2026-07-29

VS Code 1.131 adds subagent tracking at a glance, voice dictation across the editor, and agent-actionable Markdown comments.

• Track running subagents at a glance with a new subagent status view.
• Dictate text across VS Code using voice input.
• Edit Markdown with agent-actionable comments that agents can act on directly.

Third-Party & Vendor Risk (TPRM) · 2026-07-29

Conveyor adds a new API endpoint to download signed NDAs as PDFs with a temporary link.

• New GET /api/v2/exchange/gate_document_signatures/{id} endpoint returns a signature record and a one-hour temporary download link for signed NDA PDFs, enabling automated retrieval into external systems.

Third-Party & Vendor Risk (TPRM) · 2026-07-29

Conveyor adds Knowledge Library search and Trust Center subscriber visibility via two new API endpoints.

• New GET /api/v2/knowledge_base/search endpoint enables keyword search across curated Q&As and past questionnaire answers, letting agents pull from existing approved language.
• New GET /api/v2/vendor_subscriptions endpoint exposes the full list of subscribers receiving Trust Center subprocessor change notifications.
• Both endpoints are also available as MCP tools, allowing agents connected via the Conveyor AI Connector to call them directly.

Third-Party & Vendor Risk (TPRM) · 2026-07-29

Conveyor adds one-click magic-link login, eliminating manual token copy-paste during onboarding.

• Adds a one-click button in login token emails that opens Conveyor with the authentication code pre-filled, removing manual copy-paste.
• Rebuilt login and sign-up pages now surface previously hard-to-find features such as configurable roles and the AI Connector.

Security Data Pipeline · 2026-07-29

Cribl LLM Observability now supports Ollama via OpenTelemetry instrumentation.

• Adds Ollama as a supported LLM observability source — instrument Ollama with OpenTelemetry and forward telemetry to Cribl Stream and Cribl Search.

Security Data Pipeline · 2026-07-29

Cribl Search 4.19 makes full-text inverted-index search on _raw the default for Lakehouse engines, with backfill for existing engines.

• Enables full-text search (FTS) via an inverted index on _raw as the default experience in Cribl Search's Lakehouse Engine, allowing token-based searches without targeting a specific field.
• Delivers 150×–350× query acceleration on token-based 'needle in the haystack' searches (tested on 1 billion row datasets) by skipping irrelevant storage blocks.
• Supports FTS activation via the simple string predicate in the leftmost implied cribl operator, or via the where operator with the has string operator.

Vulnerability Management · 2026-07-29

DefectDojo adds nine new issue-tracker integrations: Azure DevOps Boards, Bitbucket, Freshservice, GitLab, Linear, PagerDuty, ServiceDesk Plus, Shortcut, and Zendesk.

• Adds native issue-tracker integrations for Azure DevOps Boards, Bitbucket, Freshservice, GitLab, Linear, PagerDuty, ServiceDesk Plus, Shortcut, and Zendesk.

Vulnerability Management · 2026-07-29

DefectDojo Pro adds custom RBAC roles, 25+ new findings connectors, native Pro UI auth, LDAP, and SSO diagnostics.

• Adds user-defined Custom Roles with granular per-object-type permissions, replacing reliance on built-in roles only.
• Adds 25+ new findings connectors including Fortify (SSC and FoD), HCL AppScan (ASoC and AppScan 360°), Datadog Cloud Security, MobSF, Deepfence ThreatMapper, NeuVector, Lacework/FortiCNAPP, Socket.dev, Bright Security, Aqua Security, Escape, Detectify, Fairwinds Insights, Wallarm, Vanta, NowSecure, FOSSA, Codacy, DeepSource, Beagle Security, Orca, AccuKnox, Halo Security, and Nightfall AI.
• Unifies connector nomenclature as Upstream and Downstream Connectors, with the ability to request either type from the cloud UI.

Data Security & DLP · 2026-07-29

CertCentral adds DCV polling status to APIs, ACME URL delegation to Service Users, and API key ownership transfers.

• Adds dcv_polling_status and dcv_polling_last_checked fields to the Domain info and Order validation status API endpoints, exposing whether automatic DCV polling is active and when it last ran.
• Enables creating ACME Directory URLs on behalf of another CertCentral user, Service User, or new Service User — no longer limited to self-service only.
• Enables transferring ACME Directory URL ownership to another CertCentral user or Service User, decoupling credentials from individual accounts.

Secure Access (VPN / SASE / ZTNA) · 2026-07-29

DNSFilter Windows Roaming Client v3.6.10 Beta adds DNS PreCheck v2 with hijack-resistant policy enforcement and automatic tray process recovery.

• Adds DNS PreCheck v2, which maintains policy enforcement on networks that hijack or redirect DNS traffic, closing a gap where certain network conditions could allow content through that should have been blocked.
• Adds automatic tray process recovery so the system tray process self-restarts if it stops unexpectedly, keeping tray status and controls available without manual intervention.

SIEM · 2026-07-29

Elastic Security 9.5 adds automatic Microsoft Sentinel detection rule migration, translating Scheduled and NRT rules via LLM in Tech Preview.

• Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules into Elastic Security using an LLM of your choice, available in Tech Preview in 9.5.
• Supports Watchlist-to-ES|QL Lookup conversion and severity mapping carry-over during Sentinel rule migration.
• Identifies required Elastic integrations from the Sentinel rule export alone, enabling data-onboarding planning before moving any logs.

SIEM · 2026-07-29

Elastic Security adds automatic migration of Microsoft Sentinel detection rules to Elastic Security format.

• Adds automatic Sentinel-to-Elastic detection rule migration, translating Microsoft Sentinel detection rules into Elastic Security without manual rebuilding.

SIEM · 2026-07-29

Elastic Security 9.5 adds automatic migration of Microsoft Sentinel Scheduled and NRT detection rules, watchlists, and severity mappings.

• Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules into Elastic Security using an LLM of your choice (Tech Preview in 9.5).
• Supports translation of Sentinel Watchlists to ES|QL Lookups and carries over severity mappings during migration.
• Identifies required Elastic integrations from uploaded Sentinel rule exports, enabling data-onboarding planning before moving a single log.

SIEM · 2026-07-29

Elastic Security 9.5 adds automatic Microsoft Sentinel detection rule migration to Elastic Security via LLM translation (Tech Preview).

• Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules into Elastic Security using an LLM of your choice, eliminating manual rule rebuilding.
• Translates Sentinel Watchlists to ES|QL Lookups and carries over severity mappings during migration.
• Provides per-rule translation status (Installed, Translated, Partially Translated, Not Translated, Failed) with guided upload flow via the Security Launchpad.

SIEM · 2026-07-29

Elastic Security adds automatic migration of Microsoft Sentinel detection rules to Elastic Security format.

• Adds automatic Sentinel-to-Elastic detection rule migration, translating Microsoft Sentinel rules into Elastic Security without manual rebuilding.

SIEM · 2026-07-29

Elastic Security adds automatic migration of Microsoft Sentinel detection rules to Elastic Security.

• Adds automatic Sentinel-to-Elastic detection rule migration, translating Microsoft Sentinel detection rules into Elastic Security without manual rebuilding.

SIEM · 2026-07-29

Elastic Security adds automatic Microsoft Sentinel detection rule migration, eliminating manual rewrites.

• Adds automatic migration of Microsoft Sentinel detection rules into Elastic Security, eliminating the need to manually rebuild them.

SIEM · 2026-07-29

Elastic Security 9.5 adds automatic Microsoft Sentinel detection rule migration, translating Scheduled and NRT analytics rules to Elastic via LLM.

• Adds automatic migration of Microsoft Sentinel Scheduled and Near Real Time (NRT) analytics rules into Elastic Security using an LLM of your choice.
• Supports Watchlists-to-ES|QL Lookups conversion and Sentinel severity mapping during rule migration.
• Identifies required Elastic integrations from exported Sentinel rules, enabling a rules-first migration path to plan data onboarding before moving logs.

Firewalls & Network Defense · 2026-07-29

Fastly now supports WebSockets for long-lived, bidirectional communication between clients and origin servers.

• Supports the WebSocket protocol for long-lived, two-way interactive communication sessions between clients and origin servers.
• Superusers on eligible accounts can enable WebSockets via the Products page; once enabled, any user with appropriate permissions can use the protocol.
• Billing for WebSockets is based on a combination of bandwidth and connection time (measured in usage minutes, aggregated monthly to millions of minutes).

Firewalls & Network Defense · 2026-07-29

Fastly launches Subscriber Provided Prefix: bring your own IP addresses announced via Fastly's global Anycast infrastructure

• New Subscriber Provided Prefix product lets customers bring their own IPv4 (/24 or larger) or IPv6 (/48 or larger) prefixes, announced from Fastly's AS54113 via HTTP Anycast globally or regionally (North America/Europe).
• Supports HTTP and HTTPS traffic termination at Fastly's edge for customer-owned prefixes, enabling separation of network-layer and content-delivery concerns.
• Integrates with Origin Connect and DDoS Protection and Mitigation service to route customer-owned prefix traffic through Fastly's global network, shielding origin servers.

Firewalls & Network Defense · 2026-07-29

Fastly launches Origin Connect: direct fiber links between your origin servers and Fastly shield POPs via BGP peering.

• New Origin Connect product provides a dedicated fiber cross-connect between subscriber origin servers and a Fastly shield POP, eliminating intermediate network hops.
• Supports 10G and 100G ports (up to 4x for redundancy) with BGP peering over globally unique IPv4 /31 and IPv6 /127 prefixes.
• Automatic failover to public internet transit if the direct interconnect experiences degradation or failure.

Firewalls & Network Defense · 2026-07-29

Fastly launches Oblivious HTTP Relay, enabling double-blind privacy-preserving request proxying compliant with the OHTTP spec.

• New Fastly Oblivious HTTP Relay (OHTTP Relay) product implements the relay role in the Oblivious HTTP specification, forwarding encrypted, encapsulated client requests to an OHTTP Gateway without exposing client identity.
• Strips all non-essential request headers automatically, passing only Content-Type, Content-Length, and Host (plus any additional headers you pre-approve that contain no PII).
• Performs configurable request/response validation — confirming content type, HTTPS transport, and that host/path maps to a known backend — before forwarding.

Firewalls & Network Defense · 2026-07-29

Fastly launches S3-compatible Object Storage with edge integration for Deliver and Compute services

• New Fastly Object Storage product: an Amazon S3-compatible large object storage solution integrated with Fastly's Deliver and Compute services.
• Supports objects up to 5 TB and multipart uploads (up to 10,000 parts, minimum 5 MB per part except the last).
• Data accessed from within Fastly's network bypasses the public endpoint speed cap (~150 Mbps) and 100 req/s per bucket limit.

Firewalls & Network Defense · 2026-07-29

Fastly launches authoritative DNS service built on its global edge network

• New Fastly DNS service provides authoritative DNS query resolution powered by Fastly's global high-performance edge network.

Firewalls & Network Defense · 2026-07-29

Fastly launches authoritative DNS service backed by its global edge network.

• New Fastly DNS authoritative DNS service leverages Fastly's global edge network to serve DNS query responses at high performance.

AI Coding Agents · 2026-07-29

gemini-cli v0.53.0 adds an eval coverage report command and an LLM triage orchestrator.

• Adds eval coverage report command to surface evaluation coverage metrics.
• Implements an LLM triage orchestrator for automated issue triage workflows.

SIEM · 2026-07-29

Google SecOps adds Data RBAC for SOAR cases, revamped investigation management, customizable rule schedules, and richer parser extensions.

• Adds Data RBAC for first-party SOAR cases and alerts (public preview): automatically applies SIEM data access scopes to Chronicle-connector-ingested alerts and cases so analysts only see authorized data.
• Introduces customizable execution schedules for multi-event rules (public preview): configure first-run delay offsets on the Rule Schedule tab to account for ingestion latency, with automated background true-up runs for late-arriving logs.
• Launches revamped Investigation Management experience (public preview): track raw UDM events and detections alongside alerts in cases, with customizable table views, side-drawer previews, and integrated UDM Search workflows.

SIEM · 2026-07-29

Google SecOps lets you inspect prebuilt parser preview content even when a custom parser is active for the same log type.

• View prebuilt parser preview version content for a log type even when a custom parser is active, enabling comparison before switching.

AI Agent Frameworks · 2026-07-29

Hermes Agent: terminal-native autonomous coding agent with persistent memory, 21+ messaging platforms, multi-backend execution, and MCP/ACP support.

• Supports 21+ messaging platforms natively, including Telegram, Discord, Slack, WhatsApp, Signal, Email (IMAP/SMTP), SMS via Twilio, Matrix, Mattermost, Home Assistant, and IRC/Microsoft Teams via plugins.
• Runs on local, Docker, SSH, Daytona, Modal, or Singularity execution backends.
• Connects to Nous Portal, OpenRouter, OpenAI, Anthropic, Google, or any OpenAI-compatible endpoint as an LLM provider.

AI Agent Frameworks · 2026-07-29

Hermes adds approvals suggest to mine past approval decisions into allowlist proposals automatically.

• New hermes approvals suggest command mines the session database for dangerous-classified commands you previously approved and proposes them as command_allowlist additions, ranked by approval frequency.
• Supports --apply N[,M...] flag to selectively write chosen proposals into the allowlist, with destructive command classes permanently excluded regardless of approval count.
• Adds --days N, --min-count N, --limit N, and --db PATH flags to control the history window, minimum approval threshold, result count, and database path for proposal generation.

AI Agent Frameworks · 2026-07-29

Hermes adds voice mode support, enabled via hermes setup voice.

• New hermes setup voice command enables voice mode support in the Hermes agent.

AI Agent Frameworks · 2026-07-29

Hermes voice mode gains barge-in interruption, stop-phrase ending, real-time streaming TTS, and per-call voice-design instructions.

• Adds voice stop-phrase detection: saying or typing exactly a configured phrase (default: stop) ends the voice chat hands-free; customizable via voice.stop_phrases or set to [] to disable.
• Adds barge-in support: a voice-activity monitor cuts agent playback the moment the user starts talking and returns to recording immediately, with automatic noise-floor calibration to avoid speaker bleed self-triggering; disable with voice.barge_in: false.
• Adds agent interruption awareness: when barge-in cuts a reply, the next message carries a note informing the model its spoken reply was cut off so it can respond naturally.

AI Agent Frameworks · 2026-07-29

Hermes adds Figma remote MCP support and fnmatch glob patterns for tool allow/exclude lists.

• Adds native Figma remote MCP integration: Hermes auto-sets oauth.client_name: "Claude Code" for mcp.figma.com so OAuth registration succeeds without manual workarounds.
• Supports fnmatch-style glob patterns in MCP tool allow/exclude lists, enabling bulk filtering across large tool surfaces (e.g. Cloudflare's ~3,300-tool API MCP) without listing each endpoint individually.

AI Agent Frameworks · 2026-07-29

Hermes adds mid-turn agent redirection via Buzz, letting you correct an active turn without losing completed work.

• Adds Buzz messaging mode: send a message while the agent is working to redirect its active turn, preserving reasoning, partial text, and prior tool results as a checkpoint.
• Running tools complete safely when a Buzz redirect is issued — the correction is applied at the next tool-result boundary rather than killing the tool mid-execution.
• Supports configurable busy acknowledgment suppression so the confirmation message can be hidden without changing input-handling behavior.

AI Agent Frameworks · 2026-07-29

Hermes adds idle compaction, proactive tool-result pruning, per-turn loop caps, focus view, and richer CLI turn summaries

• Adds threshold_tokens config to set an absolute token cap for compression triggers, ensuring compression fires no later than a set token count regardless of model context-window size.
• Adds idle_compact_after_seconds opt-in trigger to compact accumulated session history when a conversation resumes after a configurable idle period, before the first reply.
• Adds proactive_prune_tokens to enable deterministic, no-LLM pruning of old tool-result payloads on large-window models where size-based compaction rarely fires.

AI Agent Frameworks · 2026-07-29

Hermes adds an outbound credential-injection firewall (hermes egress) and a Claude Code/Codex CLI importer (hermes import-agent).

• New hermes egress command family: a TLS-intercepting outbound firewall (iron-proxy) for remote terminal sandboxes that swaps opaque proxy tokens for real upstream API credentials at the network boundary, so sandboxes never hold real keys.
• Supports Bitwarden Secrets Manager as a credential source via hermes egress setup --from-bitwarden, with --no-bitwarden to revert to env-based credentials.
• Hot-reload of the egress ruleset without dropping connections via hermes egress reload, using the loopback management API.

AI Agent Frameworks · 2026-07-29

Hermes gains three integration paths into Buzz, Block's Nostr-based human+agent collaboration workspace.

• Adds Buzz integration with three paths: Buzz Desktop as a managed ACP runtime, the buzz-acp relay bridge for server-side Hermes identity hosting, and a native gateway joining Buzz channels with full Hermes memory, skills, approvals, and cron support.

AI Agent Frameworks · 2026-07-29

Hermes adds mid-turn agent redirection via Buzz — correct a running agent without losing completed work or killing active tools.

• Supports sending a message while the agent is working to redirect its active turn, restarting model generation while retaining reasoning, partial text, and completed tool results.
• Running tools finish safely when a mid-turn correction is issued — the correction is applied at the next tool-result boundary rather than terminating the tool.
• Offers configurable busy-message modes, including suppressing the busy acknowledgment notification.

AI Agent Frameworks · 2026-07-29

Hermes adds hands-free Hey Hermes wake word to trigger voice sessions in CLI, TUI, and desktop app.

• Adds on-device Hey Hermes wake word that starts a voice session hands-free across the CLI, TUI, and desktop app.

AI Agent Frameworks · 2026-07-29

Hermes CLI gains mid-turn agent redirection and a visual context-usage breakdown command.

• New /context command displays a visual glyph block grid plus a per-category token table covering system prompt, tools, skills, memory, conversation, and free space.
• New /context all subcommand adds per-skill and per-toolset token costs to the context breakdown.
• Enables mid-turn redirection: sending a message while the agent is working restarts model generation with completed reasoning and tool work preserved, without cancelling in-flight tools.

AI Agent Frameworks · 2026-07-29

Hermes adds an egress credential-injection proxy for Docker sandboxes, keeping real API keys out of reach.

• New egress credential-injection proxy for Docker sandboxes replaces real API keys with opaque proxy tokens valid only through a local TLS-intercepting daemon, preventing key exposure inside the sandbox.

Endpoint Security (EDR/XDR) · 2026-07-29

Managed OS for Apple gains an embedded delay option (up to 90 days) for Rolling Enforcement target version declarations.

• Adds an automatic delay option (up to 90 days) within Rolling Enforcement for Managed OS for Apple, preventing Iru from sending a new target version declaration to devices until the delay elapses.
• Enables combining the new embedded delay with Apple software update deferrals configured in a Software Update Library Item for layered update control.

AI Coding Agents · 2026-07-29

Kiro adds editor context menu actions, guided hook creation, and Code OSS v1.108.2 upgrade with IDE language replies.

• Adds a Kiro submenu to the editor context menu for quick access to Kiro actions directly from right-click.
• Adds an Ask Kiro to Fix quick fix option surfaced inline on errors and warnings in the editor.
• Upgrades the underlying IDE to Code OSS v1.108.2.

AI Coding Agents · 2026-07-29

Kiro adds guided spec creation and automatic plan execution after approval in Plan mode.

• Adds a guided description step to /spec new so the agent uses your provided description as ground truth when drafting requirements, rather than inferring from the spec name alone.
• Plan mode now automatically begins executing an approved plan immediately after approval, eliminating the manual mode-switch step.

AI Agent Frameworks · 2026-07-29

LangGraph 1.2.10 adds per-node trace policies and typed v3 stream_events with native projections.

• Exposes trace_policy parameter on add_node, enabling per-node control over tracing behaviour.
• Adds typed return for v3 stream_events and supports native projections for more precise event filtering.
• Removes tags from TracePolicy, simplifying the tracing configuration surface.

Digital Forensics & Incident Response · 2026-07-29

MVT URL checks now run concurrently with up to 20 parallel requests and automatic deduplication.

• URL IOC checks are now deduplicated and executed concurrently, with a configurable cap of 20 in-flight requests at a time, speeding up large-scale IOC scans.
• Redirect chains within a single URL are still followed sequentially, preserving accuracy while parallelizing across distinct URLs.
• New environment variables are available to control concurrent URL request behavior.

Digital Forensics & Incident Response · 2026-07-29

MVT gains check-sysdiagnose command for analyzing iOS sysdiagnose archives via custom modules

• New mvt-ios check-sysdiagnose command analyzes iOS sysdiagnose archives (extracted directory or gzip-compressed tar) using custom MVT modules.
• New --hashes flag includes file hashes in info.json output; --list-modules lists eligible custom modules without executing them.
• New SysdiagnoseExtraction base class enables practitioners to write custom sysdiagnose modules with consistent directory and tar input handling, file lookup/read helpers, timezone extraction, and IPS crash-report metadata via ips_files.

Digital Forensics & Incident Response · 2026-07-29

MVT gains shell completion, custom module loading, iOS sysdiagnose checking, Safari profile scanning, and parallelized URL checks.

• Adds shell completion command for Bash, Zsh, and Fish via mvt-ios completion and mvt-android completion.
• Supports loading custom Python analysis modules with --load-module PATH or the MVT_CUSTOM_MODULES environment variable.
• Adds iOS sysdiagnose checking support.

Runtime Security · 2026-07-29

nono v0.70.0 adds SPIFFE/SPIRE workload identity, per-route rate limiting, Vault OIDC mediation, JWT-shaped capture nonces, and profile-declared no_proxy bypass.

• Adds SPIFFE/SPIRE workload identity authentication for upstream proxy routes, enabling zero-trust service-to-service auth without static credentials.
• Adds per-route request rate limiting via RouteRateLimiter, letting profiles cap how many requests a sandboxed tool can make to a given upstream.
• Adds support for mediating vault login -method=oidc, including a custom inject header and per-command open_port to handle the OIDC browser callback.

Identity & Access Management · 2026-07-29

Nudge Security browser extension now supports Safari deployment for managed services.

• Supports deploying the Nudge Security Browser Extension to Safari.

Identity & Access Management · 2026-07-29

Nudge Security now lets admins enforce SSO-only login, disabling Google/Microsoft sign-in and routing all auth through your IdP.

• Adds SSO login enforcement that disables alternative sign-in methods (Sign in with Google, Sign in with Microsoft) org-wide, routing all logins through your configured IdP (e.g., Okta) to inherit its MFA, conditional access, and deprovisioning controls.

AI Coding Agents · 2026-07-29

Codex CLI exec servers gain stdin-close exit control, plugin eligibility metadata, and MCP legacy-server fallback improvements.

• Adds --exit-on-stdin-close flag (and CODEX_EXEC_SERVER_EXIT_ON_STDIN_CLOSE env var) to remote exec servers, enabling graceful shutdown with telemetry flush when the parent process closes stdin.
• Exposes plugin eligibility metadata (disabledReason, eligiblePlanTypes) in app-server plugin summaries, surfacing plan-gating and admin-disabled status.
• Adds parent_turn_id tracking across nested Codex agent spawns, delegated sessions, and follow-up tasks for improved request provenance.

AI Coding Agents · 2026-07-29

Codex CLI v0.146.0 adds named/pinned sessions, thread forking, Agent Plugins, WebSocket Code Mode, and standalone web search for custom providers.

• Name new sessions with /new or /clear, pin important threads, and switch between side conversations without closing them.
• Fork threads with paginated history, including temporary forks that do not appear in thread listings.
• Support Agent Plugins manifests, workspace plugin publishing, and additional plugin marketplaces for Amazon Bedrock and Claude Code.

AI Coding Agents · 2026-07-29

OpenCode v1.18.9 adds an opt-in v2 desktop sidecar and collapsible model provider sections in settings.

• Adds opt-in v2 desktop sidecar: set OPENCODE_SIDECAR_V2=1 to initialize the desktop app from the v2 background daemon instead of the v1 utility sidecar.
• Adds collapsible model provider sections in the V2 settings page, with collapse state persisted per server and search expanding matching sections dynamically.

Threat Intelligence · 2026-07-29

OpenCTI adds UI-based SMTP configuration and a forced-sender override, both without requiring a deployment restart.

• Supports configuring SMTP entirely from the Settings > Security > SMTP configuration interface, eliminating the need for a deployment restart when changing email settings.
• Adds smtp:forced_sender_email / SMTP__FORCED_SENDER_EMAIL parameter to force all outbound emails to use a fixed sender address and disable UI-based SMTP configuration.
• Adds smtp:enabled / SMTP__ENABLED parameter to explicitly enable or disable SMTP email sending.

Threat Intelligence · 2026-07-29

OpenCTI 7.260728.0 ships a full draft approval workflow engine, XTM Hub integration, TAXII error visibility, OAuth SMTP dynamic tokens, and audit log session tracking.

• Introduces a complete draft approval workflow engine: define, visualize, and apply workflows via a ReactFlow graph UI, with filter-based conditions, async task actions, schema validation on save, auto-save/publish, and synchronous/asynchronous transition reactions.
• Adds draft workspace metadata (participants, assignees, description, creator) and the ability to filter, edit, and visualize draft details directly in the drafts list.
• Connects OpenCTI to XTM Hub, enabling integrations to be discovered and connected directly from the Hub into OpenCTI.

AI Coding Agents · 2026-07-29

OpenHands Agent Canvas adds saved LLM profiles and an in-chat /model command for switching models mid-conversation.

• Adds saved LLM profiles in Settings > LLM, letting practitioners store named provider/model/credential sets and switch between them without re-entering API keys.
• Supports Basic, Advanced, and All configuration tabs for direct providers, OpenHands LLM API keys, local OpenAI-compatible servers (LM Studio, Ollama, vLLM, etc.), and LiteLLM proxies.
• Introduces /model chat command to list available profiles (/model) or switch to a named profile (/model <profile-name>) mid-conversation while preserving history, workspace, and task state.

Secure Access (VPN / SASE / ZTNA) · 2026-07-29

ShareFile adds Tasks workspace, AI document validation, Security Insights dashboard, session management, and a wave of new integrations across Mac, Windows, and Outlook.

• Adds export of Request Lists to Excel (.xlsx) or CSV (.csv) for offline use or custom analysis, accessible from the three-dot menu on the Request List page.
• Adds Projects, Client Hub, and Solutions access in ShareFile for Mac for all Premium plan users.
• Adds Folders in ShareFile for Clients app, enabling browse, view, download, upload, and delete of shared folders from a service provider.

SAST / SCA / Code Security · 2026-07-29

• Adds fork PR support for code scanning pull requests.
• Adds comment-triggered scans to initiate code scans via PR comments.
• Adds Telecom red team plugins for industry-specific testing of telecommunications AI systems.

Firewalls & Network Defense · 2026-07-29

Rspamd 4.1.4 tightens controller auth, extends regexp size limits to named scopes, and expands WebUI read-only access.

• Controller worker now validates complete password hashes (salt and key lengths) at startup and rejects all auth attempts on malformed hashes, logging the issue explicitly.
• The regexp.max_size limit (1 MiB default) now applies to named regexp scopes including multimap regexp_rules and Lua plugin scopes, not only the default scope; raising the limit now updates all registered scopes.
• Introduces a message-wide word budget (100k words / 1 MiB of text) in the UTF tokenizer, with truncated parts flagged and logged, aligning UTF tokenizer behaviour with the raw tokenizer.

Firewalls & Network Defense · 2026-07-29

Rspamd 4.1.4 grants read-only WebUI users access to the Selectors tab and Errors history.

• Read-only WebUI users can now access the Selectors tab and the Errors history.

Identity & Access Management · 2026-07-29

SailPoint Workflows now auto-trims HTTP POST response payloads inside loops, matching existing GET behavior.

• Extends automatic payload trimming to HTTP Request (POST) steps — loop inputs now retain only the fields referenced in downstream steps, reducing data stored and transferred per run.
• Full POST response remains accessible during test/build mode so practitioners can inspect all fields while authoring workflows.

Detection Engineering · 2026-07-29

Splunk Security Content v6.3.0 adds a Starland RAT campaign story, 4 new Linux/Windows analytics, and expands 67 existing detections.

• New Analytic Story: Starland RAT Campaign (UAT-11795) — tags analytics across PowerShell abuse, ClickFix social engineering, in-memory execution, credential theft, and Telegram-based C2 for end-to-end campaign visibility.
• New detection: Linux AppArmor Bypass Via Aaexec — covers attempts to evade AppArmor confinement using aaexec.
• New detection: Linux Auditd Possible Setuid Execve Privesc — identifies local privilege escalation attempts via setuid execve patterns on Linux.

Firewalls & Network Defense · 2026-07-29

Sublime adds Customer Account Access controls so admins can govern, audit, and time-limit support sessions in their tenant.

• New single admin setting to enable or disable Sublime support access to a customer environment at any time.
• Every support session is written to an audit log that admins can view and export for full accountability.
• Live banner displayed to Sublime employees working inside a customer tenant, showing the account, role, and active session.

Firewalls & Network Defense · 2026-07-29

Sublime Security's Advanced Graymail Protection is now GA, with automated remediation, fuzzy detection, and per-user preference learning.

• Adds Advanced Graymail Protection (GA) to identify and manage marketing emails, newsletters, and subscription content across Microsoft 365 and Google Workspace.
• New Remediate graymail flagged messages Automation routes detected graymail to Promotions automatically.
• New Rule Fuzzy Attack Score: Advanced Graymail Detection extends graymail detection coverage, designed to pair with the included Automation.

Container & Image Security · 2026-07-29

Syft v1.50.0 adds a Bun binary classifier for detecting the Bun JavaScript runtime in SBOMs.

• Adds a binary classifier for the Bun JavaScript runtime, enabling Syft to detect and catalog Bun in container images and filesystems.

General Utilities & Libraries · 2026-07-29

SysReptor 2026.61 adds Prowler/ScoutSuite import, stdin AES key support, and granular API token permissions.

• Adds Prowler and ScoutSuite importers to the scanimport plugin for ingesting cloud security scan results.
• Allows creating API tokens with or without superuser permissions for finer-grained access control.
• Adds automatic user lockout after multiple failed MFA login attempts.

Secure Access (VPN / SASE / ZTNA) · 2026-07-29

Termius 9.42.2 adds bulk host management via context menu and less disruptive app updates.

• Open selected hosts in a new workspace or add them to an existing one directly from the Hosts screen context menu.

AI/LLM Security · 2026-07-29

ToolHive v0.41.0 adds MCP 2026-07-28 support, reproducible skill lock files, RFC 8693 token exchange, and an Envoy network-isolation backend.

• Supports the MCP 2026-07-28 stateless (Modern) spec across all proxies and Virtual MCP, bridging era-mismatched client×backend combinations automatically.
• Virtual MCP is now fully MCP-conformant: completions, resource templates, subscriptions, and mid-call server→client forwarding (progress, sampling, elicitation) all work.
• Adds thv skill sync to restore a project's pinned skill set on any machine and verify on-disk content in CI.

Endpoint Security (EDR/XDR) · 2026-07-29

Trend Vision One Zero Trust Secure Access adds masked/unmasked display mode for sensitive data in DLP and AI detection logs.

• Adds configurable masking for matched content in DLP and AI content detection logs, letting administrators control whether sensitive data (up to 100 bytes) is hidden or visible when reviewing Internet Access and AI Secure Access detection events.

Data Security & DLP · 2026-07-29

Varonis Atlas can now classify tools by functional capability for improved policy evaluation and MCP risk visibility.

• Adds functional capability classification for tools in Atlas, enabling policy evaluation, investigation workflows, and visibility into tool and MCP risk across the environment.

Data Security & DLP · 2026-07-29

Varonis Atlas supports connecting GitHub via a read-only GitHub App for least-privilege repository discovery.

• Supports connecting GitHub through a read-only GitHub App, enabling least-privilege access for AI artifact discovery and code-scanning workflows where automated remediation is not needed.

Data Security & DLP · 2026-07-29

Varonis Atlas now scans TypeScript repositories to discover and inventory AI resources and artifacts.

• Extends repository code scanning to TypeScript, enabling Atlas to discover and inventory AI resources and artifacts in TypeScript-based codebases.

Data Security & DLP · 2026-07-29

Varonis Atlas now discovers Salesforce Agentforce AI agents and configurations via Hosted Services.

• Adds discovery of Salesforce Agentforce resources (AI agents and related configurations) through the Hosted Services configuration in Atlas.

Data Security & DLP · 2026-07-29

Varonis Atlas adds runtime monitoring and governance for Devin CLI, Devin Desktop, Google Antigravity, Kiro, and OpenAI Codex coding agents.

• Adds Atlas runtime monitoring and governance support for Devin CLI, Devin Desktop, Google Antigravity, Kiro, and OpenAI Codex coding agents.
• Enables logging, review, and evaluation of coding agent activity via Atlas runtime policies.

Data Security & DLP · 2026-07-29

Varonis Inventory adds dedicated views for AI agents, tools, and MCP resources.

• Adds dedicated Inventory views for AI agents, tools, and MCP resources to streamline navigation and management of key AI resource types.

Data Security & DLP · 2026-07-29

Varonis Atlas now ingests AWS Bedrock activity for AI usage visibility, investigation, and runtime policy enforcement.

• Ingests AWS Bedrock activity into Atlas, enabling visibility into AI usage, audit trails, and runtime policy enforcement for Bedrock workloads.

Data Security & DLP · 2026-07-29

Varonis Atlas now surfaces Claude Managed Agent as a supported hosted service resource for inventory and governance.

• Adds Claude Managed Agent as a recognized hosted service resource in Atlas, enabling inventory visibility and governance workflows for Claude-managed agent deployments.

Data Security & DLP · 2026-07-29

Varonis DSPM now ingests Microsoft Copilot and ChatGPT Enterprise prompt activity for correlation with sensitive data context.

• Syncs Microsoft Copilot prompt activity with Varonis DSPM to correlate AI interactions with sensitive data context and policy enforcement.
• Syncs ChatGPT Enterprise prompt activity with Varonis DSPM to improve investigation workflows and sensitive data visibility.

Data Security & DLP · 2026-07-29

Varonis AI Investigation Sessions gain an Intent Timeline for chronological tracing of user intent and agent activity.

• Adds Intent Timeline to AI Investigation Sessions, giving investigators a chronological view of user intent, agent behavior, and tool activity throughout a session.
• Enables tracing of activity leading up to and following a runtime policy trigger to understand causation in AI agent workflows.

Vulnerability Management · 2026-07-29

Vuls v0.40.0-rc.1 migrates NVD, Cisco, JVN, VulnCheck, Fortinet, Palo Alto, and CTI detection to the vuls2 engine, adds ENISA EUVD and Seal Security coverage.

• Routes NVD CPE detection and enrichment through the vuls2 engine with cpematch-expanded criteria, replacing go-cve-dictionary's version-range-only matching.
• Routes Cisco, Fortinet, Palo Alto, VulnCheck, and JVN data sources through vuls2 for detection and enrichment.
• Adds ENISA EUVD (European Union Vulnerability Database) as a vuls2 enrich data source.

Runtime Security · 2026-07-29

Wiz Defend GA's Red Agent AI pentester with Web API Crawler, logic-driven API DAST, and Secrets Blast Radius modules.

• Red Agent is now generally available (GA): a continuous, autonomous AI pentester that reasons through business logic to uncover unknown vulnerabilities across custom-built software, vibe-coded applications, and APIs.
• New Web API Crawler module: uses client-side code analysis to map API endpoints, extract and analyze API specifications, and surface hidden or forgotten shadow APIs.
• New API DAST Attacker module: continuously finds and validates logic-driven exploitable risks — including OWASP API Top 10 flaws, authorization bypasses, and logic flaws — adapting its strategy in real time and delivering proofs of execution with reproduction steps.

Cloud Security Posture · 2026-07-28

Aikido adds DSPM, backport library patches, code quality scans, and new agent/IDE releases in one drop.

• New Data Exposure Audit (DSPM) scans repos to track how sensitive data flows and where it gets exposed — no database connections or data access grants required.
• New Aikido Libraries capability delivers backported CVE fixes for the exact dependency version already in use, without requiring major-version upgrades or refactors.
• New Code Quality Repository Scans surface existing code quality issues across repos to help identify and prioritize technical debt over time.

Post-Exploitation · 2026-07-28

BloodHound v9.5.0 adds OpenGraph data quality stats, webhooks UI, markdown-rich entity panels, and new management operation endpoints.

• Adds /data-quality-stats endpoint and aggregations endpoint for querying OpenGraph node and relationship counts by environment.
• Adds environment_kind_id and environment_kind_display_name fields to the available-domains API response.
• New Webhooks table and webhook details modal on the Delivery Page for managing webhook configurations.

Attack Surface & Exposure Management · 2026-07-28

Censys launches a hosted Adversary Investigation MCP server, giving AI agents (Cursor, Claude Code, Continue.dev) direct access to threat-hunting APIs.

• New hosted Adversary Investigation MCP server at https://mcp.platform.censys.io/threat-hunting/mcp/ enables AI coding agents to query Censys threat-hunting data.
• Supports OAuth and HTTP header authentication for integrating the MCP server with tools like Cursor, Claude Code, and Continue.dev.
• OAuth connections can be managed from Account Settings > Personal Settings > Connected Applications.

Attack Surface & Exposure Management · 2026-07-28

Censys Platform adds OAuth 2 Connected Apps management, letting users review and revoke third-party access to Censys APIs.

• New Connected Apps page in Account Settings lets users audit and revoke OAuth 2 applications — including the Platform MCP server — that have been granted access to Censys APIs on their behalf.

Attack Surface & Exposure Management · 2026-07-28

Censys adds OAuth MCP server setup, 10 new software fingerprints, and 23 new protocol/application scanners.

• New Connected Applications page in the Platform web console lets users review and manage OAuth connections.
• Adds 10 new software fingerprints covering Apple HTTPServer, Control Web Panel, Dynatrace, LinuxServer SWAG, Meteor, Microsoft ASP.NET MVC, Microsoft WCF, Oracle Mojarra, Weaver e-cology, and ZKoss ZK Framework.
• Adds 23 new protocol, application, and endpoint scanners including CORTEX_XDR_P2P, DENON_HEOS, DOTNET_NEGOTIATE_STREAM, ELASTICSEARCH_TRANSPORT, GIOP, INFLUXDB, ISC_DHCP_OMAPI, JUPYTER, KCODES_NETUSB, KEYCLOAK, LANGFLOW, MYSQLX, NGINX_PROXY_MANAGER, PERFORCE_P4D, PROXMOX_VE, QDRANT_GRPC, R1SOFT_BUAGENT, SYNCTHING_BEP, SYNOLOGY_DSM, TARANTOOL, TELEXPER_TLXP, TWAMP_CONTROL, and VAULT.

Identity & Access Management · 2026-07-28

Clerk introduces composable, experimental building-block APIs for UserProfile and OrganizationProfile pages.

• New experimental composable API lets developers build custom UserProfile and OrganizationProfile pages from Clerk's individual UI building blocks instead of using the pre-built monolithic components.

AI Coding Agents · 2026-07-28

Cline adds Hooks support plus two new AI providers: MiniMax and Poolside.

• Adds Hooks integration for extending Cline via SDK plugins.
• Adds MiniMax as a supported AI provider for model configuration.
• Adds Poolside as a supported AI provider for model configuration.

AI Coding Agents · 2026-07-28

Cline desktop v0.0.6 adds message queuing UI, persistent sidebar update indicator, and connector session persistence.

• Adds a queued-messages panel above the composer showing a count with expand controls to edit, send immediately, or delete individual queued turns.
• Adds a persistent sidebar update indicator that displays the new version and a one-click restart button after an update is downloaded, surviving toast dismissal.
• Displays the full workspace name and current git branch in the header and sidebar, with stable branch tracking that survives transient git lookups.

AI Coding Agents · 2026-07-28

Cline desktop v0.0.5 adds a Cline API key onboarding path, cancellable browser sign-in, and consistent MCP server cards with install guidance.

• Adds a Cline API key path to onboarding so users can authenticate without a browser.
• Enables cancellation of a pending browser sign-in instead of waiting indefinitely.
• Unifies MCP server cards across marketplace views with a single uninstall action and setup guidance on installed servers.

Identity & Access Management · 2026-07-28

ConductorOne MCP server registration gains discovery-issue acknowledgment flow, custom tool prefix override, and per-server tool enablement control.

• Adds a pre-registration discovery check that surfaces relaxable authorization server issues (e.g., issuer mismatch, cross-host auth server) for admin acknowledgment before proceeding, and blocks registration entirely for issues that cannot be safely relaxed.
• Supports an optional tool prefix override on MCP server registration; falls back to the server's declared prefix, then a C1-generated default.
• Adds per-server tool enablement setting (Require enablement or Auto-enable) that overrides the tenant-wide default tool approval setting for a specific MCP server.

Identity & Access Management · 2026-07-28

ConductorOne AI Assistant gains visual report generation with charts, stat cards, tables, and full data lineage verification.

• Generates visual reports with charts, stat cards, and tables directly in the AI Assistant response — no file download required.
• Supports side-by-side multi-chart dashboards in a single query (e.g., trend chart alongside a users-by-status chart), each with its own export option.
• Composes full reports combining aggregate stat cards, trend charts, and data tables in one response.

Identity & Access Management · 2026-07-28

ConductorOne adds AI-driven workflow approvals, per-user connector auth, custom campaign recurrence, and richer AI reporting.

• Assigns a workflow step in a request or review policy to C1 AI, which evaluates each request using built-in guidance plus custom instructions; every evaluation is logged as an AI-agent action in the audit log and recorded as a reviewable conversation.
• Adds an indirect-access section to entitlement search results, surfacing entitlements (e.g., a GitHub team) that transitively grant access to a searched resource.
• Enables custom recurrence intervals on campaign templates (e.g., every two days, every three months) and lets admins set exactly how long each campaign run lasts, replacing fixed presets.

Identity & Access Management · 2026-07-28

ConductorOne adds AI agent policy steps, group/role access reviews, per-user MCP auth, and scoped personal API keys.

• Assign a workflow step in a request or review policy to the C1 AI agent, which evaluates each request using built-in guidance plus custom instructions; every evaluation is attributed to the C1 System agent identity, labeled as an AI-agent action in the audit log, and recorded as a reviewable conversation.
• Request catalog search now includes an Entitlements matching section showing entitlements that indirectly grant access to a searched resource (e.g., a GitHub team whose repo permissions include the target repo), with a View access graph link showing the full grant chain.
• Access review campaigns can now review grants held by groups or roles in addition to users, using a new Grant types selector (Users only, Resources only, or Users and resources) on the Scope tab.

AI Agent Frameworks · 2026-07-28

CrewAI 1.15.8 adds WaitTool to let agents pause execution while waiting on long-running async jobs.

• Adds WaitTool to pause agent execution while waiting on long-running background jobs.

AI Coding Agents · 2026-07-28

Cursor launches India-local Start plan at ₹649/month with UPI billing, cloud agents, and iOS remote control.

• New Cursor Start plan (₹649/month, INR billing with UPI or card) targets developers in India with local pricing.
• Includes always-on cloud agents that build, test, and ship code in the background while the developer keeps working.
• Adds Cursor for iOS with remote control to launch and steer agents from a mobile device.

Web Application Security · 2026-07-28

DataDome Go module v2.5.0 adds a GraphQLEndpoint parameter to configure GraphQL path protection.

• Adds GraphQLEndpoint parameter to specify custom GraphQL endpoint paths (defaults to /graphql).

Web Application Security · 2026-07-28

DataDome's Google Cloud Load Balancer module adds configurable GraphQL endpoint path support.

• Adds GraphQLEndpoint parameter to specify custom paths for the GraphQL endpoint (defaults to /graphql).

Web Application Security · 2026-07-28

DataDome Python ASGI module 1.2.0 adds configurable MCP endpoint support and expands cookie length to 512 chars.

• Adds mcp_endpoint attribute to DataDomeMiddleware to specify a custom MCP endpoint path (defaults to /mcp).
• Increases DataDome cookie length limit from 128 to 512 characters to support future capabilities.

Secure Access (VPN / SASE / ZTNA) · 2026-07-28

DNSFilter adds Brave SafeSearch enforcement, AppAware Sites filter, clickable MSP widgets, and Query Log Uncategorized filtering.

• Adds Sites filter to AppAware Reporting, giving Core plan and mixed Core/Pro environments query data scoped by site.
• Supports SafeSearch enforcement on Brave browser in Filtering Policies, joining Google, Bing, DuckDuckGo, Ecosia, and Yandex.
• Adds Enforce All shortcut in the redesigned SafeSearch policy editor to enable every SafeSearch engine at once; enforcement toggles are no longer nested under Block all search engines.

Agentic Infrastructure · 2026-07-28

Emisar v0.35.0: hostname-based runner identity, retention safety for connected runners, and faster behavior matrix CI.

• Runners without an explicit runner.id now use their hostname as identity, so reboots reconnect the same runner and replaced ephemeral hosts auto-enroll without a persisted identity file.
• Pack retention no longer sweeps versions still advertised by a connected runner, preventing pack_untrusted dispatch failures after idle-window cleanups.
• Hosted admin runner bootstraps from a version-pinned release download with retries, eliminating GitHub API anonymous rate-limit failures on control-plane VM start.

Agentic Infrastructure · 2026-07-28

emisar v0.34.0 adds streaming run output via MCP cursor paging and authoring-time pack argument validation.

• New wait_for_run MCP call accepts an output cursor and returns the next cursor, enabling agents to stream run output incrementally as it arrives rather than polling.
• Curl-backed API actions now fail on 4xx/5xx HTTP responses instead of reporting transport success, making pack error handling reliable.
• Pre-run dispatch rejections (contract changes, refusals, rate limits) are now logged with bounded, allowlisted fields, making refused MCP calls visible in operations.

Secrets Detection & Management · 2026-07-28

GitGuardian roadmap adds Honeytoken multi-cloud/CI/CD/vault support, Slack App with interactive actions, Teams DMs, and an Amazon Kiro integration.

• Adds Endpoint Breach Detection view, shifting endpoint UX toward asset protection and attack detection.
• Surfaces Non-Human Identity policy breaches (overprivilege, stale identities, cross-environment usage) as actionable incidents with lifecycle tracking.
• Replaces the Slack webhook notifier with a native Slack App that threads incident events under a single parent message per incident.

Secrets Detection & Management · 2026-07-28

GitGuardian Self-Hosted 2026.7.0 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, 9 new detectors, and an MCP server deployment.

• Adds Public Monitoring to self-hosted instances (license-gated): monitor public perimeter for secret leaks and route incidents through custom webhooks, Slack, Microsoft Teams, ServiceNow ticketing, and severity-filtered email alerts via the new celeryWorkers.public-monitoring worker.
• Adds native Gerrit VCS source with full historical scanning, real-time detection via webhook plugin, and read-replica support for cloning.
• Adds Smart Notifiers: define per-channel filtering rules so alerts, tickets, or emails are only created for incidents matching severity, validity, secret type, or GitGuardian tag — across internal and public monitoring.

Secrets Detection & Management · 2026-07-28

GitGuardian adds a dedicated Check Runs dashboard page, Bitbucket source health management, perimeter column customization, and bulk source actions.

• New dedicated Check Runs page in the dashboard lets security teams browse all GitHub check run results (status, repo, commit SHA, PR, timing), filter by repository/status/date, re-run or skip checks, and jump directly to linked incidents — without switching to GitHub.
• Fine-grained GitHub personal access tokens can now be used to monitor private members of a GitHub organization (previously only classic tokens were supported) in the Public Perimeter view.
• Perimeter table now supports column customization, letting users choose which source attributes are displayed to tailor the view to their workflow.

Secrets Detection & Management · 2026-07-28

GitGuardian v2.167.0 adds 11 new secret detectors across Azure, AI/LLM, and dev tooling, plus new validity checkers for LiteLLM, Llama Cloud, New Relic, and npm.

• Adds detector for LiteLLM API Key (without host capture).
• Adds detector for Azure SQL Credentials (Assignment).
• Adds detector for Azure Machine Learning keys.

Secrets Detection & Management · 2026-07-28

GitGuardian adds a dedicated GitHub Check Runs dashboard page with filtering, KPIs, re-run controls, and incident linking.

• New GitHub Check Runs page in the Perimeter section surfaces every check run with status, repository, commit SHA, pull request, and timing in one place.
• Filter and search check runs by repository, status, or date — including workspaces with hundreds of thousands of runs.
• KPI strip at the top of the Check Runs page summarizes activity to surface failures and trends at a glance.

AI Agent Frameworks · 2026-07-28

HolmesGPT 0.37.0 adds JSON log scraping, Langfuse/OpenTelemetry tracing, and pre-acquired Azure AD token support.

• Adds JSON logging format support for log scrapers, enabling structured log ingestion pipelines.
• Adds Langfuse integration via OpenTelemetry tracing for LLM observability and trace export.
• Supports pre-acquired AZURE_AD_TOKEN for Entra ID authentication, allowing token reuse without re-authentication.

Endpoint Security (EDR/XDR) · 2026-07-28

Huntress Managed ITDR now infers Microsoft 365 home country from tenant data, eliminating false-positive Unexpected Country escalations.

• Automatically infers a Microsoft 365 identity's home country from the tenant when no Entra usage location is set, requiring zero partner configuration.
• Inferred country value serves as the Expected Country for Unexpected Country escalation evaluation, reducing false-positive alerts for users logging in from their home country.

Endpoint Security (EDR/XDR) · 2026-07-28

Managed ITDR now throttles and prioritizes escalations during a new tenant's first week to reduce onboarding noise.

• Adds onboarding escalation throttle to Managed ITDR, pacing and prioritizing alert flow during a new tenant's first week while behavioral baselines build.

Data Security & DLP · 2026-07-28

Immuta adds separate access/masking request forms, Redshift viewless auto-discovery, managed groups for policies, and OAuth 2.0 for Alation.

• Adds separate access and masking exception request forms for data products, allowing stewards to configure independent questions and data use agreements per request type.
• Expands automated sensitive data discovery to Immuta's Amazon Redshift viewless integration, automatically tagging matching columns using regex, dictionary, and column-name regex identifiers.
• Introduces three built-in Immuta managed groups — All Agents, All Users, and All Identities — available for authoring subscription and data policies without manual group management.

Secrets Detection & Management · 2026-07-28

Infisical v0.162.14 adds Google Workspace service template, Windows domain account rotation, enriched secret reminder emails, and instance version update checks.

• Adds Google Workspace as a proxied service template (available as a popular template in the service proxy catalog).
• Tracks and displays a last-used timestamp for proxied services.
• Adds an instance version update check with in-UI display so self-hosted admins can see when a newer release is available.

Attack Surface & Exposure Management · 2026-07-28

Intruder launches AI Pentesting: on-demand web app pentests with PDF reports, whitebox code repo analysis, and logic-flaw detection.

• New AI Pentesting capability delivers full web app penetration tests on demand, producing a PDF report with executive summary, severity ratings, reproduction steps, and remediation guidance.
• Supports whitebox testing via code repository integration, enabling deeper analysis beyond surface-level scanning.
• Detects access control, business logic, and auth bypass vulnerabilities that require multi-step chaining — issues missed by static or purely dynamic scanning.

Endpoint Security (EDR/XDR) · 2026-07-28

Iru adds Assignment Rule to target Library Items at devices based on Apple beta program enrollment status.

• New Assignment Rule on Assignment Maps lets you assign Library Items to devices based on Apple beta program enrollment — either any beta enrollment or specific beta programs.

Threat Intelligence · 2026-07-28

Lookyloo v1.40.1 adds WebSocket stream visibility, private captures with token access, and background tree-building scripts.

• Adds private captures mode — captures visible only to admins or holders of a temporary token.
• Adds a UI form to change the visibility of an existing capture (e.g. public → private).
• Adds background scripts to build trees and index archived captures without blocking the main process.

Endpoint Security (EDR/XDR) · 2026-07-28

Microsoft Defender's Project Perception launches public preview with coordinated red/blue/green AI agents for closed-loop autonomous defense.

• Introduces Project Perception, a continuously learning defense system that coordinates three classes of specialized AI agents — red team (attack path discovery), blue team (investigation and risk reasoning), and green team (corrective action and hardening) — operating in a closed-loop across identities, endpoints, applications, data, clouds, and AI systems.
• Launches software vulnerability management as the first Project Perception scenario, integrating MAI-Cyber-1-Flash into MDASH (software vulnerability multi-model agent team) for automated vulnerability discovery and prioritization.
• MDASH with MAI-Cyber-1-Flash achieves 96% on the CyberGym benchmark (+12 points above the previous Mythos configuration) while delivering ~50% cost reduction versus the current production MDASH configuration.

Endpoint Security (EDR/XDR) · 2026-07-28

Microsoft launches Project Perception agentic security system and the External Red Team Alliance (EXTRA) for global AI safety research.

• Introduces Project Perception, a new agentic security system with a multi-layer Cyber Stack — signals/sensors, security context, multi-model architecture, agent harness, and actuators — designed to continuously perceive, reason, and act at machine speed.
• Adds a continuously updated security context layer that transforms signals, threat intelligence, and asset/identity/relationship data into a shared, near-real-time representation for AI agents, reducing token cost and improving reasoning accuracy.
• Adopts a multi-model architecture that dynamically selects the best-fit model (frontier or specialized) per security task, optimizing for quality, latency, reliability, and cost without locking customers to a single model.

AI Coding Agents · 2026-07-28

Codex CLI alpha.14 adds cloud-managed profiles for codex sandbox, network policy callbacks for remote exec, and configurable developer instructions for v2 subagents.

• Loads cloud-managed profiles for codex sandbox, enabling permission profiles and managed requirements to be sourced from cloud config bundles.
• Adds configurable developer instructions for v2 subagents, allowing per-subagent instruction customization in multi-agent workflows.
• Routes curated plugins by authentication mode, so plugin recommendations are matched to the active auth context.

AI Coding Agents · 2026-07-28

OpenCode v1.18.8 upgrades the MCP client SDK to v2 and adds a project selector keyboard shortcut.

• Upgrades the MCP client SDK to v2, improving compatibility with newer MCP servers and OAuth flows.
• Adds a mod+shift+o shortcut to open the project selector from the new-session page in the desktop app.

AI Coding Agents · 2026-07-28

OpenHands Agent Canvas adds a prebuilt GitHub PR Review workflow that watches pull requests and posts automated reviews.

• New prebuilt GitHub PR Review workflow in Agent Canvas lets an OpenHands agent automatically review pull requests and post summary or inline feedback.
• GitHub MCP Server integration in Agent Canvas provides the agent tools for reading repositories, inspecting PRs, and posting review output.
• Configurable review scope lets the automation target specific repositories, post single summary comments or detailed inline feedback, inspect CI/check results, and ignore specified files or directories.

AI Coding Agents · 2026-07-28

OpenHands adds Agent Canvas UI, persistent memory, path-triggered rules, SDK plugins, and full Kubernetes/Enterprise deployment docs.

• New Agent Canvas: a desktop UI for running agents with reusable profiles, conversation branching, and an Automate view for managing automations.
• Adds opt-in two-tier persistent memory that survives across conversations via the SDK.
• Introduces path-triggered rules that deterministically inject context whenever an agent reads, edits, or creates a file matching a glob pattern.

Identity & Access Management · 2026-07-28

Ory Network v26.3.3 adds configurable legal footer links (ToS, Privacy Policy, Contact) to Account Experience UI.

• Adds configurable Terms of Service, Privacy Policy, and Contact links to the Account Experience legal footer.

Identity & Access Management · 2026-07-28

Passbolt 5.14 adds smarter credential suggestions, stronger MFA policy enforcement, and email-free SSO setup and recovery.

• Improves visibility over shared access for resources.
• Delivers more relevant in-context credential suggestions.
• Strengthens MFA policy enforcement.

SAST / SCA / Code Security · 2026-07-28

Portkey forwards request metadata as AWS STS session tags, enabling per-app Bedrock cost attribution in Cost Explorer and CloudTrail.

• Supports AWS STS session tags for Bedrock: metadata sent via x-portkey-metadata is forwarded as STS session tags, enabling spend segregation in AWS Cost Explorer and CloudTrail without separate IAM roles per application.
• Clarifies that model conditions and group_by keys use the request model name (e.g. gpt-4.1), not the provider's response model name (e.g. gpt-4.1-2025-06-01), which matters for Azure OpenAI and similar providers.

SAST / SCA / Code Security · 2026-07-28

Portkey adds support for configuring custom gateway endpoints for organizations.

• Supports custom gateway URLs, enabling organizations to configure dedicated endpoints for their Portkey gateway.

SAST / SCA / Code Security · 2026-07-28

Portkey March 2026: vault-backed credentials, weekly rate limits, cross-cloud GCS logging, and four new guardrail integrations.

• Adds Secret References to pull credentials from AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault at runtime via secret_mappings, keeping secrets out of Portkey config.
• Supports weekly budget and usage windows (rpw) for rate limits, enabling caps aligned to weekly planning and review cycles.
• Adds endpoint-scoped rate limits so chat completions, embeddings, and admin routes can carry independent limits instead of a single global rule.

Secure Access (VPN / SASE / ZTNA) · 2026-07-28

ShareFile adds Tasks workspace, Request List export, Outlook signature requests, session management, AI document validation, and a Security Insights dashboard.

• New Export a Request List capability lets users export Request Lists to Excel (.xlsx) or CSV (.csv) from the three-dot menu, reflecting currently active columns.
• New ShareFile Tasks provides a centralized workspace for viewing and managing work items across projects in a single location.
• New Create Signature Request in ShareFile for Outlook Online add-in lets users send documents for e-signature or self-sign directly from Outlook without leaving the inbox.

CNAPP · 2026-07-28

Qualys TotalCloud adds automated vulnerability scanning for AWS Lambda, extending serverless security beyond CSPM to workload-level risk.

• Adds automated vulnerability scanning for AWS Lambda functions, detecting vulnerable open-source packages and outdated libraries inside function code — beyond what CSPM posture checks can see.
• Enables event-driven scanning that triggers automatically when Lambda functions are created or updated, with no manual intervention required.
• Supports cross-account and multi-region AWS Lambda environments, including same-account and cross-account configurations deployed via CloudFormation templates.

CNAPP · 2026-07-28

InsightCloudSec 26.7.28 adds AI Root Cause Analysis for runtime findings, HITRUST CSF v11.7.1 compliance packs, and AWS Tag Policy resource harvesting.

• Adds a Root Cause Analysis tab to the AI Analysis panel for container runtime detection findings, surfacing an AI-generated summary, a Prevention Window showing when posture risks were first detected relative to the runtime incident, Primary Causes with confidence scores, and Contributing Factors.
• New HITRUST CSF v11.7.1 e1 Essential and i1 Intermediate compliance packs available.
• Adds harvesting support for AWS Organizations Tag Policy resources across AWS, AWS GovCloud, and AWS China environments via the new TagPolicyHarvester, enabling visibility into tag enforcement policies.

Attack Surface & Exposure Management · 2026-07-28

Surface Command adds AI asset summaries in ASM and three new connectors: Adaptive Security, Avigilon Alta, and Halcyon.

• New AI-generated asset summaries in the Attack Surface Management Asset Details view provide instant overviews of key properties, exposures, and alerts to speed up prioritization and remediation decisions.
• New Adaptive Security connector imports users and groups from the security awareness training platform into Surface Command.
• New Avigilon Alta connector integrates Users, Access Groups, ACUs, Readers, and Sites from the cloud-based physical access control solution.

Identity & Access Management · 2026-07-28

SailPoint introduces an AI-guided connectivity agent wizard to configure Web Services sources without deep API expertise.

• Adds a connectivity agent: an AI-powered, wizard-based setup experience for configuring Web Services connector sources directly within the SailPoint application onboarding workflow.
• Supports AI-recommended configuration for authentication endpoints, account aggregation with data preview, pagination rules for large datasets, attribute mapping for accounts and entitlements, and identity-to-account correlation.
• Enables detection of compatible REST and SCIM public APIs for any target application, compressing multi-day Web Services configuration into hours.

AI/LLM Security · 2026-07-28

SkillSpector v2.5.0 adds inspection-ledger reporting with execution-completeness fields in JSON/SARIF and v2 baseline fingerprints.

• Adds canonical inspection-ledger accounting across static and LLM analysis stages, including per-component coverage and explicit out-of-scope records.
• New execution_successful top-level field and analysis_completeness.ledger_exceptions diagnostics in JSON output let automation block incomplete or failed scans.
• JSON and SARIF reports now include execution-completeness information and analyzer status so a zero-finding report can be distinguished from a partial or failed scan.

SAST / SCA / Code Security · 2026-07-28

Snyk DAST gains AI-powered authenticated scan setup and native Bruno collection support for API targets.

• Adds Automatic Target Authentication Configuration for DAST: AI-driven setup automatically generates login sequences, handles 2FA, and maps CSS selectors, with natural-language instructions for complex scenarios.
• Supports native Bruno collection imports for API Targets — upload via ZIP or folder without converting to Postman or OpenAPI formats first.
• Syncs Bruno collection environments automatically and warns when variables are missing required secret values during import.

SAST / SCA / Code Security · 2026-07-28

StepSecurity Secure Registry adds Maven (Beta) support, per-ecosystem Custom Block List, and npm Tarball URL Rewriting.

• Adds Maven (Java) ecosystem support (Beta) to Secure Registry — route all Maven metadata and artifact downloads through https://registry.stepsecurity.io/java with Cooldown Period, Compromised Packages, and Custom Block List controls at launch.
• Supports four Maven integration paths: JFrog Artifactory, Google Artifact Registry, Sonatype Nexus Repository, and Direct, with setup steps switchable via a new Package manager selector on the Setup Guide tab.
• Introduces Custom Block List, a new per-ecosystem control that blocks specific packages or versions using glob patterns (e.g., lodash@4*, @scope/*), evaluated independently of Cooldown, Compromised Packages, and Typosquatting Protection.

Network Analysis & Monitoring · 2026-07-28

tcpreplay 4.6.0 adds AF_XDP and io_uring injection backends, --loss simulation, --raw socket path, and a static libtcpreplay library.

• Adds --xdp AF_XDP injection backend, now reaching ~941 Mbps (305k pps) line rate on 1GigE hardware — a 23× improvement over the previous implementation.
• Adds --xdp-queue to bind the AF_XDP socket to a specific adapter queue instead of always using queue 0.
• Adds --xdp-no-fallback to fail hard rather than silently fall back to the default injector — useful for benchmarking where a silent injector change would invalidate results.

SAST / SCA / Code Security · 2026-07-28

Veracode adds CLI --exclude flag, DAST custom host-to-IP mappings, EU Package Firewall, enhanced Python scanner, and Android 17 / .NET 10 static analysis support.

• Adds --exclude flag to Veracode CLI v2.51.1 to prevent specified Java packages or JAR files from being scanned.
• Enables custom host-to-IP address mappings for DAST scans when DNS lookup is unavailable or not desired.
• Enhances Python static scanner with taint tracking, cross-file analysis, and pattern recognition; adds framework support for PySpark, Flask, Django, and FastAPI.

Local LLM Runtimes · 2026-07-28

vMLX 1.6.18 adds a process-wide SSD cache budget with LRU eviction and detailed cache reporting.

• Adds a process-wide SSD cache budget with coordinated LRU eviction and off-request-path publication for improved prefix reuse management.
• Introduces detailed cache reporting covering attempted prefixes, applied reuse, uncached suffixes, reconstruction, fallback prefill, and aggregate disk usage.
• Supports MiniMax tool arguments emitted as request-schema XML children.

SAST / SCA / Code Security · 2026-07-28

Wiz introduces Atlas, an autonomous AI SAST system that validates every finding with a working exploit and scans pipelines for Secure by Design compliance.

• Introduces Atlas, an autonomous AI vulnerability research system that uses specialized agents to map attack surfaces, hunt in parallel, and adversarially validate findings — each confirmed with a dynamically generated, working exploit.
• Adds AI SAST at scale: Atlas performs continuous, cost-efficient deep code scanning across entire enterprise codebases using a code property graph (CPG) for call- and data-flow–grounded analysis.
• Adds shift-left tracing that links vulnerabilities discovered in production back to their originating code repository or container image, enabling fixes at the source.

Endpoint Security (EDR/XDR) · 2026-07-28

XFA desktop app gains a full security dashboard so end users can see every check and self-remediate without IT.

• New full desktop app UI (macOS, Windows, Linux): users can open the menu-bar icon to see a complete device security overview.
• Per-check pass/fail detail view shows every security check XFA runs with step-by-step remediation guidance for end users.

AI/LLM Security · 2026-07-27

AI-Infra-Guard v4.5.0 adds standalone CLI modules for Agent/MCP/Skill scanning, new AI agent detection skills, SARIF output, and open-source frontend.

• Modularizes Agent-Scan as a standalone CLI with AIG integration support, adding 4 new AI agent security detection skills.
• Modularizes MCP-Scan with dual-mode support (CLI + AIG Web) and adds a standalone mcp-scan-lite module.
• Adds 2 new MCP security detection rules plus ATR-derived MCP detection rules covering additional attack surfaces.

Identity & Access Management · 2026-07-27

Auth0 launches Metric Streams (Beta) to stream real-time API metrics to Datadog, New Relic, and Splunk via native or OTLP integrations.

• New Metric Streams feature streams real-time Auth0 API metrics (request volume, error rates, rate limits, geographic distribution, authentication flows) to external monitoring platforms.
• Supports native Datadog integration and OpenTelemetry Protocol (OTLP) for New Relic and Splunk.
• Exposes auth0.api_request.count metric with rich tagging: API type, operation name, result, failure code, country code, client ID, connection ID, and grant type.

Identity & Access Management · 2026-07-27

Auth0 launches Cross App Access (XAA) for Resource Applications in Open Early Access, enabling secure agent-to-app and app-to-app authorization.

• Adds Cross App Access (XAA), a new open standard for passing authorization across domains, enabling AI agents and enterprise apps to securely access MCP servers and APIs without per-user consent prompts.
• Centralizes IT control over cross-application data-sharing connections, improving governance and visibility into which agents and apps access which resources.
• Supports SAML and OIDC enterprise IdPs — including specific support for Okta — with no code changes required on the resource application side.

Attack Surface & Exposure Management · 2026-07-27

Axonius 9.0 introduces a redesigned grouped navigation with expandable menu groups replacing the previous icon-based side menu.

• New grouped navigation experience in v9.0 organizes all side-menu items into expandable groups, replacing the icon-based navigation.
• Cases and Case Sets are now accessible directly from the new Action Center group in the side menu.
• Activity Log and Nodes are now accessible from the new System group in the side menu.

Identity & Access Management · 2026-07-27

Castle adds VPN traffic detection via new IP intelligence signals.

• Detects VPN traffic using new IP intelligence, extending existing tunnel and residential proxy detection capabilities.

Identity & Access Management · 2026-07-27

Castle adds Residential Proxy IP signal and richer IP tunnel intelligence to its IP risk detection.

• New Residential Proxy IP signal detects traffic routed through real consumer ISPs, catching proxies invisible to traditional datacenter-based detection.
• Expanded IP tunnel intelligence provides richer context alongside existing Proxy IP and Tor IP signals.

Identity & Access Management · 2026-07-27

Castle lets you export your team members list to CSV from Team Settings for access reviews and compliance audits.

• Export team members list to CSV from the Team Settings page, including name, email, user role, 2FA status, and member-since date.

Identity & Access Management · 2026-07-27

Castle adds email.registered_domain field to collapse subdomain variants for better fraud detection.

• Adds email.registered_domain event field that strips subdomains down to the registered domain using the public suffix list, making it easier to detect fraud patterns that rotate across subdomains.

SAST / SCA / Code Security · 2026-07-27

Codacy adds PHP CS Fixer as a new tool and gains support for Checkov configuration files.

• Adds PHP CS Fixer as a supported static analysis tool for PHP code style enforcement.
• Adds support for Checkov configuration files, enabling repository-level Checkov settings to be recognized by Codacy.

AI Agent Frameworks · 2026-07-27

CrewAI 1.15.7 adds runtime skill usage event emission for observability.

• Emits skill usage events at runtime, enabling observability pipelines to trace which skills agents invoke during execution.

AI Agent Frameworks · 2026-07-27

CrewAI 1.15.7a1 adds runtime skill usage event emission for improved observability.

• Emits skill usage events at runtime, enabling observability pipelines to track which skills agents invoke during execution.

Vulnerability Management · 2026-07-27

DefectDojo Pro gains Sensei: AI-powered scan-and-fix that opens remediation PRs on GitHub repositories.

• New Sensei AI feature scans GitHub repositories and imports results as findings into DefectDojo Pro.
• Enables LLM-generated pull requests that remediate findings, using a preview-first approval workflow so nothing runs until manually approved.
• Supports triggering fixes from the findings table, from staged auto-fix candidates, or via a /fix comment on a pull request.

Vulnerability Management · 2026-07-27

DefectDojo Pro adds 20+ new findings connectors, a Linear integrator, per-assignment push filters, and a redesigned feature flags system.

• Adds findings connectors for Rapid7 InsightAppSec, Cobalt.io PtaaS, Sonatype IQ (Nexus Lifecycle), Acunetix 360, Mend (WhiteSource), Bugcrowd, Black Duck, Edgescan, Sysdig Secure, Coverity Connect, Harbor, OpenVAS/Greenbone, Nuclei/ProjectDiscovery Cloud, Endor Labs, Prowler, Kubescape/ARMO, Quay+Clair, Intruder.io, and YesWeHack.
• Adds a ServiceNow CMDB asset connector for syncing asset inventory.
• Registers the Intigriti bug bounty connector and the runZero asset connector in the Pro UI.

Vulnerability Management · 2026-07-27

DefectDojo 3.1.300 adds a Fortify parser v2, tighter API permission controls, and a case-insensitive index on Vulnerability ID.

• New Fortify parser v2 prefers true source line numbers for more accurate finding location reporting.
• Adds case-insensitive expression index on Vulnerability_Id.vulnerability_id for faster, case-insensitive vulnerability lookups.
• Restricts configuration permission assignment to superusers only in the user API, tightening privilege escalation controls.

SIEM · 2026-07-27

Elastic Security v9.4 adds Entity Analytics Watchlists to inject organizational risk context directly into entity risk scoring.

• New Entity Analytics Watchlists let teams create named, weighted lists of users, hosts, and services that feed directly into the platform's risk scoring pipeline — no ES|QL or pipeline configuration required.
• Watchlist memberships compound with alert activity, asset criticality, and behavioral anomalies to produce a single prioritized risk score per entity.
• Supports both manual curation and automated population via API, enabling integrations (e.g., HR systems) to add or remove entities as conditions change.

Threat Intelligence · 2026-07-27

Feedly Ask AI gains SPL query generation and an improved threat actor campaign detection model alongside KQL support.

• New Ask AI model tuned specifically for threat actor campaign detection.
• Adds SPL (Splunk Processing Language) hunting query generation to Ask AI, complementing existing KQL support.
• Improves MITRE ATT&CK tagging accuracy in Ask AI results.

Reverse Engineering · 2026-07-27

HyperDbg adds ucpuid command to execute CPUID in the debuggee and new scripting language data types & operators docs.

• New ucpuid command executes a CPUID instruction directly in the debuggee context.
• Scripting language gains documented data types and operators for use in HyperDbg scripts.

Digital Forensics & Incident Response · 2026-07-27

iLEAPP v2026.2.1 adds 60+ Biome streams, full Signal for iOS parsing, expanded keychain handling, and notifications overhaul.

• Adds 60+ new Biome artifact streams covering device power/lock state, location visit, app location activity, camera AutoFocus ROI, energy mode, boot session, emergency voice calls, emoji engagement, Device.Timezone, Wallet transactions, Siri Remembers Message/Audio History, Discoverability Signals, Siri UI, Siri suggestions, and a full Apple Intelligence family including Safety Overrides.
• New Signal for iOS support: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories.
• Expanded keychain handling: accepts examiner-supplied keychain input, adds a lookup helper, includes a pure-Python SQLCipher reader, supports UFED encrypted keychain dumps, and can reuse a keychain already present in the extraction.

Attack Surface & Exposure Management · 2026-07-27

Intruder extends Azure cloud scans to cover Microsoft 365 configuration risks across Entra, Exchange, SharePoint, and Teams.

• Adds Microsoft 365 configuration risk scanning (Entra ID, Exchange Online, SharePoint, Teams) as part of existing Azure cloud security scans.
• Surfaces M365 identity, email, and collaboration configuration risks automatically for existing Azure integration users.
• Enables full M365 check coverage by updating the Azure integration's permissions.

Identity & Access Management · 2026-07-27

JumpCloud adds an Admin Portal Homepage with organization health alerts and quick admin tasks.

• New Admin Portal Homepage surfaces organization health alerts, quick admin tasks, and data insights as a centralized starting point for administrators.

Identity & Access Management · 2026-07-27

JumpCloud Agent 2.149.3 expands tray/menu bar app visibility and refines Self Service App Catalog display.

• Windows tray app and macOS menu bar app now visible to users with local or Google password sources when the Self Service App Catalog is enabled.
• Self Service App Catalog now filters to show only Winget (Windows) and macOS JumpCloud App Catalog apps, removing unsupported package manager types.

Wireless & RF · 2026-07-27

multimon-ng 1.6.0 adds GSC paging, FLEX/POCSAG generation, macOS audio capture, SDL3 scope, and JSON output for GSC and FLEX_NEXT.

• Adds GSC (Golay Sequential Code) paging decoder with error correction, auto-polarity, batch message support, and JSON output.
• Adds FLEX_NEXT decoder improvements based on ARIB STD-43A: more robust decoding, message reassembly, validation, timestamps, and JSON output.
• Adds FLEX and POCSAG signal generation via the new gen-ng binary.

Identity & Access Management · 2026-07-27

Okta Open Source MCP Server GA: AI agents can now manage identity, brands, and device policies via natural language with least-privilege OAuth scoping

• Introduces the Okta Open Source Model Context Protocol (MCP) Server, a secure abstraction layer enabling AI agents and LLMs to interact with Okta org management APIs using natural language.
• Adds customization tools for AI clients to manage Okta brands, custom domains, sign-in pages, email templates, and themes without using the Admin Console.
• Adds scope-based tool loading that exposes only the tools permitted by the authenticated user's OAuth scopes, enforcing least privilege and reducing LLM token usage.

Identity & Access Management · 2026-07-27

Okta adds OIN Wizard support for Identity Verification integrations and an open-source MCP server for AI agent access to Okta APIs.

• ISVs can now build, test, and submit Identity Verification (IDV) integrations to the Okta Integration Network via the OIN Wizard, letting admins discover and configure IDV providers directly from the OIN app catalog.
• New open-source Okta MCP Server acts as a secure protocol abstraction layer enabling AI agents and LLMs to interact with Okta scoped management APIs using natural language, supporting least-privilege access control for AI workflows.

AI Coding Agents · 2026-07-27

Codex CLI alpha.13 adds cached MCP tool exposure before server startup and model-owned token budget defaults.

• Exposes cached MCP tools to inference before the MCP server finishes initializing, reducing latency at session start.
• Supports model-owned token budget defaults from the model catalog, applied automatically when no explicit token-budget configuration is set.

Vulnerability Management · 2026-07-27

OpenCVE adds Alerts API endpoints to list and retrieve alerts within a report

• New GET /api/reports/<link>/alerts endpoint lists all alerts for a given report, with pagination support.
• New GET /api/reports/<link>/alerts/<id> endpoint retrieves full details of a specific alert, including changed, added, and removed CVE reference data.

Vulnerability Management · 2026-07-27

OpenCVE launches API v2 with read/write access, granular token scopes, and full vulnerability workflow management

• New REST API v2 at https://app.opencve.io/api/v2/ adds write capabilities alongside read, enabling programmatic management of projects, subscriptions, CVE triage (status and assignee), notifications, automations, and organization members.
• Supports bulk subscription replacement via a single PUT request, allowing teams to sync an entire software inventory (vendors and products) to a project in one operation.
• Introduces organization API tokens with granular scopes (e.g., catalog:read, subscriptions:write, projects:read) on Cloud Pro plans, enabling least-privilege access for scripts, CI/CD pipelines, and SIEM integrations.

Runtime Security · 2026-07-27

OpenShell v0.0.92 adds JSON/YAML output for sandbox commands and corporate HTTP proxy egress routing.

• Adds --output json and --output yaml flags to sandbox get, sandbox status, and sandbox create commands for machine-readable output.
• Supports routing sandbox egress traffic through a corporate HTTP proxy via the gateway.

SAST / SCA / Code Security · 2026-07-27

Promptfoo snapshot-20260727 adds adaptive rate limiting, Transformers.js local inference, telecom red team plugins, and video generation providers.

• Adds Transformers.js provider to run Hugging Face models locally in Node.js or browser.
• Adds Vercel AI Gateway and Cloudflare AI Gateway providers for routing requests.
• Adds AWS Bedrock Video (Nova Reel, Luma Ray 2) and Azure AI Foundry Video (Sora) for video generation.

AI-Powered Offensive Security · 2026-07-27

Strix v1.4.0 adds self-update, ChatGPT inference, Linux ARM64, Bedrock prompt caching, and smarter context management for long scans.

• Adds strix --update command for in-place CLI self-update and automatic update notifications.
• Supports signing in with a ChatGPT subscription as an inference provider.
• Adds Linux ARM64 standalone release builds.

SOAR · 2026-07-27

Tines 42.2.0 adds API key creation restrictions and template-based case creation via API.

• Adds the ability to restrict which users can create API keys.
• Enables creating cases from a template via the API.

Endpoint Security (EDR/XDR) · 2026-07-27

Endpoint Event Viewer gains Event name and Event ID filtering in the System events view.

• Adds filtering by Event name and Event ID in the Endpoint Event Viewer System events view.

Endpoint Security (EDR/XDR) · 2026-07-27

Zero Trust Secure Access On-premises Gateway 1.0.89 adds Microsoft Tenant Restriction v1 support in AI Secure Access rules.

• Supports Microsoft Tenant Restriction v1 in AI Secure Access rules, enabling organizations to restrict AI service access to approved Microsoft tenants.

Endpoint Security (EDR/XDR) · 2026-07-27

Helm Chart 3.5.0 upgrades Falco to 0.43.0 and adds OpenShift platform override control via values.yaml

• Upgrades Falco to 0.43.0, Falco libs to 0.23.1, and plugins to v0.7.1 with updated falco.yaml plugin configuration.
• Adds openshift.enabled field in values.yaml to explicitly override OpenShift platform auto-detection in unreliable environments.
• Skips the api-server-modifier DaemonSet and its ClusterRole on OpenShift, where the kube-apiserver is operator-managed.

SAST / SCA / Code Security · 2026-07-27

Veracode Package Firewall launches with automatic blocking of untrusted packages, now available in the European region.

• New Package Firewall service automatically blocks untrusted packages that don't comply with policies across artifact repositories and package managers.
• Package Firewall mitigates risks from malware, typosquatting, and license violations by enforcing verified, compliant dependencies.
• Package Firewall is now available in the European region.

Local LLM Runtimes · 2026-07-27

vMLX 1.6.16 ships KaTeX-backed Electron renderer for chat and reasoning surfaces and hardens bundled engine provenance.

• Adds KaTeX-backed Electron renderer path for chat and reasoning surfaces.
• Hardens packaged engine provenance so signed app sessions use bundled Python/vmlx_engine instead of stale development or system virtualenvs.

Web Application Security · 2026-07-27

Wapiti 3.3.1 adds stacktrace disclosure detection, stronger SQL boolean-based detection, improved CSP analysis, and per-host passive reporting.

• Adds passive detection of server-side stacktrace disclosures in HTTP responses.
• Improves boolean-based SQL injection detection to remain robust against dynamic/randomized pages.
• Enhances the passive CSP module to flag unknown directives and missing frame-ancestors and form-action directives.

Reverse Engineering · 2026-07-26

AsmResolver v6.0.1 adds CustomMarshalDescriptor.MarshalTypeName, AOT-compatible attributes, and a virtual ProbeDirectory hook.

• Adds CustomMarshalDescriptor::MarshalTypeName to support and preserve invalid or non-existing marshal type descriptors.
• Marks assemblies with additional AOT-compatible attributes for better ahead-of-time compilation support.
• Makes AssemblyResolverBase::ProbeDirectory virtual, enabling subclasses to override directory probing logic.

Local LLM Runtimes · 2026-07-26

Ollama v0.32.4 adds Laguna MLX support with memory-resident models, agent skill permissions, and better speculative-decoding quantization.

• Adds support for the Laguna model family on Apple Silicon via the MLX engine, with Metal memory residency for significantly improved prompt and generation performance on qualifying hardware.
• Adds permission/approval flow for model-initiated agent skill loading, while preserving direct user slash-skill activation without prompts.
• Adds /system prompt inspection and on/off toggle commands to the agent TUI, with cache-impact warnings and completion support.

Secure Access (VPN / SASE / ZTNA) · 2026-07-26

ShareFile adds a Tasks Workspace for centralized management of Request Lists and Forms across all projects.

• New Tasks Workspace provides a centralized location to view and manage work items — including standalone Request Lists and Forms — across all projects in a single interface.
• AI-powered Request List generation (Beta) enables users to create Request Lists using AI assistance.

Continuous Control Monitoring (CCM) · 2026-07-26

RegScale 6.32.3.0 adds an Asset Scanning Tool De-Duplication option for administrators to control duplicate finding consolidation.

• Adds an Asset Scanning Tool De-Duplication option, giving administrators control over how duplicate findings are identified and consolidated during asset scanning workflows.

Firewalls & Network Defense · 2026-07-26

Rspamd 4.1.3 adds fuzzy hash diagnostics API, ClickHouse export, ARF enrichment, SSRF protection for lua_http, and a jQuery-free WebUI.

• Adds structured fuzzy match results and a diagnostics API: every fuzzy match now produces a structured record (rule, symbol, upstream, digests, match type, probability, score, flag, timestamp) accessible via task:get_fuzzy_results() in Lua; a new fuzzy_check.check() Lua API queries a storage with task-generated or explicit hex digests.
• Adds rspamadm fuzzy_hash command to compute a message's fuzzy hashes per configured rule, optionally check them against storage (-C), and query storages for explicit hex digests (-H).
• Adds rspamadm control fuzzyhash <128-hex-digest> per-hash storage introspection across all fuzzy workers, reporting flag slots, values, creation time, TTL, and shingle slot ownership.

Firewalls & Network Defense · 2026-07-26

Rspamd 4.1.3 adds fuzzy diagnostics API, ClickHouse fuzzy exports, per-hash introspection, and a local-network request block for lua_http.

• Adds structured fuzzy match results via a diagnostics API and the new task:get_fuzzy_results() Lua method, with a configurable probability weight curve (prob_bias, prob_power) anchored at the match threshold.
• Exports fuzzy match details to ClickHouse (schema version 11) and annotates the X-Rspamd-Fuzzy milter header with rule, flag, probability, and timestamp.
• Adds forbid_local option to lua_http to block requests to local networks (enabled by default in url_redirector).

Secure Access (VPN / SASE / ZTNA) · 2026-07-26

vopono 0.10.19 adds SSH dynamic proxy tunneling with killswitch and improves WireGuard/AmneziaWG custom config compatibility.

• Adds SSH dynamic proxy support via --protocol ssh and redsocks, transparently routing IPv4 TCP and DNS traffic through an OpenSSH SOCKS5 proxy with killswitch protection, SSH config aliases, keys, and agent support.
• Improves custom WireGuard and AmneziaWG configuration compatibility: split-tunnel AllowedIPs, independent IPv4/IPv6 routing, hostname endpoints, endpoint bypass routes, and safe handling of wg-quick-specific options.
• Improves vopono-gui handling of custom VPN configurations: missing files are clearly marked, stale launch configurations can be deleted, and the selected protocol is passed explicitly when launching.

Digital Forensics & Incident Response · 2026-07-25

ALEAPP v2026.2.0 adds C2PA AI provenance parsing, Mister Skinnylegs browser artifact integration, and enhanced Samsung clipboard/CMH extraction.

• New C2PA Content Provenance artifact parses AI-generated media provenance data including signer certificate, signing time, case-insensitive media path matching, and a Media State column grouping manifest rows per media file.
• New Mister Skinnylegs artifact plugin integrates browser artifact processing targeting every Chromium-based browser or browser-style app.
• Samsung Honeyboard clipboard artifact reworked with WAL recovery, SEFT support, and dual-schema handling (including old-schema UID resolution from ABX packages.xml on Android 12+).

Integrated & IT Risk Management · 2026-07-25

CISO Assistant v3.20.3 adds TISAX v2027, ENISA Cyber Resiliency frameworks, a Power BI native connector, Slovenian UI, and custom fields on security exceptions.

• Adds TISAX v2027 framework library for automotive information security assessments.
• Adds ENISA Cyber Resiliency Maturity Assessment Framework library.
• Introduces a native Power BI connector for direct integration with CISO Assistant data.

AI Coding Agents · 2026-07-25

Claude Opus 5 lands as the new default Opus model, with 1M context, strict sandbox networking, and depth-3 nested subagents.

• Adds Claude Opus 5 (claude-opus-5) as the default Opus model — 1M context window, fast mode at $10/$50 per Mtok.
• Adds sandbox.network.strictAllowlist setting to silently deny any sandboxed-command network request to a non-allowlisted host (no prompt).
• Adds DirectoryAdded hook that fires whenever /add-dir or the SDK register_repo_root control request registers a new working directory mid-session.

AI Coding Agents · 2026-07-25

Cline v4.0.11 adds Claude Opus 5 across six providers and Moonshot Kimi K3 support.

• Adds Claude Opus 5 support across Anthropic, Claude Code, Bedrock, Vertex, Cline, and OpenRouter providers, including 1M context window variants.
• Adds Moonshot Kimi K3 model support.
• Includes host plugin version in all telemetry events.

SAST / SCA / Code Security · 2026-07-25

Cloudsmith CLI gains automatic OIDC auth and Docker credential discovery; cooldown policies expand to Maven packages.

• Introduces a Docker credential helper in the CLI to automatically authenticate to Cloudsmith registries.
• Extends cooldown policies to Maven packages, enabling supply-chain protection against newly published versions that haven't undergone sufficient scrutiny.

Identity & Access Management · 2026-07-25

ConductorOne campaigns now support automated scheduling with configurable recurrence and duration.

• Adds automated scheduling for campaign templates, enabling draft campaign instances to be created once on a future date or on a recurring schedule.
• Supports configurable recurrence intervals (e.g., every 2 days, every 3 months) and campaign duration settings via the template's Automated scheduling section.

Identity & Access Management · 2026-07-25

ConductorOne adds AI > Conversations audit page with per-tab visibility into agent activity across all three surfaces.

• New read-only AI > Conversations page lets admins review AI agent conversations across the organization, organized into separate tabs by surface.
• New System tab surfaces agent policy step evaluations — including the agent's reasoning and tool calls — attributed to the built-in C1 System identity for every approval policy decision.

Identity & Access Management · 2026-07-25

ConductorOne adds Retry failed provisioning to recover from connector failures without re-collecting approvals.

• Adds Retry failed provisioning action to re-attempt a failed connector provisioning step on an access-change task without restarting the approval workflow.
• Supports bulk retry of multiple failed provisioning tasks via the bulk actions menu.

Identity & Access Management · 2026-07-25

ConductorOne now renders attached resource attributes (e.g. AWS IAM policy documents) as a collapsible JSON tree in the review task details drawer.

• Adds a View policy button in the resource details drawer that opens attached policy documents (e.g. AWS IAM policies) as a readable, collapsible JSON tree instead of raw text.

Identity & Access Management · 2026-07-25

ConductorOne adds AI agent policy steps, group/role access reviews, custom campaign schedules, and per-user MCP auth

• Assign an AI Agent step to any request or review policy workflow, configuring agent mode, failure action, and free-text approval/deny instructions; every evaluation is attributed to the C1 System identity and logged under AI > Conversations.
• Catalog search now returns an Entitlements matching section showing entitlements that indirectly grant access to the searched resource, with a View access graph link to see the full grant chain.
• Access review campaigns can now review grants held by groups or roles (not just users) via a new Grant Types selector offering Users only, Resources only, or Users and resources.

Identity & Access Management · 2026-07-25

ConductorOne adds AI agent policy steps, access-graph search, group/role reviews, MCP per-user auth, and scoped API keys.

• Adds AI Agent steps to request and review policies — configure agent mode (comment-only, full control, or policy-step changes), failure action (reassign or skip), and free-text approval instructions; evaluations appear in audit log and AI > Conversations.
• Extends request catalog search to surface entitlements that indirectly grant access to a searched resource, with a View access graph link showing the full grant chain.
• Access review campaigns can now scope to groups and roles (not just users) via a new Grant types selector with Users only, Resources only, or Users and resources options.

Security Data Pipeline · 2026-07-25

Cribl LLM Observability adds Mistral AI support via OpenTelemetry instrumentation

• Supports instrumenting Mistral AI with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.

AI Coding Agents · 2026-07-25

Crush v0.87.0 adds MCP OAuth 2.1, Claude Channels MCP extension, and a system-wide config at /etc/crush/crush.json

• Adds OAuth 2.1 authorization support for HTTP and SSE MCP servers, unblocking MCPs that require authentication.
• Supports the Claude Channels MCP extension, allowing MCP servers to push real-time notifications into Crush.
• Supports system-wide configuration via /etc/crush/crush.json, improving NixOS and multi-user deployments.

AI/LLM Security · 2026-07-25

Daytona adds sandbox metrics visibility and configurable auto-pause intervals for sandboxes.

• Adds sandbox metrics to surface resource and usage data for running sandboxes.
• Supports configurable auto-pause intervals, letting users control how long a sandbox idles before pausing.

AI/LLM Security · 2026-07-25

Daytona SDKs gain WebSocket-based sandbox event subscriptions for real-time sandbox lifecycle updates.

• Adds WebSocket sandbox event subscription support to the Daytona SDKs, enabling real-time event-driven monitoring of sandbox state changes.

Reverse Engineering · 2026-07-25

Finite State adds match evidence to findings CSV exports, carry-forward component exclusions, and modernized Bamboo/Jenkins CI/CD plugins.

• Adds match evidence (file paths associated with each vulnerable component) to the findings CSV export, enabling precise remediation targeting.
• Carries component exclusions forward to newly scanned versions by default, reducing repeated manual configuration.
• Updates Bamboo and Jenkins CI/CD plugins to use the upgraded API, with the Jenkins plugin now published to the Jenkins Update Center.

Endpoint Security (EDR/XDR) · 2026-07-25

Iru adds Windows Auto App deployment for Access and token-based search on the activity page.

• New token-based search on the activity page for more precise, structured querying of activity data.

AI Coding Agents · 2026-07-25

Claude Opus 5 is now available in Kiro IDE, CLI, and Web with a 1M context window and improved agentic coding performance.

• Adds Claude Opus 5 to the Kiro IDE, CLI, and Web model selector with a 1M token context window.
• Supports Claude Opus 5 for multi-file features, large refactors, and end-to-end feature work with self-verification and iteration.
• Enables Claude Opus 5 multi-agent coordination with fewer conflicts between parallel agents.

AI Coding Agents · 2026-07-25

Adds configurable code-mode host fallback control and code-mode tool names in Responses Lite metadata.

• Adds disable_in_process_fallback option to features.code_mode_host config table, letting operators prevent silent fallback to embedded V8 when the standalone code-mode host fails to start.
• Adds code_mode_tool_names field to Responses Lite turn metadata, exposing normalized code-mode identifier-to-ToolName mappings for each turn.
• Scopes pending network approvals to a turn and execution, coalesces duplicate requests within one execution, and assigns unique per-execution identifiers to user approval requests and permission hooks.

AI Coding Agents · 2026-07-25

Codex CLI adds ent26 enterprise plan support, MCP proxy-aware auth discovery, ephemeral thread forks, and workspace plugin publish capability.

• Supports the ent26 enterprise plan tier, including authentication, rate-limit payloads, cloud-config eligibility, and usage-limit guidance.
• Routes MCP OAuth discovery and authentication status through each server's configured runtime HTTP client, enabling reliable auth for MCP servers behind proxies.
• Supports ephemeral forks of paginated threads via thread/fork with excludeTurns: true, preserving selected history and fork preview without creating a persistent rollout.

AI Coding Agents · 2026-07-25

Codex CLI adds Agent Plugins manifest support, background MCP prewarming, and paginated thread forks.

• Adds support for Agent Plugins 1.0 manifests: recognizes root plugin.json files and maps their metadata, skills/, and mcp.json into Codex plugin manifests.
• Applies Codex-specific apps, hooks, and interface settings from the inline com.openai extension in Agent Plugins manifests, with .codex-plugin/plugin.json as a fallback overlay.
• Adds background prewarming of MCP runtime updates so model steps are less likely to stall waiting for MCP rebuilds after config or auth changes.

AI Coding Agents · 2026-07-25

Pi 0.80.6 adds a new max thinking level above xhigh and request-wide input-token pricing tiers for long-context cost accounting.

• Adds max thinking level opt-in above xhigh, natively supported on GPT-5.6 and adaptive Claude models, available via --thinking max in CLI, SDK, RPC, and model selection; custom themes can define thinkingMax.
• Adds request-wide input-token pricing tiers for accurate long-context cost accounting (e.g. GPT-5.4/5.5/5.6 rates), configurable for custom models via models.json, modelOverrides, and extension-registered providers.
• Adds ~ (home directory) expansion support for the shellPath setting.

AI Coding Agents · 2026-07-25

Pi 0.80.7 adds cache-friendly dynamic tool loading, Ctrl+X message copy, Fable 5 extended thinking levels, and toolChoice support for OpenAI/Codex Responses.

• Adds cache-friendly dynamic tool loading: extensions can inject tools during execution on supported Anthropic and OpenAI Responses models without busting the prompt-cache prefix.
• New Ctrl+X shortcut copies the last assistant message, or the selected message in /tree, making branched and older messages directly copyable.
• Adds native xhigh and max thinking levels for Claude Fable 5 across all generated provider catalogs.

AI Coding Agents · 2026-07-25

Pi 0.80.8 adds unified ModelRuntime, live model catalog refresh, xAI device-code OAuth, and Grok 4.5 Responses support.

• Introduces ModelRuntime as the canonical async SDK facade, centralizing model configuration, provider authentication, and dynamic provider catalogs.
• Adds provider-owned /login discovery directly from registered pi-ai providers, including ambient auth status and informational links.
• Adds pi update --models command to force an immediate model catalog refresh without updating pi or extensions.

AI Coding Agents · 2026-07-25

Pi 0.80.9 adds Kimi K3 model support with deferred tool loading across multiple providers and updates the default xAI model to Grok 4.5.

• Adds Kimi K3 model support across built-in providers including Kimi Coding, Moonshot AI, Moonshot AI China, OpenRouter, and Vercel AI Gateway.
• Adds Kimi deferred tool loading for extension-driven progressive tool activation via Kimi's native protocol.
• Changes the default xAI model to Grok 4.5 and updates xAI login to use a prefilled device-authorization link labeled Sign in with SuperGrok or X Premium.

AI Coding Agents · 2026-07-25

Pi 0.81.0 adds local llama.cpp model management, full provider extensions, Qwen Token Plan support, and expanded usage accounting.

• Adds built-in llama.cpp router support with /login connection setup and /llama subcommand for Hugging Face model search, download, explicit load/unload, and live progress.
• Enables extensions to register complete pi-ai providers with native authentication, model refresh, filtering, and custom streaming behavior.
• Adds Qwen Token Plan and Qwen Token Plan China as built-in providers with regional endpoints and API-key authentication.

AI Coding Agents · 2026-07-25

Pi 0.81.1 adds verifiable, checksummed source archives to GitHub releases for reproducible standalone binary builds.

• Adds deterministic, checksummed source archives to GitHub releases with documented instructions for rebuilding standalone binaries.

AI Coding Agents · 2026-07-25

• Supports Kimi Code subscription OAuth login (device authorization + automatic token refresh) via /login for the Kimi For Coding provider.

AI Coding Agents · 2026-07-25

Pi 0.82.1 adds Claude Opus 5 with adaptive thinking, bearer auth for Anthropic-compatible gateways, and faster model catalog revalidation.

• Adds Claude Opus 5 support on Anthropic and Amazon Bedrock with adaptive thinking (including xhigh), inference profiles, and prompt caching.
• New ANTHROPIC_AUTH_TOKEN environment variable authenticates against Anthropic-compatible gateways requiring Authorization: Bearer, covering compaction and branch summaries.
• Pi.dev model catalogs now revalidate using If-None-Match, so unchanged providers return a 304 instead of a full download, reducing startup overhead.

AI Coding Agents · 2026-07-25

Pi 0.82.x adds Claude Opus 5, OpenRouter/Kimi sign-in, constrained tool sampling, and session-aware streaming bash integrations.

• Adds Claude Opus 5 support on Anthropic and Amazon Bedrock with adaptive thinking (including xhigh), inference profiles, and prompt caching.
• Adds ANTHROPIC_AUTH_TOKEN bearer auth for Anthropic-compatible gateways, enabling compaction and branch summaries against custom gateway endpoints.
• Adds /login OAuth flow for OpenRouter (PKCE) and Kimi Code subscriptions, eliminating manual API key configuration.

AI Coding Agents · 2026-07-25

Pi exposes session state (model, provider, reasoning level, session ID/file) to bash tool commands via PI_* environment variables.

• Adds PI_CODING_AGENT=true marker so child processes can detect they run inside Pi.
• Adds PI_CODING_AGENT_DIR and PI_CODING_AGENT_SESSION_DIR to override config and session storage directories.
• Adds PI_CACHE_RETENTION=long to enable extended provider prompt caching where supported.

AI Coding Agents · 2026-07-25

Pi 0.82.1 adds Claude Opus 5 support, bearer auth for Anthropic-compatible gateways, and faster model catalog revalidation.

• Adds Claude Opus 5 support on Anthropic and Amazon Bedrock with adaptive thinking (including extended thinking), inference profiles, and prompt caching.
• New ANTHROPIC_AUTH_TOKEN environment variable authenticates against Anthropic-compatible gateways requiring Authorization: Bearer, covering compaction and branch summaries.
• Model catalog refreshes now use If-None-Match HTTP conditional requests so unchanged provider catalogs return a 304 instead of a full re-download, reducing overhead.

AI Coding Agents · 2026-07-25

Pi v0.82.1 adds Claude Opus 5 support, bearer auth for Anthropic-compatible gateways, and faster model catalog revalidation.

• Adds Claude Opus 5 model support on Anthropic and Amazon Bedrock, including adaptive thinking (with xhigh level), inference profiles, and prompt caching.
• Adds ANTHROPIC_AUTH_TOKEN bearer authentication for Anthropic-compatible gateways that require Authorization: Bearer headers, covering compaction and branch summaries.
• Speeds up pi.dev model catalog refreshes with If-None-Match conditional requests, so unchanged provider catalogs return a 304 instead of a full download.

Secure Access (VPN / SASE / ZTNA) · 2026-07-25

ShareFile Request Lists now support comments for collaborator communication.

• Adds the ability to leave comments on Request List items to facilitate in-context communication with collaborators.

Secure Access (VPN / SASE / ZTNA) · 2026-07-25

ShareFile Request Lists now support inline comments for collaborator communication.

• Adds the ability to leave comments on Request List items, enabling collaborators to communicate directly within a file request.

Attack Surface & Exposure Management · 2026-07-25

ProjectDiscovery Cloud adds Internal Network Scanning to expose reachable internal assets the way an attacker inside the network would.

• New Internal Network Scanning capability scans assets from inside the network to surface reachable exposures that external scanners miss.

Identity & Access Management · 2026-07-25

SailPoint ISC gets a centered navigation bar for admins, end users, and Data Access Security.

• Moves the Admin tab and its megamenu to the top center of the screen for a symmetrical, at-a-glance view of all menu and submenu items.
• Relocates the + Add/Create quick-access button to the center of the main menu bar, making it reachable from anywhere on the page.
• Centers core navigation items (home icon, primary product tabs) in the header for end users to reduce eye and mouse fatigue.

Identity & Access Management · 2026-07-25

SailPoint ISC adds custom Forms for Access Request, collecting contextual data from requesters before submission.

• Enables admins to define custom forms and attach them to Roles, Access Profiles, or Entitlements, prompting requesters for supplementary data before submitting an access request.
• Passes submitted form data to approvers as name-value pairs, giving decision-makers full context at approval time.
• Makes form data accessible throughout the request flow, including before-provisioning rules, enabling custom provisioning logic driven by requester-supplied data.

Detection Engineering · 2026-07-25

Tenzir v6.8.1 adds GMT/UTC/UT timezone parsing support and warnings for unparsable timestamps in time()

• Supports zero-offset timezone names (GMT, UTC, UT) in timestamp parsing, enabling out-of-the-box handling of web server and mail log timestamps.
• Adds automatic type detection for GMT/UTC/UT-suffixed values (e.g., in CSV files), promoting them from strings to timestamps.
• The time() function now emits a warning with the offending value when a string cannot be parsed, instead of silently returning null.

SOAR · 2026-07-25

Tines AI Agent actions and Workbench can now search the web, powered by Parallel.ai.

• Adds web search capability to AI Agent actions, Workbench, Workbench for Storyboard, and the App editor, powered by Parallel.ai.

Secrets Detection & Management · 2026-07-25

TruffleHog v3.96.0 adds HashiCorp Vault token, Duo API Secret Key, and SonarQube Cloud scoped token detectors plus updated Cloudflare credential format support.

• Adds HashiCorp Vault token detector supporting service tokens, periodic tokens, and legacy tokens with live verification against Vault's auth/token/lookup-self endpoint.
• Adds Duo API Secret Key detector for scanning Duo credentials.
• Adds SonarQube Cloud Scoped Organization Token detector.

Attack Surface & Exposure Management · 2026-07-24

Axonius Users page gains a Preferred Last Seen field showing the most recent last_seen timestamp across all adapters.

• Adds Preferred Last Seen aggregated date field on the Users page, surfacing the most recent last_seen timestamp across all adapters for a given user.

Post-Exploitation · 2026-07-24

BloodHound Enterprise gains a native Jira Cloud integration to sync Attack Path findings directly into Jira issues for remediation tracking.

• New Jira Cloud app (built on Atlassian Forge) automatically synchronizes BloodHound Enterprise Attack Path findings to Jira Software and Jira Service Management issues.
• Maps BloodHound Enterprise zones to Jira priorities and sets due dates based on finding priority.
• Filters synchronization by BloodHound Enterprise domains and zones.

Post-Exploitation · 2026-07-24

BloodHound Enterprise adds native Jira integration for attack path remediation ticketing

• Integrates BloodHound Enterprise with Jira to create and track remediation tickets directly from attack path findings.

Vulnerability Management · 2026-07-24

Brinqa v12 introduces AI Agents for natural-language querying, CVE exploration, and autonomous ownership attribution.

• Adds a user-facing chat agent with three tools: natural-language BQL query generation, documentation Q&A, and CVE exploration.
• Adds an Attribution Agent that autonomously infers Remediation Owner, Business Owner, and Application Owner attributes and contributes them to the attribute consolidation hierarchy.

Vulnerability Management · 2026-07-24

BrinqaIQ adds MCP integration so AI clients like Claude Desktop, GitHub Copilot, and Goose can query Brinqa data, generate BQL, and manage automations.

• New MCP server integration exposes BrinqaIQ capabilities — BQL generation, BQL execution, CVE exploration, docs search, and automation lifecycle management — to any MCP-compatible AI client.
• Supports natural-language BQL query generation and direct BQL execution with paginated results for feeding Brinqa data into external agent pipelines.
• Automation lifecycle control (launch, resume, cancel, status check) and flows/automations discovery (list, inspect by name or ID, list running flows) available through MCP-connected clients.

Vulnerability Management · 2026-07-24

Brinqa launches a new BQL API replacing the legacy GraphQL API, enabling programmatic access to the data warehouse via async queries.

• New BQL API (POST /v1/api/bql) replaces the legacy GraphQL API, providing programmatic access to the Brinqa data warehouse using the same query engine as the UI.
• Supports asynchronous two-step query workflow: submit a query and receive a polling Location URL, then GET results with automatic Retry-After guidance.
• Introduces two query modes — Analytics mode (full BQL with RETURN/ORDER BY/LIMIT in-query, returning flattened rows) and Projection mode (returningFields/orderBy/limit parameters, returning nested relationship objects).

Vulnerability Management · 2026-07-24

Brinqa adds IONIX connector supporting Action Items, Cloud Assets, Domains, IP Addresses, and more.

• New IONIX connector ingests Action Item, Action Item Definition, Cloud Asset, Domain, IP Address, Managed Domain, and Sub Domain data into the Brinqa graph.

Password & Credential Cracking · 2026-07-24

bruteforce-salted-openssl 1.4.1 adds an option to ignore the salt during brute-force attacks.

• Adds an option to ignore the salt when brute-forcing OpenSSL-encrypted files.

Integrated & IT Risk Management · 2026-07-24

CISO Assistant gains a native Power BI connector for direct BI integration.

• New native Power BI connector enables direct integration between CISO Assistant and Power BI for security reporting and dashboards.

Identity & Access Management · 2026-07-24

Clerk CLI gains a clerk mcp command group for one-command MCP server registration across 10 AI clients, plus configurable default OAuth scopes.

• Adds clerk mcp install command that detects supported AI clients (Claude Code, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Codex, opencode, OpenClaw, Warp, Hermes Agent) and registers the Clerk MCP server in each, user-globally, in a single interactive step.
• Adds --client and --all flags to clerk mcp install for non-interactive, scripted registration targeting specific or all supported clients.
• Adds clerk mcp run, a built-in stdio↔Streamable-HTTP bridge that replaces the npx mcp-remote dependency; updating the CLI updates the bridge everywhere with no re-install.

AI Coding Agents · 2026-07-24

Cline desktop v0.0.4 adds workspace-free chat, file drag-and-drop, one-time routines, and agentic compaction by default.

• Supports chat sessions without opening a project folder (workspace-free mode).
• Drag and drop files directly onto the chat to attach them.
• Image attachments display inline in the chat transcript.

SAST / SCA / Code Security · 2026-07-24

Cloudsmith CLI v1.19.0 adds automatic OIDC credential discovery for CI/CD and a Docker credential helper for registry auth.

• Automatically discovers OpenID Connect (OIDC) credentials for all major CI/CD platforms, eliminating the need for static API keys in pipelines.
• New Docker credential helper automatically authenticates to Cloudsmith registries without manual docker login steps.

Identity & Access Management · 2026-07-24

ConductorOne campaigns can now review access grants held by groups and roles, not just users.

• Adds a Grant type attribute to campaigns and campaign templates, enabling access reviews scoped to users only, resources only (groups/roles), or both users and resources.

Identity & Access Management · 2026-07-24

ConductorOne MCP servers now support JWT Bearer (RFC 7523) authentication.

• Adds JWT Bearer (RFC 7523) authentication support for MCP server connections.

Identity & Access Management · 2026-07-24

ConductorOne adds MCP client support and controls to disable MCP traffic and system features

• Supports MCP (Model Context Protocol) clients for AI access management integration.
• Adds admin controls to disable MCP traffic.
• Adds admin controls to disable system features.

Identity & Access Management · 2026-07-24

ConductorOne AI assistant now accessible via Slack DMs in addition to the web app

• Enables interaction with the C1 AI assistant directly via Slack DMs once the C1 app for Slack is installed.
• Documents the C1 MCP integration as a programmatic path for external AI clients (such as Claude Desktop or Cursor) to query C1 identity data.

Endpoint Security (EDR/XDR) · 2026-07-24

Corellium 7.12 adds Metal graphics support, MCP AI integration, Android KASAN/HWASAN debugging, PongoOS pre-boot, and folder downloads.

• Adds initial Apple Metal graphics framework support via software-based implementation, enabling Flutter-based iOS apps that previously failed to launch or render in virtualized environments.
• Introduces Model Context Protocol (MCP) Server integration, allowing AI-powered tools and autonomous agents to interact directly with Corellium environments through a standardized interface.
• Adds Android Kernel Address Sanitizer (KASAN) and Hardware-Assisted Address Sanitizer (HWASAN) kernel debugging support for identifying memory corruption, use-after-free, and buffer overflow issues.

Endpoint Security (EDR/XDR) · 2026-07-24

Corellium 7.12 adds Metal graphics support, KASAN/HWASAN kernel debugging, PongoOS pre-boot, MCP Server integration, and folder downloads.

• Adds initial Apple Metal graphics support via a software-based implementation targeting Flutter applications, enabling apps that previously failed to launch or render in virtualized iOS environments.
• Adds Android KASAN/HWASAN kernel debugging support, giving security researchers visibility into memory corruption, use-after-free, and buffer overflow issues at the kernel level.
• Enables pre-boot of supported Apple devices directly into PongoOS before iOS loads, streamlining jailbreak research and low-level boot customization workflows.

Runtime Security · 2026-07-24

CubeSandbox v0.6.0 adds Kubernetes deployment, E2B-compatible volumes, template aliases, configurable Host headers, and node isolation.

• Deploy CubeSandbox control-plane and compute nodes on TKE, standard Kubernetes, or k3s via Helm Chart, with support for rolling upgrades and canary releases.
• New E2B-compatible Volume framework lets operators plug in custom backend storage via Binary or RPC plugins, with Create/Destroy/Attach/Detach lifecycle hooks and sandbox–Volume binding APIs.
• Template aliases can be set at creation time, allowing sandboxes to be launched by alias name instead of template ID.

General Utilities & Libraries · 2026-07-24

curl 8.22.0 extends --xattr Windows support, writing Zone.Identifier Alternate Data Streams with HostUrl and ReferrerUrl.

• Supports --xattr on Windows, creating an NTFS Alternate Data Stream named Zone.Identifier containing a ZoneTransfer INI section with HostUrl and ReferrerUrl fields.

Detection Engineering · 2026-07-24

Elastic Detection Rules dev-v2.0.0 adds MITRE ATT&CK v19 support and 80+ new rules across AWS, Azure, Linux, GCP, and network protocols.

• Adds MITRE ATT&CK v19 threat mapping support, automatically applied on Elastic Stack >= 9.5 with dynamic tag assignment.
• New AWS rules: CloudTrail management event disabling, GuardDuty suppression detection, IAM console login without MFA, IAM user login from multiple geolocations, account closure, org-leave attempts, Cognito unauthenticated identity pool credential issuance, Bedrock AgentCore execution role misuse, Bedrock prompt/completion credential detection, ECR public access grants, SageMaker suspicious lifecycle config, Lambda cross-account invocation, Lambda high-frequency invocation, Lambda event source mapping creation, Lambda layer external sharing, Lambda function URL public access, Lambda deletion, Lambda policy cross-account update, Backup vault deletion/lock removal, Backup recovery point deletion, KMS imported key material deletion, IAM inline policy added to group, IAM permissions boundary modification, IAM login profile creation/modification, and IAM account password policy deletion.
• New Azure/Entra ID rules: AKS API server proxying requests to Kubelet, ROPC authentication with unknown client ID, VM extension installation and suspicious child process via CustomScript, VM configuration modification, VM Managed Run Command with unusual principal, VM Extension CRUD from unusual ASN, VM Boot Diagnostics retrieval, Serial Console connect with unusual user/ASN, Azure AD Graph access with unusual user/ASN, unusual client/user, suspicious user-agent, and 4xx error surge, Azure AD Graph potential enumeration via ROADrecon, Entra ID AiTM phishing-kit chain, device registration with phishing-kit default OS build, conditional access MFA bypass via Microsoft Graph, multiple device registrations by single user, impossible travel sign-in, ROPC auth/legacy client detection, OAuth device code sign-in to Azure AD Graph enumeration, OAuth device code phishing, TAP creation, guest-to-member promotion, and OAuth redirect URI abuse.

Identity & Access Management · 2026-07-24

Didit adds phone and email OTP verification APIs with intelligence reporting, risk actions, and sandbox support

• New POST /v3/phone/verify/ endpoint verifies OTPs and returns phone intelligence: carrier name, line type, VoIP/disposable flags, and duplicate usage across sessions.
• New POST /v3/email/verify/ endpoint verifies OTPs and returns email intelligence: deliverability status, breach exposure (is_breached + breaches list), disposable-provider detection, and duplicate usage across sessions.
• Configurable risk actions (duplicated_phone_number_action, disposable_number_action, voip_number_action for phone; duplicated_email_action, breached_email_action, disposable_email_action for email) let you set DECLINE or NO_ACTION per risk type to control whether a detected risk terminates or merely flags a verification.

Web Application Security · 2026-07-24

dirsearch v0.4.3 adds SQLite reports, progress save/resume, client cert support, and built-in web crawler.

• Automatically detects HTTP or HTTPS URI scheme when no scheme is provided in the target URL.
• Adds SQLite as a new report output format.
• New option to overwrite unwanted extensions with a selected set of extensions.

Secure Access (VPN / SASE / ZTNA) · 2026-07-24

DNSFilter redesigns the Query Log with multi-select filters, cross-org switching, and URL-persistent views, plus live local domain sync in the macOS client.

• Redesigned DNS Query Log with a top-level filter bar supporting multi-select across Sites, Roaming Clients, Relays, and Users.
• MSP admins can now toggle between organizations directly from the Query Log without losing active filters, enabling faster cross-org investigation.
• Introduced a custom timeline picker in the Query Log to narrow search windows down to the second.

Runtime Security · 2026-07-24

Docker Sandboxes org admins can now add a custom support message shown when governance policies block sandbox actions.

• Adds configurable support message (up to 500 characters) displayed to members when a sandbox action is blocked by organization governance policy, enabling admins to direct users to internal support channels or security contacts.

Runtime Security · 2026-07-24

Docker Sandboxes 0.37.0+ adds ChatGPT desktop app integration via SSH, letting Codex run inside an isolated sandbox instead of on the host.

• Supports connecting the ChatGPT desktop app to a Docker Sandbox over SSH so OpenAI Codex executes inside the isolated environment rather than on the host machine.
• Adds a Codex sandbox template that pre-installs the codex command required by the ChatGPT app's remote server.

Runtime Security · 2026-07-24

Docker Sandboxes now supports connecting Claude Desktop to a remote sandbox over SSH for isolated AI agent execution.

• Enables Claude Desktop to run Claude Code inside a Docker Sandbox over SSH, keeping agent activity isolated from the host machine.
• Adds SSH connection workflow in Claude Desktop: select a named sandbox as the remote environment via the environment drop-down and SSH Host field.
• Provides Windows-specific troubleshooting guidance for SSH connection timeouts caused by missing sh.exe (Git for Windows dependency).

Runtime Security · 2026-07-24

Docker Sandboxes now supports Cursor as a Remote-SSH editor, running files and terminals inside isolated sandboxes.

• Connects the Cursor editor to a Docker Sandbox over Remote-SSH, keeping the editor on the host while files, terminals, and extensions run inside the isolated sandbox.

Runtime Security · 2026-07-24

Docker Sandboxes 0.37.0 adds VS Code Remote-SSH integration to develop directly inside isolated sandboxes.

• Supports connecting VS Code to a running sandbox via the Remote-SSH extension, so files, terminals, and extensions run inside the isolated environment while the editor stays on the host.

Runtime Security · 2026-07-24

Docker Sandboxes adds SSH access so VS Code, Cursor, Claude Desktop, and ChatGPT can connect to running sandboxes as remote hosts.

• New sbx setup ssh command configures SSH access to sandboxes, writing a managed block to ~/.ssh/config so any SSH-capable editor or app can connect.
• Sandboxes are now reachable as SSH hosts via <name>.sbx naming, enabling remote development from VS Code, Cursor, Claude Desktop, ChatGPT, and any other SSH-over-remote tool.
• SSH connections route through the daemon's local socket (Unix domain socket on macOS/Linux, named pipe on Windows) — no open network port or stored SSH key required.

Runtime Security · 2026-07-24

Docker Sandboxes adds shared agent skills import, letting Claude Code, Codex, Copilot, Cursor, and Droid skills persist across sandboxes.

• Adds sbx skills import command to copy agent skills (Claude Code, Codex, Copilot, Cursor, Droid) from host into a persistent shared store mounted into new sandboxes automatically.
• Adds --dry-run flag to sbx skills import to preview which skills would be copied without committing them to the store.
• Adds --no-share-skills flag to sbx run to create a sandbox that opts out of the shared skills store, keeping it outside the shared trust boundary.

Runtime Security · 2026-07-24

Docker Sandboxes now support SSH-based connections from editors like VS Code and Cursor.

• Enables connecting VS Code, Cursor, and other editors/apps to a Docker Sandbox over SSH.

Runtime Security · 2026-07-24

Docker Sandboxes now support SSH connections from editors like VS Code and Cursor.

• Enables connecting editors and apps such as VS Code and Cursor to a Docker Sandbox over SSH.

Runtime Security · 2026-07-24

Docker Sandboxes now support SSH-based connections from editors like VS Code and Cursor.

• Supports connecting VS Code and Cursor editors to a Docker Sandbox over SSH.

Runtime Security · 2026-07-24

Docker Sandboxes v0.37.0 adds SSH access to sandboxes, shared agent skills, port publishing, and richer audit records.

• Adds SSH access to sandboxes (experimental): run sbx setup ssh once to register a managed *.sbx SSH config entry, then connect to any sandbox with ssh <name>.sbx from OpenSSH clients or remote-dev tools like VS Code and Cursor.
• Adds sbx skills import to discover and import host agent skills into a persistent store shared across sandboxes, with --dry-run to preview and --force to overwrite existing skills.
• New --no-share-skills flag on sbx run / sbx create lets individual sandboxes opt out of the shared skills store.

SIEM · 2026-07-24

Exabeam Outcomes Navigator adds support for the OWASP Top 10 for Agentic Applications framework.

• Supports the OWASP Top 10 for Agentic Applications framework, enabling practitioners to view, assess, and improve security configurations against agentic AI risks.

Secure Access (VPN / SASE / ZTNA) · 2026-07-24

Firezone introduces single-owner Gateway tokens with rotation, revocation, and REST API management.

• Adds single-owner Gateway tokens: each token is bound to exactly one Gateway, replacing the legacy multi-owner token shared across all Gateways in a Site.
• Supports token rotation via the admin portal or REST API with a 4-hour grace period, keeping the current Gateway connected until it picks up the replacement.
• Adds an upgrade path from legacy multi-owner tokens to single-owner tokens on a per-Gateway basis, with legacy tokens remaining active until explicitly revoked.

Secrets Detection & Management · 2026-07-24

GitGuardian Self-Hosted 2026.7 adds Public Monitoring, native Gerrit scanning, Smart Notifiers, Gateway API routing, and 9 new secret detectors.

• Adds Public Monitoring on self-hosted instances (license-gated): monitor your public perimeter for secret leaks and route public incidents through custom webhooks, Slack, Microsoft Teams, ServiceNow ticketing, and severity-filtered email alerts via the new celeryWorkers.public-monitoring worker.
• Adds native Gerrit VCS source with full historical scanning, real-time detection via webhook plugin, and read-replica support for cloning.
• Adds Smart Notifiers: define per-channel rules to filter alerts, tickets, and emails by severity, validity, secret type, or GitGuardian tag across internal and public monitoring.

SIEM · 2026-07-24

Google Unified Security adds Chrome Enterprise threat detection, multi-cloud CDIR, and AI Protection for securing AI workloads.

• Adds Chrome Enterprise Premium integration with curated detections enriched by Safe Browsing and Google Threat Intelligence (GTI) to surface browser-based threats in Google SecOps.
• Adds dedicated Google SecOps dashboards for Chrome security events and anomalies to improve analyst visibility into browser activity.
• Enables automated SOAR playbook response actions on Chrome Enterprise — including blocking malicious URLs, blocking extensions, and quarantining devices — directly from Google SecOps.

AI Coding Agents · 2026-07-24

Goose adds rp-why skill: an AI collaboration coach that scores your tool sophistication and prompt depth.

• New rp-why skill analyzes conversation history to score sessions on Gas Town Stage (tool sophistication, stages 1–8) and DOK Level (prompt cognitive depth, levels 1–4).
• New /rp-why init command establishes a personal baseline by analyzing available conversation history (~30 seconds).
• New /rp-why current command shows how the active session compares to your typical usage patterns.

AI Coding Agents · 2026-07-24

Goose v1.44.0 adds new model support (GPT-5.6, Gemini, Muse Spark 1.1), new providers, --edit session flag, per-message usage stats, and OllamaCloud integration.

• Adds support for latest Gemini models.
• Adds Muse Spark 1.1 support via the Meta Models API.
• Adds MiniMax-M3 and missing M2.7 model variants.

SAST / SCA / Code Security · 2026-07-24

graudit gains JWT rules, SVN repo scanning, commit-log vuln checks, and expanded rulesets across 8+ languages

• Adds JWT detection ruleset for identifying JWT-related vulnerabilities in source code.
• Enables scanning of SVN repositories by checking out and running rules against them.
• Supports running rules on every commit in a git repository's history.

SAST / SCA / Code Security · 2026-07-24

graudit 3.9 adds JWT and Docker rule sets plus four new misc helper scripts for git, SVN, and serial enumeration.

• Adds giterate misc script for iterating over git repositories.
• Adds snumerate misc script for serial/sequential enumeration tasks.
• Adds svnlog misc script for working with SVN log output.

SAST / SCA / Code Security · 2026-07-24

graudit 4.0 adds seventaint.sh PHP taint-flow tracker, 3rd-party JS ruleset, and expanded exec/suppression signatures.

• Adds seventaint.sh misc script that performs iterative (up to 7-hop) PHP taint-flow analysis from user-supplied sources ($_GET, $_POST, etc.) to dangerous sinks (exec, eval, mysqli_query, etc.).
• Adds 3partyjs.db signature database for detecting third-party JavaScript inclusion patterns (dynamic script/iframe creation, external URL references, eval with concatenation, keyboard event listeners).
• Expands exec.db with cross-language OS-command-execution patterns covering Python (subprocess, Popen, getoutput, execfile), Ruby (instance_eval, module_eval, class_eval, trycmd), and generic fork, openpty, Pipe, and spawn calls.

SAST / SCA / Code Security · 2026-07-24

graudit gains new detection rules for AMPscript injection, 3rd-party JS dynamic eval, seventaint.sh script, and expanded coverage across Python, Ruby, PHP, and more

• Adds AMPscript injection detection rules.
• Adds rules for detecting dynamic evaluation of 3rd-party JavaScript scripts.
• Adds seventaint.sh helper script to the misc collection.

Identity & Access Management · 2026-07-24

• Supports shared identity verification across companies in KYB (Know Your Business) workflows.

Data Security & DLP · 2026-07-24

• Adds separate request forms for data products: one for data access requests and one for masking exception requests, each with independent questions and data use agreements.
• Expands Snowflake manual policy resync to cover both data policies and subscription policies simultaneously.
• Adds automated sensitive data discovery (regex, dictionary, and column-name identifiers) for the Amazon Redshift viewless integration.

AI Coding Agents · 2026-07-24

Kiro V3 adds /upgrade-agent command to migrate V2 custom agent configs to the universal format

• New /upgrade-agent command migrates V2 custom agent configuration files to the universal format compatible with both V2 and V3 modes.
• Automatic retries for interrupted model responses, reducing manual intervention during long agent sessions.

General Utilities & Libraries · 2026-07-24

Helm now supports SOURCE_DATE_EPOCH for reproducible chart archives across builds and machines.

• Supports the SOURCE_DATE_EPOCH environment variable to produce byte-identical chart archives across builds by stamping all archive file modification times with a fixed Unix timestamp.
• Stamps the generated: timestamp in Chart.lock with SOURCE_DATE_EPOCH, making dependency-declaring charts fully reproducible across machines.
• Extends SOURCE_DATE_EPOCH support to helm install, helm dependency build, and helm dependency update when re-archiving dependencies from local file:// repositories.

Reconnaissance & OSINT · 2026-07-24

Maigret adds QQ and Bilibili numeric ID lookup via --id-type, extracting profile metadata from each platform's API.

• Adds qq_id identifier type to look up QQ/Qzone accounts by numeric ID, extracting nickname and avatar via the Qzone portrait API.
• Adds bilibili_id identifier type to look up Bilibili accounts by mid, extracting nickname, avatar, signature, and follower count via the Bilibili user-card API.

Reconnaissance & OSINT · 2026-07-24

Maigret adds QQ and Bilibili numeric ID lookup via --id-type for targeted OSINT on Chinese platforms.

• Adds qq_id identifier type to look up QQ (Tencent) accounts by numeric ID via the Qzone portrait API, extracting nickname and avatar.
• Adds bilibili_id identifier type to look up Bilibili users by numeric mid via the Bilibili user-card API, extracting nickname, avatar, signature, and follower count.

Reconnaissance & OSINT · 2026-07-24

Maigret now supports filtering site searches by identifier type, including Steam, VK, ORCID, QQ, Bilibili, and more.

• Adds identifier-type filtering so searches automatically exclude sites whose ID format doesn't match the supplied identifier; supported types include gaia_id, steam_id, vk_id, yandex_public_id, ok_id, wikimapia_uid, uidme_uguid, yelp_userid, orcid, qq_id, and bilibili_id.

Secure Access (VPN / SASE / ZTNA) · 2026-07-24

Nebula v1.11.0 adds macOS network-change rebinding, IPv6 rejects, stdin/stdout cert I/O, and six breaking config changes.

• Adds automatic listener rebind and lighthouse re-query on macOS when the underlay network changes (wifi↔wired), controlled by listen.rebind_on_network_change (default true).
• Generates IPv6 reject packets for blocked traffic, matching existing IPv4 reject behavior.
• Accepts - as a path in nebula-cert subcommands to read from stdin or write to stdout.

Local LLM Runtimes · 2026-07-24

Ollama v0.32.3 adds CUDA on Windows ARM64, B200/CUDA 12 support, Laguna 2.1 model capabilities, and lower iGPU memory use.

• Adds CUDA support on Windows ARM64 devices.
• Adds NVIDIA B200 GPU support via CUDA 12.
• Reduces memory usage on Linux CUDA and ROCm integrated GPUs.

Identity & Access Management · 2026-07-24

Omada Identity Cloud Application Gateway now supports deployment on Linux in addition to Windows.

• Supports deploying the Cloud Application Gateway on Linux platforms alongside the existing Windows support.

AI Coding Agents · 2026-07-24

Codex CLI alpha.6 adds remote code-mode host support, nonblocking TUI interrupts, and skill-catalog context warnings.

• Adds --code-mode-host flag to the app-server to connect to a remote code-mode host over WebSocket (wss://).
• Supports WebSocket transport for the code-mode host in the app-server, enabling remote code-mode sessions.
• Exposes remote skill icon URLs through the app server.

AI Coding Agents · 2026-07-24

Custom model providers can now opt into standalone web search via a new supports_standalone_web_search setting.

• Adds supports_standalone_web_search model-provider setting that lets custom Responses API providers opt into the standalone web.run web search tool.
• Routes standalone web search requests through the custom provider's own endpoint and authentication when the setting is enabled.

AI Coding Agents · 2026-07-24

Codex CLI alpha.5 adds thread pinning, MCP tool prefix omission, custom provider web search, and MCP connection reuse.

• Adds isPinned field to thread responses with pin/unpin support via thread/metadata/update and an isPinned filter on thread/list, enabling persistent thread pinning with cursor-based pagination.
• Allows omitting MCP tool name prefixes on a per-server basis, reducing verbosity when working with trusted MCP servers.
• Allows custom providers to opt into standalone web search, extending web-search capability beyond first-party models.

SAST / SCA / Code Security · 2026-07-24

Openlayer CLI gains data-sources, profile, projects, tests, and update commands; adds tabular ML prediction publishing.

• New data-sources CLI command to manage Openlayer data sources directly from the terminal.
• New profile CLI command to manage authentication profiles for the Openlayer CLI.
• New projects CLI command to manage Openlayer projects from the CLI.

General Utilities & Libraries · 2026-07-24

OpenSSL adds three new ASN1_STRING API functions for length and data manipulation.

• Adds ASN1_STRING_length_ex, ASN1_STRING_set_data, and ASN1_STRING_set_string library functions for finer-grained ASN.1 string handling.

Firewalls & Network Defense · 2026-07-24

AI Runtime Security adds tool chaining attack detection in agent scans, Azure SLR support, and updated vCPU capacity.

• Adds Tool Chaining Attack detection capability within Agent Scans for AI runtime security.
• Adds Security Lifecycle Review (SLR) support for Azure environments.
• Updates vCPU support limits for AI Runtime Security deployments.

AI Coding Agents · 2026-07-24

Pi's createBashTool() now injects session context (model, provider, reasoning level) into bash commands via environment variables.

• Adds ctx.modelRegistry, ctx.model, and ctx.thinkingLevel to expose the active model and its current effective thinking level in extension contexts.
• Injects session environment variables (PI_SESSION_ID, PI_SESSION_FILE, PI_PROVIDER, PI_MODEL, PI_REASONING_LEVEL) into bash tool commands before hook execution, giving scripts access to live session state.
• Adds exposeSessionEnvironment: false option to createBashTool() to opt out of automatic session variable injection.

AI Coding Agents · 2026-07-24

Pi 0.82.0 adds constrained tool sampling, OpenRouter/Kimi OAuth sign-in, and session-aware streaming bash integrations.

• Adds Tool.constrainedSampling to let tools prefer or require strict JSON Schema sampling, or use OpenAI Lark/regex grammars, across OpenAI, Anthropic, Amazon Bedrock, Google Gemini, and Mistral.
• Adds supportsGrammarTools, supportsStrictTools, and expanded supportsStrictMode compatibility flags plus generated model capability metadata to gate constrained sampling requests.
• Adds OAuth PKCE sign-in for OpenRouter, minting a user-controlled API key without manual configuration.

AI Coding Agents · 2026-07-24

Pi v0.82.0 adds constrained tool sampling, OAuth login for OpenRouter/Kimi Code, and streaming bash RPC events.

• Adds Tool.constrainedSampling supporting strict JSON Schema (prefer/require) and OpenAI Lark/regex grammar variants across OpenAI, Anthropic, Amazon Bedrock, Google Gemini, and Mistral providers.
• Adds model capability flags supportsGrammarTools and supportsStrictTools to gate constrained sampling requests to models that support them.
• Adds OAuth PKCE login for OpenRouter via /login, automatically minting a user-controlled API key without manual configuration.

Identity & Access Management · 2026-07-24

Ping Identity AIC adds email scripting, secrets in nodes, Rich Authorization Requests, SAML metadata import options, and a new validate-secrets endpoint.

• Adds emailService binding for next-generation scripts, enabling email delivery directly from journey scripts.
• New realm-level OAuth2 Provider setting enables Rich Authorization Requests (RFC 9396) processing when an RCS is configured, and controls advertisement of authorization_details_types_supported on the well-known endpoint.
• Individual OAuth 2.0 clients can now be configured with Authorization Detail Type(s) to restrict which authorization detail types each client may request.

SAST / SCA / Code Security · 2026-07-24

Portkey adds Prisma AIRS agentic scan controls, soft-deny guardrails, provider-backed model listing, and Continue.dev integration

• Adds scan_scope and strip_scaffolding parameters to the Palo Alto Networks Prisma AIRS guardrail, enabling fine-grained control over which messages are scanned and reducing false positives for agentic clients like Claude Code, Cursor, and Cline.
• Adds soft_deny_200 flag on guardrail checks: denials return HTTP 200 with the error as a chat completion response instead of HTTP 446, keeping sessions alive for clients that treat 4xx as fatal.
• GET /v1/models now routes through the gateway's provider-backed model listing handler, calling the upstream provider and returning a normalized model list with response transforms applied.

SAST / SCA / Code Security · 2026-07-24

Portkey adds MCP Server management, SCIM workspace mappings, rate/usage limit policies, and expanded Admin APIs for guardrails, models, and prompts.

• New Admin API endpoints to create, list, and test MCP Server connections for workspace instances.
• New Admin API endpoints to manage SCIM group-to-workspace mappings (create, list, delete) for enterprise identity provisioning.
• New Admin API endpoints to create and list Rate Limits Policies and Usage Limits Policies, with entity tracking for usage limits.

SAST / SCA / Code Security · 2026-07-24

Portkey adds vault-backed Secret References, weekly rate limits, cross-cloud GCS log delivery, and four new guardrail integrations.

• Adds Secret References so virtual keys and integrations can pull credentials at runtime from AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault via secret_mappings, keeping secrets out of Portkey config.
• Supports weekly budget and usage windows (rpw) for rate-limit policies so spend caps align with weekly planning cycles.
• Adds endpoint-scoped rate limits so chat completions, embeddings, and admin routes can each carry independent limits instead of a single global cap.

SAST / SCA / Code Security · 2026-07-24

• Adds xAI Voice provider overrides: apiBaseUrl, websocketUrl, and function call support.
• Adds test-level prompts filter, providers filter, and per-test structured output configuration at the individual test case level.
• Adds --share and --no-share flags to Model Audit for controlling cloud sharing.

Cloud Security Posture · 2026-07-24

Prowler adds Claude Code integration via MCP Server and a Prowler Plugin with guided cloud compliance workflows.

• New Prowler MCP Server at https://mcp.prowler.com/mcp enables Claude Code to query findings, onboard accounts, and explore checks directly from the CLI.
• New Prowler Plugin for Claude Code bundles official skills, including prowler:framework-compliance-triage for end-to-end compliance remediation against frameworks like CIS, PCI-DSS, and Prowler ThreatScore.
• Compliance triage skill supports two modes: Claude-assisted (step-by-step approval) and Claude autonomous (single up-front plan with one confirmation), tracking progress in a markdown report under .prowler/.

Cloud Security Posture · 2026-07-24

Prowler adds an MCP Server for AI agent integration and launches a dedicated MSP/MSSP multi-tenant offering.

• New Prowler MCP Server enables AI agents (Claude, Cursor, VS Code/GitHub Copilot, Codex/ChatGPT Desktop) to connect directly to Prowler Cloud for security query workflows.
• New Prowler for MSPs and MSSPs tier adds partner organization management, customer tenant onboarding, custom branding, and billing plan controls.

Cloud Security Posture · 2026-07-24

Prowler 5.36.0 adds SageMaker secrets detection, grouped Jira dispatch, cleaner Attack Paths UI, and regionless OCI onboarding.

• New sagemaker_notebook_instance_no_secrets check scans SageMaker notebook instance OnCreate and OnStart lifecycle scripts for hardcoded API keys, passwords, tokens, and connection strings.
• Grouped Jira workflows (Prowler Cloud/Private Cloud): send selected findings or Finding Groups to Jira as one grouped issue or separate issues, with deep links and filter context preserved.
• Attack Paths query selector now hides confirmed-empty queries for the selected scan, surfacing only paths that returned data; full catalog published on Prowler Hub.

Attack Surface & Exposure Management · 2026-07-24

runZero now displays Purdue levels for assets sourced or enriched from Dragos integration

• Displays Purdue Model levels for OT/ICS assets sourced by or enriched with data from Dragos.

Attack Surface & Exposure Management · 2026-07-24

runZero 5.0.260723.0 adds Purdue level visibility for Dragos-enriched OT/ICS assets.

• Displays Purdue Model levels for assets sourced or enriched from Dragos integration, enabling OT/ICS network segmentation visibility.

SAST / SCA / Code Security · 2026-07-24

Snyk launches Snyk Studio (agentic security), Evo AI-SPM platform, Bruno Collection API scanning, and a unified IDE configuration dialog.

• Introduces Snyk Studio, an agentic security platform with quickstart guides for 20+ AI coding agents including Cursor, Devin, GitHub Copilot, Claude Code, Gemini CLI, and Amazon Q.
• Adds Evo by Snyk, a new AI Security Posture Management (AI-SPM) platform surface with inventory, policies & issues, reports, AI asset visibility, and risk intelligence.
• Launches Agentic Development Security (ADS) within Evo, covering Agent Supply Chain Security, Agent Behavior Governance, and Trusted Output Assurance.

SAST / SCA / Code Security · 2026-07-24

Snyk Code gains Rule Extensions: define custom sanitizers to reduce false positives in taint-flow analysis without leaving the platform.

• Adds Rule Extensions, letting teams attach custom sanitizer functions to existing Snyk Code security rules to match project-specific context.
• Supports custom sanitizer definitions per language to reduce false positives in taint-flow analysis across supported rules.
• Enables impact testing via the API to preview how a proposed Rule Extension would change project findings before applying it.

Attack Surface & Exposure Management · 2026-07-24

Surface Command adds AI-generated asset summaries covering identity, vulnerabilities, mitigations, and business context.

• Adds AI Summary panel on asset detail pages that provides a concise overview of identity, business context, operational context, associated users, configured mitigations, and detected vulnerabilities.
• AI summaries are generated on first open and cached for faster subsequent access, with automatic regeneration when new data is ingested.
• Enables one-click copy of the full formatted AI summary to clipboard from the General tab.

Attack Surface & Exposure Management · 2026-07-24

Surface Command adds AI-generated asset summaries covering identity, vulnerabilities, mitigations, and business context.

• Adds AI Summary panel on asset detail pages that auto-generates a concise overview of an asset's identity, classification, associated users, configured mitigations, and detected vulnerabilities.
• Caches AI summaries for faster repeat access and automatically regenerates them when new data is ingested.
• Enables one-click copy of the full AI summary (with formatting) to clipboard for use in reports or tickets.

Attack Surface & Exposure Management · 2026-07-24

Surface Command adds AI-generated asset summaries covering identity, business context, and detected vulnerabilities.

• Adds AI Summary panel on asset detail pages that provides a concise overview of asset identity, associated users, configured mitigations, and detected vulnerabilities.
• AI summaries are generated on first open and cached for faster subsequent access, with automatic regeneration when new data is ingested.
• Enables practitioners to copy the full formatted AI summary to the clipboard for use in reports or incident notes.

Runtime Security · 2026-07-24

Tetragon gains persistent gRPC policies: tracing policies survive agent restarts with zero enforcement gaps via BPF handoff.

• New --persist-grpc-policies flag enables saving and restoring tracing policies installed via gRPC across agent restarts.
• New --persist-grpc-policies-dir flag selects the directory used as the policy store (default: /var/run/tetragon/grpc-policies).
• Combined with --keep-sensors-on-exit and --release-pinned-bpf=false, Tetragon performs a zero-gap BPF handoff: the old BPF tree stays attached until replacement programs are fully loaded.

Runtime Security · 2026-07-24

Tetragon now supports persistent gRPC policies that survive restarts and can be restored automatically.

• Adds persistent gRPC policies: tracing policies installed via gRPC can now be persisted and restored across restarts.

Runtime Security · 2026-07-24

Tetragon adds in-kernel CEL expression argument filtering and uprobe override actions with register manipulation support

• New CelExpr argument filter enables specifying Common Expression Language (CEL) expressions evaluated in-kernel for kprobe selectors, supporting arithmetic, logical, comparison operators, and 32-bit integer casting.
• Uprobe override action now supports redirecting traced user-space symbols to a new symbol (argNewSymbol), offset (argNewOffset), or absolute address (argNewAddr) at runtime, requiring Linux 6.18+ for raw register manipulation.

Runtime Security · 2026-07-24

Tetragon uprobe policies now support binary digest verification to prevent accidental attachment to wrong binary versions.

• Adds binaryDigests field to uprobe tracing policies, allowing policies to validate a target binary's hash before attaching — rejecting the policy (with load_err) if the digest doesn't match.
• Supports sha1, sha256, sha384, sha512, and ELF build-id (.note.gnu.build-id) digest types for binary verification.

SAST / SCA / Code Security · 2026-07-24

Veracode SCA gains malicious package detection, Poetry support, SBOM generation, new agent flags, and Unified Policy for workspaces.

• Adds --appname flag to the SCA agent scan command (Commercial region) to link scan results directly to an application profile, requiring OAuth or HMAC authentication.
• Adds --show-cli flag to the SCA agent scan command: used with --json, it saves structured JSON output to a file while also displaying a human-readable summary in the console.
• Enables Unified Policy assignment to SCA agent-based scan workspaces in the US Federal region, allowing policies to create issues and break builds based on defined criteria.

Web Application Security · 2026-07-24

Wallarm API Discovery adds MCP protocol support alongside documented node version requirements for GraphQL, SOAP, gRPC, and MCP.

• Supports MCP (Model Context Protocol) discovery, requiring NGINX Node 6.12.0 or Native Node 0.25.0.
• Documents minimum node versions for API Discovery across all supported protocols: GraphQL (NGINX Node 6.1.0 / Native Node 0.15.1), SOAP (NGINX Node 6.3.0 / Native Node 0.17.1), and gRPC (NGINX Node 6.4.0, NGINX only).

Secure Access (VPN / SASE / ZTNA) · 2026-07-24

ZPA gains Autonomous App Shield and Autonomous User-to-App Segmentation to continuously protect and isolate private apps.

• New Autonomous App Shield continuously assesses private applications via App Connectors, reasons about per-app risk using global threat intelligence, and applies targeted protections automatically — adapting when developers ship new releases without manual re-tuning.
• New Autonomous User-to-App Segmentation narrows user and third-party access to exactly the applications required, reducing lateral movement opportunity when a foothold is gained.
• New Zscaler Lateral Threat Bundle packages application hiding (ZPA), autonomous segmentation, and App Shield into a unified offer for layered private-app defense.

1Password 10 changes

• 1Password for Android beta 8.12.32-26 (2026-07-29) · Feature · 2026-07-29
• 1Password for Linux beta 8.12.32-26 (2026-07-29) · Feature · 2026-07-29
• 1Password for Mac beta 8.12.32-26 (2026-07-29) · Feature · 2026-07-29
• 1Password for Windows beta 8.12.32-26 (2026-07-29) · Feature · 2026-07-29
• 1Password for iOS beta 8.12.32-26 (2026-07-29) · Feature · 2026-07-29
• 1Password in the browser 8.12.32-26 (2026-07-29) · Feature · 2026-07-29
• 1Password for Linux 8.12.30 (2026-07-28) · Feature · 2026-07-29
• 1Password for Mac 8.12.30 (2026-07-28) · Feature · 2026-07-29
• 1Password for Windows 8.12.30 (2026-07-28) · Feature · 2026-07-29
• 1Password in the browser 8.12.30 (2026-07-28) · Feature · 2026-07-29

AI-Infra-Guard 2 changes

• v4.5.1 · Feature · 2026-07-30
• v4.5.0 · Feature · 2026-07-27

Aikido Security 1 changes

• #52 - DSPM, Aikido Libraries and Repository Code Quality scans · Feature · 2026-07-28

ALEAPP 1 changes

• v2026.2.0 · Feature · 2026-07-25

AsmResolver 1 changes

• v6.0.1 · Feature · 2026-07-26

Auth0 5 changes

• Dashboard Search for Organization members now in Beta! (2026-07-29) · Feature · 2026-07-29
• Organization-Level Roles - Early Access (2026-07-29) · Feature · 2026-07-29
• Organization-to-Application Entitlement - Early Access (2026-07-29) · Feature · 2026-07-29
• docs update · Docs · 2026-07-27
• Cross App Access (XAA) for Resource Applications is now in Open Early Access (2026-07-27) · Feature · 2026-07-27

Axonius 2 changes

• docs update · Docs · 2026-07-27
• docs update · Docs · 2026-07-24

BeyondTrust 9 changes

• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30

bloodhound 6 changes

• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• v9.5.0 · Feature · 2026-07-28
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24

Brinqa 4 changes

• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24

bruteforce-salted-openssl 1 changes

• docs update · Docs · 2026-07-24

Castle 4 changes

• Detect VPN traffic with new IP intelligence · Feature · 2026-07-27
• Detect residential proxies with new IP intelligence · Feature · 2026-07-27
• Export team members to CSV · Feature · 2026-07-27
• New event field: `email.registered_domain` · Feature · 2026-07-27

Censys 3 changes

• docs update · Docs · 2026-07-28
• docs update · Docs · 2026-07-28
• July 27, 2026 (2026-07-27) · Feature · 2026-07-28

Cisco Duo Desktop 1 changes

• updated · Jul 29, 2026 · Feature · 2026-07-29

CISO Assistant 3 changes

• v3.20.4 · Feature · 2026-07-29
• v3.20.3 · Feature · 2026-07-25
• powerbi-v1.0.1 · Feature · 2026-07-24

Claude Code 1 changes

• v2.1.219 · Feature · 2026-07-25

Clerk 4 changes

• docs update · Docs · 2026-07-29
• Hosted authentication for Expo, iOS, and Android (2026-07-28) · Feature · 2026-07-29
• Composable UserProfile and OrganizationProfile components (2026-07-27) · Feature · 2026-07-28
• changelog · Jul 24, 2026 · Feature · 2026-07-24

Cline 8 changes

• cli-v3.0.47 · Feature · 2026-07-30
• v4.0.12 · Feature · 2026-07-29
• sdk/sdk/v0.0.66 · Feature · 2026-07-29
• docs update · Docs · 2026-07-28
• desktop-v0.0.6 · Feature · 2026-07-28
• desktop-v0.0.5 · Feature · 2026-07-28
• v4.0.11 · Feature · 2026-07-25
• desktop-v0.0.4 · Feature · 2026-07-24

Cloudflare 5 changes

• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29

Cloudsmith 2 changes

• changelog · Jul 25, 2026 · Feature · 2026-07-25
• CLI v1.19.0: Authenticate automatically with OIDC and Docker credential discovery (2026-07-23) · Feature · 2026-07-24

Codacy 2 changes

• Support for Shellcheck configuration file - July, 2026 · Feature · 2026-07-30
• Adding PHP CS Fixer and support to Checkov configuration files July, 2026 · Feature · 2026-07-27

code-oss 1 changes

• docs update · Docs · 2026-07-29

ConductorOne 14 changes

• docs update · Docs · 2026-07-28
• docs update · Docs · 2026-07-28
• docs update · Docs · 2026-07-28
• July 24, 2026 (2026-07-27) · Feature · 2026-07-28
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• July 24, 2026 (2026-07-25) · Feature · 2026-07-25
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24

Conveyor 3 changes

• 📄 Download Signed NDAs Through the API · Feature · 2026-07-29
• 🔍 Search Your Knowledge Library and See Your Trust Center Subscribers via API · Feature · 2026-07-29
• 🔐 Refreshed Login and Sign Up, Now with One-Click Access from Email · Feature · 2026-07-29

Corellium 2 changes

• docs update · Docs · 2026-07-24
• Release 7.12.0 (2026-07-23) · Feature · 2026-07-24

CrewAI 4 changes

• 1.15.9 · Feature · 2026-07-30
• 1.15.8 · Feature · 2026-07-28
• 1.15.7 · Feature · 2026-07-27
• 1.15.7a1 · Feature · 2026-07-27

Cribl 3 changes

• docs update · Docs · 2026-07-29
• Why full-text search matters for modern log analytics (2026-07-28) · Feature · 2026-07-29
• docs update · Docs · 2026-07-25

Crush 1 changes

• v0.87.0 · Feature · 2026-07-25

CubeSandbox 1 changes

• v0.6.0 · Feature · 2026-07-24

curl 1 changes

• docs update · Docs · 2026-07-24

Cursor 2 changes

• Cursor, now on iPad · Feature · 2026-07-30
• Cursor Start · Feature · 2026-07-28

DataDome 3 changes

• Go module v2.5.0 (2026-07-28) · Feature · 2026-07-28
• Google Cloud Load Balancer module 1.7.0 (2026-07-28) · Feature · 2026-07-28
• Python ASGI module 1.2.0 (2026-07-28) · Feature · 2026-07-28

Daytona 2 changes

• Sandbox metrics and auto-pause interval support · Feature · 2026-07-25
• Websocket sandbox event subscriptions in SDKs · Feature · 2026-07-25

defectdojo 7 changes

• docs update · Docs · 2026-07-30
• 3.1.302 · Feature · 2026-07-30
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-27
• docs update · Docs · 2026-07-27
• 3.1.300 · Feature · 2026-07-27

Detection Rules 1 changes

• dev-v2.0.0 · Feature · 2026-07-24

Didit 1 changes

• docs update · Docs · 2026-07-24

DigiCert CertCentral 2 changes

• July 29, 2026 · Feature · 2026-07-30
• July 28, 2026 · Feature · 2026-07-29

dirsearch 1 changes

• docs update · Docs · 2026-07-24

DNSFilter 3 changes

• 07/29 July 29 – Windows Roaming Client v3.6.10 Beta (2026-07-29) · Feature · 2026-07-29
• 07/28 July 28 – Web Application and API Update (2026-07-28) · Feature · 2026-07-28
• changelog · Jul 24, 2026 · Feature · 2026-07-24

Docker Sandboxes 11 changes

• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• v0.37.0 · Feature · 2026-07-24

Elastic Security Labs 9 changes

• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• Stop rewriting detection rules by hand: automatic Sentinel-to-Elastic migration is here (2026-07-29) · Feature · 2026-07-29
• docs update · Docs · 2026-07-27

emisar 2 changes

• v0.35.0 · Feature · 2026-07-28
• v0.34.0 · Feature · 2026-07-28

Exabeam 1 changes

• docs update · Docs · 2026-07-24

Fastly 8 changes

• Next-Gen WAF for Apache 1.11.0 (2026-07-29) · Feature · 2026-07-30
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• Fastly DNS (2026-07-28) · Feature · 2026-07-29

Feedly Threat Intelligence 8 changes

• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• changelog · Jul 27, 2026 · Feature · 2026-07-27

Finite State Platform 1 changes

• July 23, 2026 - Component Replacement, SBOM Export Validation, and Platform Reliability Improvements (2026-07-23) · Feature · 2026-07-25

Firezone 1 changes

• docs update · Docs · 2026-07-24

gemini-cli 1 changes

• v0.53.0 · Feature · 2026-07-29

GitGuardian Detection Engine 1 changes

• Detection Engine Updates Version 2.168 (2026-07-20) · Feature · 2026-07-30

GitGuardian SaaS 5 changes

• docs update · Docs · 2026-07-28
• docs update · Docs · 2026-07-28
• docs update · Docs · 2026-07-28
• docs update · Docs · 2026-07-28
• Track your GitHub check runs from the dashboard (2026-07-28) · Feature · 2026-07-28

GitGuardian Self-Hosted 1 changes

• 2026.7 - Required (2026-07-24) · Feature · 2026-07-24

Google SecOps 3 changes

• docs update · Docs · 2026-07-29
• July 29, 2026 (2026-07-29) · Feature · 2026-07-29
• docs update · Docs · 2026-07-24

Goose 4 changes

• docs update · Docs · 2026-07-30
• v1.45.0 · Feature · 2026-07-30
• docs update · Docs · 2026-07-24
• v1.44.0 · Feature · 2026-07-24

graudit 4 changes

• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24

Hermes 13 changes

• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29

holmesgpt 2 changes

• 0.38.0 · Feature · 2026-07-30
• 0.37.0 · Feature · 2026-07-28

Huntress 2 changes

• Microsoft Usage Location Inference Live in Managed ITDR · Feature · 2026-07-28
• Onboarding Escalation Throttle Now Live in Managed ITDR · Feature · 2026-07-28

HyperDbg 1 changes

• docs update · Docs · 2026-07-27

iDenfy 1 changes

• changelog · Jul 24, 2026 · Feature · 2026-07-24

iLEAPP 1 changes

• v2026.2.1 · Feature · 2026-07-27

Immuta 3 changes

• updated · Jul 30, 2026 · Feature · 2026-07-30
• updated · Jul 28, 2026 · Feature · 2026-07-28
• updated · Jul 24, 2026 · Feature · 2026-07-24

infisical 2 changes

• v0.162.15 · Feature · 2026-07-30
• v0.162.14 · Feature · 2026-07-28

Intruder 2 changes

• AI Pentesting - expert-level web app pentesting without the wait (2026-07-28) · Feature · 2026-07-28
• changelog · Jul 27, 2026 · Feature · 2026-07-27

Iru 6 changes

• Auto App: Elgato Stream Deck · Feature · 2026-07-30
• Auto App: Screen Studio · Feature · 2026-07-30
• New Windows Auto Apps · Feature · 2026-07-30
• Managed OS for Apple: New embedded delay option · Feature · 2026-07-29
• New Apple Beta Enrollment Assignment Rule · Feature · 2026-07-28
• What's New in Iru | July 24th · Feature · 2026-07-25

JumpCloud 2 changes

• docs update · Docs · 2026-07-27
• JumpCloud Agent Release Notes for July 27, 2026 (2026-07-27) · Feature · 2026-07-27

Kiro 4 changes

• Editor Actions, Guided Hook Creation, and Code OSS Upgrade · Feature · 2026-07-29
• Spec Drafting and Plan Auto-Execution · Feature · 2026-07-29
• Claude Opus 5 Now Available · Feature · 2026-07-25
• V2 to V3 Agent Migration · Feature · 2026-07-24

Knostic 1 changes

• Introducing AgentMesh Access Tiers: Building Together, Growing Together (2026-07-27) · Feature · 2026-07-30

kubernetes-helm 1 changes

• docs update · Docs · 2026-07-24

LangGraph 1 changes

• 1.2.10 · Feature · 2026-07-29

Lookyloo 1 changes

• v1.40.1 · Feature · 2026-07-28

Maigret 3 changes

• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24

Microsoft Defender 1 changes

• changelog · Jul 27, 2026 · Feature · 2026-07-28

Microsoft Security 1 changes

• changelog · Jul 27, 2026 · Feature · 2026-07-28

Mobile Verification Toolkit 3 changes

• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-29
• v2026.7.29 · Feature · 2026-07-29

Mondoo 1 changes

• Connect Claude and other AI tools to Mondoo with the MCP server · Feature · 2026-07-30

multimon-ng 1 changes

• 1.6.0 · Feature · 2026-07-27

Nebula 1 changes

• v1.11.0 · Feature · 2026-07-24

nono 1 changes

• v0.70.0 · Feature · 2026-07-29

Nudge Security 5 changes

• docs update · Docs · 2026-07-30
• Detect sensitive data shared in Amazon Quick Suite · Feature · 2026-07-30
• Discover AI agents built on Amazon Quick · Feature · 2026-07-30
• docs update · Docs · 2026-07-29
• Enforce SSO login for Nudge Security · Feature · 2026-07-29

Okta Identity Engine 2 changes

• docs update · Docs · 2026-07-27
• docs update · Docs · 2026-07-27

Ollama 2 changes

• v0.32.4 · Feature · 2026-07-26
• v0.32.3 · Feature · 2026-07-24

Omada Identity 1 changes

• docs update · Docs · 2026-07-24

OpenAI Codex CLI 11 changes

• rust-v0.147.0-alpha.2 · Feature · 2026-07-30
• rust-v0.147.0-alpha.1 · Feature · 2026-07-29
• rust-v0.146.0 · Feature · 2026-07-29
• rust-v0.146.0-alpha.14 · Feature · 2026-07-28
• rust-v0.146.0-alpha.13 · Feature · 2026-07-27
• rust-v0.146.0-alpha.10 · Feature · 2026-07-25
• rust-v0.146.0-alpha.8 · Feature · 2026-07-25
• rust-v0.146.0-alpha.7 · Feature · 2026-07-25
• rust-v0.146.0-alpha.6 · Feature · 2026-07-24
• rust-v0.146.0-alpha.3.1 · Feature · 2026-07-24
• rust-v0.146.0-alpha.5 · Feature · 2026-07-24

OpenCode 4 changes

• docs update · Docs · 2026-07-30
• v1.18.10 · Feature · 2026-07-30
• v1.18.9 · Feature · 2026-07-29
• v1.18.8 · Feature · 2026-07-28

OpenCTI 2 changes

• docs update · Docs · 2026-07-29
• 7.260728.0 · Feature · 2026-07-29

OpenCVE 2 changes

• docs update · Docs · 2026-07-27
• docs update · Docs · 2026-07-27

OpenHands 4 changes

• v1.7.0 · Feature · 2026-07-30
• docs update · Docs · 2026-07-29
• docs update · Docs · 2026-07-28
• docs update · Docs · 2026-07-28

Openlayer 1 changes

• docs update · Docs · 2026-07-24

OpenShell 1 changes

• v0.0.92 · Feature · 2026-07-27

OpenSSL 1 changes

• docs update · Docs · 2026-07-24

Ory 1 changes

• Ory Network, Ory Hydra, Ory Kratos v26.3.3 released · Feature · 2026-07-28

Palo Alto Networks 1 changes

• changelog · Jul 24, 2026 · Docs · 2026-07-24

Passbolt 1 changes

• Sunshine | Browser Extension & API · Feature · 2026-07-28

Pi 20 changes

• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• docs update · Docs · 2026-07-30
• v0.83.0 · Feature · 2026-07-30
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25
• v0.82.1 · Feature · 2026-07-25
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• v0.82.0 · Feature · 2026-07-24

Ping Identity 1 changes

• changelog · Jul 24, 2026 · Feature · 2026-07-24

Portkey 8 changes

• docs update · Docs · 2026-07-30
• updated · Jul 30, 2026 · Feature · 2026-07-30
• docs update · Docs · 2026-07-28
• docs update · Docs · 2026-07-28
• updated · Jul 28, 2026 · Feature · 2026-07-28
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• updated · Jul 24, 2026 · Feature · 2026-07-24

Progress ShareFile 5 changes

• updated · Jul 29, 2026 · Feature · 2026-07-29
• updated · Jul 28, 2026 · Feature · 2026-07-28
• changelog · Jul 26, 2026 · Feature · 2026-07-26
• docs update · Docs · 2026-07-25
• docs update · Docs · 2026-07-25

ProjectDiscovery Cloud 1 changes

• Introducing Internal Network Scanning: see your network the way an attacker inside it would (2026-07-21) · Feature · 2026-07-25

Promptfoo 3 changes

• updated · Jul 29, 2026 · Feature · 2026-07-29
• updated · Jul 27, 2026 · Feature · 2026-07-27
• updated · Jul 24, 2026 · Feature · 2026-07-24

Prowler 3 changes

• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• 5.36.0 · Feature · 2026-07-24

python-pipx 1 changes

• docs update · Docs · 2026-07-30

Qualys TotalCloud 1 changes

• changelog · Jul 27, 2026 · Feature · 2026-07-28

Rapid7 InsightCloudSec 1 changes

• changelog · Jul 28, 2026 · Feature · 2026-07-28

Rapid7 Surface Command 1 changes

• changelog · Jul 28, 2026 · Docs · 2026-07-28

RegScale 1 changes

• RegScale 6.32.3.0 (2026-07-25) · Feature · 2026-07-26

Rspamd 4 changes

• docs update · Docs · 2026-07-29
• 4.1.4 · Feature · 2026-07-29
• docs update · Docs · 2026-07-26
• 4.1.3 · Feature · 2026-07-26

runZero 4 changes

• docs update · Docs · 2026-07-30
• runZero 5.0.260728.1 (2026-07-29) · Feature · 2026-07-30
• docs update · Docs · 2026-07-24
• runZero 5.0.260723.0 (2026-07-23) · Feature · 2026-07-24

SailPoint 4 changes

• Enhancement: Smarter Output Handling for HTTP Request (POST) (2026-07-28) · Feature · 2026-07-29
• Introducing the connectivity agent for simplified web services configuration in SailPoint (2026-07-27) · Feature · 2026-07-28
• Enhancement: Centered Navigation Bar for Enhanced User Experience (2026-07-24) · Feature · 2026-07-25
• New Capability: Forms for Access Request (2026-07-24) · Feature · 2026-07-25

Security Onion 1 changes

• 3.2.0-20260729 · Feature · 2026-07-30

SkillSpector 1 changes

• v2.5.0 · Feature · 2026-07-28

Snyk 2 changes

• changelog · Jul 28, 2026 · Feature · 2026-07-28
• changelog · Jul 24, 2026 · Docs · 2026-07-24

Snyk Code 1 changes

• changelog · Jul 24, 2026 · Docs · 2026-07-24

Splunk Security Content 1 changes

• v6.3.0 · Feature · 2026-07-29

StepSecurity 1 changes

• Secure Registry: Maven Support in Beta, Custom Block List, and Tarball URL Rewriting (2026-07-24) · Feature · 2026-07-28

Strix 1 changes

• v1.4.0 · Feature · 2026-07-27

Sublime Security 2 changes

• Platform v1.87.1 (Customer Account Access) (2026-07-28) · Feature · 2026-07-29
• Platform v1.87 (Advanced Graymail Protection - GA) (2026-07-28) · Feature · 2026-07-29

Surface Command 3 changes

• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24

syft 1 changes

• v1.50.0 · Feature · 2026-07-29

Sysdig Secure 1 changes

• Secure SaaS - July 29, 2026 · Feature · 2026-07-30

SysReptor 1 changes

• 2026.61 · Feature · 2026-07-29

tailscale 1 changes

• Tailnet creation API (2026-07-29) · Feature · 2026-07-30

tcpreplay 1 changes

• v4.6.0 · Feature · 2026-07-28

Tenzir 1 changes

• docs update · Docs · 2026-07-25

Termius 1 changes

• 9.42.2 (2026-07-29) · Feature · 2026-07-29

tetragon 4 changes

• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24
• docs update · Docs · 2026-07-24

Tines 2 changes

• changelog · Jul 27, 2026 · Feature · 2026-07-27
• AI web search (2026-07-24) · Feature · 2026-07-25

ToolHive 1 changes

• v0.41.0 · Feature · 2026-07-29

Trend Vision One 5 changes

• New resources in Container Security inventory overview (2026-07-29) · Feature · 2026-07-30
• Zero Trust Secure Access supports masking sensitive data in DLP and AI detection logs (2026-07-27) · Feature · 2026-07-29
• Endpoint Event Viewer enhancements and fixes (2026-07-27) · Feature · 2026-07-27
• Zero Trust Secure Access On-premises Gateway version 1.0.89 (2026-07-27) · Feature · 2026-07-27
• Helm Chart 3.5.0 (2026-07-22) · Feature · 2026-07-27

trufflehog 1 changes

• v3.96.0 · Feature · 2026-07-25

Varonis 10 changes

• Classify tools by capability · Feature · 2026-07-29
• Connect GitHub using least-privilege access · Feature · 2026-07-29
• Discover AI resources in TypeScript repositories · Feature · 2026-07-29
• Discover Salesforce Agentforce resources through Hosted Services · Feature · 2026-07-29
• Expanded support for monitoring and governing coding agents · Feature · 2026-07-29
• Identify Agents, Tools, and MCPs faster · Feature · 2026-07-29
• Ingest and monitor AWS Bedrock activity · Feature · 2026-07-29
• Manage Claude-hosted agents in Atlas · Feature · 2026-07-29
• Sync Copilot and ChatGPT Enterprise activity with Varonis DSPM · Feature · 2026-07-29
• Trace user intent and agent activity over time · Feature · 2026-07-29

Veracode 6 changes

• Integration updates (2026-07-30) · Feature · 2026-07-30
• Platform updates (2026-07-29) · Feature · 2026-07-30
• Static Analysis updates (2026-07-29) · Feature · 2026-07-30
• changelog · Jul 28, 2026 · Feature · 2026-07-28
• Package Firewall updates (2026-07-07) · Feature · 2026-07-27
• SCA updates (2026-07-24) · Feature · 2026-07-24

vMLX 2 changes

• v1.6.18 · Feature · 2026-07-28
• v1.6.16 · Feature · 2026-07-27

vopono 1 changes

• 0.10.19 · Feature · 2026-07-26

Vuls 1 changes

• v0.40.0-rc.1 · Feature · 2026-07-29

Wallarm 1 changes

• docs update · Docs · 2026-07-24

Wapiti 1 changes

• 3.3.1 · Feature · 2026-07-27

Windsurf 1 changes

• updated · Jul 30, 2026 · Feature · 2026-07-30

Wiz Code 1 changes

• changelog · Jul 28, 2026 · Feature · 2026-07-28

Wiz Defend 1 changes

• changelog · Jul 29, 2026 · Feature · 2026-07-29

XFA 1 changes

• A New Look for the XFA Desktop App · Feature · 2026-07-28

Zscaler Private Access 1 changes

• changelog · Jul 24, 2026 · Feature · 2026-07-24

bloodhound docs update · 2026-07-30

The Delete Custom Node API endpoint is now deprecated.

Goose v1.45.0 · 2026-07-30

The ACP scheduler is now disabled by default; deployments relying on scheduled recipe execution must explicitly pass --enable-scheduler.

Immuta updated · Jul 30, 2026 · 2026-07-30

Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake integration architecture update rolling out from July 23, 2026.

Pi docs update · 2026-07-30

TypeBox aliases upgraded to 1.3.7, removing Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate — extensions using any of these APIs must migrate to supported TypeBox APIs.

Pi v0.83.0 · 2026-07-30

TypeBox aliases upgraded to 1.3.7, removing deprecated APIs Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, and Value.Mutate — extensions using any of these APIs must migrate to supported TypeBox APIs.

Security Onion 3.2.0-20260729 · 2026-07-30

The icsnpp-modbus parser is removed from defaults.yaml; grids relying on the default Modbus protocol parser will no longer have it enabled after upgrade.

Security Onion 3.2.0-20260729 · 2026-07-30

The Detection Engineer agent configuration key is renamed to DetectionEngineer; existing configurations using the old key will need to be updated.

Veracode Integration updates (2026-07-30) · 2026-07-30

The Veracode Flaw Importer task (with spaces in the task name) in the Azure DevOps extension is deprecated and replaced by VeracodeFlawImporter; the old task is scheduled for removal in a future release.

Veracode Platform updates (2026-07-29) · 2026-07-30

The Veracode Healthcheck endpoint /healthcheck/status has been removed and now returns a 404 error; use the v2/principal endpoint in the Identity REST API instead.

Windsurf updated · Jul 30, 2026 · 2026-07-30

The status bar is now hidden by default in Agent Command Center mode; set "workbench.statusBar.visible": true in user settings to restore it.

Windsurf updated · Jul 30, 2026 · 2026-07-30

Cascade, Devin Local, and every other ACP agent are unavailable while a workspace is open in Restricted Mode, and hooks no longer load or run there.

Windsurf updated · Jul 30, 2026 · 2026-07-30

Models marked Devin Local only (including every GPT-5.6 variant) now appear disabled in Cascade's model picker rather than running degraded.

1Password 1Password in the browser 8.12.32-26 (2026-07-29) · 2026-07-29

Phishing warning settings have moved from their previous location to Settings > Security & privacy > Phishing prevention; any workflow or documentation referencing the old location will need updating.

Cisco Duo Desktop updated · Jul 29, 2026 · 2026-07-29

Support for Ubuntu 23.04 and 20.04 LTS has been dropped in Linux v4.6.0.

Cline sdk/sdk/v0.0.66 · 2026-07-29

The onRetryAttempt callback is removed from ApiHandlerOptions and provider config.

Cloudflare docs update · 2026-07-29

DNSSEC-related records (RRSIG, DS, CDS, DNSKEY, CDNSKEY) in the 1.1.1.1 DoH JSON API now use numeric algorithm identifiers instead of mnemonic names (e.g., RSASHA256 becomes 8, ECDSAP256SHA256 becomes 13, ED25519 becomes 15); DS digest types also change from mnemonic to numeric (e.g., SHA-256 becomes 2).

Cloudflare docs update · 2026-07-29

The /sse endpoint on Cloudflare MCP servers no longer serves the deprecated HTTP+SSE transport — it now aliases to the Streamable HTTP handler; clients that force SSE transport must switch to Streamable HTTP or automatic transport detection.

defectdojo docs update · 2026-07-29

The legacy feature flag table was retired; feature flags are now database-driven and exposed via the v2 API and MCP.

defectdojo docs update · 2026-07-29

Configuration permission assignment is now restricted to superusers.

defectdojo docs update · 2026-07-29

Connector engagement names now include the asset name, which may change existing engagement naming conventions.

Google SecOps docs update · 2026-07-29

Before enabling the new Investigation Management experience, advanced widget configurations (such as Safe HTML Rendering or custom widgets) must be manually copied from Default Alert View and Default Case View to the new New Default Alert View and New Default Case View, or those configurations will be lost.

Progress ShareFile updated · Jul 29, 2026 · 2026-07-29

Upgrading to ShareFile for Mac 26.04.20 requires all users to re-authenticate.

Progress ShareFile updated · Jul 29, 2026 · 2026-07-29

Upgrading to ShareFile for Windows 26.3.12.0 requires users to re-authenticate.

Progress ShareFile updated · Jul 29, 2026 · 2026-07-29

ShareFile for Windows 25.6.5.0 is signed with Progress Software Corporation's digital certificate; environments that restrict software by publisher may block this update until Progress Software Corporation is added to the trusted publishers list.

Rspamd docs update · 2026-07-29

Malformed controller password hashes (e.g. truncated $1$ missing salt or key) that previously allowed all logins will now lock out all authentication after upgrade — regenerate hashes with rspamadm pw before upgrading.

Rspamd docs update · 2026-07-29

Named regexp scopes (multimap regexp_rules, Lua plugin scopes) now silently stop matching content beyond regexp.max_size (1 MiB by default); raise max_size in the regexp config section if larger inputs must be matched.

Rspamd docs update · 2026-07-29

Fuzzy hashes and Bayes token sets learned from very large UTF text parts before 4.1.4 may stop matching or change after upgrade due to the new word budget and dropped decayed words; re-learn affected patterns post-upgrade.

Rspamd docs update · 2026-07-29

The read-only WebUI password now exposes /errors, list_extractors, list_transforms, and check_selector endpoints with no option to restore previous gating — audit and rotate the read-only password if needed.

Rspamd docs update · 2026-07-29

Building from source with -DENABLE_JEMALLOC=ON now fails at CMake configure time when only a static libjemalloc_pic.a is available (without -DENABLE_STATIC=ON); install libjemalloc-dev / jemalloc-devel before building.

Rspamd 4.1.4 · 2026-07-29

Rspamd now refuses to link against a static-only jemalloc; builds configured with a static-only jemalloc will fail to start.

SysReptor 2026.61 · 2026-07-29

PDF compression is removed and the COMPRESS_PDFS setting no longer exists; any configuration referencing COMPRESS_PDFS will need to be cleaned up.

SysReptor 2026.61 · 2026-07-29

Plugin loading is reworked so that the source code directory is now read-only in the Docker image; plugins or workflows that write to that directory will break.

Termius 9.42.2 (2026-07-29) · 2026-07-29

MultiKey authentication will no longer be available after October 15, 2026 — migrate to SSH ID or another authentication method before that date.

ToolHive v0.41.0 · 2026-07-29

Namespace-scoped operator installs (operator.rbac.scope=namespace) now fail helm upgrade at render time unless operator.features.storageVersionMigrator: false is explicitly set, because the StorageVersionMigrator controller is enabled by default.

ToolHive v0.41.0 · 2026-07-29

JSON-RPC batch requests (top-level arrays) are now rejected with HTTP 400 / error code -32600 instead of being executed; send individual requests.

ToolHive v0.41.0 · 2026-07-29

The rate-limit JSON-RPC error code changed from -32029 to 429; clients branching on error.code == -32029 must match 429 instead.

Vuls v0.40.0-rc.1 · 2026-07-29

The [cti] config section is removed; CTI data is now sourced from vuls2 rather than go-cti.

Vuls v0.40.0-rc.1 · 2026-07-29

The per-VulnInfo field previously named Ctis is renamed to CTIs; consumers of scan result JSON will need to update field references.

Vuls v0.40.0-rc.1 · 2026-07-29

EUVD content is no longer sourced from go-cve-dictionary; it is now provided solely through the vuls2 enrich path.

GitGuardian SaaS docs update · 2026-07-28

logCollector.collectMigrationLogs is enabled by default and requires Kubernetes 1.29 or later; on older clusters, set logCollector.collectMigrationLogs: false before upgrading.

GitGuardian SaaS docs update · 2026-07-28

Developer Endpoint Protection is not functional on self-hosted instances in 2026.7.0; instances relying on Endpoint Protection should hold off on upgrading.

Immuta updated · Jul 28, 2026 · 2026-07-28

Immuta policy role names used to grant users access to Snowflake data sources will be renamed as part of the Snowflake integration architecture update rolling out beginning July 23, 2026; policy roles will be recreated under new names.

Immuta updated · Jul 28, 2026 · 2026-07-28

Integration error banners for Snowflake integration validation failures will no longer be displayed; errors will only be available through the connections experience.

Progress ShareFile updated · Jul 28, 2026 · 2026-07-28

Upgrading to ShareFile for Mac 26.04.20 requires all users to re-authenticate.

Progress ShareFile updated · Jul 28, 2026 · 2026-07-28

Upgrading to ShareFile for Windows 26.3.12.0 requires all users to re-authenticate.

Progress ShareFile updated · Jul 28, 2026 · 2026-07-28

ShareFile for Windows 25.6.5.0 is now signed with Progress Software Corporation's digital certificate; environments restricting software by publisher may block this update until Progress Software Corporation is added to the trusted publishers list.

Rapid7 Surface Command changelog · Jul 28, 2026 · 2026-07-28

CyberArk Endpoint Privilege Manager connector migrates from the deprecated GetComputers API to the new Get Endpoints API and introduces the CyberArkEpmComputer2 type — existing workflows relying on the old API or type may need to be updated.

SkillSpector v2.5.0 · 2026-07-28

Baseline files with version 1 fingerprints are no longer accepted; run skillspector baseline <path>, review the generated version 2 entries, and commit the replacement baseline (rules-only version 1 baselines remain supported with a warning).

SkillSpector v2.5.0 · 2026-07-28

JSON integrations must treat invalid or missing output, a nonzero process exit, or execution_successful: false as a blocking validation error and surface analysis_completeness.ledger_exceptions for diagnosis.

vMLX v1.6.18 · 2026-07-28

This release requires JANG 2.5.34.

defectdojo docs update · 2026-07-27

Request Review is now gated on Finding_View instead of Finding_Edit.

OpenCVE docs update · 2026-07-27

API v1 (/api/) is deprecated and no longer receives new features; new integrations must use API v2 (/api/v2/).

Strix v1.4.0 · 2026-07-27

Strix now quits after a scan completes instead of hosting a local viewer — workflows that relied on the viewer launching automatically must now run strix view separately.

Rspamd docs update · 2026-07-26

The WebUI drops jQuery entirely and deletes the vendored jQuery build; any local customizations or extensions depending on jQuery or the $.fn API will break.

Rspamd docs update · 2026-07-26

The modalDialog backdrop attribute is renamed from its previous name to data-bs-backdrop (Bootstrap 5 native); custom WebUI code referencing the old attribute will lose the static-backdrop behaviour.

Rspamd docs update · 2026-07-26

Font Awesome SVG-with-JS is removed in favour of a local SVG sprite; any custom markup or extensions referencing Font Awesome JS APIs or its CSS classes outside the automated <i class="fas fa-name"> replacement sweep will stop rendering icons.

Rspamd docs update · 2026-07-26

The old zero-anchored fuzzy probability weight curve (sqrt(prob)) is not preserved; deployments relying on the previous scoring behaviour for non-exact fuzzy matches will see different scores after upgrade.

Rspamd docs update · 2026-07-26

HAVE_ED25519 no longer gates libsodium Ed25519 code in the DKIM path; builds that previously worked around missing OpenSSL Ed25519 support via compile-time flags may need configuration review.

Rspamd 4.1.3 · 2026-07-26

WebUI: jQuery has been removed entirely; all modules now use native DOM and XMLHttpRequest. Font Awesome is replaced by a local SVG sprite — any customizations or plugins depending on jQuery or Font Awesome in the WebUI will break.

Rspamd 4.1.3 · 2026-07-26

DKIM: HAVE_ED25519 is now scoped to OpenSSL key parsing only, changing ed25519 verification behavior on OpenSSL builds.

Claude Code v2.1.219 · 2026-07-25

Opus 4.7 is removed from fast mode; /fast now applies only to Opus 5 and Opus 4.8.

Claude Code v2.1.219 · 2026-07-25

Dynamic workflows now default to a medium size guideline (fewer than 15 agents); workflows relying on the previous unrestricted default will be subject to this new cap unless overridden in /config.

Claude Code v2.1.219 · 2026-07-25

Managed MCP allowlist/denylist ${VAR} entries now resolve from the startup environment and managed-settings env instead of the settings-file env, which may change which values are substituted.

Pi docs update · 2026-07-25

The compat.sendSessionIdHeader flag is removed from models.json; session-affinity behavior is now controlled by compat.sessionAffinityFormat (openai, openai-nosession, or openrouter). Replace sendSessionIdHeader: false with sessionAffinityFormat: "openai-nosession".

Pi docs update · 2026-07-25

The SDK's CreateAgentSessionOptions.authStorage and modelRegistry options are replaced with the async modelRuntime option.

Pi docs update · 2026-07-25

AuthStorage and its storage backends are no longer exported; use ModelRuntime (or a custom pi-ai CredentialStore), or readStoredCredential() for one-off reads of auth.json.

Pi docs update · 2026-07-25

ModelRuntime.getAll(), find(), getSnapshot(), and getAuthOptions() are removed; use the pi-ai Models methods getModels(), getModel(), getProviders(), and checkAuth() directly.

Pi docs update · 2026-07-25

SDK request-auth assembly via ModelRegistry.getApiKeyAndHeaders() is replaced by ModelRuntime.getAuth(); passing a provider ID returns provider-scoped auth, passing a model also resolves built-in, models.json, and extension model headers.

Pi docs update · 2026-07-25

ModelRegistry.refresh() changed from synchronous void to Promise<void> because models.json loading is asynchronous; extensions must await it before making synchronous registry reads.

Pi docs update · 2026-07-25

Canonical dynamic catalog refresh moved to async ModelRuntime.refresh() / pi-ai Models.refresh(); legacy extension OAuth modifyModels remains supported only as a synchronous compatibility projection after credential initialization.

Pi docs update · 2026-07-25

Grok 3, Grok 3 Fast, Grok 4.20 variants, and Grok Code Fast 1 have been removed from the built-in xAI model catalog — any configuration referencing these models will break.

Tenzir docs update · 2026-07-25

Values like "2026-07-21 13:55:59 GMT" that previously stayed as strings are now automatically recognized as timestamps during type detection (e.g., when reading CSV files), which may change pipeline behavior for workflows relying on those values being strings.

Clerk changelog · Jul 24, 2026 · 2026-07-24

Beginning January 18, 2027, CBC-mode SSL/TLS cipher suites (including TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, and others) will be removed from Clerk-managed subdomains (clerk.example.com, accounts.example.com); clients that can only negotiate a CBC cipher will fail the TLS handshake after their subdomain's certificate rotates.

Detection Rules dev-v2.0.0 · 2026-07-24

Emitted related integrations now use >= instead of ^ for version constraints, which is expected to not function on Elastic stacks older than 9.5 — ensure your stack schema map and/or packages.yml match your stack version before upgrading.

Detection Rules dev-v2.0.0 · 2026-07-24

MITRE ATT&CK v19 mappings are automatically applied on stack >= 9.5; to use v19 on stacks <= 9.4 you must explicitly set DR_THREAT_MAPPING_FRAMEWORK="MITRE ATT&CK" and DR_THREAT_MAPPING_VERSION=1, or add threat_mapping_framework: "MITRE ATT&CK" and threat_mapping_version: "19" to your _config.yaml.

DNSFilter changelog · Jul 24, 2026 · 2026-07-24

Starting with macOS Roaming Client v2.4.4, macOS 13 Ventura or later is required; macOS 12 Monterey is no longer supported.

GitGuardian Self-Hosted 2026.7 - Required (2026-07-24) · 2026-07-24

Helm installations: logCollector.collectMigrationLogs is now enabled by default and injects a native sidecar requiring Kubernetes 1.29 or later; on older clusters you must set logCollector.collectMigrationLogs: false.

GitGuardian Self-Hosted 2026.7 - Required (2026-07-24) · 2026-07-24

Endpoint Protection (Developer Endpoint Protection) is not functional on self-hosted instances in this release — do not upgrade if you rely on Endpoints without contacting GitGuardian support first.

Immuta updated · Jul 24, 2026 · 2026-07-24

Snowflake integration architecture update (rolling out July 23, 2026): Immuta policy role names used to grant users access to Snowflake data sources will be changed and recreated; any automation or tooling that references specific policy role names by their current values will need to be updated.

Immuta updated · Jul 24, 2026 · 2026-07-24

Immuta will no longer display integration error banners when integration validation fails for Snowflake; errors will only be visible through the connections experience.

Immuta updated · Jul 24, 2026 · 2026-07-24

When a data source is disabled in Immuta, Immuta now revokes data owners' Immuta-managed grants in the data platform (behavior change releasing 8/1 by default, 9/1 for all).

Nebula v1.11.0 · 2026-07-24

Logging has switched from logrus to Go's structured slog: log levels are now upper case (level=INFO), trace prints as level=DEBUG-4, timestamps are always RFC3339Nano, logging.timestamp_format is ignored, and some messages were reworded. Embedders must update constructors to accept *slog.Logger.

Nebula v1.11.0 · 2026-07-24

firewall.inbound_action and firewall.outbound_action were each applied to the opposite direction; this is now corrected. If you set either, you are currently getting the behavior of the other and likely need to swap them before upgrading.

Nebula v1.11.0 · 2026-07-24

On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and listener port by default, bypassing Windows Defender Firewall (WDF) inbound rules for those. Set tun.windows_bypass_wdf and listen.windows_bypass_wdf to false to leave WDF in charge.

Nebula v1.11.0 · 2026-07-24

On Windows, the Nebula device network category is now set to private instead of whatever Windows chose (usually Public). Set tun.network_category to unset to keep the old behavior.

Nebula v1.11.0 · 2026-07-24

Reject packets for non-TCP traffic now use ICMP code 13 (communication administratively prohibited) instead of code 3 (port unreachable). Anything keying off the old code needs updating.

Nebula v1.11.0 · 2026-07-24

The SSH debug server's profiling commands (start-cpu-profile, save-heap-profile, save-mutex-profile) are now confined to sshd.sandbox_dir (default $TMP/nebula-debug). Absolute paths outside that directory are rejected; the directory is not created automatically. Scripts using paths elsewhere must set sshd.sandbox_dir accordingly.

Portkey docs update · 2026-07-24

Configs exceeding the new fan-out limits (100 root-level targets, 1,000 for conditional strategy, 50 nested targets per root target) will be rejected at request time; override with MAX_ROOT_CONFIG_TARGETS, MAX_NESTED_CONFIG_TARGETS, or MAX_CONDITIONAL_ROOT_CONFIG_TARGETS environment variables before upgrading.

tetragon docs update · 2026-07-24

--release-pinned-bpf defaults to true; continuous enforcement across restarts requires explicitly setting --release-pinned-bpf=false, otherwise the previous BPF tree is removed at startup before replacement policies load.

Veracode SCA updates (2026-07-24) · 2026-07-24

The default SCA agent download URL changes from https://download.sourceclear.com to https://sca-downloads.veracode.com; the legacy URL will be retired after 12 months.

Veracode SCA updates (2026-07-24) · 2026-07-24

The default backend API URL for Commercial region customers changes from https://api.sourceclear.io to https://sca-api.veracode.com; the legacy URL will be retired after 12 months.

Veracode SCA updates (2026-07-24) · 2026-07-24

The default backend API URLs for European region customers change from https://platform-backend.analysiscenter.veracode.eu to https://sca-api.veracode.eu; legacy URLs will be retired after 12 months.

Veracode SCA updates (2026-07-24) · 2026-07-24

The default backend API URLs for US Federal region customers change from https://platform-backend.analysiscenter.veracode.us to https://sca-api.veracode.us; legacy URLs will be retired after 12 months.