The week in full · Aug 1–7

Identity & Access Management · 2026-08-07

Google Workspace Group and Group Membership sync is now GA in Auth0, with paginated dashboard UI and self-service selective group sync.

• Adds paginated, searchable, filterable table in the Auth0 Management Dashboard for browsing and selecting Google Workspace groups to sync.
• Enables self-service selective Google Workspace Directory Sync for Groups via the Self-Service assistant flow, letting enterprise IT admins choose all or a subset of groups to synchronize.

AI Coding Agents · 2026-08-07

Claude Code v2.1.224 adds self-hosted runners, cross-session messaging, archive plugin sources, and new sandbox credential-masking options.

• New claude self-hosted-runner subcommand turns your own machines or containers into execution environments for Claude Code web, mobile, and desktop sessions (Team and Enterprise plans).
• New ANTHROPIC_BEDROCK_REGION_PREFIX environment variable lets Bedrock users prefer a specific cross-region inference profile over the AWS_REGION-derived default.
• New crossSessionInbound and dialogExpiry settings: cross-session messages sent to a bypassed-permission session are held for approval; messages to other sessions auto-deliver.

AI Coding Agents · 2026-08-07

Cline desktop v0.0.10 adds OAuth for remote MCP servers, mcp uninstall/mcp rm CLI commands, and new keyboard shortcuts.

• Adds cline mcp uninstall <name> command (alias: cline mcp rm) to remove a registered MCP server from cline_mcp_settings.json.
• Adds CLINE_MCP_SETTINGS_PATH environment variable to point the CLI at a custom MCP settings file.
• Remote MCP servers can now authenticate with OAuth from Settings → MCP, including servers that require a pre-registered OAuth client (client ID/secret) instead of dynamic registration; stored tokens are invalidated when a server's client configuration changes.

Agentic Infrastructure · 2026-08-07

emisar runner 0.17.2 adds BunnyCDN operations, explicit runbook targets, and production MIG rollout zone placement.

• Adds BunnyCDN operations and explicit runbook targets.
• Allows production MIG rollout placement in available zones.

AI Coding Agents · 2026-08-07

Kiro adds open Agent Plugin format support, session pinning, and Kiro CLI hand-off in Agent Focus Mode.

• Supports installing Powers packaged in the open Agent Plugin format from a local folder or GitHub URL, bundling skills, steering, scripts, and assets for sharing across compatible agent tools.
• Adds Pin Session in Agent Focus Mode to keep a session pinned at the top of its section.
• Adds Open with Kiro CLI to resume an existing session directly in the Kiro CLI.

AI Coding Agents · 2026-08-07

Codex CLI v0.147.0 adds --approve-for-me, portable Agent Plugins, MCP 2026-07-28 protocol support, and Bedrock cached web search.

• Adds --approve-for-me CLI flag to codex exec to enable automatically reviewed approvals without manual confirmation prompts.
• Supports the opt-in MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup.
• Installs portable Agent Plugins and searches across local, personal, workspace, and remote plugin catalogs.

AI Coding Agents · 2026-08-07

Adds migrate-rollouts subcommand to inspect and migrate legacy local sessions to paginated thread history.

• Adds migrate-rollouts subcommand with --apply, --thread, --max-mib-per-second, --json, and --verbose flags to inspect or migrate legacy local sessions to paginated thread history.
• Adds a Guardian circuit-breaker policy that interrupts cyber model turns after the first Guardian denial, while retaining existing denial thresholds for all other models.
• Supports fetching remote installed plugins across all scopes.

AI Coding Agents · 2026-08-07

OpenCode TUI gains cursor config block to control terminal cursor style and blinking in input fields.

• Adds cursor config block with style and blinking keys to control the terminal cursor in TUI input fields; style accepts "block" (default), "underline", "line", or "default" (restores terminal default, making blinking ineffective).

AI Coding Agents · 2026-08-07

OpenCode adds cursor.style and cursor.blinking config keys to control terminal cursor appearance.

• Adds cursor.blinking config key to toggle cursor blinking; note it has no effect when cursor.style is set to "default", which restores the terminal's default cursor.

AI Coding Agents · 2026-08-07

OpenCode v1.18.15 adds session JSON export from the UI and broader desktop locale coverage.

• Adds Export... option to the session 3-dot dropdown, an Export session button in the Context tab, and a session.export command palette action (/export) to export full session transcripts as JSON from the UI.
• Expands locale coverage across the desktop app with much broader language support.

Vulnerability Management · 2026-08-07

OSV-Scanner adds ScanGoModVersion config key to optionally scan the Go version declared in go.mod files

• Adds ScanGoModVersion config key to enable scanning of the Go version from go.mod files, which is disabled by default because the go directive specifies a minimum required language version rather than the actual toolchain in use.

Vulnerability Management · 2026-08-07

OSV-Scanner now supports Ubuntu chiseled packages via /var/lib/chisel/manifest.wall

• Adds support for scanning Ubuntu chiseled packages by reading /var/lib/chisel/manifest.wall.

Vulnerability Management · 2026-08-07

OSV-Scanner v2.5.0 completes the OSV-Scalibr pipeline migration, adds VSIX scanning, and expands ecosystem support for SUSE, Azure Linux, and more.

• Enables most osv-scalibr plugins via the --experimental-plugins flag after migrating scanning, filtering, and matching to the full osv-scalibr end-to-end pipeline.
• Adds a javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
• Extends ecosystem mapping in osv-scalibr to cover SUSE, Azure Linux / Mariner, Alpaquita, Mageia, openSUSE Leap, and Debian/Ubuntu PURL.

AI Coding Agents · 2026-08-07

Pi v0.84.0 adds fullscreen TUI, AGENTS.override.md per-directory context, Baseten provider, custom samplingParams, and a remote-session client API.

• Adds opt-in Ctrl+P/Ctrl+N prompt history navigation in the TUI editor.

AI Coding Agents · 2026-08-07

Pi 0.84.1 adds Qwen Token Plan Individual provider, pi auth check preflight, extension terminate support, and fullscreen selection improvements.

• Adds QWEN_TOKEN_PLAN_API_KEY environment variable and Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog.
• New pi auth check command runs provider/model auth preflight and optionally emits the resolved credential.
• Adds terminate support to blocked extension tool_call events, allowing all-terminating batches to skip the automatic follow-up model call.

AI Coding Agents · 2026-08-07

Pi v0.84.1 adds pi auth check for credential preflight, Qwen Token Plan Individual provider, and terminate support for blocked extension tool_call events.

• Adds pi auth check subcommand to verify provider or model credentials before a run, with optional resolved credential output.
• Adds QWEN_TOKEN_PLAN_API_KEY environment variable and Qwen Token Plan Individual as a built-in provider with its subscription model catalog.
• Adds terminate support to blocked extension tool_call event handlers, allowing all-terminating batches to skip the automatic follow-up model call.

AI-Powered Offensive Security · 2026-08-07

Strix v1.5.0 adds LLM_EXTRA_HEADERS, LLM_DISABLE_STREAMING, STRIX_REASONING_EFFORT, API spec/Postman targets, a Go/Bubble Tea TUI, and richer SCA reporting.

• Adds LLM_EXTRA_HEADERS environment variable to inject custom request headers into any OpenAI-compatible endpoint, enabling use with proxies, gateways, or auth-requiring local models.
• Adds LLM_DISABLE_STREAMING environment variable as an opt-in flag to disable streaming for OpenAI-compatible endpoints that don't support it.
• Adds STRIX_REASONING_EFFORT=max config option for providers that expose a reasoning-effort control.

SIEM · 2026-08-07

Sumo Logic adds threatlookup operator for searching threat intelligence indicators directly in log data.

• New threatlookup operator enables searching threat intelligence indicators against log data in Sumo Logic queries.
• Threat intelligence indicator search and Cloud SIEM entity enrichment now default to active indicators only.

SAST / SCA / Code Security · 2026-08-07

Veracode DAST adds business unit targeting, custom host-to-IP mappings, Directory Restrictions, enhanced scheduling, and open-port scanning.

• Adds custom host-to-IP address mapping configuration for DAST scans when DNS lookup is unavailable or not desired.
• Adds Directory Restrictions to target configuration to control DAST scan scope.
• Enhances the DAST Schedule feature with advanced scheduling capabilities and greater configuration flexibility; all existing schedules are automatically migrated.

Detection Engineering · 2026-08-06

Beelzebub v3.9.0 adds boot-time background plugins, YAML-based plugin config, and shared JSON Schema validation for honeypot configs.

• Migrates plugin declarations to YAML config, enabling declarative plugin management via configuration files.
• Adds ServicePlugin support for background plugins that start automatically at boot time.
• Adds shared JSON Schema validation for honeypot configurations, catching config errors before deployment.

AI Coding Agents · 2026-08-06

Claude Code v2.1.223 adds owner wildcard marketplace controls, /teleport for cloud-to-local handoff, and upgraded /code-review with effort levels.

• Adds "owner/*" wildcard entries to strictKnownMarketplaces and blockedMarketplaces managed settings to allow or block all marketplace repos under a GitHub org in one entry.
• Adds claude --teleport <session id> flag and a /teleport hint in cloud sessions to continue a cloud session locally.
• Adds CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 env var to opt out of the new behavior that keeps sessions on unrecognized model IDs within the assumed context window.

Identity & Access Management · 2026-08-06

Clerk adds Device Trust: auto-requires a second factor on new-device password sign-ins without MFA enabled.

• New Device Trust capability automatically requires a second factor when a user signs in with a password from a new device and has not enabled MFA.

Identity & Access Management · 2026-08-06

Clerk adds community-maintained Flutter integration documentation.

• Adds community-maintained Flutter integration support, with dedicated documentation for integrating Clerk into Flutter applications.

Identity & Access Management · 2026-08-06

Clerk adds Google Workspace Directory Sync with role mapping and custom attribute support.

• Adds Google Workspace Directory Sync to sync users and groups directly from Google Workspace into Clerk, with support for role mapping and custom attributes.

AI Coding Agents · 2026-08-06

Cline v4.1.6 adds meta/muse-spark-1.2-contributor to the Cline provider model catalog.

• Adds meta/muse-spark-1.2-contributor to the Cline provider, alongside a refreshed model catalog.

AI Coding Agents · 2026-08-06

Cline CLI v3.0.51 adds meta/muse-spark-1.2-contributor to the Cline provider and standardises reasoning-effort control across all providers including Ollama.

• Adds meta/muse-spark-1.2-contributor as a selectable model on the Cline provider, alongside a refreshed model catalog.
• Reasoning effort now applies consistently across all providers, including Ollama, instead of going through per-provider thinking overrides; disabling reasoning is respected everywhere.

AI Coding Agents · 2026-08-06

Cline SDK v0.0.71 unifies reasoning settings across all AI SDK providers including Ollama and surfaces a new Cline provider model.

• Surfaces meta/muse-spark-1.2-contributor in the model catalog for the Cline provider.

AI Coding Agents · 2026-08-06

Cline v4.1.5 adds a dedicated notice when a free model promotion ends and unifies reasoning settings across AI SDK providers including Ollama.

• Unified reasoning settings (effort levels and enable/disable toggles) now map to a shared path across all AI SDK providers, including Ollama, for consistent behavior without per-provider overrides.
• When a retired free model is requested, shows a dedicated notice with a button to pick another model instead of a generic error with only a Retry prompt.

Internet Services · 2026-08-06

Cloudflare Workers AI adds FLUX 3 Video (text/image/video-to-video) and ElevenLabs v3 text-to-speech models.

• Adds flux-3-video model from Black Forest Labs supporting text-to-video (t2v), image-to-video (i2v), and video-to-video (v2v) generation with synchronized audio, up to FHD resolution, and 5–20 second durations.
• Adds eleven-v3 model from ElevenLabs for expressive, natural text-to-speech generation with advanced voice control.

Internet Services · 2026-08-06

Cloudflare adds AI Gateway User Insights, identity-aware spend controls, agent tracing, Vectorize 20M-vector limit, and CI/CD for Artifacts repos

• Adds cf.user_id to AI Gateway request metadata when traffic flows through a Cloudflare Access-protected custom domain, enabling identity-aware spend limits, log filtering, and routing without passing user IDs from the client.
• Adds cf.artifacts.repo.pushed Wrangler trigger event so a CI Workflow fires automatically on every Artifacts repo push; configure via triggers.events[].type, filter.namespace, filter.repoName, target.scriptName, and target.workflowName in wrangler.toml.
• Adds cache.inputs option to ci.runner() in @cloudflare/ci SDK to reuse installed dependencies across sandboxed CI steps when the lockfile (e.g. pnpm-lock.yaml or bun.lock) is unchanged.

Internet Services · 2026-08-06

Cloudflare API gains sinkhole management, Pages tails/assets, BGP path analytics, and billable-usage endpoints.

• Adds GET /zones/{zone_id}/custom_hostnames/quota to retrieve the custom hostname quota for a zone.
• Adds GET /zones/{zone_id}/dnssec/zsk to list DNSSEC Zone Signing Keys (ZSKs).
• Adds POST /accounts/{account_id}/addressing/prefixes/{prefix_id}/validate to validate an IP prefix.

Internet Services · 2026-08-06

Cloudflare adds AI spend tracking with identity attribution, identity-aware AI Gateway controls, and 20M-vector Vectorize support.

• New User Insights feature tracks AI spend per identity and flags anomalous usage that may signal a security risk.
• Identity-aware controls in AI Gateway let teams set spend limits, control model access, and filter logs using Cloudflare Access identity.
• Vectorize indexes now support up to 20 million vectors, up from the previous limit.

Internet Services · 2026-08-06

Cloudflare adds AI spend tracking with identity attribution, identity-aware AI Gateway controls, Vectorize 20M vector support, and more.

• Adds User Insights for AI Gateway: track organization-wide AI spend, attribute it to identities, and flag anomalous usage that can signal a security risk.
• Identity-aware controls now available in AI Gateway: use Cloudflare Access identity to set spend limits, control model access, and filter logs.
• Agent traces for Think, Flue, and AI SDK instrumented by Agents SDK now show model calls, tool runs, approvals, token usage, and runtime operations per turn.

Container & Image Security · 2026-08-06

cosign v3.1.3 adds X.509 certificate chain support for OCI signing and auto-detects digest algorithms for public keys.

• Auto-detects the default digest algorithm for public keys, removing the need to manually specify it.
• Supports OCI signing with an X.509 certificate chain, enabling bring-your-own PKI workflows for container image signing.

AI Agent Frameworks · 2026-08-06

CrewAI 1.15.12 adds URLReadTool, unified crewai create <resource> scaffolding, and platform action tool metadata.

• Unifies project scaffolding under crewai create <resource>, replacing separate scaffold commands.
• Adds URLReadTool for reading arbitrary URLs inside agent workflows.
• Adds app metadata to platform action tools.

Runtime Security · 2026-08-06

Docker Sandboxes daemon now writes local audit logs as JSON Lines files with policy decision and session lifecycle records.

• Adds local audit log delivery: the sandbox daemon writes audit records as .jsonl files (JSON Lines format) to a per-OS directory, independent of cloud delivery.
• Default audit log paths are ~/Library/Logs/com.docker.sandboxes/sandboxes/auditkit/ (macOS), ${XDG_STATE_HOME:-~/.local/state}/sandboxes/sandboxes/auditkit/ (Linux), and %LOCALAPPDATA%\DockerSandboxes\sandboxes\logs\auditkit\ (Windows).
• Audit files are named audit-<utc-timestamp>-<process-uuid>-<seq>.jsonl; in-progress writes use a .tmp extension and are finalized by atomic rename at rotation thresholds of 5 minutes, 1000 events, or 50 MiB.

Runtime Security · 2026-08-06

Docker Sandboxes 0.35.0 adds AI Governance Audit Logs with local disk, Docker Cloud, CSV export, and SIEM streaming delivery modes.

• New AI Governance Audit Logs feature (requires Docker Sandboxes 0.35.0 or later and an AI Governance subscription) records principal, action, target, decision, and time for governance events — metadata only, no prompt content or parameter values.
• Supports two delivery modes: local disk (sandbox daemon writes JSON Lines files per host, suitable for air-gapped or custom log-shipper setups) and Docker Cloud (stores records centrally, on by default when AI Governance is enabled).
• Docker Cloud delivery powers a hosted audit log view, CSV export, and SIEM streaming from app.docker.com; local delivery alone does not enable these features.

Runtime Security · 2026-08-06

Docker Sandboxes adds sbx secret set-custom support for OpenCode Zen API keys with host-side proxy substitution

• Adds sbx secret set-custom -g --host opencode.ai --env OPENCODE_API_KEY --value to store OpenCode Zen API keys as custom secrets, keeping the real key in the host secret store while the sandbox receives a placeholder that the host-side proxy replaces on requests to opencode.ai.
• Adds sbx policy allow network opencode.ai:443 requirement for sandboxes using OpenCode Zen, enabling outbound network access to the OpenCode Zen service.

Runtime Security · 2026-08-06

Docker Sandboxes v0.38.0 adds local model routing, first-class MCP management, enterprise proxy/NTLM/Kerberos support, and per-sandbox network deny rules.

• Adds sbx run --model <name> claude to serve a local GGUF model via llmman, or an already-running Ollama install using an ollama/ prefix, routing Claude Code away from api.anthropic.com; enable with sbx settings set platform.allowExperimentalFeatures true and sbx settings set feature.model true.
• Adds sbx mcp as a first-class, no-longer-hidden subcommand for MCP server management.
• Adds sbx mcp add with --dir and OAuth override flags; registering a server immediately refreshes the mcp-find/mcp-add index in every running sandbox so new servers are discoverable without recreating sandboxes.

Firewalls & Network Defense · 2026-08-06

Fastly Next-Gen WAF Rules and Signals APIs now return a created_by field showing the creator's email.

• Adds created_by field to Next-Gen WAF Rules and Next-Gen WAF Signals API responses, identifying the email address of the user who created the rule or signal.

Threat Intelligence · 2026-08-06

Feedly Vulnerability Intel Agent now ingests Atlassian security releases with per-CVE enrichment, stack filters, and alert deployment

• Adds a Latest Atlassian Security Release filter in the Vulnerability Intel Agent that always points to the most recent Atlassian advisory, ingested within minutes of publication — no manual updates needed each cycle.
• Supports product-level filtering so practitioners can scope CVEs down to the specific Atlassian products (e.g., Confluence Data Center, Sourcetree, Jira) running in their environment.
• Supports CVSS and EPSS threshold filters to match internal patch policies, letting teams isolate CVEs that breach both thresholds simultaneously.

Threat Intelligence · 2026-08-06

Feedly Vulnerability Intel Agent now ingests Atlassian security releases within minutes, with CVE filtering by attack path, product, and patch policy.

• Adds a Latest Atlassian Security Release filter in the Vulnerability Intel Agent that always points to the most recent Atlassian advisory, eliminating manual updates each cycle.
• Supports filtering Atlassian CVEs down to specific products in your stack (e.g., Confluence Data Center, Sourcetree, Jira) to surface only relevant exposures.
• Supports filtering by attack path — attack vector, privileges required, and user interaction — to isolate unauthenticated, no-interaction reachable CVEs.

AI/LLM Security · 2026-08-06

Giskard v1.0.1b6 adds third-party scan integration and enforces non-blank judge reasons in checks.

• Integrates third-party scan support into vulnerability_scan via the new feat(scan): integrate third party scan capability, extending the scanner beyond built-in generators.
• Enforces non-blank judge reasons in LLM-as-judge checks — evaluations that return an empty reason string now fail explicitly instead of silently passing.
• Exposes default registry generators on the public API (chore(scan): export default registry generators on the public API), making it easier to inspect and reuse built-in ScenarioGenerator instances.

Secrets Detection & Management · 2026-08-06

GitGuardian Detection Engine 2.169.1 adds Lovable token detectors and tightens GitHub and npm token precision.

• New detector: identifies Lovable project access tokens.
• New detector: identifies Lovable git tokens.
• GitHub Personal Access Token, GitHub OAuth Token, and GitHub App Token detectors now skip values that fail format validation, reducing false positives from generic detectors.

Secrets Detection & Management · 2026-08-06

GitGuardian Detection Engine 2.169 adds 7 new detectors, a Supabase JWT checker, and expands PostgreSQL credential matching.

• New detector for Slack Workflow Builder webhook trigger URLs.
• New detector for n8n API keys.
• New detector for Atlassian auth keys (OAuth 2.0 access tokens issued by auth.atlassian.com).

Exploitation & C2 · 2026-08-06

NodeZero 2026.07 adds flexible Tripwire deployment, AD enhancements, MCP Server updates, and MSP controls

• More-flexible Tripwire deployment reduces reliance on the Remote Access Tool (RAT), cutting EDR noise from endpoint detection and response systems.
• Active Directory enhancements improve group enumeration, NTLM posture assessment, and DCSync detection.
• MCP Server updates deliver stronger authentication, a streamlined toolset, and expanded documentation for safer integrations.

Exploitation & C2 · 2026-08-06

NodeZero July 2026 adds flexible Tripwire deployment, AD enhancements, expanded Rapid Response coverage, and MCP Server security upgrades.

• More-flexible Tripwire deployment reduces reliance on the Remote Access Tool (RAT), cutting Endpoint Detection and Response (EDR) noise during deployments.
• Expanded Rapid Response coverage adds exploitability testing for Cisco Unified Communications Manager, SonicWall SMA1000, Adobe ColdFusion, and ManageEngine ADAudit Plus.
• Active Directory enhancements improve group enumeration, NTLM posture assessment, and DCSync detection.

Exploitation & C2 · 2026-08-06

NodeZero Tripwires automatically place decoy files and credentials along critical attack paths during pentests to enable early threat detection.

• Introduces NodeZero Tripwires, decoy files and credentials automatically deployed by NodeZero along critical attack paths during autonomous pentests — triggering an immediate alert if a malicious actor interacts with them.
• Deploys up to two tripwires per asset during testing, placed at points where NodeZero has gained access via a Remote Access Tool (RAT) or direct file write.
• Adds a Tripwires dashboard in the NodeZero Portal for visibility into deployed tripwires across your environment.

Identity & Access Management · 2026-08-06

iDenfy adds a dashboard UI for creating and managing Age Estimation sessions, with configurable safety margins and ID step-up verification.

• New Age Estimation section in the dashboard lets partners browse, filter, search, and inspect Age Estimation sessions created via the API or the dashboard.
• New session-creation form (New estimation) on the Age Estimation page exposes Minimum age (1–120), Safety margin (0–20 years), ID verification for uncertain results (step-up document scan), Retry limit (1–3), Save selfie photo, and Link expiry time settings across General settings and Verification redirects tabs.
• Per-session Webhook URL field in Verification redirects lets you override the account-level Age Estimation notification URL for individual sessions.

Identity & Access Management · 2026-08-06

iDenfy adds Age Estimation: selfie-only age-gating with optional document step-up, webhook results, and dashboard review

• New Age Estimation feature checks whether a user meets a minimum age requirement using a single selfie — no document scan required in the common case, suited for alcohol, gambling, and adult-content age-gating.
• Automatic document step-up: when the AI model lacks confidence, a document check is triggered to read an exact date of birth from the ID and compare the ID portrait against the capture selfie.
• Session outcomes — SUCCESS, UNDERAGE, UNCERTAIN, FACE_MISMATCH, ATTEMPTS_EXCEEDED — are delivered via a result webhook as soon as a session finishes.

Identity & Access Management · 2026-08-06

iDenfy adds configurable email templates for KYB verification requests, update requests, and completed-company notifications.

• New Email template configuration in the dashboard (Business Verifications → Configurations → Email template) lets teams create branded email templates for KYB workflows.
• Supports three template types: sending a new business verification session URL, sending a renewed session URL to request an information update, and sending a verification result for a completed company.
• Templates include an Add verification link action that inserts a session URL placeholder into the email body, ensuring recipients can always reach their verification session.

Identity & Access Management · 2026-08-06

iDenfy adds Age Estimation: infer a user's age from a selfie, with optional document fallback when confidence is low.

• New Age Estimation capability estimates a user's age from a selfie photo, triggering an optional document check when the result is uncertain.

Identity & Access Management · 2026-08-06

iDenfy Sprint 132 adds Age Estimation in dashboard, Spanish KYB, risk assessment in company API, and new digital IDs for India and Philippines.

• Age Estimation is now available in the dashboard, including session creation, filtering, and result details.
• Business verification adds Spanish language support.
• The company verification API now returns risk assessment results.

Identity & Access Management · 2026-08-06

iDenfy adds a Bank Verification API to its identity verification service.

• Adds a Bank Verification API for programmatic bank account verification workflows.

Identity & Access Management · 2026-08-06

iDenfy adds Age Estimation, Face Authentication, Fraud Prevention, Bank Verification, KYB, and AML Screening APIs with webhook and dashboard support

• New Age Estimation API: creates sessions via the Partner API, pre-checks finances, and rejects requests with 402 when funds are insufficient.
• New Age Estimation Webhooks endpoint delivers results via HTTP POST with signed payloads, per-session URL overrides, and idempotent delivery.
• New Age Estimation Dashboard lets teams create sessions and browse results with status filter groupings, session detail views, and document step-up links.

Identity & Access Management · 2026-08-06

iDenfy adds Age Estimation, Blocklist API, KYB automation re-run endpoint, Companies House integration, and more across recent sprints.

• New Blocklist API endpoint for managing blocklisted identities.
• New API endpoint to re-run KYB automation on existing records.
• Company verification API now returns risk assessment results.

Data Security & DLP · 2026-08-06

Immuta adds native Trino/Starburst integration with policy enforcement, customizable plugin properties, and read/write access mapping.

• New Trino integration allows registering a Trino connection so Immuta can administer access controls directly on objects in Trino.
• Adds customizable Trino plugin properties to tailor the Immuta Trino plugin configuration to your environment.
• Supports customizing how read and write access policies are enforced for Starburst (Trino) via write access mapping.

Data Security & DLP · 2026-08-06

Immuta adds connection health states, per-object policy sync toggles, managed groups for policies, and Redshift viewless automated data discovery.

• New ACTIVE, INACTIVE, or UNHEALTHY health state display per connection in the Connections UI for Databricks Unity Catalog and Snowflake integrations.
• Tag inheritance at the database or schema level, with bulk assignment or removal propagating to all attached data sources.
• Data products now support two separate request forms: one for data access requests and one for masking exception requests, each with independent questions and data use agreements.

Endpoint Security (EDR/XDR) · 2026-08-06

Iru's Software Update Library Item now supports Apple beta program enrollment, offering opt-in or enforced enrollment without requiring a specific version.

• The Software Update Library Item now supports Apple beta program enrollment, allowing end users to opt-in or enforcing a specific program without tying it to a specific version.

Endpoint Security (EDR/XDR) · 2026-08-06

Iru extends phased rollout controls to Apple Managed OS updates, giving admins staged fleet deployment.

• Extends phased rollout support — previously available for Mac Auto Apps — to Apple Managed OS, letting admins stage OS update declarations across their device fleet instead of pushing to all devices simultaneously.

Endpoint Security (EDR/XDR) · 2026-08-06

Iru's Single Sign-On Extension Library Item now supports Authenticated Guest Mode for Platform SSO on macOS.

• Adds Authenticated Guest Mode configuration support to the Single Sign-On Extension Library Item when using Platform SSO with macOS.

Web Application Security · 2026-08-06

Katana v1.7.0 adds secrets/endpoints extractors to the knowledge base, content similarity deduplication, and headless callbacks.

• Adds -kb-secrets flag to enable a secrets extractor within the knowledge base, automatically detecting exposed credentials and tokens during crawls.
• Adds -kb-validate-secrets flag to validate detected secrets live against their respective providers (sends real API calls).
• Adds -kb-endpoints flag to enable an endpoints extractor that classifies REST, GraphQL, SOAP, and XHR requests found during crawling.

Digital Forensics & Incident Response · 2026-08-06

MVT gains a custom CLI command extension system via entry-points, --load-command, and MVT_IOS/ANDROID_CUSTOM_COMMANDS env vars.

• Adds --load-command <file-or-folder> flag to mvt-ios and mvt-android to inject local .py Click commands at runtime without packaging; the flag can be repeated.
• Adds MVT_IOS_CUSTOM_COMMANDS and MVT_ANDROID_CUSTOM_COMMANDS environment variables to auto-load a command file or folder on every invocation.
• Supports installing third-party command packages via mvt.ios.cli_plugins and mvt.android.cli_plugins Python entry-points in pyproject.toml, making new top-level subcommands available directly in the respective CLI.

General Utilities & Libraries · 2026-08-06

Obsidian 1.8.5 adds SettingDefinitionBase#disabled to the API and more granular startup stats.

• The startup stats window now shows more granular information about startup speed.

General Utilities & Libraries · 2026-08-06

Obsidian Mobile 1.13.5 adds swipe-to-close tabs in the tab switcher and proportional checkbox scaling.

• Adds swipe-to-close gesture to dismiss tabs directly from the tab switcher.
• Tabs now animate to their new position after closing a tab from the tab switcher.
• Mobile toolbar settings page now displays icons alongside each command for easier identification.

Local LLM Runtimes · 2026-08-06

Ollama v0.32.6 adds automatic MTP speculative decoding for Qwen3.5 on Apple GPUs and fixes OpenAI streaming wire format compliance

• Adds stream_options.include_usage support in /v1/chat/completions so usage is returned in a separate trailing chunk, matching OpenAI's streaming wire format — role now appears only on the first chunk and finish_reason on its own chunk.
• Qwen3.5 inference on Apple GPUs is faster: the MLX engine now automatically uses the model's MTP head for speculative decoding.
• Experimental image generation has been removed; continue using v0.32.5 for image generation support.

AI Coding Agents · 2026-08-06

Adds thread/section/move API, section_position sorting to thread/list, and a hidden --psp flag for PSP routing in the app-server.

• Adds hidden --psp flag to the app-server to enable process-only PSP routing for first-party ChatGPT requests.
• Loads cloud-managed servers in MCP CLI commands.
• Exposes MCP read-only hints in tool call items.

AI Coding Agents · 2026-08-06

Codex CLI adds image resize notices, local auth policy enforcement, and symlinked skill path preservation.

• Adds the disabled-by-default image_resize_notice feature: when enabled, appends a developer message after resized images in user messages or tool outputs, reporting each image's original and prepared dimensions.
• Enforces managed authentication requirements locally via a requirements.toml allowlist for login methods and ChatGPT workspaces, combining managed and existing workspace restrictions by intersection and failing closed when no usable login method remains.
• Preserves discovery paths for symlinked skills in the skill catalog, allowing either the discovery path or canonical path for structured selections and linked skill mentions.

AI Coding Agents · 2026-08-06

Codex CLI alpha.6.5 adds Amazon Bedrock cached web search, stricter Agent Plugin runtime boundaries, and expanded MCP namespace description limits.

• Skips symbolic links and other non-file, non-directory entries when installing plugins into the store instead of rejecting the installation.

AI Coding Agents · 2026-08-06

Codex CLI alpha.11 adds per-session code-mode execution limits and switches API-key Guardian reviews to gpt-5.6-luna.

• Adds create_session_with_limits and session-scoped cell execution limits via CodeModeSessionCellExecutionLimits, clamping execute and wait yield times to max_yield_time_ms without terminating the running cell.
• Switches Guardian approval reviews authenticated with an API key to use gpt-5.6-luna, while retaining codex-auto-review for ChatGPT authentication; falls back to the bundled Guardian policy when the selected model has no catalog-provided review policy.
• Caches McpBinding per published MCP runtime once the tool catalog revision is stable, reusing it across sampling steps and rebuilding only after a runtime publish or catalog change.

AI Coding Agents · 2026-08-06

Codex CLI alpha.10 adds concurrent exec-server dispatch, safer TUI defaults for cyber models, and expanded MCP namespace description limits.

• Adds --concurrent-requests flag (alias concurrent-requests, default 1) to the exec-server subcommand to enable opt-in concurrent request dispatch across connections.
• Adds --psp flag (global, hidden) to the main CLI and app-server for process-scoped PSP routing of first-party ChatGPT requests.
• Adds safer TUI defaults for cyber models.

AI Coding Agents · 2026-08-06

OpenCode adds Poolside provider support with custom deployment config and dual xAI auth options

• Adds Poolside as a supported provider via its OpenAI-compatible API, with API key configuration at platform.poolside.ai.
• Supports self-hosted Poolside deployments configured as a custom OpenAI-compatible provider, storing credentials in ~/.secrets/poolside-key and using the /openai/v1/models endpoint to discover available model IDs.
• Supports reasoning_content field and interleaved reasoning mode for Poolside deployment models.

AI Coding Agents · 2026-08-06

OpenCode adds Poolside provider support with custom deployment config and xAI SuperGrok device-code OAuth.

• Adds Poolside as a supported provider via its OpenAI-compatible API, configurable with a custom provider ID, base URL (e.g. https://poolside.example.com/openai/v1), and API key stored at ~/.secrets/poolside-key.
• Supports Poolside self-hosted deployments by configuring a custom OpenAI-compatible provider with model IDs sourced from the /openai/v1/models endpoint and reasoning fields (reasoning_content, interleaved) for thinking-capable models.
• Adds xAI (Grok) authentication via SuperGrok subscription using device-code OAuth — OpenCode opens xAI's verification link with the user code pre-populated and polls the token endpoint automatically.

AI Coding Agents · 2026-08-06

xAI login simplified to a single device-code flow for better headless and remote environment support.

• Simplifies xAI login to a single device-code flow that works in headless and remote environments.

AI Coding Agents · 2026-08-06

OpenHands v1.10.0 adds activity log export, a featured automations dashboard, manifest-driven automation sub-pages, and faceted skills filtering.

• Adds activity log export capability to the interface.
• Ships a featured automations landing dashboard for discovering and launching automations.
• Adds manifest-driven sub-pages to the automation interface, enabling structured automation workflows.

SAST / SCA / Code Security · 2026-08-06

June 2026: Gantt-style trace timeline view makes slow spans and unexpected branches immediately visible.

• New Gantt-style trace timeline view lines up every span by start time, duration, and nesting to surface slow steps and unexpected branches at a glance.

Runtime Security · 2026-08-06

OpenShell v0.0.99 adds system CA root mode for sandboxes and honors OCI image working directories, plus a TCP_NODELAY latency fix.

• Adds system CA root mode to the build, enabling sandboxes to trust the host's system certificate authorities.

Secure Access (VPN / SASE / ZTNA) · 2026-08-06

OpenVPN v2.7.6 makes tun the default device, caps --ping/--keepalive at 24 h, and enables TCP_NODELAY by default.

• Omitting --dev from an OpenVPN config now defaults to --dev tun, removing a previously required boilerplate option for the common tun case.
• TCP_NODELAY socket flag is now always enabled on the local socket; --tcp-nodelay in server mode now specifically pushes socket-flags TCP_NODELAY to clients that may not have this default.

AI Coding Agents · 2026-08-06

Pi SDK adds setRuntimeApiKey(), removeRuntimeApiKey(), refresh() with abort signals, and CredentialSynchronizationError for provider credential lifecycle management.

• Adds setRuntimeApiKey(providerId, key) and removeRuntimeApiKey() methods to ModelRuntime for runtime credential management — each resolves once the affected provider's local catalog, composition, and availability snapshot are consistent.
• Adds CredentialSynchronizationError (with providerId, operation, credential, and cause fields) thrown when credentials are committed but local synchronization fails, enabling structured error inspection instead of blind retry.
• Adds refresh({ providers, signal }) to ModelRuntime for on-demand provider catalog freshness checks, with optional AbortSignal support for deadline control; returns an object with aborted and errors (keyed by providerId) fields.

AI Coding Agents · 2026-08-06

Pi custom providers gain thinking-format support with thinkingFormat and chatTemplateArgs fields, plus supportsFinishReason and token-refresh API.

• Adds thinkingFormat field to custom provider config, supporting values "openai", "openrouter", "deepseek", "together", "baseten", "zai", "qwen", "chat-template", "qwen-chat-template", "string-thinking", and "ant-ling" to control how thinking/reasoning output is parsed per provider.
• Adds chatTemplateArgs field (Record<string, string | number | boolean | null | { "$var": "thinking.enabled" | "thinking.effort"; omitWhenOff?: boolean }>) for passing dynamic thinking toggle values under chat_template_args when a provider expects them at the chat-template level.
• Adds supportsFinishReason optional boolean field to custom provider config to declare whether the provider returns a finish reason.

AI Coding Agents · 2026-08-06

Pi extensions gain pi.registerMarkdownTransformer() and async dynamic model discovery with cancellation support.

• Adds pi.registerMarkdownTransformer(transformer) API to let extensions transform Markdown in user text, assistant text, and assistant-thinking blocks before Pi renders them; transformers receive the Markdown string plus a context with messageType, isStreaming, and availableWidth fields.
• Transformers chain in extension load order, each receiving the output of the previous one; errors in a transformer are isolated and Pi continues with the next transformer in the chain.
• Adds async dynamic model discovery callback on providers; returned models replace extension-provided models and can be persisted via context.publish({ persist: entry }) or removed with persist: null.

AI Coding Agents · 2026-08-06

Pi adds fullscreen TUI viewport with transcript scrolling, history navigation actions, and configurable keybindings.

• Adds --tui-mode fullscreen flag that enables a dedicated fullscreen viewport with a primary transcript scroll region, fixed editor/status/footer dock, mouse-wheel and two-finger trackpad scrolling, OSC 8 hyperlink support, and click-to-copy text selection.
• Adds tui.altScreen.pageUp and tui.altScreen.pageDown actions to scroll the fullscreen transcript by one page, defaulting to ctrl+pageUp / ctrl+pageDown.
• Adds tui.altScreen.previousPrompt (ctrl+shift+up) and tui.altScreen.nextPrompt (ctrl+shift+down) actions to jump between marked messages in the fullscreen transcript.

AI Coding Agents · 2026-08-06

Pi adds fullscreen TUI mode, configurable scrollbar, image resizing, and Mermaid rendering controls

• Adds tuiMode setting (values: "regular", "fullscreen") and --tui-mode CLI flag to switch between standard and experimental fullscreen TUI modes at startup
• Adds fullscreenScrollbar setting to control transcript scrollbar visibility in fullscreen mode (values: show temporarily while scrolling, reserve rightmost column and keep visible, or "hidden")
• Adds markdown.mermaid setting to control Mermaid diagram rendering mode (values: "final", "streaming")

AI Coding Agents · 2026-08-06

Pi adds AGENTS.override.md context file override and a new --tui-mode fullscreen terminal UI mode.

• Adds AGENTS.override.md support: placing this file in a directory causes Pi to load it instead of the default context file for that directory, while context files from other directories still layer normally.
• Adds --tui-mode <mode> CLI flag with regular (default) and experimental fullscreen values; fullscreen mode locks the input, status, and footer widgets to the bottom of the viewport while the transcript scrolls inside it, with mouse/trackpad and keyboard scroll support.
• Supports inline images in fullscreen TUI mode for terminals implementing the Kitty graphics protocol (Kitty, Ghostty); iTerm2 renders them as text placeholders in fullscreen due to protocol limitations, while regular mode preserves normal iTerm2 inline-image rendering.

AI Coding Agents · 2026-08-06

Pi 0.84.0 adds fullscreen TUI, Mermaid/LaTeX rendering, per-directory context overrides, custom sampling params, and Baseten provider support.

• Adds --tui-mode fullscreen CLI flag to enable fullscreen TUI mode, with a sticky editor/footer dock, independently scrollable transcript, and draggable scrollbars configurable as auto, always, or hidden.
• Adds AGENTS.override.md per-directory context files that replace AGENTS.md or CLAUDE.md in the same directory while preserving context from other directories.
• Adds samplingParams support in model config, model overrides, extension providers, and stream options for arbitrary OpenAI-compatible model sampling parameters.

Identity & Access Management · 2026-08-06

PingOne /as/signoff endpoint now accepts HTTP POST for OIDC RP-initiated sign-offs; Android Signals SDK 5.4.0 released.

• The /as/signoff endpoint now accepts HTTP POST requests in addition to HTTP GET for OIDC relying party (RP)-initiated sign-offs, giving applications more flexibility in how they trigger user sign-offs.
• Releases version 5.4.0 of the PingOne Protect (Signals) SDK for Android.

Identity & Access Management · 2026-08-06

PingOne /as/signoff endpoint now accepts HTTP POST for OIDC RP-initiated sign-offs; Protect Signals SDK 5.4.0 released for Android.

• Adds HTTP POST support to the /as/signoff endpoint for OIDC relying party (RP)-initiated sign-offs, alongside the existing HTTP GET method.
• Releases version 5.4.0 of the PingOne Protect (Signals) SDK for Android.

SAST / SCA / Code Security · 2026-08-06

• Adds Secret References so secret_mappings can point virtual keys and integrations at credentials stored in AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault — Portkey fetches values at runtime instead of storing keys directly.
• Adds weekly (rpw) budget and usage windows so rate-limit caps align with weekly spend planning, not only per-minute or monthly aggregates.
• Adds endpoint-scoped rate limits so chat completions, embeddings, and admin routes can each carry independent limits instead of one global rule.

Cloud Security Posture · 2026-08-06

Prowler 5.38.0 adds 20 Attack Paths privilege-escalation queries, 12 M365 checks, SAML multi-domain SSO, and compliance watchlists.

• Adds admincenter_shared_bookings_disabled check for M365 provider, covering CIS Microsoft 365 Foundations Benchmark v7.0.0 control 1.3.9.
• Adds defender_priority_account_protection_enabled and defender_strict_preset_security_policy_enabled checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 controls 2.4.1 and 2.4.2.
• Adds exchange_owa_mailbox_policy_personal_accounts_disabled and exchange_organization_reject_direct_send_enabled checks for M365 provider, covering CIS M365 Foundations Benchmark v7.0.0 controls 6.3.2 and 6.5.5.

Continuous Control Monitoring (CCM) · 2026-08-06

RegScale CLI 6.38.0 adds eMASS CAC authentication support for custom CA bundles (e.g. DoD PKI) via config, env var, and CLI flag.

• Adds emass.ssl_ca_cert config key to trust a custom CA bundle (e.g. DoD PKI) when verifying the eMASS server certificate during CAC authentication.
• Adds EMASS_SSL_CA_CERT environment variable as an alternative to emass.ssl_ca_cert for supplying the custom CA bundle path.
• Adds --ca-cert option to the emass_api register command to specify the custom CA bundle at registration time.

Identity & Access Management · 2026-08-06

SailPoint Agentic Fabric brings AI agent and non-human identity governance to Identity Security Cloud with discovery, registry, and audit-ready reporting.

• Navigating to Admin > Global > Agent Settings > Sensors and selecting the Endpoint Agent tab manages the background endpoint agent that discovers AI agent software installed on managed laptops and desktops.
• Navigating to Admin > Global > Agent Settings > Sensors and selecting the Browser Extension tab manages the browser extension sensor for GenAI governance across managed and unmanaged SaaS environments.
• Navigating to Admin > Global > Agent Settings and selecting SIEM and EDR Connections connects EDR or SIEM platforms for AI agent discovery and monitoring.

Identity & Access Management · 2026-08-06

SailPoint adds Dark Mode across Agentic Fabric and select Identity Security Cloud pages.

• Adds Dark Mode support across SailPoint Agentic Fabric and a select number of Identity Security Cloud pages, user-configurable per account.

Secure Access (VPN / SASE / ZTNA) · 2026-08-06

ScoutDNS launches a ground-up console redesign with dark mode, Zero Trust TLD analytics, per-policy Secure Score, and a new MSP dashboard.

• New per-entry match or subtree option on every custom allow/block list rule makes it explicit whether a rule covers one hostname or a domain and all subdomains.
• Single wildcard entry now covers both the domain itself and all subdomains, eliminating the need for two separate entries.
• Comments can be added to any allow or block list entry to preserve the reason a rule was created.

SAST / SCA / Code Security · 2026-08-06

Snyk API & Web adds NTLM v2 authentication support, enabling authenticated DAST scans of Windows-protected internal applications.

• Adds NTLM v2 authentication support for Web targets in Snyk API & Web, configurable via Target Settings > Authentication tab in the Basic Auth / NTLM module, with fields for username, password, domain, and workstation — enabling authenticated scans of Windows-protected internal applications without separate tooling.

Firewalls & Network Defense · 2026-08-06

Sophos DNS Protection adds a Generative AI web category for granular allow/block control of AI services in filtering policies.

• Adds a Generative AI category to the Business and generative AI category group, enabling filtering policies to block or allow generative AI websites independently of other business categories.
• Renames the Business-relevant site categories category group to Business and generative AI to reflect the new category.

Reconnaissance & OSINT · 2026-08-06

subfinder v2.15.0 adds shodanct passive source, VirusTotal result-type filtering, and machine-readable source listing

• Adds machine-readable source listing via -ls -oJ (outputs available sources as JSONL).
• Adds shodanct as a new passive subdomain discovery source.

SIEM · 2026-08-06

Sumo Logic lets you build and update Automation Service playbooks by describing them in plain language to Mobot.

• Mobot now supports playbook creation and editing via natural-language chat: describe the automation you want, Mobot checks available integrations, asks clarifying questions, proposes a plan, configures each step, and saves the result as a draft for review and publishing.

Vulnerability Management · 2026-08-06

Tenable Hexa AI automates exposure-to-patch remediation using intent-driven Routines with human approval guardrails.

• Introduces Tenable Hexa AI, an agentic capability within Tenable One that automates the full remediation cycle — scoping, patch deployment, and verification — across integrated platforms such as Jamf.
• Adds intent-driven Routines that encode the multi-step remediation workflow (asset scoping, policy targeting, patch execution, status check, re-scan confirmation) into a single automated sequence.
• Enforces safety guardrails by binding AI autonomy strictly to defined user permissions within the Tenable One harness, with human approval gates before changes are applied.

Attack Surface & Exposure Management · 2026-08-06

Tenable Hexa AI adds agentic remediation routines with Jamf integration, proposal-gated patching, and intent-driven guardrails.

• New Tenable Hexa AI agentic engine automates end-to-end vulnerability remediation within a single conversational workflow — enumerating affected assets, mapping CVEs to fix versions, and executing patch deployments without manual tool-switching.
• Proposal-gated execution: before writing any changes, Hexa presents a plan showing device count, device list, policy, deployment window, and blast radius, and requires explicit approval before proceeding.
• Supports scope narrowing mid-workflow — tell Hexa to restrict enumeration to a single business unit and it re-scopes and returns a revised plan before executing.

Detection Engineering · 2026-08-06

Tenzir v6.9.0-rc.2 adds native Iceberg output, NetFlow/IPFIX decoding, OCSF 1.9.0 support, and faster catalog startup with new tuning knobs.

• New to_iceberg operator writes events to Apache Iceberg tables via a REST catalog, with partition_by supporting transforms year, month, day, hour, bucket, and truncate; mode selects create_append, create, or append; files are zstd-compressed Parquet rotated by max_size and timeout.
• New to_iceberg operator connects to S3 and S3-compatible stores via aws_iam, s3_endpoint, s3_path_style, bearer-token catalogs via token, AWS Glue and Amazon S3 Tables via catalog_aws_service, and Google BigLake (gs://) via gcp_service_account_key or gcp_auth=true.
• New read_netflow operator automatically decodes NetFlow v5, NetFlow v9, and IPFIX from byte streams and UDP envelopes, learning templates per-exporter and preserving unknown elements as blobs.

Detection Engineering · 2026-08-06

Tenzir v6.9.0-rc.2 adds the to_iceberg operator for native Apache Iceberg output, plus automatic NetFlow/IPFIX decoding and OCSF 1.9.0 support.

• New to_iceberg operator writes events directly into Apache Iceberg tables via a REST catalog, automatically creating and evolving the table schema as heterogeneous streams arrive.
• Automatic NetFlow and IPFIX decoding — no manual parser configuration needed for these flow formats.
• OCSF 1.9.0 schema support added.

Detection Engineering · 2026-08-06

Tenzir v6.9.0-rc.2 adds to_iceberg for native Apache Iceberg table output, automatic NetFlow/IPFIX decoding, and OCSF 1.9.0 support.

• New to_iceberg operator writes events directly into Apache Iceberg tables via a REST catalog, automatically creating and evolving table schemas as heterogeneous streams arrive.
• Adds optional batch validation for events read from persisted stores.
• Adds automatic NetFlow and IPFIX decoding.

Detection Engineering · 2026-08-06

Tenzir v6.9.0 adds native Iceberg output, NetFlow/IPFIX decoding, dynamic field assignment, and faster catalog startup.

• Adds tenzir.index.load-concurrency config key to tune the number of worker threads used for concurrent partition synopsis loading at startup, improving start time on networked storage (NFS, etc.).
• Adds tenzir.index.lazy-sketches config key to defer Bloom-filter sketch loading to query time, keeping only one sketch resident at a time and bounding warm memory via an LRU cache controlled by tenzir.index.sketch-cache-bytes (default 1 GiB).
• Adds tenzir.index.skip-synopsis-verification config key to skip recursive FlatBuffers verification of partition synopses at startup, trading corruption robustness for significantly faster loads on trusted networked storage.

Detection Engineering · 2026-08-06

Tenzir Node v6.9.0 adds native Apache Iceberg output via to_iceberg, automatic NetFlow/IPFIX decoding, and OCSF 1.9.0 support.

• Adds to_iceberg operator to write events directly into Apache Iceberg tables through a REST catalog, with automatic schema creation and evolution for heterogeneous streams.
• Adds automatic NetFlow and IPFIX decoding.
• Adds OCSF 1.9.0 support.

Detection Engineering · 2026-08-06

Tenzir v6.9.0 adds native Apache Iceberg output via to_iceberg, automatic NetFlow/IPFIX decoding, and OCSF 1.9.0 support.

• New to_iceberg operator writes events directly into Apache Iceberg tables through a REST catalog, automatically creating and evolving schemas as heterogeneous streams arrive.
• Adds automatic NetFlow and IPFIX decoding.
• Supports OCSF 1.9.0.

AI/LLM Security · 2026-08-06

thv ai-plugin gets a full CLI + REST API, registry catalog, and Sigstore signature verification at install/sync/upgrade

• Adds thv ai-plugin subcommand with a full CLI and REST API for end-to-end AI-tool plugin management.
• Adds a registry catalog to thv ai-plugin for discovering and deploying plugins from a curated index.
• Adds Sigstore signature verification for skills/plugins at install, sync, and upgrade time.

SAST / SCA / Code Security · 2026-08-06

Veracode training adds LLM security labs, OWASP Top 10:2025 courses, and Get Lesson Progress API enhancements including updatedAfter and excludeNotStarted parameters.

• Adds updatedAfter parameter to the Get Lesson Progress API to support incremental loads of lesson progress data.
• Adds excludeNotStarted=true parameter to the Get Lesson Progress API to filter out lessons that have not been started.
• Get Lesson Progress API now includes stack and updated_on fields in the response, and surfaces Not Started status when both start_time and end_time are null.

SAST / SCA / Code Security · 2026-08-06

Veracode EASM adds real-time scan notifications, multi-project visibility, AI-powered intelligence, scan scheduling, and DAST candidate export.

• Adds real-time in-app notifications when scans complete, fail, or are cancelled.
• Adds multi-project visibility for centralized risk management across all projects.
• Adds scan scheduling to streamline scan orchestration across projects.

Cloud Security Posture · 2026-08-06

Wiz adds automated DISA STIG assessment for Amazon Linux 2023 and Windows Server 2025 in AWS GovCloud.

• Adds automated DISA STIG compliance assessment for Amazon Linux 2023 (AL2023 V1R2 and V1R3 benchmarks) and Windows Server 2025, covering gaps where official SCAP content is not yet available.
• Delivers continuous hardening validation for federal agencies and defense contractors operating in AWS GovCloud, supporting FedRAMP Rev5, FedRAMP 20x, CMMC, and DoD authorization requirements.

CNAPP · 2026-08-06

Wiz adds automated DISA STIG assessment for Amazon Linux 2023 and Windows Server 2025 via agentless Host Configuration Rules.

• Adds DISA STIG Amazon Linux 2023 benchmark support via Host Configuration Rules (HCR), providing continuous agentless assessment across all connected cloud instances without SCAP content or scan credentials.
• Adds DISA STIG Microsoft Windows Server 2025 benchmark support via Host Configuration Rules (HCR), with an initial automated rule set and expanding coverage in upcoming releases.
• STIG findings for both frameworks surface in the Compliance Posture dashboard alongside existing frameworks, with per-rule pass/fail status per instance and rollup into category and subcategory scores.

Secure Access (VPN / SASE / ZTNA) · 2026-08-06

Zscaler AI Guard integrates with Claude inference hooks to enforce Zero Trust DLP policy natively at the model layer across Claude Enterprise.

• Integrates Zscaler AI Guard with Anthropic Claude inference hooks to enforce Zero Trust data-loss-prevention policy natively at the Claude model layer, evaluating full conversation context in real time rather than individual messages.
• Extends existing Zscaler platform policies to Claude Enterprise touchpoints with no additional governance stack required — existing Zscaler customers can activate with their current policy configuration.

Web Application Security · 2026-08-05

Burp Suite DAST 2026.8 gives every vulnerability a persistent identity that carries across scans.

• Assigns each vulnerability a persistent identity that carries across scans, enabling lifecycle tracking of findings over time rather than treating them as isolated scan results.

Identity & Access Management · 2026-08-05

API surface changed: +2 endpoints, 2 modified

• New endpoint GET /ips/downloads/{dataset}/{window}.{format}.gz
• New endpoint HEAD /ips/downloads/{dataset}/{window}.{format}.gz
• GET /ips/{value}: response schema changed

Integrated & IT Risk Management · 2026-08-05

CISO Assistant v3.20.8 adds AI-driven risk assessment import via chat and ANSSI industrial cybersecurity library support.

• Adds support for importing risk assessments through the AI chat interface.
• Adds the ANSSI 'la cybersécurité des systèmes industriels - mesures détaillées' framework library.
• Updates Dutch (NL) and Ukrainian translations.

AI Coding Agents · 2026-08-05

Claude Code v2.1.222 tightens multi-agent permission enforcement and improves Remote Control scoping

• Remote Control auto-start can no longer be enabled via repo-local .claude/settings.json or .claude/settings.local.json; enable it at user scope via /config instead (repo-local settings can still turn it off)
• Improves auto mode safety: messages dispatched to other agent sessions via SendMessage are now evaluated by the permission classifier before delivery
• Improves disable-model-invocation refusal behavior: Claude now prompts the user to run the skill directly rather than attempting to replicate its workflow

Identity & Access Management · 2026-08-05

Clerk's <SignIn /> component now supports the combined sign-in-or-up flow under strict user enumeration protection.

• Enables the combined sign-in-or-up flow in <SignIn /> when strict user enumeration protection is active — visitors verify identity first, then Clerk signs them in or creates the account.

AI Coding Agents · 2026-08-05

Cline adds --auto-approve flag and per-session toggle to run tools without permission prompts

• Adds --auto-approve true CLI flag to the agent config to start every session with tool auto-approval enabled, bypassing per-call permission prompts.
• Adds an Auto-approve tools per-session toggle in the client's session settings (visible alongside model and mode pickers in ACP-config-supporting clients such as Zed) that takes effect on the next tool call.

AI Coding Agents · 2026-08-05

Cline v4.1.4 adds Chutes provider support, surfaces skills in the slash command menu, and enforces hard plan-mode file-edit blocking.

• Adds Chutes as a recognized provider.
• Shows skills alongside workflows in the slash command menu, disambiguating commands that share a name instead of silently shadowing one with another.
• Hard-blocks file-manipulation shell commands (in-place editors, file redirections, mutating git subcommands, package installs) in plan mode at the enforcement level, not just via prompting; read-only investigation remains available.

AI Coding Agents · 2026-08-05

Cline desktop v0.0.9 adds universal macOS binary, session-source filtering, context-window token ring, and Plan mode file-edit hard-blocking.

• Session history can now be filtered by origin — Desktop, CLI, extension, or scheduled — via a new filter control in the sidebar.
• The composer displays a token usage ring showing context-window consumption, cumulative cost, and a color change as the limit approaches.
• Plan mode now hard-blocks file-editing shell commands rather than relying on prompting alone; read-only investigation still works.

AI Coding Agents · 2026-08-05

Cline CLI v3.0.50 adds user-selectable TUI color themes, Plan mode command blocklist, and auto-approval over ACP.

• Adds /theme command, command palette, and Theme row in /settings to select TUI color themes, with live preview; CLINE_THEME environment variable overrides the persisted choice at startup. Built-in themes: Auto, Cline Dark, Cline Light, Tokyo Night, Gruvbox Dark, Nord, Dracula, Catppuccin Mocha, One Dark, Solarized Dark, Solarized Light.
• Plan mode now hard-blocks file-manipulation shell commands in run_commands: rejects in-place editors (sed -i, perl -i), file redirections, mutating git subcommands, package installs, and nested command strings (sh -c, eval, sudo) on Linux, Windows, and PowerShell; run_commands remains available for read-only investigation.
• Auto-approval settings are now honored over ACP, surfaced as auto_approve session config option (AUTO_APPROVE_CONFIG_ID).

AI Coding Agents · 2026-08-05

Cline SDK v0.0.70 adds hard Plan-mode command blocking, a new mode field on StartSessionInput, and lazy root-session persistence.

• Adds a mode field to StartSessionInput (values: user, automation, subagent, team) alongside the existing source field to record how a session began.
• Plan mode now hard-blocks file-editing shell commands at the tool level — run_commands remains available for read-only investigation, but file-manipulation commands, in-place editors (sed -i, perl -i), redirection to files, mutating git subcommands, package installs, and nested command strings (sh -c, eval, sudo, xargs) are rejected with a tool error on Windows and PowerShell too.
• Root-session persistence is now lazy: starting a runtime allocates the session ID in memory without writing a database row, so abandoned sessions no longer leave empty history entries.

SAST / SCA / Code Security · 2026-08-05

API surface changed: +1 endpoint, 4 modified

• New endpoint POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens/delete
• GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens: response schema changed
• GET /user/tokens: response schema changed

General Utilities & Libraries · 2026-08-05

VS Code enterprise policies add Claude agent toggle and four new chat restriction controls for managed environments.

• Adds sessions.chat.claudeAgent.enabled policy to control access to the Claude agent in managed environments.
• Adds ChatStrictPluginOnlyCustomization policy that blocks standalone user and workspace skills, agents, hooks, instructions, and MCP servers while keeping eligible plugin customizations available.
• Adds ChatAllowManagedHooksOnly policy that restricts hooks to enterprise-managed sources and policy-force-enabled plugins only.

General Utilities & Libraries · 2026-08-05

New workbench.browser.newTabPlacement setting controls where integrated browser tabs open in code-oss.

• Adds workbench.browser.newTabPlacement setting to control where new integrated browser tabs open, supporting values activeGroup (default), sideGroup (dedicated locked side group), and window (dedicated locked auxiliary window).

Detection Engineering · 2026-08-05

Cotool v0.62.0 adds Linear full-text search, GitHub sandbox file uploads, and expanded Huntress, Darktrace, and Kolide integrations.

• Adds full-text Linear issue search with team, status, archive, and comment filters
• Adds support for GitHub tools to upload sandbox-generated files
• Expands Huntress support for MSP and MSSP accounts with optional organization scoping

AI Agent Frameworks · 2026-08-05

CrewAI 1.15.11 adds an IBM Db2 search tool, enterprise project_id linking, AMP surfacing in AGENTS.md, and coding-agent telemetry detection.

• Adds IBM Db2 search tool, enabling agents to query Db2 databases as a built-in tool.
• Adds project_id support to link open-source CrewAI usage to an enterprise account.
• Surfaces CrewAI AMP in AGENTS.md and adds detection of coding agents in telemetry.

Security Data Pipeline · 2026-08-05

Cribl launches the App for AI Observability: unified search, cost tracking, PII detection, and trace investigation across all AI models and providers.

• New Cribl App for AI Observability delivers a single pane to search, investigate, and report on AI telemetry across models, tools, and environments, built on Cribl's AI Platform for Telemetry.
• Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLM efficiency anti-patterns, and an activity heatmap.
• Org View provides a hierarchical roll-up of spend, tokens, and requests across an organization.

Agentic Infrastructure · 2026-08-05

Emisar v0.29.0 tightens MCP argument coercion, improves error clarity, and raises pack risk levels for secret-dense config dumps.

• Scalar MCP arguments sent as canonical strings (e.g. "limit": "50", "dry_run": "true") now coerce to their expected types instead of failing the call.
• MCP argument faults now name the specific field and type mismatch — e.g. limit must be a JSON integer from 1 to 100; it was sent as a string. — replacing generic contract errors; enum faults list allowed values and unknown arguments are spelled out against the allowed set.
• MCP run summaries omit zero-information fields: stdout/stderr, byte-count, and truncation fields are absent when a stream produced no bytes; output_complete appears only when false; per-stream SHA-256 digests removed from the MCP projection (retained on the run detail page and audit record).

Agentic Infrastructure · 2026-08-05

emisar v0.28.0 adds emisar doctor dispatch-log checks, SSO/MFA route coverage, SCIM rate-limiting, and honest fleet degradation diagnostics.

• Adds emisar doctor checks for the dispatch log, degraded packs, and last cloud rejection; adds emisar state check-dispatch-log for scriptable verdict on dispatch-log health.
• Adds QUARANTINE_DISPATCH_LOG=1 environment variable to install.sh to automatically quarantine an unreadable dispatch log instead of leaving a host crash-looping after an upgrade.
• install.sh now verifies dispatch state with the staged binary before touching a running service, aborting with remediation options on failure.

Agentic Infrastructure · 2026-08-05

Runner v0.12.0 adds corrupt-state pre-flight checks, bounded MCP failure messages, and account-chooser OAuth consent.

• Corrupt durable dispatch state now halts the runner before it connects to the control plane, preventing a misconfigured runner from silently operating.
• MCP run summaries now include a bounded terminal failure message when the runner supplies one, making MCP failures visible in the portal without a new MCP bridge binary.
• OAuth consent now lets a user choose which account to connect during connector setup.

Agentic Infrastructure · 2026-08-05

Emisar v0.26.0: in-flight run recovery on reconnect and out-of-date MCP bridge flagging in the console.

• Console LLM agents list now groups connections by the operator behind each key, displays the emisar-mcp bridge version inline per connection, and flags out-of-date bridges with a one-step path to the upgrade command.
• Control plane recovers runs that were in flight when a runner drops and reconnects, instead of stranding them.
• Runner version-upgrade notice now scopes its count to the current page rather than reading as a single runner across a multi-runner list.

Agentic Infrastructure · 2026-08-05

emisar v0.24.0: hardened infrastructure, release integrity attestations, dedicated pack registry, and MCP server listing.

• Pack registry now serves from its own hostname at registry.emisar.dev/v1/catalog.json, with anonymous access narrowed to exact object reads.
• Hosted MCP server (dev.emisar/emisar) is now published to the official MCP registry.
• Portal releases now publish the exact image exercised by CI, pinned by digest, with provenance and SBOM attestations; fixable HIGH/CRITICAL vulnerabilities block publication.

Endpoint Security (EDR/XDR) · 2026-08-05

Fleet adds database debug endpoints, SCIM object descriptions, and new host/software API fields including CVE metadata and enrollment controls.

• Adds GET /debug/db/process-list endpoint returning active database queries with fields id, user, host, db, command, time, state, and info.
• Adds GET /debug/pprof/cmdline endpoint exposing Go net/http/pprof profiling data — plain text for cmdline, binary pprof profiles for other keys.
• Adds waiting_trx_id, waiting_thread, waiting_query, blocking_trx_id, blocking_thread, and blocking_query fields to the database debug response for InnoDB lock contention visibility.

AI/LLM Security · 2026-08-05

garak v0.16.0 adds Context Aware Scanning with technique/intent annotations, a native Anthropic generator, and a new adaptive attacks probe.

• Introduces a unified run.spec selection grammar that consolidates probe_spec and buff_spec into the run config definition and adds support for selecting _intents_ alongside probes and buffs.
• Adds suppressed_params support to BedrockGenerator for controlling which parameters are passed to the Bedrock API.
• New Context Aware Scanning (CAS) framework: technique and intent annotations on probes, a technique_intent_matrix in reports enriched with names and descriptions, and a new IntentProbe base class for intent-driven evaluation.

Secrets Detection & Management · 2026-08-05

GitGuardian API gains a token-creation endpoint that lets personal access tokens and service account tokens mint new tokens programmatically.

• Adds a Create API Token endpoint that mints a new personal_access_token or service_account token programmatically; the clear-text token value is returned only in the creation response and cannot be retrieved again via list or retrieve endpoints.
• Enforces scope delegation on token creation: the scopes granted to the new token must be a subset of the calling token's scopes, and some scopes implicitly include others, so the returned token may carry more scopes than explicitly requested.
• Rejects creation when the name is already used by an active token of the same type, when the workspace has reached its active-token limit, or when the requested lifetime exceeds the workspace policy maximum.

Exploitation & C2 · 2026-08-05

• External Pentest workflow rebuilt: reusable Scopes replace Asset Groups, with improved bulk asset management and uploads for large external attack surfaces.
• Rapid Response coverage added for Starlette/LiteLLM BadHost, Apache Solr, Palo Alto Networks PAN-OS, Nginx UI, Ivanti Sentry, Check Point Remote Access VPN, Splunk Enterprise, Cisco Unified Communications Manager, and Squid.

Exploitation & C2 · 2026-08-05

Horizon3 NodeZero exposes a public GraphQL API for automation and integration with the Horizon3 Portal.

• New public GraphQL API provides programmatic access to a subset of Horizon3 Portal functionality, enabling automation, integration, and advanced workflows.

Data Security & DLP · 2026-08-05

Immuta adds Connection health dashboards, split data-product request forms, Redshift viewless auto-discovery, and system-managed identity groups.

• Adds per-connection health state display (ACTIVE, INACTIVE, or UNHEALTHY) and moves integration settings directly into Connections for Databricks Unity Catalog and Snowflake.
• Adds a per-object policy sync toggle in Connections that controls whether Immuta pushes policy down into the platform for a given data object, with a Custom label when a child object's setting differs from its parent.
• Adds detail pages for leaf data objects in Connections, each including a direct link to the corresponding data source.

Secrets Detection & Management · 2026-08-05

Infisical v0.162.16 adds Spacelift sync, Cloudflare secret rotation, PKI post-sync commands, machine identity expiry alerts, and cross-project secret sharing.

• Adds secret rotation support for Cloudflare API tokens and R2 access keys.
• Adds PKI post-sync command support for Windows and Linux agents.
• Adds Spacelift as a new secrets sync integration.

Secrets Detection & Management · 2026-08-05

Infisical v0.162.4 adds a secrets activation modal and expands framework and infrastructure integration coverage.

• Adds an activation modal for secrets management workflows.
• Revamps and expands framework integrations and infrastructure integrations coverage.

Secrets Detection & Management · 2026-08-05

Infisical v0.162.3 adds certificate upload, Azure CLI PAM access, Slack approval notifications, and JSON/plain-text Cloudflare Workers sync

• Supports JSON and plain text variable formats in Cloudflare Workers sync
• Adds Azure CLI access to Privileged Access Management (PAM)
• Adds Slack notifications for access approvals

Secrets Detection & Management · 2026-08-05

Infisical v0.162.2 revamps Privileged Access Management (PAM).

• Revamps the PAM (Privileged Access Management) module with a redesigned experience.

Secrets Detection & Management · 2026-08-05

Infisical v0.162.0 adds Rundeck support for secret sync and revamps the PAM user experience.

• Adds Rundeck as a supported app connection for secret sync.
• Revamped PAM user experience.

Secrets Detection & Management · 2026-08-05

Infisical v0.161.14 adds native Windows ADCS support and improves metering UI visibility.

• Adds native Windows Active Directory Certificate Services (ADCS) support for certificate management.
• Improves metering UI to surface more usage information for users.

Secrets Detection & Management · 2026-08-05

Infisical v0.161.13 adds HSM-backed internal CAs, Hasura Cloud secret sync, and cross-project secret sharing.

• Exposes certificate sync external identifier in the API and UI, making it easier to correlate Infisical-managed certs with external systems.
• Adds HSM-backed internal certificate authorities, enabling hardware-protected signing for internally issued certificates.
• Supports Hasura Cloud as a secret sync destination, pushing secrets directly to Hasura Cloud environments.

Endpoint Security (EDR/XDR) · 2026-08-05

Iru lets admins exclude (and re-include) specific users from a policy assignment when publishing or updating.

• Admins can exclude specific users from a policy assignment when publishing or updating a policy, for handling exceptions to broad policy coverage.
• Admins and auditors can re-include a previously excluded user in a policy assignment.

Identity & Access Management · 2026-08-05

JumpCloud Agent 2.152.1 filters unsupported apps in Self Service App Catalog and improves Entra ID login on Windows.

• The Self Service App Catalog now filters unsupported package-manager applications so users see only installable apps in the JumpCloud app.
• The updated login window is now enabled on Microsoft Entra ID-joined devices, expanding supported sign-in coverage.

Identity & Access Management · 2026-08-05

Zero Trust Assessment gains new AI, Security Operations, and Infrastructure pillars for broader posture coverage.

• Adds AI, Security Operations, and Infrastructure pillars to the Zero Trust Assessment, expanding automated posture evaluation beyond the existing Identity, Devices, Network, and Data pillars.

Endpoint Security (EDR/XDR) · 2026-08-05

Microsoft adds a DevSecOps pillar and AI-focused Zero Trust Assessment to the Zero Trust Workshop.

• Introduces a new DevSecOps pillar in the Zero Trust Workshop with 15 control groups and 91 tasks covering developer platforms, CI/CD pipelines, source repositories, dependencies, artifacts, and infrastructure-as-code.
• Adds four AI-assisted development tasks in the DevSecOps pillar: code governance, tool allowlisting, data protection, and AI and machine learning pipeline supply-chain security.
• Introduces a new AI-focused Zero Trust Assessment experience to establish a baseline across Zero Trust pillars including AI and DevSecOps scenarios.

General Utilities & Libraries · 2026-08-05

Obsidian 1.13 adds a searchable Settings panel, full-screen image viewer, new Vim :image command, and tightened URI security.

• Settings now open in a new window; disable via Settings → Interface → Open settings in new window.
• Adds settings search by name or description, navigable with Ctrl/Cmd-F to re-focus; currently covers core settings and core plugins (community plugins can migrate to the new Settings API to appear in results).
• Adds keyboard navigation in Settings: arrow keys to move between items, Enter to open a tab, with Vim key binding support.

General Utilities & Libraries · 2026-08-05

Obsidian Mobile 1.13 adds iOS Share Sheet, searchable Settings panel, drag-and-drop tab reordering, and resizable splits.

• New iOS Share Sheet lets users save content from Safari, YouTube, and other apps directly to Obsidian without opening the app; supports customizable Locations to define the vault, folder, and template used.
• New searchable Settings panel for faster navigation across all settings.
• New Tab switcher supports drag and drop to reorder tabs.

General Utilities & Libraries · 2026-08-05

Obsidian 1.13.3 adds image zoom, click-and-drag pan in lightbox, and keyboard navigation in File Recovery.

• Adds a zoom button to image embeds in the editor.
• Image lightbox now supports click and drag to pan within an image.
• File Recovery file history records now support keyboard navigation via arrow keys.

General Utilities & Libraries · 2026-08-05

Obsidian Mobile 1.13.3 adds a swipe-down gesture to dismiss lightbox images.

• Adds a swipe-down gesture to dismiss an image in the lightbox.

General Utilities & Libraries · 2026-08-05

Obsidian 1.13.2 adds a fullscreen image lightbox, keyboard image resizing, and a Vim :image command for image management.

• New image lightbox lets you view images fullscreen in reading mode (click image) or live preview (select image, then click or press Space); use arrow keys to navigate all images embedded in the current file.
• Live Preview: Press + or - to resize a selected image, 0 to reset size, Enter to edit the image, or Tab to manually edit the image size.
• Vim: New :image Ex command supports :image grow, :image shrink, and :image reset; accepts a count prefix (e.g. :5image grow grows the image 5 times).

AI Coding Agents · 2026-08-05

Codex CLI now enables cached web search for Amazon Bedrock, falling back from unsupported live/indexed modes.

• Enables hosted text web search for Amazon Bedrock, automatically resolving unsupported live and indexed web-access modes to cached search (or disabling the tool when cached search is prohibited by managed requirements).
• Normalizes built-in and configured Bedrock model catalogs to text-only web search payloads, removing the unsupported search_content_types field that Bedrock rejects.

AI Coding Agents · 2026-08-05

MCP namespace tool-spec description limit raised from 1,000 bytes to 512 KiB, preserving complete server instructions.

• Raises the MCP namespace tool-spec description limit from 1,000 bytes to 512 KiB, truncating only at a UTF-8 character boundary when the new limit is exceeded — preventing tools from being hidden due to truncated server instructions.

Runtime Security · 2026-08-05

OpenShell v0.0.98 adds OTLP trace export from VM driver sandboxes.

• Exports driver traces from VM-backed sandboxes over OTLP for observability into sandbox execution.

SAST / SCA / Code Security · 2026-08-05

• Adds Secret References so credentials stored in AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault are fetched at runtime via secret_mappings, keeping plaintext keys out of Portkey config.
• Adds weekly budget/usage windows (rpw) and endpoint-scoped rate limits, letting teams cap spend per API surface (chat completions, embeddings, admin routes) independently.
• Adds Zscaler AI Guard guardrail integration applying Zscaler Detection Policies via beforeRequestHook / afterRequestHook, with required policyId and optional timeout (default 10 000 ms).

AI/LLM Security · 2026-08-05

• Adds test-level prompts filter and providers filter to scope test cases more precisely.
• New Vercel AI Gateway and Cloudflare AI Gateway providers for request routing.
• OpenAI Codex provider adds collaboration_mode support and integrated tracing.

SAST / SCA / Code Security · 2026-08-05

Semgrep adds Agentic Workflows public beta, license compliance block logic, and Supply Chain incident notification policies.

• Semgrep Agentic Workflows enters public beta — runs multi-step AI-enabled detection pipelines from Semgrep AppSec Platform, combining program analysis, deterministic tools, and constrained AI-based reasoning to produce reviewable security issues.
• License compliance can now be configured to block a dependency only when all of its licenses are blocked, rather than when any single license is blocked.
• A default Supply Chain incident notification policy is now available to all Supply Chain customers using Unified policies, with optional Slack channel notifications for ongoing incidents based on the most recent SBOM.

AI/LLM Security · 2026-08-05

SkillSpector v2.5.2 adds MCP registry posture scanning and enforces ingest size caps via INGEST_MAX_BYTES and INGEST_MAX_ZIP_MEMBERS.

• Enforces INGEST_MAX_BYTES (100 MiB) cap on streamed URL downloads, total uncompressed zip size, and post-clone Git repo disk usage, and INGEST_MAX_ZIP_MEMBERS (10,000) cap on zip entries — failing closed with IngestLimitExceededError on breach.

SAST / SCA / Code Security · 2026-08-05

StepSecurity threat intel notifications gain three match-granularity levels and a tenant-wide channel configuration page.

• Adds a Notifications page under Admin console settings to configure email, Slack webhook, and Teams webhook once at the tenant level, replacing per-organization channel setup.
• Introduces three match-granularity levels for threat intel notifications — All threat intel incidents, Affected packages, and Exact version only — selectable from the Threat intel notifications dialog.
• Makes threat intel alerting an explicit opt-in per organization via the Notify when StepSecurity threat intel flags a compromised component event in organization notification settings, shown alongside existing Harden-Runner detection events.

SAST / SCA / Code Security · 2026-08-05

Harden Runner adds AWS CodeBuild runner support, container process tracing, versioned job hooks v1.0.0, and implicit single-label domain allowances in block mode.

• Adds support for GitHub Actions runners hosted on AWS CodeBuild in Harden-Runner GitHub Action v2.20.1.
• Adds container process tracing (opt-in) for ARC pods — enable via Helm value env: enableContainerProcessTracing: "true" in ARC Harden Runner v2.18.6.
• Single-labeled internal hostnames (no dot) are now implicitly allowed when egress-policy: block is set across all three deployment options (GitHub Action v2.20.1, ARC v2.18.6, Self-Hosted VM v1.8.14), removing the need to list them in allowed-endpoints.

Firewalls & Network Defense · 2026-08-05

API surface changed: 2 deprecated

Detection Engineering · 2026-08-05

Tenzir Ship v2.0.0 keeps pre-1.0 projects on major version zero when breaking changes are pending, and adds --major and --yes flags to release create.

• Adds automatic logic to keep projects on major version zero when unreleased entries include breaking changes — e.g., a breaking entry after v0.4.2 now produces v0.5.0 instead of v1.0.0.
• New --major flag on tenzir-ship release create to explicitly declare the first stable (1.0.0) release; accepts 1.0.0 as an explicit version argument as well.
• stats now warns and reports no next version instead of failing when multiple outstanding release-candidate series make the target version ambiguous.

Detection Engineering · 2026-08-05

Tenzir Ship v2.0.0 keeps pre-1.0 projects on major version zero when unreleased entries include breaking changes.

• Automatically selects the next minor release instead of bumping to 1.0.0 when unreleased entries include breaking changes in pre-1.0 projects.
• Projects can still explicitly request 1.0.0 to declare their first stable release.

SOAR · 2026-08-05

Tines adds reworked case list layout with more control over display options.

• New layout options for the case list give users more control over what information is shown and how it is displayed.

Endpoint Security (EDR/XDR) · 2026-08-05

AI Scanner gains an Objective filter, JSON/CycloneDX/HTML export formats, and direct report upload for air-gapped environments.

• Adds JSON, CycloneDX 1.6 (VEX form), and self-contained sortable HTML as export formats for AI Scanner scan reports, in addition to the existing CSV option; all formats respect active dashboard filters.
• Adds an Objective filter for AI Scanner scan results, letting users narrow widgets, the findings table, and exported reports to one or more attack objectives (default: all selected).
• Enables direct upload of AI Scanner HTML reports into the TrendAI Vision One console (up to 100 MB), supporting on-premise and air-gapped deployments via AI Security → AI Application Security.

Local LLM Runtimes · 2026-08-05

vMLX 1.6.7 enables paged KV cache by default for major text model families and turns reasoning ON by default for all reasoning-capable models.

• Paged KV cache now defaults ON for autodetected text families (Qwen3.5/3.6, Zaya, Nemotron-H, LFM2.5, Laguna, Hy3, Step-3.7) when continuous batching and prefix cache are active; --use-paged-cache / --no-paged-cache always override the default.
• Reasoning mode now defaults ON for every reasoning-capable family; max_thinking_tokens is honored and gated on both streaming and non-streaming paths.

Cloud Security Posture · 2026-08-04

Aikido adds code-based DSPM: map sensitive data flows and find exposure risks without connecting production data stores.

• New Data Exposure Audit feature uses LLM agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — entirely from code, with no production data store connection required.
• Detects credential and token leakage in URLs, query strings, redirects, and clone URLs where logs, proxies, and browser history can capture them.
• Identifies API over-exposure: endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks on data access.

Managed Detection & Response (MDR) · 2026-08-04

Arctic Wolf launches integrated cyber resilience offering combining security operations, exposure management, endpoint protection, incident response, and up to $3M warranty.

• New comprehensive cyber resilience offering bundles security operations, exposure management, endpoint protection, and incident response into a single integrated package.
• Includes up to $3 million in warranty protection coverage for cybersecurity incidents.

Identity & Access Management · 2026-08-04

Auth0 Organizations Search gains metadata, third-party client access, and app entitlement filters with AND/OR logic.

• Adds filtering by Name, Display name, ID, Metadata (custom key-value pairs), Third-party client access (allow or block), and App entitlement active status in the Organizations Search interface.
• Supports combining up to 5 filters simultaneously with AND/OR logic.
• Filter pills persist in the URL, enabling shareable and bookmarkable filtered Organization views.

Post-Exploitation · 2026-08-04

API surface changed: 22 deprecated

Attack Surface & Exposure Management · 2026-08-04

Censys adds OAuth login to cencli, 12 new platform fingerprints, and 3 new ASM risk detections

• Adds OAuth authentication support to the cencli command line tool, triggered via censys auth login, which redirects to an authentication page to select an account and approve the connection.
• Manage OAuth connections through the Connected Applications page in the Platform web console.
• Adds 3 new ASM risk fingerprints: Exposed json-server Instance (unauthenticated CRUD REST API exposure), Exposed PTC Windchill Application (PLM platform reachable from public internet), and Exposed Express Default Page (unconfigured Express.js scaffold in production); new risk types may be disabled by default and are reviewable under risk type configuration in the ASM web console.

Integrated & IT Risk Management · 2026-08-04

CISO Assistant v3.20.7 adds richer AI chat context and lets you rename qualifications to risk categories.

• Allows renaming of qualifications to risk categories.
• Adds more context to in-window AI chat sessions.

AI Coding Agents · 2026-08-04

Claude Code v2.1.221 adds Focus view, sandbox credential masking, prompt-audit subcommand, and smarter plugin/session management.

• Adds mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (whole file or spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; on macOS falls back to deny.
• Adds prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions for patterns written for older models.
• Adds warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync.

Internet Services · 2026-08-04

API surface changed: 263 deprecated

Identity & Access Management · 2026-08-04

ConductorOne AI assistant now delivers a personalized onboarding plan with agent-assisted setup steps at tenant creation.

• C1AI opens automatically on new tenant creation and runs a guided onboarding conversation, asking about industry, organization size, and goals to build a categorized onboarding plan.
• Detects the identity provider used during SSO sign-up and incorporates it into onboarding step suggestions.
• Supports agent-assisted onboarding steps — C1AI can execute tasks such as connecting an app directly from the chat panel, without requiring manual navigation.

Security Data Pipeline · 2026-08-04

Cribl Guard adds a locally-run NER model on Worker Nodes to surface sensitive data without requiring custom rules.

• Adds a Cribl-managed Named Entity Recognition (NER) model that runs locally on Worker Nodes to detect sensitive data not covered by existing rules, via Cribl Background Detection.

Endpoint Security (EDR/XDR) · 2026-08-04

API surface changed: +18 endpoints, 4 modified

• New endpoint DELETE /audiences/{audience_id}
• New endpoint DELETE /audiences/{audience_id}/members/{member_id}
• New endpoint DELETE /modules/{module_id}

AI Coding Agents · 2026-08-04

Cursor gains five Google Workspace plugins — Gmail, Drive, Calendar, Docs, and Sheets — giving coding agents direct read/write access.

• New Google Drive plugin lets agents search files and folders, open and download content, and create and organize files from within Cursor.
• New Gmail plugin lets agents search and read mail, draft and send messages, apply labels, and manage threads.
• New Google Calendar plugin lets agents read schedules, create and update events, and find free time.

AI/LLM Security · 2026-08-04

API surface changed: 5 deprecated

Vulnerability Management · 2026-08-04

DefectDojo 3.2 adds per-vulnerability-ID type classification, multiple CWEs per finding, and deprecates six API-pull parsers and Tool Configuration infrastructure.

• Adds vulnerability_id_type column to Vulnerability_Id — auto-detected from the identifier's prefix (CVE, GHSA, RUSTSEC, etc.), indexed, and backfilled by migration 0282_backfill_vulnerability_id_type; NULL when no non-numeric prefix exists.
• Adds unique constraint on (finding, vulnerability_id) via migration 0283_unique_finding_vulnerability_id, consolidating any pre-existing duplicate rows.
• Adds Finding_CWE relationship table (migration 0284_finding_cwe) so a finding can carry multiple CWEs; primary CWE remains on Finding.cwe and additional CWEs are accessible via finding.cwes.

Vulnerability Management · 2026-08-04

DefectDojo 3.2.0 adds 34+ new parsers (composer, pnpm, dotnet, SPDX, CSAF 2.0, OpenVEX, and 30 CLI tools) plus per-vulnerability KEV/EPSS enrichment columns.

• Adds parsers for composer audit, pnpm audit, dotnet vulnerable packages, and mix_audit output formats.
• Adds SPDX, CSAF 2.0, and OpenVEX interchange-format parsers for software bill-of-materials and VEX ingestion.
• Adds 30 new command-line cyber tool parsers spanning SAST, IaC, host hardening, web/network discovery, and malware categories.

Container & Image Security · 2026-08-04

Docker Compose v5.4.0 introduces a new reconciliation model for volumes and networks lifecycle management.

• Adds volume recreation modelling to the reconciliation plan, giving Compose finer control over when volumes are recreated during up.
• Adds network lifecycle modelling to the reconciliation plan, enabling Compose to track network create/remove operations as first-class steps in the deployment plan.

AI-Powered Offensive Security · 2026-08-04

Dreadnode adds agent memory UI, five data-integration connectors, air-gapped hub sync commands, AST-based JS/TS analysis, and in-place finding triage.

• Adds dn capability sync and dn task sync CLI commands to pull hub content from SaaS (or another on-prem) into a local directory and push it to a self-hosted instance, enabling air-gapped on-prem loading.
• Adds /report-bug command (or r in console) to the TUI, assembling a privacy-reviewed diagnostic bundle and submitting it without losing logs after a crash.
• Adds the llm-wiki capability (compiles source material into linked wiki pages) and analysis-ledger capability (maintains a resumable code-analysis frontier with evidence-bearing claims).

AI-Powered Offensive Security · 2026-08-04

Dreadnode adds 20+ traditional-ML attacks, dn airt run-classifier CLI, multi-agent ATLAS campaigns, and eval agent selection to its red teaming platform.

• New dn airt run-classifier CLI command runs classic-ML attacks — evasion, extraction, membership inference, and model inversion — directly against a predict endpoint without SDK code.
• New dn evaluation create --agent <name> flag specifies which agent runs in an evaluation; eval output reports which agent actually ran.
• New --project-memory-preload-limit flag sets the number of memories preloaded at session start (range: 1–200), replacing a hardcoded default of 20.

SIEM · 2026-08-04

Elastic Security 9.5 adds immutable detection rule history with one-click rollback and GA queryable case analytics across all deployments.

• Detection Rules History Management (GA in 9.5) adds a History section on the rule details page showing a complete, chronological, immutable, append-only log of every saved rule state — who changed it, when, and the revision number — captured via UI or API, with one-click restore to any prior revision.
• Case analytics feature Cases as Data is now GA, on by default, and available across all deployment types including Serverless — auto-provisioned with a pre-built Case Analytics data view per space, no manual index configuration required.
• Case analytics index architecture reduced from 12 indices per space to 3 global indices, enabling SOC dashboards for closure rates, time to close, and assignment load without manual setup.

SIEM · 2026-08-04

Elastic Security adds detection rule change history with one-click rollback and out-of-the-box queryable SOC case data.

• Tracks every detection rule change with a full audit trail and one-click rollback, requiring no additional configuration.
• Makes SOC case management data queryable out of the box, enabling reporting without manual setup.

Firewalls & Network Defense · 2026-08-04

Fastly CLI v15.5.0 adds Python support for Compute init and new Notification Service Integrations management.

• Adds Python language support to compute/init, enabling Python-based Compute service scaffolding.
• Adds support for Notification Service Integrations via the integrations commands.

Firewalls & Network Defense · 2026-08-04

Fastly Terraform Provider 9.5.0 adds five new integration types to fastly_integration: Datadog, Jira Issue, JSM, OpsGenie, and Splunk On-Call.

• Adds datadog, jiraissue, jsm, opsgenie, and splunkoncall integration types to the fastly_integration resource.

Secrets Detection & Management · 2026-08-04

GitGuardian adds 4 new detectors, 2 new validity checkers, and expands HTML/Markdown scanning to npm, GitHub, and Slack tokens

• New Azure Immersive Reader Key detector added.
• New DashScope Coding Plan API Key detector added for Alibaba Cloud Model Studio (Qwen / DashScope) Coding Plan API keys.
• New DashScope Token Plan API Key detector added for Alibaba Cloud Model Studio (Qwen / DashScope) Token Plan API keys.

Secrets Detection & Management · 2026-08-04

GitGuardian adds ggshield machine report command to scan and submit results in a single step for scheduled jobs.

• Adds ggshield machine report command that combines scanning and result submission in one step, purpose-built for scheduled/automated jobs (previously required separate ggshield machine submit after scanning).

SIEM · 2026-08-04

Google SecOps adds Threat Hunt Agent (Public Preview) and 27 new log source integrations

• New Threat Hunt Agent (Public Preview, Enterprise Plus) autonomously generates structured hunting plans targeting specific threat actors, campaigns, malware families, software toolkits, or MITRE ATT&CK techniques, converts hypotheses into YARA-L 2.0 queries, executes them against historical telemetry, and auto-creates cases with verdicts (Substantial Evidence, Evidence Found, or Threat Not Found) in Case Management.
• Adds 27 new log source integrations, including ARMIS_ALERTS, FORTINET_SWITCH, GCP_SECURITYCENTER_EXTERNAL_EXPOSURE, OPEN_VPN, THREATLOCKER, ADOBE_EXPERIENCE_PLATFORM, AUDIOCODES_SBC, AZURE_GATEWAY_CONTAINERS, AZURE_LOGIC_APPS, AZURE_NATGW_FLOW, BROADCOM_DX_NETOPS_SPECTRUM, CARTO_ACTIVITY, CLAUDE_CODE_OBSERVABILITY, CYBLE_ASM, CYBLE_BIP, DARKWEB_IQ, ELLIO_THREAT_INTEL, EXEON_NDR, GRAVITEE, KASPERSKY_ANTI_TARGETED_ATTACK, MICROSOFT_COPILOT_INTERACTION, OSTTRA_MARKITWIRE, PROOFPOINT_ADAPTIVE_EMAIL_SECURITY, SECOMEA_GATEMANAGER, TRENDMICRO_VISION_ONE_RISK_EVENT, TXONE_EDGEIPS, VECTRA_RUX, and ZOHO_CRM.
• Extends the Stage 2 SOAR migration to Google Cloud deadline from September 30 to November 30, 2026.

AI-Powered Offensive Security · 2026-08-04

API surface changed: 1 modified

• GET /repos: response schema changed

Digital Forensics & Incident Response · 2026-08-04

Hayabusa dfir-timeline gains scan wizard by default, flexible output types, GeoIP enrichment, and CSV/JSON/JSONL format controls.

• Enables scan wizard by default for the dfir-timeline command.
• Adds -t, --output-type flag to dfir-timeline for selecting output format: csv (default), json, or jsonl (value is case-insensitive, e.g. -t JSONL).
• Adds -G, --geo-ip <MAXMIND-DB-DIR> to enrich IP addresses in dfir-timeline output with GeoIP data (ASN, city, country).

Digital Forensics & Incident Response · 2026-08-04

Hayabusa adds a config-critical-systems subcommand for configuring critical system inputs.

• Adds config-critical-systems subcommand, accepting an <INPUT> argument and [OPTIONS], for configuring critical systems.

Digital Forensics & Incident Response · 2026-08-04

Hayabusa analysis commands gain JSON/JSONL input, checksum validation, duplicate removal, base64 extraction, and richer timestamp options across the board.

• Adds -V, --validate-checksums flag to computer-metrics, eid-metrics, extract-base64, log-metrics, logon-summary, pivot-keywords-list, and search commands to enable checksum validation.
• Adds -X, --remove-duplicate-records flag to eid-metrics and logon-summary to deduplicate event records (default: disabled).
• Adds --threads <NUMBER> flag to eid-metrics, extract-base64, log-metrics, logon-summary, pivot-keywords-list, and search to control thread count (default: optimal for performance).

Digital Forensics & Incident Response · 2026-08-04

Hayabusa 4.0.0 unifies timeline commands under dfir-timeline with -t output-type selection and adds Linux ARM64 musl binaries.

• Adds unified dfir-timeline command replacing separate CSV/JSON/JSONL commands; output format selected with -t, --output-type: -t csv (default), -t json, or -t jsonl (case-insensitive).
• Removes -L, --JSONL-output flag; use -t jsonl instead with dfir-timeline.
• Reassigns -t shorthand from --threads to --output-type; --threads retains its long form only.

Digital Forensics & Incident Response · 2026-08-04

Hayabusa adds dfir-timeline command to save timelines in CSV, JSON, and JSONL formats.

• Adds dfir-timeline command to save event timelines in CSV, JSON, or JSONL format.

Digital Forensics & Incident Response · 2026-08-04

Hayabusa v4.0.0 merges csv-timeline and json-timeline into dfir-timeline, expands RDP and PowerShell coverage, and adds ARM64 Linux support.

• New dfir-timeline command replaces csv-timeline and json-timeline, with output format selected via -t, --output-type: -t csv (default), -t json, or -t jsonl (case-insensitive); CSV-only flags -M, --multiline, -S, --tab-separator, and -R, --remove-duplicate-data now error if used with a non-CSV -t.
• All command-line option long names standardized to lowercase: --GeoIP→--geo-ip, --HTML-report→--html-report, --UTC→--utc, --ISO-8601→--iso-8601, --RFC-2822/--RFC-3339→--rfc-2822/--rfc-3339, --JSON-input/--JSON-output→--json-input/--json-output, --EID-filter→--eid-filter; short flags unchanged.
• logon-summary now counts RDP session events: Security EIDs 4778/4779 (session reconnect/disconnect with client workstation name and IP) and Terminal Services events RemoteConnectionManager/Operational 1149 and LocalSessionManager/Operational 25, covering RDP activity even when 4624 events have been overwritten.

AI Agent Frameworks · 2026-08-04

Hermes Agent docs debut: installer, CLI commands, and Tool Gateway surface named for immediate use.

• Adds hermes setup --portal to log in, set Nous as the LLM provider, and enable the Tool Gateway (web search, image generation, TTS, cloud browser) in one command.
• Adds hermes model command to interactively choose an LLM provider and model, including custom endpoints for local/self-hosted models.
• Adds hermes gateway setup command to connect messaging platforms (Telegram, Discord, Slack, and others).

AI Agent Frameworks · 2026-08-04

Hermes adds per-session stall watchdog, compression timeout caps, font customization, and auxiliary concurrency limits.

• Adds terminal.font_family config key to set the embedded terminal font (accepts a locally installed family name or CSS font stack, with JetBrains Mono as fallback); also editable at Settings → Appearance → Terminal Font.
• Adds context_timeout_seconds config key to cap the inactivity budget for in-agent compress_context operations (conversation loop, preflight compaction, and manual compress); set to 0 to disable.
• Adds context_total_ceiling_seconds config key to set an absolute pre-commit ceiling on in-agent compression even while summary tokens are still streaming; clamped to at least context_timeout_seconds.

AI Agent Frameworks · 2026-08-04

Hermes CLI gains prompt stashing with Ctrl+S and zero-cost shell mode via !<command>

• Adds Ctrl+S prompt stash: parks the current composer draft and clears the input so you can send something else first; pressing Ctrl+S again on an empty composer restores the draft (with cursor position and attached images). Repeated presses build a stack — with two or more stashed, Ctrl+S opens a browse panel (↑/↓ to navigate, Enter to restore, D to discard, Esc/Ctrl+S to close). A 📌 N badge in the status bar shows the number of parked drafts.
• Adds !<command> shell mode in the CLI: prefixing a line with ! (e.g. !git status, !pytest -x tests/cli) runs it as a shell command without invoking the model — no API call, no tokens, no latency, and no history entry. Dangerous commands (e.g. rm -rf) still go through the approval prompt. Non-zero exits print ! exited <code>. Shell mode is CLI-only; Gateway platforms (Discord, Telegram, Slack) and cron runs ignore it.
• Adds /personality none (also accepts default or neutral) to remove any active personality overlay and return to the default.

AI Agent Frameworks · 2026-08-04

Hermes v2026.8.3 adds conversational voice with barge-in, A2A v1.0, signed outbound webhooks, grounded citations, a plugin SDK, and a wave of CLI power commands.

• Adds !command shell escape to run a shell command instantly from the CLI without spending a model turn.
• Adds /init CLI command to scan a project and generate or update an AGENTS.md file.
• Adds /diff CLI command to show staged, all, or session changes from any surface.

Exploitation & C2 · 2026-08-04

NodeZero adds an MCP Server hosted by Horizon3 with OAuth 2.1 auth and multi-user support.

• New MCP Server hosted by Horizon3 provides OAuth 2.1 authentication and multi-user support.

Exploitation & C2 · 2026-08-04

NodeZero Tripwires: honeytoken decoys deployed to high-risk assets to silently detect attacker activity.

• Introduces Tripwires, a honeytoken capability that deploys silent decoy credentials to assets flagged as high-risk by NodeZero autonomous pentest results — tokens communicate only when triggered, alerting Horizon3's cloud infrastructure.
• Tripwires use real credentials generated by Horizon3 that blend into the network environment, making them attractive targets for attackers without generating noise until activated.

Exploitation & C2 · 2026-08-04

NodeZero June 2026: Rapid Response asset-level exploitability, Real-Time View redesign, and External Pentest Scopes rebuild

• Rapid Response now surfaces personalized asset-level exploitability status, remediation guidance, and verification feedback to distill vulnerability noise.
• Real-Time View (RTV) redesigned with a visual timeline, event-log summaries, and granular event details with flexible filtering to help distinguish NodeZero testing from real attacks.
• External Pentest rebuilt: replaces Asset Groups with reusable Scopes, improves bulk asset management and uploads, and enhances support for large external attack surfaces.

Agentic Infrastructure · 2026-08-04

API surface changed: +1 endpoint, 3 modified

• New endpoint POST /api/credentials/revoke
• GET /api/users/{username}/overview: response schema changed
• GET /oauth/userinfo: response schema changed

Agentic Infrastructure · 2026-08-04

• Adds label-based filtering to the Jobs pages for users and organizations, with most-used labels shown as clickable chips displaying job counts and a free-form key=value input field for filtering by any label.

Endpoint Security (EDR/XDR) · 2026-08-04

Huntress adds API-based IP rules for ITDR, trusted-device suppression for corporate logins, onboarding escalation pacing, and automatic usage-location inference.

• New API endpoint lets you create IP address-based allow/block rules for Managed ITDR Unwanted Access, accepting a single IP, a CIDR range, or a list of IPs in one call.
• Logins from corporate-managed devices no longer trigger location and VPN escalations by default for new accounts; existing partners can configure which device trust levels qualify — compliant, domain-joined, or registered — per account or per organization.
• Managed ITDR now automatically paces escalation flow during a new tenant's first week to prevent onboarding noise spikes, on by default with no configuration required.

Reverse Engineering · 2026-08-04

ILSpy v11.0-rc adds Open from running process, two new ilspycmd modes, hover tooltips, and metadata layout improvements.

• Adds --dump-table metadata dump mode to ilspycmd for inspecting raw metadata tables.
• Adds --member flag to ilspycmd for single-member decompilation.
• New Open from running process dialog lets you attach ILSpy directly to a live process.

Container & Image Security · 2026-08-04

Inspektor Gadget v0.55.0 adds a gpu-ebpf-bridge daemon for GPU telemetry, map pinning, non-destructive map iteration, and three new eBPF program types.

• eBPF operator now supports map pinning via LIBBPF_PIN_BY_NAME in gadget maps and non-destructive map iteration via iter/bpf_map_elem with GADGET_ITER_TARGET_MAP.
• Adds support for ebpf.SockOps, ebpf.SkSKB, and ebpf.SkMsg eBPF program types in the eBPF operator.
• Enables OTel/Python stack symbolization for perf_event-based gadgets (e.g. profile_cpu), including aggregation of identical stacks.

Attack Surface & Exposure Management · 2026-08-04

Intruder adds AI Pentesting with whitebox code-repo integration, delivering full PDF reports on demand.

• New AI Pentesting capability launched from the portal (left nav → AI Pentesting → Start new pentest → AI Pentest option), delivering full PDF reports with executive summary, severity ratings, reproduction steps, and remediation guidance.
• Supports whitebox testing via code repository integration, enabling coverage of access control, business logic, and auth bypass issues that require multi-step chaining.
• Allows practitioners to define custom entry points, credentials, and application context to scope the AI pentest to their real environment.

Identity & Access Management · 2026-08-04

API surface changed: 7 deprecated

Secure Access (VPN / SASE / ZTNA) · 2026-08-04

Knocknoc adds Allowlist/EDL backend to publish active IP grants via server API for agentless firewall integration

• New Allowlist (EDL) backend publishes active IP address grants via the Knocknoc server API, enabling firewalls and appliances to poll for dynamic IP lists without deploying a Knocknoc agent — compatible with Palo Alto External Dynamic Lists, Fortinet External Connectors, Juniper SRX, SonicWall DEAG, F5 BigIP IP Intelligence, Cisco Firepower Dynamic Attributes Connector, PfSense, and others.
• Supports two EDL modes: Passive (firewall polls on its own schedule) and Passive+ (Knocknoc also pushes an API call to the firewall requesting an immediate EDL refresh, reducing grant propagation delay).
• EDL access security supports two protection methods: Secret based (requires a secret/key in the authentication header plus IP access control) and IP based (restricts EDL access by source IP only).

Exploitation & C2 · 2026-08-04

Metasploit Pro 5.1.0-2026073001 adds MALLEABLEC2 HTTP(S) shaping, 8 new MCP tools, RISC-V payloads, expanded CertificateTrace/KerberosTicketTrace, and an HTTP-to-SMB NTLM relay module.

• Adds MALLEABLEC2 option to all Meterpreter HTTP(S) payloads (Windows, Java, Python, PHP, Linux) to load a standard Malleable C2 profile and reshape HTTP(S) traffic.
• Adds --enable-dangerous-actions flag to the msfmcpd CLI to opt in to dangerous actions across the eight new MCP tools that wrap existing RPC endpoints for module and session control.
• Adds eight new MCP tools wrapping existing RPC endpoints for module and session control, backed by strict per-tool input validation.

Data Security & DLP · 2026-08-04

Netskope R140 adds an AI agent for automatically generating NPA app segments and policies.

• Introduces an AI agent within Netskope Private Access (NPA) that automatically generates app segments and policies.

Data Security & DLP · 2026-08-04

Netskope R119 brings GA for Box, Cisco Webex, ServiceNow, and Slack Enterprise in Next-Gen API Data Protection, plus HTTP/2 RBI and a new URL Lookup API.

• Adds Transaction Events Field - Format 4 (Beta) for Netskope Secure Web Gateway transaction event logging.
• Adds Netskope URL Lookup API (Controlled GA) enabling programmatic URL classification queries.
• General Availability of Next Generation API Data Protection for Box, Cisco Webex, ServiceNow, and Slack Enterprise.

Data Security & DLP · 2026-08-04

Netskope R121 brings Cloud TAP to general availability and adds multiple IdP support for NPA Browser Access.

• Promotes Cloud TAP to general availability (GA).
• Adds multiple IdP support for Netskope Private Access (NPA) Browser Access, enabling more than one identity provider per deployment.

Data Security & DLP · 2026-08-04

Netskope Cloud 122 adds Google Badged Label write support, ChatGPT Enterprise NPA, browser access, new SWG file constraints, and RBI SKU scope isolation.

• Adds Browser Access for RUH1 in Netskope Private Access.
• Adds new Inline File Constraints to the Netskope Secure Web Gateway (NG SWG).
• Adds XRBI SKU Scope and isolation of third-party auth flows in Remote Browser Isolation (RBI).

Data Security & DLP · 2026-08-04

Netskope CE v5.1 adds Unified Cloud Risk Exchange, IoC labeling/retraction, full ticket lifecycle management, and endpoint event visibility.

• Adds Unified Cloud Risk Exchange (CRE) providing user and application risk context for adaptive zero trust policy enforcement, with integrations for Microsoft Entra, CrowdStrike Identity Protect, CrowdStrike Cloud Security (CNAPP), Okta, and Wiz.
• Adds IoC Source Labeling in Cloud Threat Exchange (CTE) to identify the origin of IoCs shared between Netskope and third-party Threat Intel Providers (TIPs) including CrowdStrike, SentinelOne, MISP, and Anomali.
• Adds IoC Retraction in Cloud Threat Exchange (CTE) to remove or roll back IoCs shared between Netskope and third-party TIPs such as CrowdStrike, SentinelOne, MISP, and Anomali.

SAST / SCA / Code Security · 2026-08-04

Noir AI power adds timeout, connect-timeout, and raw-log env vars with automatic retry on rate limits

• Adds NOIR_AI_TIMEOUT environment variable to set the seconds Noir waits for a provider response (default: 300).
• Adds NOIR_AI_CONNECT_TIMEOUT environment variable to set the seconds Noir waits for the connection itself (default: 10).
• Adds NOIR_ACP_RAW_LOG environment variable — set to 1 to expose raw ACP and agent stderr logs for debugging.

AI Coding Agents · 2026-08-04

API surface changed: 1 deprecated

Threat Intelligence · 2026-08-04

OpenCTI Map gains updated dark and light mode styles via new filigran-dark3.json and filigran-light3.json files.

• Adds filigran-dark3.json dark mode map style for the OpenCTI Map view.
• Adds filigran-light3.json light mode map style for the OpenCTI Map view.

Threat Intelligence · 2026-08-04

OpenCTI releases now ship a CycloneDX SBOM asset (sbom-opencti-platform-<version>.cdx.json) per Docker image base starting from 7.260728.0.

• Adds a CycloneDX JSON SBOM file (sbom-opencti-platform-<release version>.cdx.json) to each release's assets, generated by .github/workflows/cd-build-rolling-images-on-merge.yml, enabling component verification, compliance reviews, and supply chain transparency.
• Provides one SBOM asset per Docker image base (standard, FIPS, and UBI9), with a nested component structure covering platform, frontend, GraphQL API, and worker sub-components.

Threat Intelligence · 2026-08-04

OpenCTI 7.260803.0 adds stop-operation control for data sanity tasks and improved HTTP header management.

• Improves HTTP header management in the Express layer.

AI Coding Agents · 2026-08-04

OpenHands agent canvas now lets you inspect plugin contents including bundled skills and a syntax-highlighted file viewer.

• Adds a plugin detail view in the agent canvas that lists bundled skills (including command-derived skills) with their icons, names, and descriptions.
• Adds an expandable directory tree in the plugin detail view with inline syntax-highlighted file viewing — select a file to open it, select again to close.

AI Coding Agents · 2026-08-04

OpenHands LLM profiles can now be assigned specifically for conversation title generation

• Adds a dedicated LLM profile selector for conversation title generation under Settings > Application > Conversation titles, with an Automatic option to use the active local profile or a specific saved profile.

AI Coding Agents · 2026-08-04

OpenHands Agent Canvas ships a preview desktop app for macOS (Apple silicon) and Windows that bundles all runtimes.

• New Agent Canvas desktop app (preview) for macOS (Apple silicon) and Windows bundles Node.js and required runtimes — no prerequisites or open terminal needed; download Agent-Canvas-<version>-arm64.dmg (macOS) or Agent-Canvas-Setup-<version>.exe (Windows) from the OpenHands releases page.
• Desktop app auto-starts its local backend on launch; select Show details during startup to view and copy the live startup log for troubleshooting.
• Supports in-app update checking and version display via Settings > Application.

AI Coding Agents · 2026-08-04

OpenHands offers a native desktop app preview build for testing.

• Adds a native desktop app preview build available for testing via the Try the desktop preview link.

AI Coding Agents · 2026-08-04

OpenHands v1.9.0 adds live agent activity in chat, a compact backend chooser, and an extension-manifest hosting system.

• Shows live agent activity directly in the chat view so users can monitor what the agent is doing in real time.
• Adds a compact Cloud vs Agent-server backend chooser in the UI for faster backend selection.
• Introduces a domain-neutral extension-manifest host, enabling extensions to be served without domain-specific coupling.

Runtime Security · 2026-08-04

OpenShell v0.0.97 adds gateway callback listener negotiation for compute and a prototype Bazel build system.

• Adds gateway callback listener negotiation for the compute layer, enabling dynamic coordination between sandboxes and the gateway control plane.
• Introduces a prototype Bazel build system, including OpenTelemetry crate targets, for an alternative build path.

Web Application Security · 2026-08-04

API surface changed: 73 deprecated

CNAPP · 2026-08-04

Plerion adds GCP organization-wide onboarding via a single generated command with keyless Workload Identity Federation.

• Onboards an entire Google Cloud organization from a single generated command using keyless access via Workload Identity Federation — no service account keys required.
• Provides an equivalent Terraform template for organizations preferring infrastructure-as-code onboarding.
• Automatically discovers every project in the organization, including projects created after initial onboarding, with the option to include all automatically or select individually.

CNAPP · 2026-08-04

Plerion adds native Terraform onboarding for AWS and SBOM/secret scanning for Kubernetes workloads.

• New Terraform template provisions the IAM role and policies as native Terraform resources and registers the AWS integration automatically — no CloudFormation stack, no manual console step — with a choice of running workload scanning inside your own account or through a Plerion-managed service account.
• Workload scanning now builds a software bill of materials (SBOM) for every container image across Kubernetes Deployments, DaemonSets, StatefulSets, Pods, Jobs, and CronJobs, surfaced on each asset's SBOM tab.
• Secret scanning detects API keys, tokens, and passwords inside container images and reports them with severity on the asset's Sensitive data tab, so practitioners know what to rotate first.

SAST / SCA / Code Security · 2026-08-04

Portkey March 2026 adds vault-backed Secret References, weekly/endpoint-scoped rate limits, cross-cloud GCS log delivery, and four new guardrail integrations.

• Adds Secret References so credentials stored in AWS Secrets Manager, Azure Key Vault, or HashiCorp Vault can be mapped to integrations and virtual keys via secret_mappings, with Portkey fetching values at runtime instead of storing them directly.
• Adds rpw (requests-per-week) budget and usage windows so rate limits can align with weekly planning cycles, alongside endpoint-scoped limits that let chat completions, embeddings, and admin routes carry independent caps.
• Adds GCP_WIF_AUDIENCE and GCP_WIF_SERVICE_ACCOUNT_EMAIL environment variables to enable GCP Workload Identity Federation (gcs_assume style) for GCS log delivery when the gateway runs in AWS, eliminating static cross-cloud credentials.

AI/LLM Security · 2026-08-04

Promptfoo snapshot-20260804 adds adaptive rate limiting, Transformers.js local inference, telecom red team plugins, and multi-input red team scanning.

• Adds promptfoo logs command for viewing log files directly.
• Adds --share and --no-share flags to Model Audit for controlling cloud sharing.
• Adds -d/--description flag to redteam generate commands.

Cloud Security Posture · 2026-08-04

Prowler Cloud Lighthouse adds a context-aware chat panel that scopes questions to the current page and open finding/resource.

• New context-aware chat panel automatically attaches the current app page and any open finding or resource metadata to each message, so queries like explain this resolve against what is on screen — active context is shown as a chip in the composer.

Cloud Security Posture · 2026-08-04

Prowler adds Huawei Cloud, 11 Nitro Enclaves checks, 4 Attack Path queries, OCSF MITRE ATT&CK enrichment, GCP org onboarding, and MCP tool families for integrations/users/roles.

• Adds HUAWEICLOUD_ACCESS_KEY_ID and HUAWEICLOUD_SECRET_ACCESS_KEY environment variables to enable scanning of Huawei Cloud accounts via Prowler CLI, covering 25 checks across CTS, ECS, ELB, EVS, IAM, KMS, OBS, RDS, VPC, and WAF services plus the CIS Huawei Cloud Foundations Benchmark 1.0 compliance framework.
• Adds 11 new AWS Nitro Enclaves CSPM checks in the ec2_confidential_workload_host_* family (IMDSv2 enforcement, public IP exposure, unrestricted ingress, exposed vsock proxy ports, stopped hosts) and kms_key_enclave_* family (attestation enforcement, bypass, deployment binding, debug-mode, PCR mismatches, unknown enclave images), mapped across 23 compliance frameworks including NIST 800-53 Rev 5, PCI-DSS v4.0, ISO 27001:2022, SOC 2, HIPAA, and MITRE ATT&CK.
• Adds codecommit_repository_no_secrets check under the new codecommit service, scanning files at the tip of each repository's default branch for hardcoded secrets.

Cloud Security Posture · 2026-08-04

Prowler 5.37.0 adds Huawei Cloud, 11 Nitro Enclave checks, 4 attack-path queries, MCP integrations/users/roles, and OCSF MITRE ATT&CK enrichment.

• Adds HUAWEICLOUD_ACCESS_KEY_ID and HUAWEICLOUD_SECRET_ACCESS_KEY environment variables to authenticate a new huaweicloud provider, enabling prowler huaweicloud scans across 25 checks covering CTS, ECS, ELB, EVS, IAM, KMS, OBS, RDS, VPC, and WAF, plus the CIS Huawei Cloud Foundations Benchmark 1.0.
• Adds 11 new AWS Nitro Enclaves CSPM checks: five ec2_confidential_workload_host_* checks for parent-instance hygiene (IMDSv2, public IP, ingress, vsock proxy ports, host state) and six kms_key_enclave_* checks for KMS attestation-policy correctness, mapped across 23 compliance frameworks including NIST 800-53 Rev 5, PCI-DSS v4.0, ISO 27001:2022, SOC 2, HIPAA, and MITRE ATT&CK.
• Adds four AWS privilege-escalation Attack Path queries: STS-002 (cross-account role trust), STS-003 (wildcard role trust), IAM-022 (user permissions-boundary removal), and SSO-001 (IAM Identity Center permission-set escalation).

Attack Surface & Exposure Management · 2026-08-04

Exposure Command adds unified compliance mapping with custom rules and AI-powered root cause analysis for runtime alerts.

• New Map to Compliance Pack row and bulk action in Controls & Compliance > Insights consolidates pack membership and compliance rule mapping into a single step, replacing the separate Edit Metadata and Add to Custom Pack actions.
• Custom compliance packs now support user-defined compliance rules (e.g., Custom Control 1.3, Internal Policy 2.1) with the ability to define, rename, and delete rules from the Compliance Rules tab on a custom pack's detail page without losing existing Insight mappings.
• Custom packs can now inherit read-only rules from base packs, with filtering of compliance rules by source for scalable governance.

Vulnerability Management · 2026-08-04

Rapid7 Command Platform adds an AI Summary Card to the Detection & Response Dashboard for MDR customers.

• Adds an AI Summary Card to the Detection & Response Dashboard in SIEM (InsightIDR) and the Command Platform, giving MDR customers a quick AI-generated overview of their environment.

SAST / SCA / Code Security · 2026-08-04

InsightAppSec 7.5.028 adds OOB Host Header Injection detection, AI-powered SQL injection and RFI validation, and Windows implicit authentication for Chromium scans.

• New Out-of-Band attack module detects DNS Redirect vulnerabilities by injecting callback domains into Host, X-Forwarded-Host, X-Host, X-Forwarded-Server, and RFC 7239 Forwarded headers, with raw socket delivery to bypass WinInet constraints; DNS-only evidence findings are assigned Medium confidence.
• AI Vulnerability Validator for SQL Injection uses AWS Bedrock LLM to automatically assess and validate SQL Injection findings, filtering false positives before reporting.
• AI Vulnerability Validator for Remote File Inclusion uses AWS Bedrock to confirm successful exploitation prior to reporting, eliminating false positives from unexploited payload reflections.

CNAPP · 2026-08-04

InsightCloudSec adds unified compliance mapping with custom rules and AI-powered root cause analysis for runtime alerts.

• New Map to Compliance Pack row and bulk action in Controls & Compliance > Insights consolidates pack membership and compliance rule mapping into a single step, replacing the separate Edit Metadata and Add to Custom Pack actions.
• Custom compliance packs now support user-defined compliance rules (e.g. Custom Control 1.3, Internal Policy 2.1) with a dedicated Compliance Rules tab on each custom pack's detail page for defining, renaming, and deleting rules without losing existing Insight mappings.
• Custom packs can now inherit read-only rules from base packs and filter compliance rules by source for scalable, consistent governance.

SIEM · 2026-08-04

InsightIDR adds an AI Summary Card to the Detection & Response Dashboard and phased event-time search in Log Search.

• Adds an AI Summary Card to the Detection & Response Dashboard (in SIEM/InsightIDR and Command Platform) for MDR customers, surfacing an AI-generated headline plus 3 AI-generated insights drawn from live dashboard data, with links back to source widgets for verification.
• Begins phased rollout of default event-time search in Log Search, allowing events to be queried by when the activity occurred in the source data rather than ingestion time.

Attack Surface & Exposure Management · 2026-08-04

Surface Command adds Azure Blob Storage, HCL AppScan, Microsoft AD CS, and UpGuard connectors plus DataGuard and EAS enrichments

• New Azure Blob Storage connector reads JSON blobs from Azure Blob Storage and imports them into the Rapid7 Platform as Surface Command records, with the type configured at runtime.
• New HCL AppScan on Cloud connector imports application inventory, DAST/SAST/SCA/IAST scan results, and security findings into Surface Command for application security posture visibility.
• New Microsoft AD Certificate Services connector queries the CA database via WinRM to retrieve all certificates — issued, revoked, pending, denied, and failed — with full lifecycle, expiration, template, and PKI inventory detail.

Identity & Access Management · 2026-08-04

SailPoint adds rule-based auto-discovery of privileged entitlements with accept/reject workflows and auditable classification records.

• Surfaces recommendations for potentially privileged entitlements based on aggregate privilege classification pattern analysis, covering access that falls outside vendor-published lists or custom criteria.
• Integrates recommendations into existing entitlement and source pages, allowing administrators to accept or reject each recommendation and assign a privilege level when marking an entitlement as privileged.
• Enables delegation of recommendations to entitlement owners, source owners, governance groups, or other subject matter experts using the existing approvals flow.

Identity & Access Management · 2026-08-04

SailPoint ISC Access Model Metadata now supports free-form ad hoc values on roles, access profiles, and entitlements.

• Adds Allow Ad Hoc Values option when creating or editing a custom metadata attribute, enabling free-form values up to 100 characters per value — no pre-defined list required — on roles, access profiles, and entitlements.
• Adds Allow Multivalued Assignment option on custom metadata attributes, permitting more than one value to be assigned to a single attribute (note: once enabled, cannot be undone).
• Expands value capacity to up to 5,000 different values per custom attribute and up to 250 custom metadata attributes per access object type.

Identity & Access Management · 2026-08-04

SailPoint Agentic Fabric launches in Sandbox, delivering unified discovery, governance, and protection for AI agents and non-human identities across 32+ frameworks.

• New Agentic Fabric tab in top navigation (MIS and AIS tenants) surfaces a dedicated governance workspace for AI agents and non-human identities (NHIs).
• New Applications and Accounts left-nav items consolidate machine accounts (IAM roles) and machine/application identities into a single view.
• Adds approval routing for agent provisioning (activation/deactivation) configurable under Global → System Settings → Approval Settings → Agent Requests.

SAST / SCA / Code Security · 2026-08-04

API surface changed: 3 deprecated

SAST / SCA / Code Security · 2026-08-04

skill-scanner adds pre-commit hook, incremental CI scans, and an expanded CLI allowlist for GitHub Actions workflows

• Adds skill-scanner-pre-commit --install to install a pre-commit hook that maps each changed path to its nearest parent SKILL.md, scans each affected skill once, and blocks commits at the configured severity.
• Adds --scan-all flag to the pre-commit hook to scan every configured skill instead of only those affected by changed paths.
• Supports incremental CI scans via pre-commit run skill-scanner --from-ref "$BASE_SHA" --to-ref "$HEAD_SHA" to scan only changed files between two revisions.

SAST / SCA / Code Security · 2026-08-04

skill-scanner adds OSV.dev dependency querying, trigger specificity analysis, LLM consensus runs, and token usage reporting

• Adds use_osv config field to query OSV.dev for vulnerable exactly pinned Python dependencies during scans.
• Adds use_trigger config field to enable trigger specificity analysis.
• Adds llm_consensus_runs integer config field (default: 1) to control the number of LLM runs used for majority consensus adjudication.

SAST / SCA / Code Security · 2026-08-04

skill-scanner Python SDK adds llm_usage token reporting and build_analyzers factory for programmatic analyzer assembly.

• Adds llm_usage field (dict[str, int]) to scan results, reporting aggregate input, output, and total tokens across LLM, meta, and adjudication calls.
• Adds build_analyzers factory function in skill_scanner.core.analyzer_factory to assemble optional analyzers (use_behavioral, use_llm, use_osv, llm_consensus_runs) programmatically, matching CLI and API parity.
• Enables demote-only adjudication pass programmatically via policy.adjudicator.enabled = True before constructing SkillScanner.

SAST / SCA / Code Security · 2026-08-04

skill-scanner adds adjudicator and llm_analysis policy keys for false-positive demotion and LLM budget control

• Adds adjudicator.enabled and adjudicator.min_fp_confidence config keys to enable demote-only false-positive review with a configurable confidence threshold; disabled by default and records decisions for audit.
• Adds llm_analysis.trusted_reference_domains config key to list organization-controlled domains whose transitive-trust and supply-chain findings are automatically demoted to LOW severity.
• Adds llm_analysis policy section covering prompt/output budgets and a meta multiplier for controlling LLM analysis behavior.

SAST / SCA / Code Security · 2026-08-04

skill-scanner gains repo scanning, OSV advisory queries, LLM adjudication, multi-format output, and rule-pack controls in one release.

• New scan-repo subcommand clones a public GitHub repository into a temporary directory, recursively discovers and scans skills, then removes the clone on completion — accepts owner/repo shorthand or a full HTTPS URL.
• Adds --use-osv flag to query OSV.dev for advisories affecting exactly pinned Python dependencies; no API key required.
• Adds --adjudicate flag for a demote-only LLM review of deterministic HIGH/CRITICAL literal-regex false positives before LLM enrichment.

SAST / SCA / Code Security · 2026-08-04

skill-scanner gains repo scanning, multi-format output, behavioral/LLM analyzers, and rule pack selection in one release.

• Adds scan-repo owner/repo subcommand to scan every skill in a public GitHub repository in a single invocation.
• Adds --use-behavioral, --use-osv, --use-llm, and --enable-meta flags to scan for dependency, OSV, and LLM-powered semantic analysis.
• Adds --rule-packs to scan and scan-all for selecting optional rule packs; supports atr and promptguard packs, and accepts list as a value to enumerate all bundled packs.

SAST / SCA / Code Security · 2026-08-04

Skill Scanner adds OSV dependency scanning, an adjudicator engine, ATR and PromptGuard rule packs, and extended detection coverage across 9 ecosystems.

• Adds --use-osv flag to activate the OSV Analyzer, which checks known vulnerabilities in exactly pinned Python dependencies with no API key required.
• Adds --adjudicate flag to enable the Adjudicator, a demote-only LLM review that can reduce deterministic HIGH/CRITICAL literal-regex false positives to INFO without ever promoting a finding.
• Adds --rule-packs atr to enable the ATR (Cisco AI Threat Research) rule pack, currently covering 712 rules.

SAST / SCA / Code Security · 2026-08-04

skill-scanner adds OpenAI-compatible endpoint routing, per-role model overrides, and OSV.dev dependency scanning via new env vars and --use-osv.

• Adds SKILL_SCANNER_LLM_PROVIDER environment variable to route LLM calls, including openai for OpenAI-compatible endpoints.
• Adds SKILL_SCANNER_LLM_BASE_URL environment variable to point skill-scanner at any OpenAI-compatible base URL.
• Adds SKILL_SCANNER_LLM_USER environment variable to inject a raw Chat Completions user field on OpenAI-compatible routes.

SAST / SCA / Code Security · 2026-08-04

Skill Scanner 2.0.13 adds OSV.dev dependency scanning, unpinned-dependency detection, suspicious-URL classification, trusted-domain LLM policy, and LLM token usage in JSON output.

• Adds --use-osv flag to enable the new OSV.dev dependency vulnerability analyzer, checking dependencies against the open OSV advisory database.
• Adds trusted_reference_domains to the LLM analysis policy to allowlist domains that should not be flagged as suspicious during semantic analysis.
• Exposes LLM token usage in ScanResult JSON output, including adjudicator token consumption, enabling cost tracking and auditing.

Endpoint Security (EDR/XDR) · 2026-08-04

Sophos Core Agent 2025.2.1.709 adds ZTNA trusted-network detection via DNS and a new process-level CredGuard exclusion capability.

• Adds process-level exclusion capability in HitmanPro.Alert to support more specific exclusion of CredGuard detections (WINEP-56443).
• ZTNA agents can now detect trusted networks via DNS configuration and bypass traffic interception, reducing latency for local resources such as CIFS and RDP (WINEP-57828).
• Adds Kingston IronKey peripheral to the Secure Removable Storage classification in Sophos Endpoint Defense (WINEP-60202).

SAST / SCA / Code Security · 2026-08-04

Dev Machine Guard v1.15.0 adds npm/pnpm/Yarn/bun registry enforcement, VS Code private marketplace URLs, and an MDM verify-only channel.

• Adds package_config policy support: the agent converges a StepSecurity-owned block in ~/.npmrc to route npm, pnpm, Yarn classic, and bun through your tenant's Secure Registry; absent policy is a no-op with snapshot rollback.
• Writes extensions.gallery.serviceUrl into VS Code user-scope settings.json atomically alongside extensions.allowed when a policy sets a gallery URL; removal is ownership-gated so developer-configured URLs are never deleted.
• Introduces a verify-only enforcement channel for MDM-enforced profiles: reads the OS-managed VS Code policy (Windows registry, macOS managed preferences, /etc/vscode/policy.json) or effective ~/.npmrc and reports observed values and drift without writing.

SAST / SCA / Code Security · 2026-08-04

Device Policy adds npm package config policies, MDM drift verification, private marketplace support, and per-profile enforcement types.

• Adds npm package config policies that write a managed block into ~/.npmrc with the tenant Secure Registry URL and a per-device ::dev: suffixed authentication token, bounded by BEGIN/END markers to leave surrounding configuration untouched.
• Adds MDM verification with field-by-field drift diffs: the agent continuously compares what your MDM deployed against the policy and reports one of eight states (MDM verified, MDM drift, Not deployed, Verification failed, and others), showing desired vs. observed for every field.
• Generates audit, remediation, and uninstall script sets per platform for MDM-delivered package config policies, designed for deployment into Intune Remediations detection/remediation slots or an Iru Custom Script library.

SAST / SCA / Code Security · 2026-08-04

StepSecurity adds NuGet (.NET) ecosystem support to GitHub Checks, OSS Package Search, and Secure Registry.

• Adds NuGet Package Compromised Updates PR Content Security control to GitHub Checks, blocking pull requests that introduce or update a NuGet dependency flagged in StepSecurity's compromised-packages database; can be set to Required or Optional.
• Adds NuGet Package Cooldown PR Content Security control to GitHub Checks, blocking pull requests that add recently published NuGet versions until they age beyond the configured cooldown window; can be set to Required or Optional.
• Secure Registry now serves NuGet (Beta) at https://registry.stepsecurity.io/dotnet/index.json (V3 protocol only; resources under /dotnet/v3/), routing all NuGet metadata requests and package downloads through Secure Registry for policy evaluation.

Firewalls & Network Defense · 2026-08-04

Sublime adds Tailored Phishing Simulations (Beta): run campaigns prioritized by attacks already detected in your environment.

• New Tailored Phishing Simulations (Beta) lets you run phishing simulation campaigns prioritized by attack patterns Sublime is already detecting in your environment.
• Supports multiple templates per campaign with staggered delivery across recipients.
• Tracks click rates, report rates, and repeat clickers in a cross-campaign dashboard with recipient-level detail per campaign.

Secure Access (VPN / SASE / ZTNA) · 2026-08-04

Tailscale v1.102.1 adds four new CLI commands, new client metrics, iOS/tvOS UI upgrades, and macOS deep-linking.

• New tailscaled_serve_outbound_bytes_total and tailscaled_serve_inbound_bytes_total client metrics report bytes sent to and received from peers on Tailscale Serve connections.
• New tailscale get CLI command returns the current node's preferences.
• New tailscale whoami CLI command displays information about the current user and device.

Detection Engineering · 2026-08-04

Tenzir Ship v1.12.0 adds option to publish a release tag without creating a GitHub release

• Adds the ability to publish a release tag without creating a GitHub release, for cases where another repository owns the release or downstream builds must validate the tag first.

Detection Engineering · 2026-08-04

Tenzir Ship v1.12.0 adds pre-publish confirmation and the ability to tag a release without creating a GitHub release.

• Adds option to publish a release tag without creating a GitHub release, for cases where another repository owns the release or downstream builds must validate the tag first.
• Confirms every commit, tag, and push before making any changes during release publishing.

Secure Access (VPN / SASE / ZTNA) · 2026-08-04

Termius 9.42.2 adds host context-menu actions to open or add selected hosts to workspaces.

• Adds the ability to open selected hosts in a new workspace or add them to an open one directly from the Hosts screen context menu.
• Makes app updates less disruptive.

SOAR · 2026-08-04

API surface changed: 8 deprecated

SOAR · 2026-08-04

Tines 42.3.0 adds dynamic SMTP management, JSON in records, find-and-replace in stories, and AI-generated story names.

• Manage SMTP settings dynamically without requiring static configuration changes.
• Store and work with JSON natively inside Tines records.
• Find and replace content across stories for bulk editing workflows.

Compliance Automation & Trust Management · 2026-08-04

API surface changed: 1 deprecated

Data Security & DLP · 2026-08-04

Varonis Atlas adds Agent IBAC to detect AI agent intent drift and quarantine rogue agent identities in real time.

• New Agent Intent-Based Access Control (IBAC) in Varonis Atlas validates that an AI agent's reasoning, tool use, and data access stay consistent with its original instructions — alerting on or blocking out-of-policy actions.
• Intent drift detection monitors every agent action across sessions and provides a complete audit trail for every agent interaction.
• When an agent crosses policy boundaries, Atlas can quarantine the agent's identity and block all subsequent actions for a defined window.

SAST / SCA / Code Security · 2026-08-04

Veracode adds a Custom PDF REST API, >200 MB Pipeline Scan support, and a new GitHub app uninstallation workflow.

• New Custom PDF REST API enables programmatic generation of custom PDF reports.
• Pipeline Scan now supports packaged artifacts larger than 200 MB with no changes to existing integrations required.
• New uninstallation workflow on the Veracode Platform lets you uninstall the Veracode app from GitHub organizations.

Web Application Security · 2026-08-04

WPScan v4.1.0 adds opt-in local vulnerability database for enterprise customers via --enterprise-db-token

• Adds --enterprise-db-token TOKEN flag (also settable via the WPSCAN_ENTERPRISE_DB_TOKEN environment variable or the enterprise_db_token config-file key) to scan against a local vulnerability database dump instead of the online API, with no per-request limits.
• When --enterprise-db-token is set, WPScan downloads plugins.json.gz, themes.json.gz, and wordpresses.json.gz from enterprise-data.wpscan.org (authenticated via the X-DB-JSON-AUTH header) and reads vulnerability data locally — API status is reported as plan enterprise with Unlimited requests remaining.
• --enterprise-db-token and --api-token are mutually exclusive (including via their environment variables); supplying both raises an error, and the token is redacted from logged command lines.

Malware Analysis · 2026-08-04

YARA-X 1.19.0 lets you suppress multiple warnings in one comment by comma-separating their IDs.

• Supports suppressing multiple warnings in a single // suppress: comment by comma-separating warning IDs, e.g. // suppress: <WARNING_ID_1>,<WARNING_ID_2>.

Malware Analysis · 2026-08-04

YARA-X C API gains yrx_scanner_max_matches_per_pattern to cap per-pattern match output

• Adds yrx_scanner_max_matches_per_pattern to the C API, letting callers cap how many matches a single pattern will produce before suppressing further hits.

Managed Detection & Response (MDR) · 2026-08-03

Arctic Wolf bundles MDR, exposure management, endpoint defense, IR360, and up to $3M warranty into a single Cyber Resilience offering.

• Introduces Arctic Wolf Cyber Resilience, a bundled offering combining Aurora MDR, Attack Surface Management, Vulnerability Management with Resolve Patch Management, Managed Endpoint Defense, Managed Security Awareness, and Incident Response 360 (IR360) in a single package.
• Adds Aurora Incident Response 360 (IR360) as a component providing immediate threat containment and full recovery coverage for any incident type.
• Includes Arctic Wolf's Security Operations Warranty at up to $3 million in financial coverage when a security incident occurs while using the offering — described as the largest security operations warranty in the industry to date.

AI Coding Agents · 2026-08-03

Cline desktop v0.0.7 adds a system tray status icon, paginated session history, session favorites, and free-tier model support.

• Adds a system tray icon displaying live app status and the count of currently running agent sessions.
• Session history is now paginated in ten-session pages, loading older history on demand rather than all at once.
• Enables favoriting sessions and orders all sessions by most recent activity with consistent status dot colors across views.

Vulnerability Management · 2026-08-03

Cloudmersive Cloud DLP AI API v2-8-0 adds batch job API overrides

• Adds additional batch job API overrides for the DLP AI API.

Vulnerability Management · 2026-08-03

Cloudmersive Cloud Virus API v11-10-10 adds recognition of additional Python model file formats.

• Adds recognition of additional Python model file formats for virus scanning.

Web Application Security · 2026-08-03

Dalfox adds baseline diffing, session monitoring, state-file resume, and dedup modes for large-scale XSS scanning

• Adds --dedup-urls with exact, signature, and no-dedup modes to collapse duplicate targets before scanning
• Adds --state-file to record completed targets and resume interrupted bulk scans without restarting from scratch
• Adds --baseline to compare results against a previous Dalfox JSON/JSONL report and surface only newly introduced findings

Web Application Security · 2026-08-03

Dalfox gains MCP server integration and Caido Active Workflow support for AI-agent and proxy-driven XSS testing.

• Exposes Dalfox as a tool via an MCP stdio server, making it available to any MCP-compatible client including Claude and Cursor.
• Adds drop-in instructions for skill-aware AI agents (Claude Code, Cursor, OpenCode, Codex) to safely invoke Dalfox.
• Integrates with Caido's Active Workflows and Findings to automate real-time XSS testing from within a proxy session.

Web Application Security · 2026-08-03

Dalfox config gains baseline diffing, session-loss detection, and URL deduplication controls

• Adds baseline config key to diff a new scan against a previous JSON/JSONL report, surfacing only net-new findings
• Adds baseline_mode with filter (drops known findings) and annotate (keeps them, marks new) modes
• Adds mid-scan session-loss detection via session_check (regex on response body), session_check_url (dedicated probe), and on_session_loss (abort or continue)

Web Application Security · 2026-08-03

Dalfox server mode gains session-expiry detection, flagging SESSION_LOST when credentials expire mid-scan.

• Detects expired sessions mid-scan: when credentials (cookie or Authorization header) are supplied, Dalfox fingerprints the authenticated response before scanning and re-checks it at completion, ending the scan with a SESSION_LOST signal if the session died rather than silently returning zero findings.

Web Application Security · 2026-08-03

Dalfox gains baseline diffing to suppress known findings in CI gates, with filter and annotate modes.

• New --baseline flag suppresses previously known findings by diffing against a prior JSON/JSONL report, so CI gates only fail on genuinely new XSS findings.
• Two baseline modes: --baseline-mode filter (drops known findings from counts, output, and exit code) and --baseline-mode annotate (keeps all findings and tags each with new: true / new: false for dashboards).
• Structured output gains a meta.baseline block reporting path, mode, enabled state, total baseline findings, new count, and known count.

Web Application Security · 2026-08-03

Dalfox gains a payload subcommand with named selectors for special chars, sinks, PoC alerts, DOM clobbering, mXSS, and blind-XSS payloads.

• New dalfox payload subcommand lets practitioners query built-in payload libraries by named selector: special-chars, functions, awesome-alert, dom-clobbering, mxss, and blind.
• Each selector prints one payload per line, making the output directly composable with standard shell tools like grep and wc.
• Adds CSP-aware payload generation: when a Content-Security-Policy header is present, Dalfox tailors output to DOM script-gadgets and emits nonce-based policy-callback payloads.

Web Application Security · 2026-08-03

Dalfox gains URL deduplication by parameter signature, resumable scans via state file, and authenticated session monitoring.

• Adds --dedup-urls signature mode to collapse near-duplicate URLs by method, scheme, host, port, path, and sorted parameter names — so a recon dump of thousands of value variants scans each unique endpoint once instead of thousands of times.
• Adds --dedup-urls off to disable all deduplication when every input line must be scanned as given.
• Adds --state-file flag to record scan progress and resume interrupted runs, skipping already-completed targets while retrying cancelled or errored ones.

Web Application Security · 2026-08-03

Dalfox gains URL deduplication, scan resumption, baseline diffing, and session-loss detection for mass XSS scans.

• Adds --dedup-urls flag with exact (drop identical URL+method) and signature (collapse URLs differing only in parameter values) modes to reduce redundant scanning in large target sets.
• Adds --state-file to record completed targets and resume interrupted mass scans from where they left off instead of restarting.
• Adds --baseline to diff a new scan against a previous Dalfox JSON/JSONL report, surfacing only net-new findings.

Web Application Security · 2026-08-03

Dalfox v3.2.0 adds mass-scan resumption, baseline diffing, dedup, six new DOM-XSS sinks, HTTP QUERY method, and richer finding metadata.

• New --state-file flag lets mass scans resume from where they left off, skipping already-completed targets.
• New --baseline flag filters output to only findings that are new since a previous run, enabling diff-style reporting.
• New --dedup-urls flag performs signature-level deduplication on large URL lists before scanning begins.

Exploitation & C2 · 2026-08-03

DHCPig 2.7.x adds new eviction techniques, richer OS fingerprinting, and improved roll-call reporting

• Adds CLIENTS_HOLDING_STOLEN_LEASES (FAIL/high) finding for hosts sitting on server-reassigned leases, replacing the understated CLIENTS_DEFENDED_ADDRESSES outcome.
• Roll-call rows now include a renewal bound (e.g. fails at next renewal (within ~12h)) derived from the lease duration handed to the attacker.
• Eviction now sends a third, unicast ARP-conflict frame per target per round via build_arp_conflict_unicast(), improving success against wireless APs with client isolation.

Exploitation & C2 · 2026-08-03

DHCPig gains a richer web dashboard with ppm traffic graph, per-host result column, ARP/DHCP split tracking, and auto-open browser on launch.

• Converts the web dashboard and traffic graph from packets-per-second to packets-per-minute (ppm) display.
• Adds a 4-line traffic graph tracking ARP, DISCOVER, RELEASE, and RENEW rates separately, with pps shown as their sum.
• Adds an ARP/s dashboard tile and graph line; folds ARP rate into the overall pps counter.

Exploitation & C2 · 2026-08-03

• New dhcpig-web command launches a browser-based UI for running and reviewing DHCP hardening sessions (--open auto-opens the browser).
• New exhaust subcommand performs full DHCP pool exhaustion: ARP inventory, neighbour lease release, DISCOVER/REQUEST flood, re-request by option 50, and ARP conflict forging.
• New release subcommand evicts currently active clients (inventory → release → re-request → ARP conflict) without flooding the pool.

Digital Forensics & Incident Response · 2026-08-03

ElcomSoft releases EIFT Firewall, a free macOS app for controlled USB-network agent sideloading to iOS devices.

• New free macOS companion app EIFT Firewall replaces the 2023 firewall script for sideloading the iOS Forensic Toolkit low-level extraction agent.
• Creates a temporary, controlled USB network path between a Mac and a connected evidentiary iOS device to safely deliver the extraction agent.

AI-Powered Offensive Security · 2026-08-03

Hacktron adds Azure DevOps integration, bulk triage workflows, and live AI-assisted runs.

• Adds Azure DevOps integration, enabling teams to connect Hacktron findings and workflows directly with Azure DevOps projects.
• Introduces bulk triage, allowing practitioners to triage multiple findings simultaneously.
• Supports live AI runs, enabling real-time AI-assisted analysis during assessments.

AI-Powered Offensive Security · 2026-08-03

Hacktron adds taint trace navigation, findings export, and Bitbucket PR scanning.

• Walk a taint trace interactively to follow data flows from source to sink during code analysis.
• Export your findings for reporting or downstream workflows.
• Scan Bitbucket pull requests to surface vulnerabilities before code is merged.

Agentic Infrastructure · 2026-08-03

Hugging Face Jobs now supports label-based filtering via clickable chips and free-form key=value input.

• Filter Jobs by label using clickable chips showing most-used labels with job counts, available on both user and organization jobs pages.
• Free-form key=value label input enables filtering by any label, including those not surfaced as chips.

Reverse Engineering · 2026-08-03

HyperDbg v0.23 adds the ucpuid command, floating-point support in the script engine, and advances Linux porting.

• New ucpuid command lets users execute CPUID in user-mode context directly from the debugger.
• Adds an SDK function for the ucpuid command, enabling programmatic invocation via the HyperDbg API.
• Introduces floating-point (float) data types and operators in the script engine, enabling FP-aware scripting.

Data Security & DLP · 2026-08-03

• Adds integration health states (ACTIVE, INACTIVE, UNHEALTHY) displayed per connection for Databricks Unity Catalog and Snowflake, giving admins at-a-glance integration status.
• Adds per-object policy sync toggle in Connections, letting admins enable or disable policy push to the platform for individual data objects with visibility into child object configuration.
• Adds automated sensitive data discovery for Immuta's Amazon Redshift viewless integration, supporting regex, dictionary, and column name regex identifier types.

AI Coding Agents · 2026-08-03

• Named tangents via /tangent <name>, a visual conversation-tree picker via /tangent ls, and one-step return to the root via /tangent root
• Guided spec creation: /spec new now prompts for a description before drafting requirements, using your input as ground truth instead of inferring from the spec name alone
• Plan mode now auto-executes an approved plan immediately, removing the manual mode-switch step after plan review

Endpoint Security (EDR/XDR) · 2026-08-03

OSSEC 4.2.0 adds a multi-threaded analysisd pipeline, rootcheck file-hash enrichment, pthread migration, and a self-contained Windows agent installer.

• Adds an always-on multi-threaded analysisd event pipeline for Linux servers, improving analysisd scalability.
• Appends MD5, SHA1, and SHA256 hashes of detected rootcheck files to alerts, enriching forensic context.
• Migrates manager daemons to pthreads and adds shared thread pool support.

CNAPP · 2026-08-03

Plerion adds CIS Google Cloud Platform Foundation Benchmark v5.0.0 mapping for Google Cloud posture tracking.

• Maps Google Cloud posture to CIS Google Cloud Platform Foundation Benchmark v5.0.0, enabling control-by-control compliance tracking from compliance settings.

Exploitation & C2 · 2026-08-03

shellfire v0.16 adds a configurable request timeout to prevent indefinite hangs on unresponsive targets.

• Adds a configurable request timeout (cfg.timeout, default 30 s) to GET, POST, and form requests so shellfire no longer blocks indefinitely against a hung target.

SAST / SCA / Code Security · 2026-08-03

Snyk Code gains Ignore Approval Workflow (IAW): ignores now require reviewer sign-off before taking effect.

• Adds Ignore Approval Workflow (IAW) so developer-submitted ignores become Pending requests requiring explicit reviewer approval or rejection before being applied.
• Enables ignore requests to be submitted from the CLI, IDE, or API — a reason is required on every submission.
• New Ignore Requests page in the web UI lets reviewers approve or reject pending ignore requests in one place.

SIEM · 2026-08-03

Sumo Logic now tracks mid-subscription credit purchases as separate blocks, preserving original burn rates.

• Tracks additional credits purchased mid-subscription as a separate credit block, so original credits continue burning at their original rate without being repriced.

Endpoint Security (EDR/XDR) · 2026-08-03

Service Gateway 3.0.31 adds FQDN support for the Indonesia (ID) site and expands disk management for extended drives.

• Adds FQDN support for the Indonesia (ID) site, enabling Service Gateway deployments in that region.
• Allocates remaining disk space to the /data partition when a disk is extended, improving storage utilization on expanded appliances.
• Improves service installation reliability by waiting for CNI network readiness before proceeding.

Endpoint Security (EDR/XDR) · 2026-08-03

Service Gateway Forward Proxy Service 2.0.12 adds FQDN support for the Indonesia (ID) site.

• Adds FQDN support for the Indonesia (ID) site in the Forward Proxy Service.

Local LLM Runtimes · 2026-08-03

vMLX 1.6.22 scales the MLX cache ceiling with installed memory, delivering ~11% faster decoding for DeepSeek V4 Flash.

• Scales the MLX cache ceiling dynamically with installed memory (16 GB → 4 GB, 64 GB → 11.5 GB, 128 GB → 23 GB, capped at 24 GB), enabling ~11% faster decode throughput for DeepSeek V4 Flash at every context length by eliminating redundant buffer re-allocation.

Local LLM Runtimes · 2026-08-03

vMLX v1.6.20 adds native DeepSeek V4 Flash runtime support with DSML tooling, pool-quantization, and enhanced cache reporting.

• Adds native DeepSeek V4 Flash (DSV4) session support with native reasoning, DSML tool support, sampling guidance, cache-tier capabilities, and pool-quantization behavior.
• Server and Chat settings now distinguish native DSV4 compiled decode and pooled-cache state from generic TurboQuant and unsupported whole-model cache modes, with explicit Activation-QAT control and effective-state reporting.
• Native DSV4 cache handling preserves short append checkpoints, lossless L2 writes, valid eviction ancestry, partial-tail replay, SSD-only operation, and RAM-to-SSD refault.

Secure Access (VPN / SASE / ZTNA) · 2026-08-03

Zscaler Zero Trust Branch now available in FedRAMP Moderate and High, enabling secure distributed branch connectivity for civilian federal agencies.

• Extends Zscaler Zero Trust Branch to FedRAMP Moderate and High environments, giving civilian federal agencies and public sector organizations a compliant path to zero trust branch security.
• Supports CISA TIC 3.0 Branch Office Use Case with local breakout architecture, allowing branch users to access the web and agency-sanctioned CSPs directly without backhauling traffic.
• Provides device segmentation using a /32 per-device network approach (with variable subnet length support), acting as a DHCP server to discover and isolate every device at a branch site.

Identity & Access Management · 2026-08-02

Castle now publishes an API — 25 endpoints across 6 areas: List Items, Lists, Privacy, …

• List Items (8 endpoints) — List Items represents entries in a List.
• Lists (6 endpoints) — Lists represents a generic collection of items, such as Users, IPs, Transactions or any custom property.
• Privacy (4 endpoints) — APIs intended to help adhere to GDPR Compliance and specifically assist in supporting Article 15: Right of access by the data subject and Article 17: Right to be forgotten.

Identity & Access Management · 2026-08-02

Clerk adds self-serve OIDC SSO for org admins, hosted mobile auth, and composable profile UI building blocks.

• Adds OIDC provider support to Self-serve SSO, letting customers' IT admins configure custom OpenID Connect connections directly inside <OrganizationProfile /> without Dashboard access — domains are verified via DNS TXT record and the connection is scoped to the Organization.
• New startHostedAuth() method in Expo, iOS, and Android SDKs hands the full sign-in/sign-up flow to Account Portal in a browser session, automatically covering all enabled auth methods (email codes, passwords, social, enterprise SSO, MFA) without requiring native UI.
• Introduces experimental composable building blocks in @clerk/ui/experimental for assembling <UserProfile /> and <OrganizationProfile /> from individual panels and sections (e.g. UserProfileAccountPanel, UserProfileEmailSection, OrganizationProfileMembersPanel).

AI Coding Agents · 2026-08-02

Cline desktop v0.0.8 adds conversation branching with transactional workspace restores and improved reasoning controls.

• Adds the ability to edit any earlier message in a conversation, forking the session at that point and rewinding the workspace to that checkpoint before re-running from the edited prompt.
• Reasoning controls (effort, thinking budget, on/off) now sourced from the shared model catalog, giving each model only the reasoning options it actually supports.
• Ollama cold model loads now supported: empty responses are retried automatically and the response-start timeout is raised to 5 minutes.

AI Coding Agents · 2026-08-02

Cline SDK v0.0.69 upgrades checkpoint restore to full workspace rewind and hardens Ollama support with smarter timeouts and empty-response retries.

• Extends Ollama's response-start timeout to 5 minutes (from 30 seconds), enabling large cold-loading models to complete initialization without failing the task.
• Adds automatic retry at the model boundary when Ollama returns a completely empty turn, instead of immediately failing the task with Model returned empty response.

SAST / SCA / Code Security · 2026-08-02

Codacy now publishes an API — 287 endpoints across 29 areas: Analysis, Repository, Organization, …

• Analysis (49 endpoints) — create, read, update
• Repository (47 endpoints) — create, read, update, delete
• Organization (32 endpoints) — create, read, update, delete

General Utilities & Libraries · 2026-08-02

goshs v2.1.5 adds a TUI password reveal popup with masked/plaintext toggle and clipboard copy.

• Adds a password reveal modal in the --tui status bar: press p to open an overlay showing basic-auth credentials, u to toggle plaintext, y/c to copy, and esc/q to close.

SAST / SCA / Code Security · 2026-08-02

InsightAppSec now publishes an API — 102 endpoints across 17 areas: Apps, Attack Templates, Engines, …

• Apps (11 endpoints) — An App owns Scan Configs, Schedules, Scans and Vulnerabilities; you must create an App in order to create any of these other resources.
• Attack Templates (10 endpoints) — An Attack Template describes if and how Attacks should be executed during the execution of a Scan.
• Engines (9 endpoints) — An Engine encapsulates the state and high-level attributes of the components which may be installed and running on a specific On-Premise host.

Secrets Detection & Management · 2026-08-02

Opsera now publishes an API — 125 endpoints across 27 areas: Pipelines, Group Management, Insights Tool Mappings, …

• Pipelines (16 endpoints) — API endpoints for pipeline actions
• Group Management (8 endpoints) — API endpoints for group management operations
• Insights Tool Mappings (8 endpoints) — create, read, update, delete

Third-Party & Vendor Risk (TPRM) · 2026-08-02

Panorays Q2'26 adds MCP-based AI/LLM integration, new Live Dashboard widgets, and expanded public API for questionnaire automation.

• New Panorays Axis integration enables AI/LLM tools to securely connect with Panorays tenants via a remote MCP server, providing access to third-party risk data with guided workflows for questionnaire analysis, assessment reports, and supplier onboarding.
• Live Dashboards gains interactive widgets, pre-configured dashboards, and expanded filtering options for building flexible, use-case-tailored reports.
• Public API expanded with new entities, endpoints, questionnaire lifecycle management, evidence validation retrieval, and additional questionnaire data fields.

Attack Surface & Exposure Management · 2026-08-02

runZero 5.1 adds compliance-friendly AI workflows, autonomous discovery, Git Smart Protocol scanning, Jira owner sync, and Purdue-level inventory search.

• New site details page lets users with organization access view site details and subnet definitions.
• Adds ability to sync issue owners with Jira.
• Goals widget now includes a Pending metric showing baseline assets not matching the target query, with click-through to inventory.

Exploitation & C2 · 2026-08-02

starkiller now publishes an API — 135 endpoints across 18 areas: Agents, Plugins, Keywords, …

• Agents (33 endpoints) — create, read, update, delete
• Plugins (16 endpoints) — create, read, update, delete
• Keywords (10 endpoints) — create, read, update, delete

Exploitation & C2 · 2026-08-02

Starkiller v3.6.0 adds server-side validation feedback to dynamic forms and a full Playwright E2E test suite.

• Introduces a Playwright end-to-end test suite run as a CI job on every PR.

AI Coding Agents · 2026-08-02

Windsurf v3.6.21 adds Plan mode, browser preview for ACP agents, editable command approvals, and multi-user Devin Cloud session improvements.

• Adds a unified notifications setting that posts native OS notifications when any agent session finishes or needs input.
• Codemaps now open in their own editor tabs in agent window mode, and codemap @-mentions work in Devin Local.
• Adds Add to chat button (⌘L / Ctrl+L) to add selected transcript text directly to chat input.

Identity & Access Management · 2026-08-01

Auth0 adds AI agent identity, curated IP blocklists, org-scoped roles, cross-app access, and enterprise federation in a wave of new capabilities.

• Adds Global Search (Beta) to the Command Palette (Cmd+K), enabling real-time tenant-wide search across Applications, APIs, Organizations, and Users by name, ID, email, or identifier with one-click ID copying.
• Introduces Enterprise Connect (Beta), letting you federate existing SAML or OIDC authorization servers (including Okta) into Auth0 and layer on enterprise SSO, SCIM user provisioning, and self-service B2B onboarding with Actions-based claim enrichment and connection lifecycle events.
• Launches Curated Blocklists in Tenant ACLs (GA), integrating dynamically updated Auth0 Threat Intel categories — auth0.low_reputation, auth0.tor, auth0.proxy, auth0.vpn, auth0.icloud_relay_proxy — into Network ACL rules via the auth0_managed matcher block in the Management API.

Vulnerability Management · 2026-08-01

Brinqa adds connectors for Invicti Enterprise, Invicti Platform, Offensity, and Upwind

• New Invicti Enterprise and Invicti Platform connectors ingest Container, DAST, SAST, and SCA findings, finding definitions, projects, repositories, scans, and sites.
• New Offensity connector pulls in sites and violations with their definitions.
• New Upwind connector ingests alerts, API endpoints, hosts, people, stories, teams, violations, and vulnerabilities with their definitions.

Integrated & IT Risk Management · 2026-08-01

CISO Assistant v3.20.5 adds LPM/OIV metrics definitions, cybersecurity metrics translations, and expanded evidence file previews.

• Adds 10 LPM/OIV required metrics definitions to the library, supporting regulated French operators of vital importance.
• Adds translations for core cybersecurity metrics.
• Expands in-platform preview support to additional evidence file types.

Identity & Access Management · 2026-08-01

Clerk lets end-customer IT admins self-configure OIDC SSO connections directly from the OrganizationProfile UI.

• Enables organization IT admins to configure their own OpenID Connect SSO connections self-serve via the Security tab in <OrganizationProfile />.

AI Coding Agents · 2026-08-01

Cline CLI adds ACP (Agent Client Protocol) support, letting any ACP-compatible editor drive Cline as a coding agent via stdio.

• New --acp flag launches Cline CLI as an ACP (Agent Client Protocol) server over stdio, enabling any ACP-capable client (Zed, JetBrains AI Assistant, Neovim, Emacs, Obsidian, marimo, Slack/Discord/Telegram bridges) to use Cline as its coding agent.
• Supports Plan/Act mode switching, model and provider selection, permission prompts, session resume, image inputs, and organization switching all driven from the ACP client's UI.
• Environment variables CLINE_API_KEY, CLINE_PROVIDER, and CLINE_MODEL can preconfigure the agent in the client's server config without interactive sign-in.

AI Coding Agents · 2026-08-01

Cline now supports ACP, enabling it to act as a coding agent in Zed, JetBrains, Neovim, Emacs, and other ACP-capable clients.

• Adds ACP (Agent Communication Protocol) support, letting Cline function as a coding agent inside Zed, JetBrains IDEs, Neovim, Emacs, and any other ACP-capable client.

AI Coding Agents · 2026-08-01

Cline SDK v0.0.68 adds display-ready model names, ClinePass provider, UTF-8 PowerShell stdin, and Organization selector for ACP.

• Adds fetchClineRecommendedModels returning display-ready model names resolved through the model catalog (including Vercel and OpenRouter id aliases) under a shared timeout budget, so hosts no longer need to map ids to names themselves.
• Adds Organization selector to ACP, letting users switch between personal account and org contexts without leaving the session.
• Adds ClinePass as a selectable provider on ACP (id: cline-pass, Sign in with ClinePass).

SAST / SCA / Code Security · 2026-08-01

Cloudsmith CLI 1.20.0 ships as a standalone binary, dropping the Python dependency, with a new bug bounty platform at bounties.cloudsmith.com.

• New one-line installer, refreshed Homebrew tap, and updated Docker image available for the standalone CLI.
• New bug bounty platform launched at bounties.cloudsmith.com for security researchers to submit vulnerability reports.

Security Data Pipeline · 2026-08-01

Cribl adds OpenRouter and Semantic Kernel as supported LLM observability integrations via OpenTelemetry.

• Supports instrumenting OpenRouter with OpenTelemetry to send LLM telemetry to Cribl Stream and Cribl Search.
• Supports instrumenting Semantic Kernel with OpenTelemetry to send LLM telemetry to Cribl Stream and Cribl Search.

Security Data Pipeline · 2026-08-01

Cribl launches AI Observability app — unified search, cost tracking, PII detection, and trace investigation across all AI models and providers.

• New Cribl app for AI Observability provides a single platform to search, investigate, and report on AI telemetry across models, tools, and environments.
• Usage and Cost Dashboard surfaces spending trends, token consumption, top users and models, LLM efficiency anti-patterns, and an activity heatmap.
• Org View delivers a hierarchical roll-up of spend, tokens, and requests across the organization.

AI Coding Agents · 2026-08-01

Crush v0.88.0 adds .crushrc bash-based config, permissions deny, AWS Bedrock SSO re-auth, and new crushrc builtins for providers, models, MCPs, LSPs, and hooks.

• Adds .crushrc bash-based configuration file, replacing JSON config with a scriptable shell format that supports conditionals, source includes, and environment variable expansion.
• Adds permissions deny command in crushrc to explicitly hide specific tools from the agent.
• Adds permissions allow command in crushrc to auto-approve tools without prompting.

General Utilities & Libraries · 2026-08-01

curl gains RFC 9421 HTTP Message Signing and HTTP/3 proxy support in 8.21–8.22

• Adds --httpsig-algo to sign outgoing HTTP requests using RFC 9421 HTTP Message Signatures, with ed25519 (default) or hmac-sha256 algorithms.
• Adds --httpsig-key to supply the signing key (inline hex or @filename) for RFC 9421 HTTP Message Signatures.
• Adds --httpsig-keyid to set the keyid parameter in the Signature-Input header so servers can look up the correct verification key.

Exploitation & C2 · 2026-08-01

DHCPig adds a web UI, five named attack/scan modes, and new flags including --dry-run, --scope, --report, and --no-spoof-eth-src

• New web UI (dhcpig-web --open) provides a browser-based interface for running and reviewing DHCP attack sessions at http://127.0.0.1:8787/?token=...
• New exhaust mode: ARP-inventories the segment, floods DISCOVER/REQUEST from fabricated MACs, and verifies whether a new client can still obtain an address after pool exhaustion
• New release mode: releases every active neighbour's lease via DHCPRELEASE (no proof of ownership required) and reports whether any host loses connectivity

Exploitation & C2 · 2026-08-01

DHCPig gains a web UI, five attack/recon modes, structured reports, and a lease-recovery workflow for DHCP hardening validation.

• Adds dhcpig-web command that launches a browser-based web UI (binds loopback on port 8787 with token auth) for running and reviewing DHCP attack sessions without the CLI.
• Adds exhaust mode: ARP-inventories the segment, floods DISCOVER/REQUEST from fabricated MACs, releases neighbours' leases, and forges ARP conflicts to validate whether new clients can still obtain addresses.
• Adds release mode: evicts currently active clients via DHCPRELEASE without exhausting the pool, then checks whether hosts can re-acquire.

Identity & Access Management · 2026-08-01

Didit adds custom domain support for white-label verification flows, letting users stay on your subdomain end-to-end.

• Adds custom domain support so the identity verification flow can be served from your own subdomain (e.g. verify.yourbrand.com) instead of verify.didit.me, completing a white-label experience.
• Generates two DNS records (Verification CNAME and CloudFront CNAME) automatically in the Business Console for the operator to add at their DNS provider.
• Provides in-console domain verification with a real-time status panel, including a Verification failed box that identifies the specific missing or misconfigured record.

Identity & Access Management · 2026-08-01

Didit API adds session deletion, PDF report generation, and KYB/mixed session listing across v3 endpoints.

• New DELETE /v3/session/{sessionId}/ endpoint removes KYC or KYB sessions and all associated data (decision, media, extracted fields, feature records) permanently.
• New GET /v3/session/{sessionId}/generate-pdf/ endpoint renders and downloads a compliance-ready PDF report for finished KYC or KYB sessions, including all executed feature sections and white-label branding.
• New session_kind filter on GET /v3/sessions/ supports listing user (KYC), business (KYB), or all session types in a single paginated response.

Identity & Access Management · 2026-08-01

Didit adds Travel Rule compliance, an AI Copilot, sandbox Test Mode, device attestation, and major KYB/AML/transaction monitoring upgrades.

• Adds end-to-end Travel Rule handling for crypto transfers: IVMS 101-encrypted sender/recipient exchange, TRP messaging, secure email fallback, VASP directory from the EU register, and self-custody wallet ownership proof across Ethereum-compatible, Solana, Bitcoin, and Tron networks.
• Introduces Didit Copilot in the Business Console: a resizable AI panel that builds workflows, applies filters, and navigates dialogs via natural language, voice input, file attachments, and persistent conversation history — with explicit user confirmation before any write or delete.
• Adds ID Verification Data Review: a pre-submission step where applicants confirm or correct extracted document fields, with configurable outcomes by mismatch severity, MRZ-protected fields, full correction history, and optional image retake for camera scans.

Identity & Access Management · 2026-08-01

Didit adds Travel Rule compliance, Console Copilot, Test mode sandbox, device integrity attestation, and expanded KYB/AML capabilities.

• Adds end-to-end Travel Rule compliance: encrypted IVMS 101 sender/recipient exchange, TRP messaging, secure email fallback, VASP directory, self-custody wallet ownership proof, and preset EU Transfer of Funds Regulation rules.
• Introduces Didit Copilot in the Business Console — a resizable AI panel that builds workflows, applies filters, and navigates dialogs via natural language, voice input, or file attachment, with explicit confirmation gates for writes/deletes.
• New applicant ID Verification Data Review step lets users confirm or correct extracted document fields before submission, with configurable outcomes by mismatch severity, MRZ-protected fields, and full correction history in session details.

Secure Access (VPN / SASE / ZTNA) · 2026-08-01

DNSFilter 3.6.10 adds DNS PreCheck v2, Brave SafeSearch enforcement, redesigned SafeSearch controls, and AppAware Sites filter.

• Introduces DNS PreCheck v2 for Windows Roaming Client, maintaining policy enforcement even on networks that hijack or redirect DNS traffic.
• Adds automatic tray process recovery so the system tray restarts itself if it stops unexpectedly, keeping status and controls available.
• Adds Sites filter to AppAware Reporting, giving Core plan and mixed Core/Pro environments query data scoped to specific sites.

Reconnaissance & OSINT · 2026-08-01

dnsrecon gains Shodan netblock expansion via CLI flags and REST API for passive and active host discovery

• Adds --shodan and --shodan-key flags to enrich enumeration results with Shodan data from SPF and WHOIS netblocks.
• Adds --shodan-active flag to re-resolve discovered hosts and confirm they still match the queried netblock.
• Supports SHODAN_API_KEY environment variable as an alternative to passing the key on the command line.

Agentic Infrastructure · 2026-08-01

Emisar adds SSO support with Okta, Microsoft Entra, JumpCloud, Keycloak, and Google Workspace integrations.

• Supports Single Sign-On (SSO) via Okta, Microsoft Entra, JumpCloud, Keycloak, and Google Workspace for centralized identity management.

Agentic Infrastructure · 2026-08-01

Emisar adds SSO support with Okta, Microsoft Entra, JumpCloud, Keycloak, and Google Workspace integrations.

• Supports Single Sign-On (SSO) authentication via Okta, Microsoft Entra, JumpCloud, Keycloak, and Google Workspace.

Agentic Infrastructure · 2026-08-01

Emisar v0.36.0 adds staged runbooks with typed inputs and parallel execution, MCP 2026-07-28 routing, and 91 action packs with bounded diagnostics.

• Adds staged runbooks with typed inputs, sequential or parallel stage execution against selected runner groups, named step outputs, success condition testing, and explicit wait bounds.
• Adds a single pre-execution approval gate that freezes the complete runbook execution plan before work begins.
• Adds canonical JSON runbook definition format shared across the console, MCP, and execution pages, with attempt, output, wait, and terminal cause history.

Agentic Infrastructure · 2026-08-01

emisar mcp-v0.5.0 expands its infrastructure diagnostics catalog.

• Expands the infrastructure diagnostics catalog with additional checks.

Agentic Infrastructure · 2026-08-01

emisar runner v0.16.0 expands its infrastructure diagnostics catalog.

• Expands the infrastructure diagnostics catalog with additional checks.

SIEM · 2026-08-01

Exabeam adds Agent Behavior Analytics to baseline, detect, and investigate AI agent activity across Claude, ChatGPT, Gemini, Copilot, and more.

• New Agent Behavior Analytics (ABA) capability establishes behavioral baselines for AI agents and autonomous workflows, detecting misuse, drift, abnormal tool use, risky access, and out-of-role activity.
• Correlates AI agent activity with users, entities, applications, and security events to accelerate investigation and response.
• New Exabeam Agent Sensor collects and normalizes activity across AI models and runtimes.

SIEM · 2026-08-01

Exabeam extends behavioral analytics to AI agents and autonomous activity across major AI platforms via OpenTelemetry.

• New Agent Behavior Analytics capability applies behavioral analytics to AI agents and autonomous activity across major AI platforms and any agent sharing OpenTelemetry data.

Firewalls & Network Defense · 2026-08-01

Fastly JavaScript SDK 3.44.0 adds bot detection capability.

• Adds bot detection support to the Fastly JavaScript SDK.

AI Coding Agents · 2026-08-01

gemini-cli v0.53.0 adds LLM triage orchestration, eval coverage reporting, and sandbox security hardening.

• New LLM triage orchestrator with container build setup for caretaker triage workflows.
• New command for generating evaluation coverage reports.
• Enforces workspace trust and task isolation in the A2A server.

Web Application Security · 2026-08-01

humble 1.64 adds multiple output format support, redirect totals in Info section, and an improved AI SKILL file.

• Supports exporting analysis results in multiple output formats simultaneously via a single invocation.
• Shows the total number of redirects in the Info section of each analysis.
• Adds improved redirect information detail in analysis output.

Endpoint Security (EDR/XDR) · 2026-08-01

Huntress API gains an endpoint to create IP-based allow/block rules for Managed ITDR Unwanted Access.

• New API endpoint lets you programmatically create IP address-based rules for Managed ITDR Unwanted Access, accepting a single IP, a CIDR range, or a list of IPs in one call.

Data Security & DLP · 2026-08-01

Immuta adds richer Connections controls, split request forms for data products, Redshift viewless data discovery, and new managed identity groups.

• Adds integration health states (ACTIVE, INACTIVE, UNHEALTHY) and per-connection settings directly within Connections for Databricks Unity Catalog and Snowflake.
• Introduces per-object policy sync toggle to control whether Immuta pushes policies down to a given data object, with visibility into child object configuration and a Custom label when child settings differ from the parent.
• Adds individual detail pages for leaf data objects, including a direct link to the corresponding data source.

Post-Exploitation · 2026-08-01

impacket gains LDAP Schannel auth, ntlmrelayx Pre-Win2000 enumeration, HTTPS relay support, and named-pipe MSSQL improvements

• Adds LDAP Schannel authentication support using a client certificate (PFX/PEM) for LDAP operations.
• Adds --dump-pre2k flag to ntlmrelayx to enumerate Pre-Windows 2000 vulnerable computers during relay attacks.
• Adds HTTPS/TLS support to httpRelayServer, enabling relay of HTTPS POST requests.

Post-Exploitation · 2026-08-01

Impacket gains Pre-Win2000 enumeration, MSSQL named-pipe support, MS-NEGOEX, DFS, AES256 blob decryption, and more.

• Adds --dump-pre2k flag to ntlmrelayx to enumerate Pre-Windows 2000 vulnerable computers.
• Adds --dump-userinfo option to ntlmrelayx to dump user information during relay.
• Adds support for enumerating ADCS certificate templates over HTTP via ntlmrelayx.

Web Application Security · 2026-08-01

• Adds AI-aided Login recovery: when an LSR playback fails during a scan, Invicti can now use AI to recover and complete authentication, reducing scan failures caused by login issues.
• Increases the character limit for authentication values in IDOR/BOLA credentials from 1,024 to 4,096 characters, enabling long JWT Bearer Tokens to be saved.

AI Coding Agents · 2026-08-01

Kiro gains /tangent side-conversations and per-tool token breakdown in /context.

• New /tangent command lets you branch into named side-conversations that inherit full conversation history, then return to the main thread without polluting it.
• Browse your entire conversation tree with /tangent ls and jump to the root from any depth with /tangent root.
• The /context command now shows a per-tool token breakdown so you can see exactly what is consuming your context window.

SAST / SCA / Code Security · 2026-08-01

Lakera adds Detection mode for projects — observe policy hits without enforcing blocks, ideal for safe policy rollouts.

• New Project Mode setting lets you run a project in Detection (detect) mode, surfacing policy hits in the response breakdown and dashboard without setting flagged: true, so you can tune detectors against live traffic before enforcing.

Web Application Security · 2026-08-01

Nikto 2.6.1 adds SQL Direct database reporting, TLS keep-alives for ~18% faster scans, and a new COOKIE: DSL matcher.

• Adds -F sqld output format to insert findings directly into a MySQL or PostgreSQL database via the new SQL Direct plugin.
• TLS connections now use keep-alives for session reuse, delivering an ~18% scan speed increase; disable with -nosslkeepalive if a server misbehaves.
• Adds -useragent flag to force a specific User-Agent string for all requests.

Identity & Access Management · 2026-08-01

Omada Identity adds support for exporting custom contexts to the Omada Data Warehouse (ODW).

• Enables configuration and export of custom contexts to the Omada Data Warehouse (ODW) for extended reporting and analytics.

SAST / SCA / Code Security · 2026-08-01

Openlayer adds a guided CLI init command and multimodal trace support for images, audio, and files.

• New init CLI command sets up Openlayer in a project through a single guided flow.
• Supports attaching images, audio, and files to traces for multimodal LLM monitoring.

UNCATEGORIZED · 2026-08-01

OpenOSINT v2.25.0 adds global HTTP/SOCKS5 upstream-proxy support and cloud billing OAuth for web-facing tools.

• Adds global upstream-proxy support (HTTP and SOCKS5) for all web-facing tools.
• Introduces cloud billing OAuth integration and associated tooling.

Runtime Security · 2026-08-01

OpenShell v0.0.96 adds supervisor middleware content guard, Kubernetes PVC storage class config, policy-first OCI image identity, workspace authorization, and OTLP gateway tracing.

• Adds supervisor middleware content guard example for filtering or inspecting sandbox traffic at the supervisor layer.
• Supports configuring a custom storageClassName for workspace PVCs in Kubernetes deployments.
• Introduces policy-first OCI image identity resolution in the sandbox, giving security policies priority in image evaluation.

Firewalls & Network Defense · 2026-08-01

PAN-OS 12.2 Ceres adds Advanced IP Defense, post-quantum crypto for GlobalProtect, PAN-OS Shield, OT microsegmentation, and Cloud NGFW Premium instances.

• New PAN-OS Shield protects the firewall itself against attacks on PAN-OS using the built-in Threat Prevention engine with one-click enablement — securing GlobalProtect gateway and portal without a separate Threat Prevention license.
• PAN-OS 12.2 adds post-quantum cryptography support for GlobalProtect, providing quantum-resistant VPN tunnels.
• PAN-OS 12.2 introduces intent-based configuration management for declarative, AI-driven policy authoring.

Cloud Security Posture · 2026-08-01

Prowler adds Huawei Cloud provider support, scanning compute, storage, IAM, networking, and more across all three Huawei clouds.

• New huaweicloud provider enables security misconfiguration scanning across Huawei Cloud compute (ECS), storage (OBS, EVS), networking (VPC, ELB), IAM, KMS, RDS, CTS, and WAF services.
• Supports all three Huawei Cloud environments — International (.com), China (.com/cn-* regions), and Huawei Cloud Europe (.eu) — with automatic endpoint selection per region.
• New --cloud flag (values: international, europe, china) expands a scan to every region in the selected cloud without manual region listing.

Cloud Security Posture · 2026-08-01

Prowler adds Huawei Cloud as a supported cloud provider for security assessments.

• Adds Huawei Cloud as a supported target cloud provider for security checks.

Cloud Security Posture · 2026-08-01

Prowler adds E2E Networks provider, cross-provider compliance, Lighthouse AI actions, one-step AWS Organizations onboarding, and new checks across AWS/Azure/Kubernetes.

• New provider: Scans E2E Networks with 27 checks covering compute, networking, security groups, load balancers, storage, and managed databases via prowler e2enetworks.
• Cross-Provider Compliance rolls up the most recent scan of every compatible provider into a single compliance posture per framework (CIS Controls 8.1, CSA CCM 4.0, DORA 2022/2554) with a combined executive PDF report.
• Lighthouse AI can now take actions: connect/remove providers, trigger and schedule scans, update scan settings, and manage mutelists — all gated by RBAC.

Cloud Security Posture · 2026-08-01

Prowler adds Huawei Cloud support, cross-provider compliance roll-ups, and Attack Paths active query tracking.

• Adds Huawei Cloud as a supported provider, including authentication configuration and a getting-started guide.
• Adds cross-provider compliance aggregation to consolidate a single-provider framework across every provider of the same type, with roll-up view and combined PDF report download.
• Adds cross-provider type compliance aggregation to unify a universal compliance framework across every compatible provider with a completed scan, with per-provider breakdown and combined PDF report.

Cloud Security Posture · 2026-08-01

Prowler adds Huawei Cloud support, extending multi-cloud security assessments to a new provider.

• Adds Huawei Cloud as a supported cloud provider for security assessments.

Cloud Security Posture · 2026-08-01

Prowler adds Huawei Cloud as a supported cloud provider for security assessments.

• Adds Huawei Cloud as a supported cloud provider, enabling security assessments against Huawei Cloud environments.

Attack Surface & Exposure Management · 2026-08-01

runZero 5.1 adds compliance-friendly AI workflows, autonomous discovery, enhanced integration framework, ITSM remediation handoffs, and improved Dragos OT enrichment.

• Adds compliance-friendly AI workflows for querying and surfacing asset data insights.
• Introduces autonomous discovery mode for automated, continuous attack surface intelligence.
• Enhanced integration framework with refined merge logic to accelerate custom integrations.

Detection Engineering · 2026-08-01

Stratus Red Team adds attack technique for enabling local auth and exfiltrating Azure AI Foundry API keys

• Adds new attack technique: Enable Local Authentication and Exfiltrate Azure AI Foundry API Keys, extending MITRE ATT&CK coverage to Azure AI Foundry credential theft scenarios.

Detection Engineering · 2026-08-01

Stratus Red Team adds Azure AI Foundry attack technique covering local auth enablement and API key exfiltration.

• New attack technique: Enable Local Authentication and Exfiltrate Azure AI Foundry API Keys covering Persistence and Credential Access tactics against Azure AI Foundry.

Detection Engineering · 2026-08-01

Adds new Azure attack technique to emulate AI Foundry API key exfiltration via local auth re-enablement.

• New Azure technique azure.persistence.exfiltrate-foundry-key: re-enables local (key-based) authentication on an Azure AI Foundry (Cognitive Services) account and retrieves API keys via ListKeys, emulating a Persistence/Credential Access attack path.

Firewalls & Network Defense · 2026-08-01

Sublime email events now stream into CrowdStrike Falcon Next-Gen SIEM, and Sublime Actions run natively in Falcon Fusion SOAR playbooks.

• Streams Sublime email security events (flagged message groups, user-reported messages) into CrowdStrike Falcon Next-Gen SIEM alongside endpoint, identity, and threat intelligence telemetry.
• Surfaces per-message triage context in Falcon Next-Gen SIEM: matched Sublime coverage, source IPs, URLs, attachment hashes, link-click activity, and ASA (Autonomous Security Analyst) verdict.
• Adds Sublime Actions as native steps in Falcon Fusion SOAR playbooks, enabling message investigation and enrichment, hunt result retrieval, Rule and List management, and remediation without leaving Falcon.

SIEM · 2026-08-01

Sumo Logic adds new dashboards, FERs, and monitors across 18+ apps, plus a new Terraform resource for Lambda invoke actions.

• Adds new and updated dashboards, field extraction rules (FERs), and monitors for Active Directory 2012+ (JSON), Artifactory 7, Azure Audit, ChatGPT Compliance, Cisco Meraki, Cloudflare Enterprise Audit - Cloud SIEM, Heroku, Host and Process Metrics, Host Metrics Linux, LiteLLM, Microsoft Office 365, Windows 2012+ (JSON), Windows 7+2008 (Legacy), Windows CSMA, Windows Performance, Zscaler Internet Access, and Zscaler Private Access.
• Migrates Azure Metrics collection from legacy ARM-based collection to the latest Azure Metrics Source.
• Adds new Terraform resource sumologic_lambda_invoke_action in SumoLogic Terraform Provider v3.2.9.

Runtime Security · 2026-08-01

Tetragon adds partial policy loading via ignore.digestVerificationFailure for uprobe binary digest mismatches

• New ignore.digestVerificationFailure field in tracing policies lets hooks that fail SHA-256 binary digest verification be skipped instead of rejecting the entire policy.
• Partially loaded policies are surfaced via TracingPolicyStatus per-hook status and a new TP_STATE_PARTIALLY_ENABLED state in TracingPolicyState, so operators can see exactly which uprobes were attached.

Endpoint Security (EDR/XDR) · 2026-08-01

Trend Vision One Container Security now supports Service Gateway as a connection method for Amazon ECS clusters.

• Supports Service Gateway as a connection method when configuring Amazon ECS cluster connections in Container Security.

Endpoint Security (EDR/XDR) · 2026-08-01

Container Protection for Amazon ECS 2.2.6 adds Service Gateway forward proxy support and CodePipeline deployment updates.

• Supports using a Service Gateway as a forward proxy for Amazon ECS clusters.
• Supports CodePipeline standard deployment updates for OriginalTaskDefArn.

Data Security & DLP · 2026-08-01

Varonis adds Search & Export APIs, IP-based tenant lockdown, VAST multi-tenant visibility, and expanded AI agent governance in Atlas.

• New Search API provides programmatic access to Varonis data — events, identities, resources, permissions, memberships, and alerted events — to support investigations, workflow automation, and SIEM/SOAR integrations.
• Label lifecycle controls let administrators automatically remove or preserve Varonis-applied Microsoft Purview labels when the triggering conditions no longer apply.
• Automatic label downgrade prevention compares existing Microsoft Purview labels against Varonis recommendations and only applies changes that result in stronger protection.

Digital Forensics & Incident Response · 2026-08-01

Velociraptor artifact exchange adds AI LLM integrations, Sliver C2 detection, Microsoft Recall forensics, and new hunt-comparison artifacts.

• Adds AI analysis artifacts integrating with Anthropic, Google, OpenAI, and Ollama — serializing endpoint data into LLM prompts for assisted triage.
• New hunt-baseline comparison artifact lets analysts diff results between two hunts (Baseline_Hunt_1 vs Hunt_2) on a chosen column.
• New Microsoft Recall forensics artifact reads and correlates multiple Recall database tables, including enriched Window Capture events.

Local LLM Runtimes · 2026-08-01

vMLX 1.6.19 adds native-MTP diagnostics, model-owned sampling defaults, separate macOS Tahoe builds, and scoped sparse-cache blocks for MiniMax M3.

• Adds native-MTP health and profiling telemetry exposing bounded cache-lifecycle, acceptance, and phase-timing metrics for Qwen MTP models.
• Introduces model-owned generation defaults: temperature, Top P, Top K, repetition penalty, and output limits now hydrate from the selected model bundle in new and restored chats.
• Ollama requests now preserve an explicitly supplied top_k value, including 0, through request translation.

Aikido Security 1 changes

• New - DPSM: Find data exposure risks without connecting your data stores 🚀 · Feature · 2026-08-04

Arctic Wolf 2 changes

• Arctic Wolf Launches Comprehensive Cyber Resilience Offering to Help Organizations with Enhanced Coverage for Cybersecurity Incidents (2026-08-03) · Feature · 2026-08-04
• announced · Aug 3, 2026 · Feature · 2026-08-03

Auth0 3 changes

• Google Workspace Directory Sync for Groups - Now in General Availability! (2026-08-06) · Feature · 2026-08-07
• Organizations Search Expands with Advanced Filtering (2026-08-04) · Feature · 2026-08-04
• changelog · Aug 1, 2026 · Feature · 2026-08-01

Beelzebub 1 changes

• v3.9.0 · Feature · 2026-08-06

bloodhound 1 changes

• v2 · API · 2026-08-04

Brinqa 1 changes

• docs update · Docs · 2026-08-01

Burp Suite 1 changes

• DAST 2026.8 (2026-08-05) · Feature · 2026-08-05

Castle 2 changes

• 1 · API · 2026-08-05
• 1 · API · 2026-08-02

Censys 1 changes

• August 3, 2026 (2026-08-03) · Feature · 2026-08-04

CISO Assistant 3 changes

• v3.20.8 · Feature · 2026-08-05
• v3.20.7 · Feature · 2026-08-04
• v3.20.5 · Feature · 2026-08-01

Claude Code 4 changes

• v2.1.224 · Feature · 2026-08-07
• v2.1.223 · Feature · 2026-08-06
• v2.1.222 · Feature · 2026-08-05
• v2.1.221 · Feature · 2026-08-04

Clerk 6 changes

• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• Google Workspace Directory Sync (2026-08-05) · Feature · 2026-08-06
• Sign-in-or-up now works with strict enumeration protection (2026-08-04) · Feature · 2026-08-05
• changelog · Aug 2, 2026 · Feature · 2026-08-02
• Self-serve SSO for OIDC (2026-07-31) · Feature · 2026-08-01

Cline 16 changes

• desktop-v0.0.10 · Feature · 2026-08-07
• v4.1.6 · Feature · 2026-08-06
• cli-v3.0.51 · Feature · 2026-08-06
• sdk/sdk/v0.0.71 · Feature · 2026-08-06
• v4.1.5 · Feature · 2026-08-06
• docs update · Docs · 2026-08-05
• v4.1.4 · Feature · 2026-08-05
• desktop-v0.0.9 · Feature · 2026-08-05
• cli-v3.0.50 · Feature · 2026-08-05
• sdk/sdk/v0.0.70 · Feature · 2026-08-05
• desktop-v0.0.7 · Feature · 2026-08-03
• desktop-v0.0.8 · Feature · 2026-08-02
• sdk/sdk/v0.0.69 · Feature · 2026-08-02
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• sdk/sdk/v0.0.68 · Feature · 2026-08-01

Cloudflare 6 changes

• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• 4.0.0 · API · 2026-08-04

Cloudmersive 2 changes

• Cloudmersive Cloud DLP AI API v2-8-0 Released (2026-08-02) · Feature · 2026-08-03
• Cloudmersive Cloud Virus API v11-10-10 (2026-08-02) · Feature · 2026-08-03

Cloudsmith 1 changes

• changelog · Aug 1, 2026 · Feature · 2026-08-01

Codacy 2 changes

• 3.1.0 · API · 2026-08-05
• 3.1.0 · API · 2026-08-02

code-oss 2 changes

• docs update · Docs · 2026-08-05
• docs update · Docs · 2026-08-05

ConductorOne 1 changes

• docs update · Docs · 2026-08-04

cosign 1 changes

• v3.1.3 · Feature · 2026-08-06

Cotool 1 changes

• v0.62.0 · Feature · 2026-08-05

CrewAI 2 changes

• 1.15.12 · Feature · 2026-08-06
• 1.15.11 · Feature · 2026-08-05

Cribl 4 changes

• What is your AI actually doing? Introducing the Cribl App for AI Observability (2026-07-31) · Feature · 2026-08-05
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-01
• What is your AI actually doing? Introducing the Cribl app for AI Observability (2026-07-31) · Feature · 2026-08-01

Crush 1 changes

• v0.88.0 · Feature · 2026-08-01

CTFd 1 changes

• v1 · API · 2026-08-04

curl 1 changes

• docs update · Docs · 2026-08-01

Cursor 1 changes

• Google Workspace Plugins · Feature · 2026-08-04

Dalfox 9 changes

• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• v3.2.0 · Feature · 2026-08-03

Daytona 1 changes

• 1.0 · API · 2026-08-04

defectdojo 2 changes

• docs update · Docs · 2026-08-04
• 3.2.0 · Feature · 2026-08-04

dhcpig 5 changes

• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-03
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01

Didit 4 changes

• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• updated · Aug 1, 2026 · Feature · 2026-08-01

DNSFilter 1 changes

• changelog · Aug 1, 2026 · Feature · 2026-08-01

dnsrecon 1 changes

• docs update · Docs · 2026-08-01

Docker Compose 1 changes

• v5.4.0 · Feature · 2026-08-04

Docker Sandboxes 4 changes

• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• v0.38.0 · Feature · 2026-08-06

Dreadnode 2 changes

• Agent memory, triage, and session monitoring overhaul · Feature · 2026-08-04
• Traditional-ML red teaming suite — evasion, extraction, membership inference, and model inversion in one platform · Feature · 2026-08-04

Elastic Security Labs 2 changes

• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04

ElcomSoft 1 changes

• EIFT Firewall: a new free tool for controlled agent sideloading (2026-08-03) · Feature · 2026-08-03

emisar 11 changes

• runner-v0.17.2 · Feature · 2026-08-07
• v0.29.0 · Feature · 2026-08-05
• v0.28.0 · Feature · 2026-08-05
• v0.27.0 · Feature · 2026-08-05
• v0.26.0 · Feature · 2026-08-05
• v0.24.0 · Feature · 2026-08-05
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• v0.36.0 · Feature · 2026-08-01
• mcp-v0.5.0 · Feature · 2026-08-01
• runner-v0.16.0 · Feature · 2026-08-01

Exabeam 2 changes

• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01

Fastly 4 changes

• Next-Gen WAF: `created_by` field now included in rules and signals (2026-08-04) · Feature · 2026-08-06
• CLI v15.5.0 (2026-08-04) · Feature · 2026-08-04
• Fastly Terraform Provider 9.5.0 (2026-08-04) · Feature · 2026-08-04
• JavaScript SDK 3.44.0 (2026-07-27) · Feature · 2026-08-01

Feedly Threat Intelligence 2 changes

• docs update · Docs · 2026-08-06
• Enrich and triage Atlassian security releases in the Vulnerability Intel Agent (2026-08-07) · Feature · 2026-08-06

Fleet 1 changes

• api-docs-9c952da21d7e · API · 2026-08-05

garak 1 changes

• v0.16.0 · Feature · 2026-08-05

gemini-cli 1 changes

• docs update · Docs · 2026-08-01

Giskard 1 changes

• giskard-core/v1.0.1b6 · Feature · 2026-08-06

GitGuardian Detection Engine 2 changes

• Detection Engine Updates Version 2.169.1 (2026-08-04) · Feature · 2026-08-06
• Detection Engine Updates Version 2.169 (2026-08-03) · Feature · 2026-08-06

GitGuardian SaaS 3 changes

• api-docs-7c9d3e1aa9a9 · API · 2026-08-05
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04

Google SecOps 1 changes

• docs update · Docs · 2026-08-04

goshs 1 changes

• v2.1.5 · Feature · 2026-08-02

Hacktron 3 changes

• 1.0 · API · 2026-08-04
• ​Azure DevOps is here, plus bulk triage and live AI runs · Feature · 2026-08-03
• ​Walk a taint trace, export your findings, and scan Bitbucket PRs · Feature · 2026-08-03

Hayabusa 6 changes

• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• v4.0.0 · Feature · 2026-08-04

Hermes 4 changes

• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• v2026.8.3 · Feature · 2026-08-04

Horizon3 NodeZero 8 changes

• docs update · Docs · 2026-08-06
• updated · Aug 6, 2026 · Feature · 2026-08-06
• docs update · Docs · 2026-08-06
• updated · Aug 5, 2026 · Feature · 2026-08-05
• api-docs-cfcbf60ea3eb · API · 2026-08-05
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• updated · Aug 4, 2026 · Feature · 2026-08-04

Hugging Face 3 changes

• 0.0.1 · API · 2026-08-04
• changelog · Aug 4, 2026 · Feature · 2026-08-04
• Filter Jobs by Label · Feature · 2026-08-03

humble 1 changes

• 1.64 · Feature · 2026-08-01

Huntress 2 changes

• changelog · Aug 4, 2026 · Feature · 2026-08-04
• Huntress API now supports creating IP-based rules for ITDR · Feature · 2026-08-01

HyperDbg 1 changes

• v0.23 · Feature · 2026-08-03

iDenfy 8 changes

• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• updated · Aug 6, 2026 · Feature · 2026-08-06

ILSpy 1 changes

• v11.0-rc · Feature · 2026-08-04

Immuta 5 changes

• docs update · Docs · 2026-08-06
• updated · Aug 6, 2026 · Feature · 2026-08-06
• updated · Aug 5, 2026 · Feature · 2026-08-05
• updated · Aug 3, 2026 · Feature · 2026-08-03
• updated · Aug 1, 2026 · Feature · 2026-08-01

impacket 2 changes

• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01

infisical 7 changes

• v0.162.16 · Feature · 2026-08-05
• v0.162.4 · Feature · 2026-08-05
• v0.162.3 · Feature · 2026-08-05
• v0.162.2 · Feature · 2026-08-05
• v0.162.0 · Feature · 2026-08-05
• v0.161.14 · Feature · 2026-08-05
• v0.161.13 · Feature · 2026-08-05

InsightAppSec 1 changes

• v1 · API · 2026-08-02

Inspektor Gadget 1 changes

• v0.55.0 · Feature · 2026-08-04

Intruder 1 changes

• changelog · Aug 4, 2026 · Feature · 2026-08-04

Invicti 1 changes

• changelog · Aug 1, 2026 · Feature · 2026-08-01

Iru 4 changes

• Offer Apple beta releases with the Software Update Library Item · Feature · 2026-08-06
• Phased Rollouts for Managed OS for Apple devices · Feature · 2026-08-06
• Platform SSO for Mac: Authenticated guest mode · Feature · 2026-08-06
• Policy assignment exclusions and generated-policy editor styling · Feature · 2026-08-05

JumpCloud 1 changes

• JumpCloud Agent Release Notes for August 4, 2026 (2026-08-04) · Feature · 2026-08-05

Katana 1 changes

• v1.7.0 · Feature · 2026-08-06

Keycloak 1 changes

• 1.0 · API · 2026-08-04

Kiro 3 changes

• Agent Plugin Support and Session Pinning · Feature · 2026-08-07
• changelog · Aug 3, 2026 · Feature · 2026-08-03
• Tangent Side-Conversations and Per-Tool Token Breakdown · Feature · 2026-08-01

Knocknoc 1 changes

• docs update · Docs · 2026-08-04

Lakera 1 changes

• docs update · Docs · 2026-08-01

Metasploit Pro 1 changes

• August 3, 2026: 5.1.0-2026073001 · Feature · 2026-08-04

Microsoft Entra 1 changes

• changelog · Aug 4, 2026 · Feature · 2026-08-05

Microsoft Security 1 changes

• changelog · Aug 4, 2026 · Feature · 2026-08-05

Mobile Verification Toolkit 1 changes

• docs update · Docs · 2026-08-06

Netskope 5 changes

• Netskope Cloud 140.0.0 Documentation Available Now! · Feature · 2026-08-04
• Netskope Cloud 119.0.0 Documentation Available Now! · Feature · 2026-08-04
• Netskope Cloud 121.0.0 Documentation Available Now! · Feature · 2026-08-04
• Netskope Cloud 122.0.0 Documentation Available Now! · Feature · 2026-08-04
• Netskope Cloud Exchange (CE) v5.1 is NOW GA · Feature · 2026-08-04

nikto 1 changes

• 2.6.1 · Feature · 2026-08-01

noir 1 changes

• docs update · Docs · 2026-08-04

Obsidian 7 changes

• Obsidian 1.13.5 Desktop (Early access) (2026-08-05) · Feature · 2026-08-06
• Obsidian 1.13.5 Mobile (Early access) (2026-08-05) · Feature · 2026-08-06
• Obsidian 1.13 Desktop (Public) (2026-07-30) · Feature · 2026-08-05
• Obsidian 1.13 Mobile (Public) (2026-07-30) · Feature · 2026-08-05
• Obsidian 1.13.3 Desktop (Early access) (2026-07-21) · Feature · 2026-08-05
• Obsidian 1.13.3 Mobile (Early access) (2026-07-21) · Feature · 2026-08-05
• Obsidian 1.13.2 Desktop (Early access) (2026-07-14) · Feature · 2026-08-05

Ollama 1 changes

• v0.32.6 · Feature · 2026-08-06

Omada Identity 1 changes

• docs update · Docs · 2026-08-01

OpenAI Codex CLI 9 changes

• rust-v0.147.0 · Feature · 2026-08-07
• rust-v0.148.0-alpha.1 · Feature · 2026-08-07
• rust-v0.147.0-alpha.13 · Feature · 2026-08-06
• rust-v0.147.0-alpha.12 · Feature · 2026-08-06
• rust-v0.147.0-alpha.6.5 · Feature · 2026-08-06
• rust-v0.147.0-alpha.11 · Feature · 2026-08-06
• rust-v0.147.0-alpha.10 · Feature · 2026-08-06
• rust-v0.147.0-alpha.6.4 · Feature · 2026-08-05
• rust-v0.147.0-alpha.6.3 · Feature · 2026-08-05

OpenCode 7 changes

• docs update · Docs · 2026-08-07
• docs update · Docs · 2026-08-07
• v1.18.15 · Feature · 2026-08-07
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• v1.18.14 · Feature · 2026-08-06
• 1.0.0 · API · 2026-08-04

OpenCTI 3 changes

• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• 7.260803.0 · Feature · 2026-08-04

OpenHands 6 changes

• v1.10.0 · Feature · 2026-08-06
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• v1.9.0 · Feature · 2026-08-04

Openlayer 2 changes

• updated · Aug 6, 2026 · Feature · 2026-08-06
• docs update · Docs · 2026-08-01

OpenOSINT 1 changes

• v2.25.0 · Feature · 2026-08-01

OpenShell 4 changes

• v0.0.99 · Feature · 2026-08-06
• v0.0.98 · Feature · 2026-08-05
• v0.0.97 · Feature · 2026-08-04
• v0.0.96 · Feature · 2026-08-01

OpenVPN 1 changes

• v2.7.6 · Feature · 2026-08-06

Opsera 1 changes

• 2.0.0 · API · 2026-08-02

OSSEC HIDS 1 changes

• 4.2.0 · Feature · 2026-08-03

OSV-Scanner 3 changes

• docs update · Docs · 2026-08-07
• docs update · Docs · 2026-08-07
• v2.5.0 · Feature · 2026-08-07

OWASP ZAP 1 changes

• 2.16.1 · API · 2026-08-04

Palo Alto Strata NGFW 1 changes

• changelog · Aug 1, 2026 · Docs · 2026-08-01

Panorays 1 changes

• Q2’26 · Feature · 2026-08-02

Pi 10 changes

• v0.84.0 · Feature · 2026-08-07
• docs update · Docs · 2026-08-07
• v0.84.1 · Feature · 2026-08-07
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06

Ping Identity 2 changes

• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06

Plerion 3 changes

• Connect your entire GCP organization at once: · Feature · 2026-08-04
• Onboard AWS accounts with Terraform: · Feature · 2026-08-04
• CIS benchmark coverage for Google Cloud: · Feature · 2026-08-03

Portkey 3 changes

• updated · Aug 6, 2026 · Feature · 2026-08-06
• updated · Aug 5, 2026 · Feature · 2026-08-05
• updated · Aug 4, 2026 · Feature · 2026-08-04

Promptfoo 2 changes

• updated · Aug 5, 2026 · Feature · 2026-08-05
• updated · Aug 4, 2026 · Feature · 2026-08-04

Prowler 10 changes

• 5.38.0 · Feature · 2026-08-06
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• 5.37.0 · Feature · 2026-08-04
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01

Rapid7 Exposure Command 1 changes

• changelog · Aug 4, 2026 · Docs · 2026-08-04

Rapid7 Insight Platform 1 changes

• changelog · Aug 4, 2026 · Docs · 2026-08-04

Rapid7 InsightAppSec 1 changes

• changelog · Aug 4, 2026 · Docs · 2026-08-04

Rapid7 InsightCloudSec 1 changes

• changelog · Aug 4, 2026 · Docs · 2026-08-04

Rapid7 InsightIDR 1 changes

• changelog · Aug 4, 2026 · Docs · 2026-08-04

Rapid7 Surface Command 1 changes

• changelog · Aug 4, 2026 · Docs · 2026-08-04

RegScale 1 changes

• CLI 6.38.0 (2026-08-06) · Feature · 2026-08-06

runZero 2 changes

• changelog · Aug 2, 2026 · Feature · 2026-08-02
• runZero 5.1.260731.2 (2026-07-31) · Feature · 2026-08-01

SailPoint 5 changes

• docs update · Docs · 2026-08-06
• Enhancement: Dark Mode Support Across SailPoint Agentic Fabric and Limited Support Across Identity Security Cloud (2026-07-22) · Feature · 2026-08-06
• New Capability: Auto-Discovery of Privileged Entitlements (2026-08-03) · Feature · 2026-08-04
• New Capability: Access Model Metadata Adhoc Values (2026-07-27) · Feature · 2026-08-04
• New Product: SailPoint Agentic Fabric (2026-07-22) · Feature · 2026-08-04

ScoutDNS 1 changes

• The all-new ScoutDNS console is live · Feature · 2026-08-06

Semgrep 2 changes

• updated · Aug 5, 2026 · Feature · 2026-08-05
• 1.0.0 · API · 2026-08-04

shellfire 1 changes

• v0.16 · Feature · 2026-08-03

skill-scanner 9 changes

• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04
• 2.0.13 · Feature · 2026-08-04

SkillSpector 1 changes

• v2.5.2 · Feature · 2026-08-05

Snyk 1 changes

• changelog · Aug 6, 2026 · Feature · 2026-08-06

Snyk Code 1 changes

• changelog · Aug 3, 2026 · Feature · 2026-08-03

Sophos Core Agent 1 changes

• Version 2025.2.1.709Windows 10 64-bit and later · Feature · 2026-08-04

Sophos DNS Protection 1 changes

• 2026.32Released on August 5, 2026 · Feature · 2026-08-06

starkiller 2 changes

• 0.1.0 · API · 2026-08-02
• v3.6.0 · Feature · 2026-08-02

StepSecurity 5 changes

• Threat Intel Notifications: Tenant-Wide Channels and Match Granularity (2026-08-04) · Feature · 2026-08-05
• Harden Runner Releases- August 5, 2026 (2026-08-05) · Feature · 2026-08-05
• Dev Machine Guard v1.15.0 (2026-08-03) · Feature · 2026-08-04
• Device Policy: Package Config Policies, MDM Verification, and Private Marketplace (2026-08-03) · Feature · 2026-08-04
• NuGet Ecosystem Support in GitHub Checks, OSS Package Search, and Secure Registry (2026-07-30) · Feature · 2026-08-04

Stratus Red Team 3 changes

• docs update · Docs · 2026-08-01
• docs update · Docs · 2026-08-01
• v2.35.0 · Feature · 2026-08-01

Strix 1 changes

• v1.5.0 · Feature · 2026-08-07

subfinder 1 changes

• v2.15.0 · Feature · 2026-08-06

Sublime Security 3 changes

• api · API · 2026-08-05
• Platform v.1.88 Tailored Phishing Simulations (Beta) (2026-08-03) · Feature · 2026-08-04
• Platform v1.87.25 (CrowdStrike Falcon Next-Gen SIEM and Fusion SOAR integrations) (2026-07-31) · Feature · 2026-08-01

Sumo Logic 4 changes

• Threat Intelligence (Security) (2026-08-06) · Feature · 2026-08-07
• Manage Playbooks with Mobot (Automation Service) (2026-08-05) · Feature · 2026-08-06
• Credit Block Burn Rates (Manage) (2026-08-03) · Feature · 2026-08-03
• Apps, Solutions, and Collection Integrations - July Release (2026-07-31) · Feature · 2026-08-01

tailscale 1 changes

• Tailscale v1.102.1 (2026-08-03) · Feature · 2026-08-04

Tenable 1 changes

• changelog · Aug 5, 2026 · Feature · 2026-08-06

Tenable One 1 changes

• changelog · Aug 5, 2026 · Feature · 2026-08-06

Tenzir 10 changes

• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• Tenzir Node v6.9.0-rc.2: Native Apache Iceberg output (2026-08-06) · Feature · 2026-08-06
• docs update · Docs · 2026-08-06
• docs update · Docs · 2026-08-06
• Tenzir Node v6.9.0: Native Apache Iceberg output (2026-08-06) · Feature · 2026-08-06
• docs update · Docs · 2026-08-05
• Tenzir Ship v2.0.0: Safe pre-1.0 breaking-change version bumps (2026-08-05) · Feature · 2026-08-05
• docs update · Docs · 2026-08-04
• Tenzir Ship v1.12.0: Safer and more flexible release publishing (2026-08-04) · Feature · 2026-08-04

Termius 1 changes

• 9.42.2 (2026-08-03) · Feature · 2026-08-04

tetragon 1 changes

• docs update · Docs · 2026-08-01

TheHive 1 changes

• v5.7.5 · API · 2026-08-04

Tines 2 changes

• New layout options for the case list (2026-08-05) · Feature · 2026-08-05
• changelog · Aug 4, 2026 · Feature · 2026-08-04

ToolHive 1 changes

• v0.42.0 · Feature · 2026-08-06

Trend Vision One 5 changes

• Export, filter, and upload scan reports in AI Scanner (2026-08-03) · Feature · 2026-08-05
• Service Gateway firmware version 3.0.31 (July 2026) (2026-07-15) · Feature · 2026-08-03
• Service Gateway: Forward Proxy Service version 2.0.12 (July 2026) (2026-07-15) · Feature · 2026-08-03
• Service Gateway support for ECS clusters in Container Security (2026-07-30) · Feature · 2026-08-01
• Container Protection for Amazon ECS version 2.2.6 (2026-07-27) · Feature · 2026-08-01

Vanta 1 changes

• 1.0.0 · API · 2026-08-04

Varonis 2 changes

• Detect agent intent drift and rogue activity with Agent IBAC · Feature · 2026-08-04
• changelog · Aug 1, 2026 · Feature · 2026-08-01

Velociraptor 1 changes

• docs update · Docs · 2026-08-01

Veracode 4 changes

• DAST updates (2026-08-06) · Feature · 2026-08-07
• Training updates (2026-08-06) · Feature · 2026-08-06
• EASM updates (2026-08-05) · Feature · 2026-08-06
• changelog · Aug 4, 2026 · Feature · 2026-08-04

vMLX 4 changes

• v1.6.7 · Feature · 2026-08-05
• v1.6.22 · Feature · 2026-08-03
• v1.6.20 · Feature · 2026-08-03
• v1.6.19 · Feature · 2026-08-01

Windsurf 1 changes

• updated · Aug 2, 2026 · Feature · 2026-08-02

Wiz 1 changes

• changelog · Aug 6, 2026 · Feature · 2026-08-06

Wiz Cloud 1 changes

• changelog · Aug 6, 2026 · Feature · 2026-08-06

WPScan 1 changes

• v4.1.0 · Feature · 2026-08-04

YARA-X 2 changes

• docs update · Docs · 2026-08-04
• docs update · Docs · 2026-08-04

Zscaler 2 changes

• changelog · Aug 5, 2026 · Feature · 2026-08-06
• changelog · Aug 3, 2026 · Feature · 2026-08-03

OpenAI Codex CLI rust-v0.147.0 · 2026-08-07

The deprecated --full-auto flag for codex exec has been removed; use --sandbox workspace-write instead.

OpenAI Codex CLI rust-v0.147.0 · 2026-08-07

Redundant Linux bundle archives are no longer published; use the standard codex-package-<target> release archives instead.

Pi v0.84.0 · 2026-08-07

The ModelsStreamTransforms interface is renamed to ModelsRequestTransforms; extensions referencing ModelsStreamTransforms will break.

Pi v0.84.0 · 2026-08-07

JSON and RPC message_update events now emit only assistantMessageEvent deltas; the cumulative message and assistantMessageEvent.partial fields are removed. Clients must assemble deltas between message_start and message_end.

Pi v0.84.0 · 2026-08-07

ModelRegistry.getApiKeyAndHeaders() now returns ProviderHeaders with string | null values; extensions that inspect returned headers must handle null.

Pi v0.84.0 · 2026-08-07

ModelRegistry.refresh() now accepts ModelsRefreshOptions and returns ModelsRefreshResult instead of discarding cancellation and provider errors.

Pi v0.84.0 · 2026-08-07

ModelRuntime.setRuntimeApiKey() now accepts auth cancellation options instead of catalog refresh options; callers must call refresh({ providers: [providerId], signal }) separately when remote freshness is required.

Pi v0.84.0 · 2026-08-07

Config-form extension OAuth refreshToken(credentials, signal) callbacks are now required to accept and honor a concrete abort signal.

Pi v0.84.0 · 2026-08-07

Dynamic provider refresh context store access is replaced with the read-only context.stored snapshot and generation-checked context.publish() transaction; handwritten Provider.refreshModels() implementations using context.store.read() / context.store.write() must migrate.

Pi v0.84.0 · 2026-08-07

The inherited pi-agent-core harness session model is replaced with the v4 lane-based Session, SessionStorage, and SessionRepo APIs; code using the old session model will break.

Pi v0.84.0 · 2026-08-07

The legacy JSONL and in-memory repository APIs are removed; code must migrate to JsonlSessionRepo or InMemorySessionRepo from pi-agent-core v4.

Pi v0.84.0 · 2026-08-07

Custom harness file-system implementations must now provide a FileSystem.renameFile() operation for atomic JSONL publication.

Pi v0.84.0 · 2026-08-07

RemoteSession.sessions no longer exposes runtime phase, model, thinking, attachment, or lock state; that data is now only available from acquired SessionSnapshot values.

Veracode DAST updates (2026-08-06) · 2026-08-07

The DAST scheduling REST API endpoints have changed; integrations that use the REST API to manage schedules must be updated to use the new endpoints (refer to the DAST API specification for details).

Cline sdk/sdk/v0.0.71 · 2026-08-06

Per-provider thinking overrides are replaced by the AI SDK's native reasoning setting; existing configurations relying on those overrides will need to be updated.

Docker Sandboxes v0.38.0 · 2026-08-06

The sbx mcp bundle command has been removed; single-server management via sbx mcp add/ls/rm is the only supported flow.

Docker Sandboxes v0.38.0 · 2026-08-06

Service and custom secrets default to global scope; legacy positional and --global forms are deprecated with warnings.

GitGuardian Detection Engine Detection Engine Updates Version 2.169 (2026-08-03) · 2026-08-06

The grafbase_access_token detector and checker have been removed entirely.

GitGuardian Detection Engine Detection Engine Updates Version 2.169 (2026-08-03) · 2026-08-06

The Amadeus OAuth credentials detector and checker have been disabled.

Immuta updated · Aug 6, 2026 · 2026-08-06

Starting August 26, 2026, Databricks will mask query_text in the query_history system table by default; Immuta query audit will no longer contain query text and all query audit events will show as Indeterminant unless the Immuta service principal is added to the databricks_pii_access group in Databricks.

Immuta updated · Aug 6, 2026 · 2026-08-06

Immuta policy role names used to grant users access to Snowflake data sources will be renamed and recreated as part of the Snowflake integration architecture update rolling out from July 23, 2026 (user role names remain unchanged).

Immuta updated · Aug 6, 2026 · 2026-08-06

Integration error banners for Snowflake integration validation failures will no longer be displayed; errors will instead appear in the new Connections experience.

Ollama v0.32.6 · 2026-08-06

Experimental image generation is no longer available in v0.32.6; the feature has been removed and requires staying on v0.32.5.

OpenAI Codex CLI rust-v0.147.0-alpha.13 · 2026-08-06

Legacy Linux bundle archives are no longer published.

OpenVPN v2.7.6 · 2026-08-06

The --ping and --keepalive options now reject values exceeding 86400 seconds (24 hours); configs with larger values will need to be updated.

OpenVPN v2.7.6 · 2026-08-06

TCP_NODELAY is now enabled by default on all sockets; previously it was opt-in via --tcp-nodelay.

Pi docs update · 2026-08-06

The ModelsStreamTransforms interface is renamed to ModelsRequestTransforms; extensions implementing it must update their type references.

Pi docs update · 2026-08-06

JSON and RPC message_update events now emit only assistantMessageEvent deltas; the cumulative message / assistantMessageEvent.partial fields are removed. Clients must now assemble deltas between message_start and message_end.

Pi docs update · 2026-08-06

#7290 now returns ProviderHeaders with string | null values and preserves null header-deletion markers; extensions that inspect returned headers must handle null.

Pi docs update · 2026-08-06

ModelRuntime.setRuntimeApiKey() now accepts auth cancellation options instead of catalog refresh options; callers that relied on it for remote freshness must call refresh({ providers: [providerId], signal }) separately.

Pi docs update · 2026-08-06

Config-form extension OAuth refreshToken(credentials, signal) callbacks are now required to accept and honor a concrete abort signal.

Pi docs update · 2026-08-06

Dynamic provider refresh context store access is replaced with the read-only context.stored snapshot and generation-checked context.publish() transaction; handwritten Provider.refreshModels() implementations must be updated.

Pi docs update · 2026-08-06

The legacy JSONL and in-memory repository APIs from pi-agent-core's experimental entrypoint are removed; use JsonlSessionRepo or InMemorySessionRepo from pi-agent-core's default export.

Pi docs update · 2026-08-06

Custom harness file-system implementations must now provide FileSystem.renameFile() with same-filesystem replacement semantics.

Pi docs update · 2026-08-06

RemoteSession.sessions no longer exposes runtime phase, model, thinking, attachment, or lock state; this data is now available only from acquired SessionSnapshot values.

Pi docs update · 2026-08-06

The experimental pi-agent-core subpaths are removed; the v2 AgentHarness API is now on pi-agent-core's default export.

Portkey updated · Aug 6, 2026 · 2026-08-06

The gateway no longer forwards the x-portkey-forward-headxers header, preventing header-forwarding loops — any setup relying on that header being passed through will stop working.

SailPoint Enhancement: Dark Mode Support Across SailPoint Agentic Fabric and Limited Support Across Identity Security Cloud (2026-07-22) · 2026-08-06

Custom branding colors will not be applied in Dark Mode — they continue to appear in Light Mode only.

ToolHive v0.42.0 · 2026-08-06

status.referencingWorkloads and status.referenceCount fields (and the References printer column) are removed from all six config CRDs (MCPOIDCConfig, MCPAuthzConfig, MCPExternalAuthConfig, MCPToolConfig, MCPWebhookConfig, MCPTelemetryConfig); replace any automation that reads them with workload field queries.

ToolHive v0.42.0 · 2026-08-06

Cedar authorization policy is now evaluated against the post-mutation MCP request — if you run a mutating webhook (--webhook-config with a mutating: entry, or MCPWebhookConfig.spec.mutating) alongside Cedar authz, policy decisions and audit records (type, target.name) can change on upgrade; re-audit policies against the post-mutation shape before upgrading.

ToolHive v0.42.0 · 2026-08-06

Recovered HTTP panics no longer emit a slog.Error log line or stack trace — setups relying on log-based alerts or support bundles to diagnose recovered panics will silently lose that diagnostic output (a patch fix is expected).

ToolHive v0.42.0 · 2026-08-06

pkg/telemetry/providers was deleted and two long-published optimizerdec constants were removed from the Go API, breaking any out-of-tree importers that reference them.

Veracode Training updates (2026-08-06) · 2026-08-06

The default Security Labs URL has changed from https://securitylabs.veracode.com/ to https://securitylabs.veracode.com/security-labs/; customers using SSO with a stand-alone account must update their configured URL.

Veracode Training updates (2026-08-06) · 2026-08-06

In Security Labs, Teams are now called Organizations and Roles are now called Teams; any documentation, automation, or integrations referencing these terms must be updated.

Veracode Training updates (2026-08-06) · 2026-08-06

The Security Labs community edition will be deprecated on July 31, 2026.

Veracode Training updates (2026-08-06) · 2026-08-06

33 deprecated eLearning courses (OWASP 2017, OWASP Top 10 2021, and language-specific Secure Coding courses for .NET, Java, JavaScript, PHP, and Python) are no longer available as of June 10, 2026.

Veracode Training updates (2026-08-06) · 2026-08-06

OWASP Top 10 (2021) Security Labs lessons are no longer available as of June 10, 2026.

Claude Code v2.1.222 · 2026-08-05

Remote Control auto-start can no longer be enabled from .claude/settings.json or .claude/settings.local.json; configurations relying on repo-local settings to turn it on will stop working — use /config at user scope instead.

Claude Code v2.1.222 · 2026-08-05

The ultraplan feature has been removed; any configuration or workflows depending on it will break.

Cline v4.1.4 · 2026-08-05

Model-initiated switching from plan mode to act mode is removed; the model can no longer transition out of plan mode mid-turn — only the user can.

emisar v0.27.0 · 2026-08-05

Upgrading to runner-v0.12.0 starts a new durable dispatch journal and does not import older unacknowledged entries; downgrading to an earlier runner after v0.12.0 has written new dispatch records is unsupported.

garak v0.16.0 · 2026-08-05

probe_spec and buff_spec configuration keys move into the run definition as part of the new unified spec syntax — existing config files using top-level probe_spec or buff_spec will break.

garak v0.16.0 · 2026-08-05

CLI plugin selection options for probes and buffs are now deprecated in favour of the unified spec syntax (old options still accepted but marked deprecated).

garak v0.16.0 · 2026-08-05

The report.jsonl output structure changes: new probe_summary entry type is added, the digest format is expanded, and digest values tied to the old *_spec configuration keys are removed — any downstream parsers of report.jsonl must be updated.

Immuta updated · Aug 5, 2026 · 2026-08-05

Immuta will rename Snowflake policy role names as part of the new Snowflake integration architecture rollout (beginning July 23, 2026); existing policy roles will be recreated under new names. User role names remain unchanged and there is no downtime.

Immuta updated · Aug 5, 2026 · 2026-08-05

Starting August 26, 2026, Databricks will mask query_text in the query_history system table by default; Immuta's Databricks Unity Catalog query audit will lose query text and all affected events will show as Indeterminant unless the Immuta service principal is added to the databricks_pii_access group.

Immuta updated · Aug 5, 2026 · 2026-08-05

Immuta will no longer display integration error banners when integration validation fails; error messages will only be available through the new Connections experience.

Immuta updated · Aug 5, 2026 · 2026-08-05

When a data source is disabled, Immuta now revokes data owners' Immuta-managed grants in the data platform (behavior change release; on by default August 1, enabled for all accounts September 1).

infisical v0.162.3 · 2026-08-05

The PAM assumer role has been removed

Obsidian Obsidian 1.13 Desktop (Public) (2026-07-30) · 2026-08-05

The --callout-color CSS variable now expects a valid CSS color (e.g. #ff0000 or rgb(255,0,0)) instead of a bare RGB triplet (e.g. 255,0,0); existing theme/snippet overrides using the old format will break.

Obsidian Obsidian 1.13 Mobile (Public) (2026-07-30) · 2026-08-05

Minimum iOS version raised from iOS 14.5 to iOS 15.

Sublime Security api · 2026-08-05

Deprecated endpoint GET /v0/message-groups/hunt/{id} (still works)

Sublime Security api · 2026-08-05

Deprecated endpoint POST /v0/message-groups/hunt (still works)

Tenzir docs update · 2026-08-05

Projects on major version zero will no longer automatically bump to v1.0.0 on a breaking change — they receive a minor bump instead (e.g., v0.4.2 → v0.5.0). Reaching v1.0.0 now requires an explicit tenzir-ship release create --major --yes invocation.

bloodhound v2 · 2026-08-04

Deprecated endpoint DELETE /api/v2/custom-nodes/{kind_name} (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint DELETE /api/v2/saml/providers/{saml_provider_id} (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/asset-groups/{asset_group_id}/combo-node (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/asset-groups/{asset_group_id}/members (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/clients/{client_id}/completed-tasks (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/domains/{domain_id}/attack-path-findings (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/pathfinding (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/saml (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/saml/providers/{saml_provider_id} (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/saml/sso (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/tasks (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/tasks/available (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/tasks/current (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/tasks/finished (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/tasks/{task_id} (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint GET /api/v2/tasks/{task_id}/log (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint POST /api/v2/asset-groups/{asset_group_id}/selectors (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint POST /api/v2/clients/{client_id}/tasks (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint POST /api/v2/saml/providers (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint POST /api/v2/tasks/end (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint POST /api/v2/tasks/start (still works)

bloodhound v2 · 2026-08-04

Deprecated endpoint PUT /api/v2/tasks/{task_id}/cancel (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /accounts/{account_id}/access/bookmarks/{bookmark_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /accounts/{account_id}/email-security/settings/domains (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /accounts/{account_id}/infrastructure/targets/batch (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /accounts/{account_id}/pipelines/{pipeline_name} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /accounts/{account_id}/storage/kv/namespaces/{namespace_id}/bulk (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /accounts/{account_id}/vectorize/indexes/{index_name} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /user/organizations/{organization_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/api_gateway/user_schemas/{schema_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/cache/origin_cloud_regions/batch (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/cache/origin_cloud_regions/{origin_ip} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/filters (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/filters/{filter_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/firewall/rules (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/firewall/rules/{rule_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/firewall/waf/overrides/{overrides_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint DELETE /zones/{zone_id}/rate_limits/{rate_limit_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/access/bookmarks (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/access/bookmarks/{bookmark_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/addressing/prefixes/{prefix_id}/bgp/status (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/billing/profile (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/cloudforce-one/events/indicatorTypes (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/cloudforce-one/events/{event_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/devices (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/devices/{device_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/devices/{device_id}/override_codes (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/gateway/configuration/custom_certificate (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/images/v1 (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/intel/attack-surface-report/issues (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/intel/attack-surface-report/issues/class (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/intel/attack-surface-report/issues/severity (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/intel/attack-surface-report/issues/type (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/logs/explorer/query/sql (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/pipelines (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/pipelines/{pipeline_name} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/registrar/domains (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/registrar/domains/{domain_name} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/roles (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/roles/{role_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/urlscanner/response/{response_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/urlscanner/scan (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/urlscanner/scan/{scan_id} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/urlscanner/scan/{scan_id}/har (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/urlscanner/scan/{scan_id}/screenshot (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/vectorize/indexes (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /accounts/{account_id}/vectorize/indexes/{index_name} (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/ai/bots/summary/user_agent (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/ai/bots/timeseries_groups/user_agent (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/ai/inference/summary/model (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/ai/inference/summary/task (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/ai/inference/timeseries_groups/model (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/ai/inference/timeseries_groups/task (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/summary/dnssec (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/summary/edns (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/summary/ip_version (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/summary/protocol (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/summary/query_type (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/summary/response_codes (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/timeseries_groups/dnssec (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/timeseries_groups/edns (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/timeseries_groups/ip_version (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/timeseries_groups/protocol (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/timeseries_groups/query_type (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/as112/timeseries_groups/response_codes (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/summary/bitrate (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/summary/duration (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/summary/industry (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/summary/ip_version (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/summary/protocol (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/summary/vector (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/summary/vertical (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/timeseries_groups/bitrate (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/timeseries_groups/duration (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/timeseries_groups/industry (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/timeseries_groups/ip_version (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/timeseries_groups/protocol (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/timeseries_groups/vector (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/timeseries_groups/vertical (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/top/industry (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer3/top/vertical (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer7/summary/http_method (still works)

Cloudflare 4.0.0 · 2026-08-04

Deprecated endpoint GET /radar/attacks/layer7/summary/http_version (still works)