This Week's Highlights — issue 007, August 14, 2026
THE CYBER TOOLCHAIN
NO. 007
The best tooling updates that shipped this week.
The week in numbers · Aug 7–13
Changes per week, last 12 weeks · Aug 7–13
Changes we read in that week's dailies, including docs and API changes. A gap means no daily was published.
Every feature release from the 1309 tools on our watchlist goes into the daily newsletter. Once a week we read the whole field side by side and choose our top picks, judged on two questions: how deep and complete is the single best capability in the release, and how much it changes what you can actually do.
A tool is judged on everything it shipped that week, so a project that releases daily gets credit for the sum — and still only takes one slot. We would rather run a short list than a padded one.
Focus: What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out: Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus: New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out: Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus: Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out: Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus: API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out: Governance, SOC operations, and vendor launches with no developer surface.
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
The picks in full
Free Active Directory pentesting tool for Linux. Automates AD and LDAP enumeration, Kerberoasting, ASREPRoast, password spraying, ADCS/ESC1, DCSync, RBCD, gMSA, shadow credentials, NTLM relay and credential dumping across 104 techniques, mapping BloodHound-compatible attack paths to Domain Admin.
Adds cross-forest privilege-escalation chains, surfacing cross-forest Kerberos delegation and MSSQL linked-server compromise across trust boundaries as a single blast radius, plus Tier 0 membership counts and ADSCAN_TRUST_SCOPE trust-collection control. The prior release also executes AD CS ESC5 end to end and generates MITRE-mapped coverage and reports.
Across four releases, ADscan shipped an integrated password-cracking pipeline with a bundled 94-million-entry wordlist, full end-to-end ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. ESC5 exploitation, SQL Server and Shadow Credentials attack coverage, cross-forest trust escalation modeling, and resumable scans with native macOS/ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support, alongside new harvest, jobs, generate_report, writeup, and adscan execute attack_paths commands. The window also carried several breaking changes: bundled external tools were removed in favor of a native engine, nine REPL commands were renamed, and the tool now refuses to run outside its container.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
ADSCAN_TRUST_SCOPE (values all or origin) controls which domains are collected across forest trusts, overridable per scan via the web scan-setup domain-enumeration policy. Cross-forest KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket delegation is now surfaced as an escalation route, drawing both forests as one blast radius with remediation to disable the delegation. MSSQL linked-server-chain compromise now extends across forest boundaries, coupling SYSTEM-on-DC to directory replication in the target trusted domain rather than stopping at the controller. Trust relationships are always mapped regardless of collection scope, and domain collection follows engagement type: CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. scans collect all reachable domains including newly unlocked trusted forests unattended, while audit scans default to the origin domain.
$ ADSCAN_TRUST_SCOPE=origin adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'
Adds password-strength auditing built into the scan: credentials captured via broadcast poisoning, Kerberos service tickets, and AS-REP hashes are cracked in the background using the bundled 94-million-entry ADscan AD Audit Wordlist and a client-targeted wordlist generator, with recovered passwords fed back into the attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. automatically. A four-rung selectable cracking-effort ladder is calibrated to host hardware, with accurate pre-commit time estimates and live progress/ETA during cracking; cracking-effort and poisoning controls are exposed in the YAML scan-config file and the web platform.
$ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!'
New adscan execute attack_paths subcommand runs a single saved attack path or step against a workspace without a full rescan; it resolves credentials automatically for already-owned accounts, and a companion re-arm action resets step status to re-run a path.
$ adscan execute attack_paths
REPL commands now accept flag-form arguments -d/--dc-ip, -u, -p, --host, --service alongside the existing positional form, with tab-completion for both flag names and values.
$ start_auth -d 10.0.0.1 -u alice -p 'S3cr3t!' --host corp.local
New harvest command provides a single view of every credential obtained during a scan (captured, cracked, and sprayed), each tagged with its privilege tier and reachable assets, plus an end-of-scan harvest summary.
$ harvest
New adscan deliver --client-logo and adscan ci --client-logo flags accept PNG, SVG, or JPG to embed a client logo in both the free and PRO report covers.
$ adscan ci auth --type audit --interface eth0 --domain corp.local --dc-ip 10.0.0.1 -u alice -p 'S3cr3t!' --client-logo client_logo.png
Adds --no-telemetry and --offline flags to adscan start; also restores set telemetry off as a per-workspace setting and introduces set telemetry off global for an operator-wide default.
Adds SQL Server attack coverage: linked-server lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. across domain and forest trusts, automated command execution with escalation to SYSTEM, and arbitrary file read via bulk import, each surfaced as a validated attack step in the report. The SQL Server post-authentication workflow now runs automatically in unattended scans instead of defaulting to skip.
New writeup command captures port data, directory contents, the full attack chain as an editable Mermaid diagram, timestamped steps with credential provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., flags, and dead ends into a lab/CTF writeup; it runs automatically on lab and CTF scans.
MSSQL SYSTEM-escalation follow-up and HasSession exploitation now offer a choice between minting a fresh privileged account or elevating one already under the operator's control. HasSession escalation elevates to the host's own local Administrators group on member servers instead of always adding to Domain Admins. At workspace exit, ADscan prompts whether to delete any account it created during an MSSQL follow-up (default: yes); declining records the exact removal command so nothing is silently left behind.
ADscan now executes AD CS ESC5 end to end: it backs up the CA private key, forges a certificate offline, and authenticates with it from the CA host's machine account or a recovered local-admin password.
New jobs command lists, reviews, and stops long-running background tasks such as broadcast-name-resolution poisoning capture and password cracking.
$ jobs
Adds broadcast name-resolution poisoning capture (LLMNR, NBT-NS, mDNSmDNSA zero-configuration protocol that resolves hostnames to IP addresses on a local network segment without a central DNS server, using multicast UDP on 224.0.0.1:5353. Cyber tools use it to discover hosts and services without active probing.) as a background task, surfaced as a finding and linked attack step, with an explicit consent panel in interactive mode and automatic start in unattended scans.
New generate_report command produces a free self-contained HTML report and a paginated A4 PDF exposure report from any scan; audit-mode scans now run it automatically.
Password sprayingPassword sprayingTrying a small number of common passwords across many accounts. Attackers spread attempts out to avoid the lockouts caused by repeatedly guessing one user's password., share enumeration, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. hardening checks, local credential verification, and account cleanup now run on ADscan's built-in engine with consistent proxy support, removing the dependency on bundled external command-line tools. Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents.
Attack pathsAttack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. with interchangeable intermediate accounts now collapse into a single finding that names and counts those accounts, reducing report duplication. The operator can choose which interchangeable accounts to target — several at once for a roast or spray, or one for a direct step — with unattended runs picking the strongest candidate automatically.
Adds opt-in writable-share credential bait: plants a bait file on writable shares and captures resulting authentication attempts as a background job that does not block the scan; configurable via new scan-configuration toggles in the CLI and web console.
New COVERAGE.md lists all 103 Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. techniques implemented, each mapped to MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and marked executed, detected, or declined for safety; it is generated from the product catalog so it cannot drift.
Remediation guidance is now written entirely in native Microsoft tooling (dsacls, RSAT Active Directory module, Get-*/Set-* cmdlets) with no third-party product names in client-facing report text.
Certificate Services attacks now run through a native implementation, including detection of delegated CA-management rights and detection of Extended Protection on the web-enrollment endpoint, which suppresses false ESC8ESC8An Active Directory privilege escalation path where an attacker abuses the Web Enrollment interface of a Microsoft Certificate Authority to coerce NTLM authentication and relay it to obtain a certificate for a privileged account. findings when enrollment is hardened.
On large directories, ADscan now prompts the operator to choose the SMB host-enrichment scope: the recommended host set, a custom count, all hosts, or skipping enrichment entirely. Reports and the platform state how many hosts were enriched out of the reachable total.
Force Change Password steps now follow engagement type in unattended runs: CTF scans reset the target password and continue automatically, while audit scans skip the reset unless an operator explicitly approves it. Machine account password resets are refused outright in every mode.
Adds native macOS and Apple Silicon support; LITE and PRO images are now published for ARM64/Apple Silicon in addition to x86-64.
Adds resumable scans — interrupted scans (crash, disconnect, or deliberate stop) can resume from the last completed phase or host; the web platform can stop and resume a running scan gracefully.
Adds credential capture through a pivot: NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. authentication can be captured across a routed tunnel, with per-target selection of the callback address.
The Enterprise platform adds a cross-scan exposure comparison view that plots exposure across a workspace's scans and lists findings and attack paths that appeared, closed, or carried over.
Adds Shadow Credentials escalation: detects when it can write a key credential to a target account and executes the full authentication chain end to end.
Attack paths now carry more precise result states: 'Partially Validated', 'Not Executed for Safety', and 'Attack Surface Reduced — Hardening Observed'. The AD exposure score now combines proof strength with per-technique exploitability.
Adds recovery of secrets protected with PowerShell ConvertFrom-SecureString -Key, chained into share-password findings.
Adds Privilege Blast Radius: reports, the web platform, and the CLI now show the full set of assets and capabilities a single compromised account reaches.
Extended-rights escalation (forced password reset, DCSyncDCSyncAn attack that abuses Active Directory replication permissions to request password-related data from a domain controller. It imitates the synchronization normally performed between controllers., LAPSLAPSA Microsoft feature that automatically generates, rotates, and stores unique local administrator passwords for each Windows machine in Active Directory, eliminating shared static credentials across a fleet. password read) is now modeled per target and chained into attack paths.
Service accounts carrying an HTTP SPN are now flagged as a Kerberos web-application relay and coercion surface, with native remediation guidance included in the report and platform.
GPO control is now chained through to code execution via a scheduled task on machines the GPO applies to.
Reports and the platform now show how many accounts already hold Tier 0 privilege via group membership alongside the count reachable via attack paths, with already-privileged accounts excluded from the attack-path figure.
Nine REPL commands were renamed to native names; the previous command names are no longer accepted.
Web ports 8080 and 8443 are now included in the important-ports sweep and folded into service discovery.
Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container.
The Blocked by Active Controls report category was removed.
- !Nine REPL commands were renamed to native names; the previous command names are no longer accepted.
- !The Blocked by Active Controls report category was removed.
- !Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container.
- !Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents.
Elastic Security Labs is a research division that publishes threat intelligence, malware analysis, and security research to help defenders detect and respond to cyber threats.
Ships a dependency-free bash/PowerShell hook collector that streams every Cursor AI coding-agent tool call to Elasticsearch as ECS-conformant JSONL, letting teams run ES|QL queries to find, for example, which hosts ran an agent that read a .pem file. A companion CEL integration snapshots .npmrc to catch silent removal of npm's min-release-age cooldown.
Elastic Security Labs shipped an end-to-end auditing pipeline for Cursor AI coding agent activity — a hook collector script, an MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.-less distribution mechanism, and an Elastic Agent integration for ES|QLES|QLElasticsearch Query Language, maintained by Elastic, a pipe-based query language for filtering, transforming, and aggregating data stored in Elasticsearch, giving cyber tools a concise syntax for log and event analysis. queries — plus a CELCELCommon Expression Language, an open-source expression language maintained by Google, used to embed lightweight, safe policy evaluation logic into tools without running a full scripting engine.-based detector that catches silent removal of npm's min-release-age cooldown setting.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
A 280-line dependency-free bash script log-tool-calls.sh (plus a PowerShell port for Windows), published in the elastic/elasticsearch-labs repository, records every Cursor AI agent tool call as JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. to a date-rotated log file readable only by the owner (chmod 0600). Each entry promotes top-level fields hook_event_name, tool_name, command, file_path, mcp_server, model, session_id, duration, duration_ms plus an ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping.-conformant event object (event.category, event.type, event.outcome), and is tagged with a detected agent/ide surface (cursor, cursor-cli, remote) by inspecting CURSOR_VERSION, CURSOR_CODE_REMOTE, VSCODE_PID, VSCODE_CWD, VSCODE_IPC_HOOK. The same hooks.json also covers the headless cursor-agent CLI used in CI, and local logs are retained for 30 days with opportunistic deletion, with Elasticsearch as the system of record.
cursor-agent CLI log every tool call without MDM.$ sudo mkdir -p /usr/local/share/ai-hooks sudo cp log-tool-calls.sh /usr/local/share/ai-hooks/log-tool-calls.sh sudo chmod +x /usr/local/share/ai-hooks/log-tool-calls.sh sudo tee "/Library/Application Support/Cursor/hooks.json" <<'EOF' { "version": 1, "hooks": { "sessionStart": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "beforeShellExecution": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "afterShellExecution": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "beforeMCPExecution": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "afterMCPExecution": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "postToolUse": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "postToolUseFailure": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "afterFileEdit": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "beforeReadFile": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "subagentStart": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "subagentStop": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "sessionEnd": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }], "stop": [{ "command": "/usr/local/share/ai-hooks/log-tool-calls.sh" }] } } EOF
$ cursor-agent --print "say hello" tail -1 ~/.config/ai-hooks/logs/tool-calls-$(date -u +%F).jsonl
A ~40-line CEL integration in Elastic Agent snapshots every .npmrc on a 6-hour heartbeat and sets cooldown.absent = true in the ingest pipeline when min-release-age disappears between snapshots. It uses the file() and dir() CEL functions to enumerate user home directories (/Users, /home) and machine-global npm config paths (/opt/homebrew/etc/npmrc, /usr/local/etc/npmrc, /etc/npmrc, /usr/lib/node_modules/npm/.npmrc) across macOS and Linux, sets resource.url: file:///dev/null to satisfy CEL's required URL field, and takes global paths and poll interval via the Custom request cursor YAML field in Fleet UI. Registry auth token lines (//registry.npmjs.org/:_authToken=...) are filtered in the ingest pipeline before indexing, and per-file SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hashes (file.hash.sha256) are emitted so in-place rewrites that strip min-release-age are caught even without a path change. The design note explains that the Custom Logs Filestream integration was unsuitable because files under 1024 bytes are held back under the default fingerprint identity strategy, filestream only emits on append, and clean_inactive requires ignore_older — a poor fit for static config files that may sit unchanged for months.
Delivers the collector to devices outside MDM via Cursor's Cloud Distribution console, which pushes a self-bootstrapping hook command carrying the collector script gzipped and base64-encoded, verified against a pinned SHA-256 hash on every invocation.
An Elastic Agent filestream integration configuration parses the JSONL hook logs into structured fields, enabling ES|QL queries across all agent activity — for example, identifying which hosts ran an agent that read a .pem file in a given time window.
UNIX-like reverse engineering framework and command-line toolset
Adds a Rust v0 symbol demangler that makes modern Rust binaries readable, plus new binary-resource extraction commands (iU/ix, rabin2 -xU) and struct synthesis from pointer-argument access patterns (afts), with PPC64 ELFv2 calling-convention and WebAssembly type support.
Radare2 6.2.0 adds a generic binary resource extraction system, an initial Rust v0 demangler, struct type synthesis from pointer-argument patterns, and broader calling-convention analysis for PPC64 and MIPSMIPSA RISC processor architecture originally developed at Stanford and commercialized by MIPS Technologies, widely used in embedded and network devices; cyber tools target it to analyze or exploit routers, cameras, and similar hardware., alongside several breaking changes including a Capstone v4 minimum and stricter r2agent authentication.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds the iuo command to open binary resources inline, ix to extract sections, segments, and resources, and iU (with iUx extraction) plus the rabin2 -xU flag for listing and extracting resources; the old iR command is renamed to iU and the old iU is moved to iu. Backed by a new generic resource API supporting GLib Resources in ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code., Macho code signatures, PE/CLR resources, PE resources from MDMP, OS/2 LE/LX resources, QNX LMF resources, and Pebble resources.
$ rabin2 -xU malware.exe
Adds struct type synthesis from pointer-argument access patterns via the afts command, and a types.fields config key to gate propagation of callee types into struct and union fields during aaft.
$ r2 /bin/target
> aaa
> s sym.process_packet
> afts
Adds automatic ppc64 ELFv2 calling convention selection from the ELF ABI, automatic MIPS calling convention selection from the o32/n32 ABI, and callconv definitions (clobber and preserve registers) for all supported architectures including PPC and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.. Adds PPC64 TOC pointer base-register tracking gated by RArchOpMask.STATEFUL and wired into aar, plus new r_anal_cc_argslot and r_anal_cc_argval APIs for resolving calling-convention stack argument slots, r_anal_cc_isclobber for querying register clobbering, and reguse analysis hints with dyncc register role APIs.
Adds anal.gpseed to seed a PIC base register during ESIL analysis, asm.cmt.reguse to emit register-use comments in disassembly, dir.binsdb (from binpath/dirprefix) for PE/MDMP ordinal lookups, and scr.drag to enable click-and-drag scrolling in disasm, hex, and graph views.
$ r2 /bin/firmware.elf
> e anal.gpseed=0x10000
> aaa
Adds auth protection to r2agent web session spawns via an HTTP auth file; empty lines in the auth file now block all access rather than allowing any password through, a behavior change from prior releases.
Adds the Lcc command to list all plugins registered with the new command API, RArchOpMask.STATEFUL and RArchSession.reset for stateful architecture decoding in plugins, and makes RBin demanglers pluggable and selectable.
Adds && and || short-circuit command chaining support in the r2 shell, including support for chaining after literal commands in the shell pipeline.
Adds v128, ref, and reftype support for WebAssemblyWebAssemblyA binary instruction format that runs in browsers and server runtimes at near-native speed, letting developers compile C, Rust, or other languages into a portable, sandboxed module any compliant host can execute. binaries.
Adds MiKNix platform support in the build system and a dist/jslinux target using temu/rv64 for JavaScript-based Linux builds.
Removes Capstone v3 support; Capstone v4 is now the minimum required version.
Adds an initial Rust v0 symbol demangler, making Rust binaries easier to analyze.
RBinPluginAny is renamed to "null" and no longer uses LibMagic.
- !The
iRcommand is renamed toiU; the oldiUcommand is moved toiu; therabin2 -uflag behavior is moved to an environment variable. - !Capstone v3 support is removed; Capstone v4 is now the minimum supported version.
- !
RBinPluginAnyis renamed to"null"and no longer uses LibMagic. - !Empty lines in the r2agent HTTP auth file now deny all access (previously they permitted any password through).
Wiz Code is a developer security tool that scans code and infrastructure-as-code for vulnerabilities and misconfigurations during the development lifecycle.
Validates whether exposed secrets are actually live via a Wiz Red Agent that actively tests what a leaked credential can reach, and inventories developers' personal public GitHub repos to close the unmanaged-secret visibility gap, mapping blast radius on the Security Graph with the exact commit and pusher for owner-assigned remediation.
Wiz Code extends secret exposure detection beyond organizational boundaries to developers' personal public GitHub repositories, pairing this with AI-driven exploitability validation and full attack-path visibility on the Security Graph.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Surfaces identity-attached findings with the exact commit, GitHub user, and email that pushed a secret, enabling immediate owner-assigned remediation without manual investigation. These findings integrate into existing remediation workflows including Jira ticket creation, Slack developer notification, and tracked token rotation and revocation.
Introduces exploitability validation via the Wiz Red Agent — an AI-powered attacker that actively tests whether an exposed credential is live and what it can reach, going beyond traditional validity checks.
Enriches secrets found in personal repositories onto the Wiz Security Graph to show the full attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. and blast radius of a compromised credential, including downstream resource access.
Wiz Code adds automated inventory and correlation of developer identities to their personal public GitHub repositories outside org boundaries, closing the visibility gap where unmanaged secret exposure lives.
Tenzir Changelog is an RSS feed tracking updates, new features, and fixes for Tenzir's open-source security data pipeline and threat detection platform.
Adds native beacon-detection analytics to TQL with cadence (deltas, mad, skewness) and periodicity (autocorrelation, periodogram, dominant_period) functions for identifying periodic C2 beaconing directly in pipelines, plus automatic NetFlow detection and richer ClickHouse JSON handling.
Tenzir shipped native TQL functions for beacon and anomaly detection alongside ClickHouse and NetFlow ingestion improvements, while the Platform added pipeline ID search and made telemetry collection opt-in.
what's the number?
Each feature carries 0–100 for how completely the vendor documented it — not how big or important the work is. A major capability described in eight words scores low, and that is the finding.
- depth0–40 what it does and how it works or what changed
- specificity0–30 names real surfaces — APIs, flags, formats, limits, numbers
- actionability0–30 enough to go use it — a named endpoint, flag, or config key tops this; a UI path is a starting point
Code and config rank first by construction: a documented endpoint, flag or config key scores at the top of specificity and actionability, so it sorts above a feature described only in prose. Under 60 the notes go thin — everything below the “thinner coverage” line is thinner documentation, not smaller work. Hover any meter for that feature's three sub-scores.
Adds cadence analysis functions deltas, mad, and skewness and periodicity detection functions autocorrelation, periodogram, and dominant_period to TQL, providing research-grade tooling for beacon and anomaly detection and for identifying periodic C2 beacon patterns.
$ from connections | summarize times=collect(ts) by src_ip, dest_ip | extend d=deltas(times) | extend period=dominant_period(autocorrelation(d))
$ from connections | summarize times=collect(ts) by src_ip | extend d=deltas(times) | where mad(d) > 5s or skewness(d) > 2.0
Adds non-top-level JSON column support and automatic JSON column detection to to_clickhouse, including detection after ocsf::cast.
The pipeline list search box now matches on pipeline ID, letting you paste an ID to jump directly to a pipeline.
Telemetry collection is now opt-in, gated behind explicit user consent via the Account page.
Enables automatic NetFlow format detection for simplified ingestion pipelines.
Where each pick stands · Aug 7–13
Tools with changes in each pick's category over the last 12 weeks, including the pick itself.
Each pick's release rhythm · Aug 7–13
Changes per week for the last 12 weeks. The bright bar is this week; a dash marks a week with no daily.
Which categories moved · Aug 7–13
The thick bar is this week. The thin bar is the average of the four weeks before, counting only weeks with a daily.
Who shipped the most · Aug 7–13
Changes per tool this week. Volume is not a quality score.