The week in full · Aug 7–13

Identity & Access Management · 2026-08-13

Auth0 Flexible Password Policy reaches GA, replacing legacy fields with a single options.password_options object for database connections.

• Adds granular composition controls in options.password_options: minimum length, required character types, and blocking of sequential or repeated characters.
• Adds password history enforcement in options.password_options to prevent reuse across a configurable number of previous passwords.
• Adds dictionary blocking in options.password_options using a 10,000- or 100,000-word built-in list plus custom entries.

AI Coding Agents · 2026-08-13

Claude Code v2.1.229 adds plugin command sources, Remote Control session status, SSE keepalives, and VSCode session groups.

• Documents claude remote-control --continue to resume the most recent Remote Control session without specifying a session ID.
• Adds plugin marketplace command sources: a local command (e.g. an IDE) prints the plugin directory, re-resolved each session without a restart; mode: "link" uses it in place.
• Sets CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS=0 to disable the new workflow fan-out staggering that lets same-prefix sibling agents share a cached prompt prefix.

AI Coding Agents · 2026-08-13

Cline CLI v3.0.54 adds directional Hub upgrades with update-and-restart prompts and self-update on Hub mismatch.

• Managed Hub daemons now upgrade directionally: when another Cline install ships a newer Hub build, the CLI attaches to the newer daemon and prompts you to update and restart (via onHubUpdateRestart) instead of the two installs repeatedly retiring each other's daemons; yolo and sandbox sessions are never interrupted by this prompt.
• CLI self-updates automatically after the user accepts the Hub-update dialog, running cline update under the hood and printing instructions to reconnect.

AI Coding Agents · 2026-08-13

Cline SDK v0.0.74 improves Claude Code provider usability, Hub daemon upgrade behavior, and run.started event correlation.

• Managed Hub daemons now upgrade directionally: when a newer Hub build is detected, hosts attach to the newer daemon and prompt to update and restart, instead of two installs repeatedly retiring each other's daemons.
• Token telemetry now reports disjoint per-request buckets — uncached input, cache reads, and cache writes — eliminating ~5x inflation of per-task sums on cache-heavy sessions.
• The Claude Code provider now declares its own native tools, anchors the session on the workspace directory, and loads ~/.claude plus project settings so user-configured permission rules apply; file edits under the workspace are auto-approved while command execution remains gated by Claude settings.

AI Coding Agents · 2026-08-13

Cline desktop v0.0.12 adds per-tool-call transcript rows, Vertex AI Fable 5 support, and a restored Claude Code provider for agentic sessions.

• Vertex AI provider adds Fable 5 and support for custom model IDs, and the global-region picker no longer hides models from the live catalog.
• Compaction now respects the Max Output Tokens setting instead of a hardcoded 1024-token cap, enabling reasoning models to produce summaries instead of skipping compaction.
• Every tool call now gets its own row in the session transcript with its own icon, status indicator, and expandable detail — commands render like a terminal (e.g. $ bun test) with captured output on expand, and edits show diffs inline per hunk.

AI/LLM Security · 2026-08-13

Daytona 0.201.0 adds pre-signed file upload/download URLs, typed SDK error codes, and autoDestroyAt range filtering for sandbox listing.

• Adds autoDestroyAt range filter to the sandbox list API, enabling lifecycle-aware sandbox queries.
• Adds pre-signed sandbox file download and upload URLs for direct, credential-free file transfers to/from sandboxes.
• Adds structured error responses with typed error codes to the SDK, making programmatic error handling against the API practical.

SAST / SCA / Code Security · 2026-08-13

deepsec adds a local model route so machines with an existing claude/codex login skip all credential setup and env-var checks.

• Adds --model-auth local CLI flag (and interactive Use local subscriptions as option 4 in the model-access prompt) to configure a local model route, delegating model auth entirely to the machine-wide claude/codex login — no credential is resolved, injected, or verified.
• Sandbox commands under the local route still require AI_GATEWAY_API_KEY (an ambient key is accepted), preserving the firewall token-brokering requirement.
• Documents --scaffold-only in docs/getting-started.md, including what it writes, what it skips, and how to resume the automated flow later, plus a Using local subscriptions section across models.md, FAQ, CLI help, and the scaffolded workspace README.

Exploitation & C2 · 2026-08-13

Dradis Pro v5.3 adds multiplayer Echo chat, reusable CSV and ServiceNow field mappings, and Gateway PDF exports from projects.

• Adds ServiceNow to the Mappings Manager — define how Dradis fields map to ServiceNow fields (with Liquid templating support) across the Application, Container, and Vulnerability Response modules, so mapped fields populate automatically when creating a Vulnerable Item; configure via Mappings Manager → ServiceNow → New ServiceNow Mapping.
• Adds CSV import support for the Mappings Manager — define column-to-Issue/Evidence field mappings once per Report Template and have them applied automatically on future uploads with the same column headers.
• Adds HTML / PDF Gateway export option directly from a project's Export tab — generates themed HTML output (including the Athena theme optimised for print-to-PDF) without requiring access to the Results Portal.

Exploitation & C2 · 2026-08-13

Dradis Pro v5.3 adds multiplayer Echo chat, reusable CSV and ServiceNow field mappings, and Gateway PDF exports from projects.

• Adds multiplayer Echo chat on Issues: start a conversation from a saved prompt, send follow-up messages, and watch Roslin's reply stream live to every teammate viewing the same Issue simultaneously.
• Integrates CSV imports with the Mappings Manager so column-to-field mappings are saved per Report Template and applied automatically on future uploads with matching headers.
• Integrates ServiceNow with the Mappings Manager — define Dradis-to-ServiceNow field mappings once (across Application, Container, and Vulnerability Response modules) with Liquid templating support, and they are populated automatically when creating Vulnerable Items.

Exploitation & C2 · 2026-08-13

Dradis Pro v5.3 adds multiplayer Echo chat, reusable CSV/ServiceNow field mappings, and Gateway HTML/PDF export from projects.

• Adds ServiceNow to the Mappings Manager — define Dradis-to-ServiceNow field mappings once (including Liquid expressions) and have them auto-populate across the Application, Container, and Vulnerability Response modules whenever a Vulnerable Item is created; configure via Mappings Manager → ServiceNow → New ServiceNow Mapping.
• Adds Mappings Manager support for CSV imports — map CSV columns to Issue and Evidence fields once per Report Template, and Dradis automatically re-applies the saved mapping on future uploads with matching column headers.
• Adds Gateway HTML/PDF export directly from the project Export tab — select HTML / PDF, choose a Gateway theme (Athena recommended for print-ready PDFs), and generate themed output without going through the Results Portal.

Exploitation & C2 · 2026-08-13

Dradis Pro v5.3 adds multiplayer Echo chat, reusable CSV/ServiceNow field mappings, and Gateway HTML/PDF export from projects.

• Adds multiplayer Echo chat sessions on Issues via the Echo tab: start a conversation from a saved prompt, send follow-up messages, and watch Roslin's reply stream live to all project viewers in real time.
• Adds CSV imports to the Mappings Manager so column-to-field mappings are saved per Report Template and applied automatically on future uploads with the same headers.
• Adds ServiceNow to the Mappings Manager — configure once under Mappings Manager → ServiceNow → New ServiceNow Mapping, covering the Application, Container, and Vulnerability Response modules, with Liquid support for field content.

Exploitation & C2 · 2026-08-13

Dradis Pro v5.3 adds multiplayer Echo chat, reusable CSV/ServiceNow field mappings, and Gateway HTML/PDF exports from projects.

• Adds Mappings Manager support for CSV imports — define column-to-field mappings once and have them applied automatically on future uploads when the same column headers are detected for a project associated with a Report Template.
• Adds Mappings Manager support for ServiceNow — map Dradis fields to ServiceNow fields (supporting Application, Container, and Vulnerability Response modules) with Liquid templating, auto-populating fields when a Vulnerable Item is created; configure via Mappings Manager → ServiceNow → New ServiceNow Mapping.
• Adds VSTS Work Item attachment support.

Exploitation & C2 · 2026-08-13

Dradis Pro v5.3 adds multiplayer Echo chat, reusable CSV/ServiceNow field mappings, and Gateway HTML/PDF exports from projects.

• Adds Mappings Manager support for CSV imports so column-to-field mappings are saved per Report Template and applied automatically on subsequent uploads with matching headers.
• Adds Mappings Manager support for ServiceNow under Mappings Manager → ServiceNow → New ServiceNow Mapping, covering the Application, Container, and Vulnerability Response modules with Liquid templating support for field values.
• Adds Gateway-themed HTML and PDF export directly from the project Export tab (HTML / PDF), alongside existing Word, Excel, and CSV options — no longer requiring the Results Portal.

Exploitation & C2 · 2026-08-13

Dradis Pro v5.3 adds multiplayer Echo chat, reusable CSV/ServiceNow field mappings, and Gateway HTML/PDF exports from projects.

• Adds ServiceNow to the Mappings Manager — define how Dradis fields map to ServiceNow fields once (via Mappings Manager → ServiceNow → New ServiceNow Mapping) and have them auto-populated on every Vulnerable Item creation; supports Liquid templating in mapped values across the Application, Container, and Vulnerability Response modules.
• Integrates CSV imports with the Mappings Manager so column-to-field mappings are saved per Report Template and applied automatically on future uploads with matching column headers.
• Adds Gateway HTML/PDF export directly from the project Export tab (Export → HTML / PDF → choose Gateway theme), including the print-optimised Athena theme, without requiring the Results Portal.

SIEM · 2026-08-13

Elastic Security Labs publishes a 280-line bash hook collector that ships every Cursor AI agent tool call to Elasticsearch as structured JSONL via Elastic Agent filestream.

• Adds a 280-line dependency-free bash hook collector script (log-tool-calls.sh) available in the elastic/elasticsearch-labs repository, plus a PowerShell port for Windows, that records every Cursor AI agent tool call as JSONL to a date-rotated log file readable only by the owner (chmod 0600).
• Promotes top-level structured fields (hook_event_name, tool_name, command, file_path, mcp_server, model, session_id, duration, duration_ms) plus an ECS-conformant event object (event.category, event.type, event.outcome) in every log entry for correlation with existing Elastic security indices.
• Tags each event with a detected agent and ide surface (cursor, cursor-cli, or remote) by inspecting inherited environment variables (CURSOR_VERSION, CURSOR_CODE_REMOTE, VSCODE_PID, VSCODE_CWD, VSCODE_IPC_HOOK) so IDE and CLI sessions are distinguishable in a single log stream.

SIEM · 2026-08-13

Google SecOps adds Cloud Logging-based feed diagnostics and an upgraded rich-text editor across SOAR surfaces

• New public preview: monitor, debug, and troubleshoot Google SecOps ingestion pipelines and feeds using Cloud Logging — requires a Bring Your Own Project (BYOP) Google Cloud project configuration.
• New Debug with logs option on the Feed management page opens Logs Explorer pre-filtered for a specific feed, enabling fast per-feed diagnosis.
• Supports configuring exclusion filters in the Log Router to exclude specific logs (e.g. Storage Transfer Service logs) from being routed to Cloud Logging.

SIEM · 2026-08-13

Google SecOps gains Cloud Logging integration for feed pipeline visibility, debugging, and telemetry investigation via Gemini.

• Adds Cloud Logging integration (public preview, requires BYOP Google Cloud project) to monitor, debug, and troubleshoot SIEM ingestion pipelines and feeds via Logs Explorer, supporting both push- and pull-based ingestion mechanisms.
• Adds Debug with logs option on the Feed management page that opens Logs Explorer pre-filtered for a specific feed.
• Enables Gemini Cloud Assist to investigate logging and metrics telemetry directly from the Google SecOps console.

AI Coding Agents · 2026-08-13

Kiro adds voice dictation with on-device Whisper transcription, spec review screen, and nested AGENTS.md steering.

• Adds /voice command (also triggerable via Ctrl+O or holding Space) for on-device speech-to-text prompt dictation using Whisper, with no audio leaving the machine and no cloud API key required; --continuous flag enables hands-free back-and-forth mode that auto-starts a new recording each turn.
• Adds Ctrl+X shortcut at spec phase checkpoints to open a spec review screen where you can read phase documents and stage line comments, which are batched into a single revision request when the checkpoint question is answered.
• AGENTS.md files now load as steering context from anywhere in the workspace tree, not just the workspace root or ~/.kiro/steering/, enabling co-location of steering instructions with the code they describe.

SAST / SCA / Code Security · 2026-08-13

npq v3.26.0 expands coding-agent detection signals to better identify AI-assisted install environments.

• Expands coding-agent detection signals to more accurately identify when npq is running inside an AI coding agent environment.

General Utilities & Libraries · 2026-08-13

Obsidian 1.13.5–1.13.7 adds swipe-to-close tabs, improved undo-close behavior, richer startup stats, a new API property, and a revamped image editing experience in Live Preview.

• Adds SettingDefinitionBase#disabled to the plugin API, letting plugin authors programmatically disable individual settings controls.
• New Live Preview image editing experience: images can now be selected via keyboard, no longer auto-expand to show filenames, and Backspace/Delete remove the embedded image when selected.
• Mobile toolbar settings page now shows icons next to each command.

AI Coding Agents · 2026-08-13

Codex CLI alpha.12 routes network access through the approval pipeline, adds interrupted turn recovery, and hardens inline visualization sandbox isolation.

• Adds RecoverTurnRequest and CodexThread::recover_turn_if_idle to resume an interrupted regular turn with its existing turn ID and updated thread settings, including Plan-mode recovery without injecting an empty user message.
• Routes blocked network requests through the shared approval pipeline so permission hooks, automatic review, and user review all use the common approval flow — including for background terminals started by an earlier turn.
• Materializes inline visualization viewer documents in a dedicated cache under CODEX_HOME, keyed by source and artifact thread IDs, instead of alongside visualization artifacts, preventing sandboxed sessions from modifying viewer documents before they open in a browser.

AI Coding Agents · 2026-08-13

OpenCode adds Grok 4.6, Hy3 Free, and Nemotron 3.5 Lightning Free models.

• Adds grok-4.6 model (Grok 4.6) with support for context windows up to 200K tokens and above 200K tokens.
• Adds hy3-free model (Hy3 Free) as a limited-time free offering on OpenCode.
• Adds nemotron-3.5-lightning-free model (Nemotron 3.5 Lightning Free) as a limited-time free NVIDIA endpoint on OpenCode.

AI Coding Agents · 2026-08-13

OpenHands SDK launches with modular AI agent framework supporting bash, file editing, web browsing, and LiteLLM-compatible LLM backends

• Introduces openhands-sdk and openhands-tools PyPI packages (must be installed together at matching versions, e.g. pip install "openhands-sdk==1.22.1" "openhands-tools==1.22.1") for building AI agents that execute bash commands, edit files, and browse the web.
• Optional openhands-workspace and openhands-agent-server packages add sandboxed workspaces in Docker or remote servers.
• Adds LLM class accepting model, api_key, and base_url constructor arguments, supporting any LiteLLM-compatible provider via the LLM_MODEL, LLM_API_KEY, and LLM_BASE_URL environment variables.

AI Coding Agents · 2026-08-13

OpenHands adds Agent Canvas with ACP support, Sandbox Server REST API v1, local LLM integrations, and org-level spend budgets.

• New Agent Canvas component connects to execution, automation, and sandbox services, with documented architecture for understanding how the pieces fit together.
• Supports running Claude Code, Codex, or Gemini CLI inside Agent Canvas via the Agent Client Protocol (ACP).
• New Sandbox Server REST API (V1) exposes REST endpoints for conversations and sandboxes.

AI Coding Agents · 2026-08-13

OpenHands v1.13.0 adds conversation archiving, inline markdown artifact previews, a context window usage meter with manual compaction, and an issue readiness gate.

• Adds client-side conversation archive, letting users archive and manage past conversations directly in the UI.
• Adds inline markdown artifact previews in the chat panel, rendering markdown output without leaving the conversation.
• Adds a context window usage meter, usage drawer, and manual compaction control so users can monitor and manage LLM context consumption mid-session.

Firewalls & Network Defense · 2026-08-13

Unit 42 Frontier AI Exposure Analysis gains GPT-5.6 Daybreak for automated attack-path discovery and exploitability validation.

• Expands Unit 42 Frontier AI Exposure Analysis to deploy GPT-5.6 Daybreak — previously unavailable for commercial use — directly in customer environments to find exposures, test exploitability, validate attack paths, and prioritize remediation.
• Adds Action Center to Device Security, enabling automated response actions against IoT/OT devices.
• Adds integration between Device Security and IGEL UMS for unified endpoint and device security management.

CNAPP · 2026-08-13

Prisma AIRS Runtime API integrates natively with OpenAI Codex Enterprise to scan all developer prompts org-wide in real time.

• Adds native integration between the Prisma AIRS Runtime API and OpenAI Codex Enterprise, routing all user prompts across an organization through real-time inspection by configuring the Prisma AIRS API key and endpoint inside the Codex Global Admin Console.
• Extends Enterprise DLP controls to OpenAI Codex, scanning developer inputs — including logs, config snippets, and code functions — for proprietary data and credentials before they reach the AI model.
• Adds AI Discovery capability via Cortex AISPM, surfaced as a new documentation area alongside the Codex integration.

Cloud Security Posture · 2026-08-13

Prowler adds a developer integration framework with a Jira Cloud integration class for sending findings as issues.

• New Jira integration class (in prowler/lib/outputs) exposes send_findings(findings, project_key, issue_type), test_connection(redirect_uri, client_id, client_secret, raise_on_exception), get_projects(), get_available_issue_types(project_key), get_access_token(), refresh_access_token(), auth_code_url(), and input_authorization_code() for pushing Prowler findings into Jira Cloud as issues via the Atlassian REST API.
• Adds an integration authflow using AUTH_URL (https://auth.atlassian.com/authorize), TOKEN_URL (https://auth.atlassian.com/oauth/token), and API_TOKEN_URL (https://api.atlassian.com/oauth/token/accessible-resources) with OAuth 2.0 scopes read:jira-user, read:jira-work, and write:jira-work.
• Publishes a developer guide for building custom integrations targeting messaging platforms (e.g. Slack), project management tools (e.g. Jira), and cloud services (e.g. AWS Security Hub) using the prowler/lib/outputs folder as the reference implementation location.

Cloud Security Posture · 2026-08-13

Prowler adds Compliance Watchlist, multi-domain SAML SSO, 20 new AWS privilege-escalation Attack Paths, and per-architecture SBOMs.

• Adds iam_policy_allows_privilege_escalation check with 22 additional escalation combinations, plus 20 new AWS privilege-escalation Attack Paths queries covering iam:PassRole paths across AWS Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, Systems Manager, and Step Functions — also covering existing-resource abuse, permissions-boundary removal, role assumption, and IAM Identity Center permission-set policy injection.
• Attack Paths query catalog now exposes each AWS query's outcome category, distinguishing code execution, privilege escalation, public exposure, and resource inventory.
• New Compliance Watchlist lets organizations pin frameworks from any compliance view, manage them through a searchable catalog, and filter the Compliance section to show only pinned frameworks — Overview page reports the latest score for every pinned framework.

Cloud Security Posture · 2026-08-13

Prowler adds a guided wizard to discover and onboard Azure subscriptions via Management Groups.

• Adds a guided wizard to discover Azure subscriptions within Management Groups and selectively onboard them through a single workflow.

Cloud Security Posture · 2026-08-13

Prowler 5.39.0 adds CMMC 2.0, Azure Management Group onboarding, 20+ M365 checks, and two new AWS hardcoded-secret detections.

• Adds batch_job_definition_no_secrets check for AWS, scanning Batch job definition environment variables and command parameters for hardcoded secrets.
• Adds awslambda_layer_no_secrets_in_content check for AWS, scanning Lambda layer package content for hardcoded secrets.
• Adds GET /api/v1/users/me membership relationships now identify the active tenant with meta.active for both JWT and API key authentication.

AI/LLM Security · 2026-08-13

SkillSpector v2.9.4 adds whitespace-padding prompt-injection detection, Python bytecode supply-chain finding (SC8), and hardens HTTP MCP transport against local-path abuse.

• Adds detection for whitespace-padding techniques used to hide prompt-injection instructions in skill content.
• Adds a HIGH-severity SC8 finding when a skill ships Python bytecode or __pycache__ content, expanding supply-chain coverage.
• HTTP MCP transport (skillspector mcp with http transport) now rejects local filesystem scan targets and local YARA-rule directories, enforcing a security boundary between remote callers and scanner-host paths; stdio transport retains full local-scan capability.

Secure Access (VPN / SASE / ZTNA) · 2026-08-13

Zscaler launches Zero Trust Gateway for Google Cloud via native Network Security Integration, deployable in under 10 minutes.

• Introduces Zscaler Zero Trust Gateway (ZTGW) for Google Cloud, integrating with Google Cloud's Network Security Integration (NSI) to transparently steer workload traffic to Zscaler for deep inspection without application changes, manual tunnels, or route table modifications.
• Supports Single VPC, Multiple VPC, and Shared VPC Google Cloud topologies, fitting into existing GCP network architectures.
• Uses Google Cloud Security Profiles and Profile Groups to control traffic steering to Zscaler, enabling policy-driven enforcement within GCP traffic flows.

Data Security & DLP · 2026-08-13

Zscaler Zero Trust Gateway for Google Cloud brings inline DLP and context-aware policy driven by Google Cloud resource labels and network tags.

• Supports Google Cloud resource labels and network tags as policy metadata, enabling context-aware DLP enforcement scoped to specific workloads (e.g., stricter rules for Production vs. Development environments) tied to your Google Cloud hierarchy.
• Adds inline Data Loss Prevention (DLP) to inspect and block sensitive data in transit across Google Cloud workloads.

Secure Access (VPN / SASE / ZTNA) · 2026-08-13

Zscaler Zero Trust Gateway for Google Cloud adds multi-cloud policy, SSL/TLS inspection, sandboxing, and AI dev tool protection.

• Adds Advanced Threat Protection with inline SSL inspection targeting malware and ransomware in cloud traffic.
• Enables secure access controls for AI development tools such as Devin and Cursor without blocking developer workflows.
• Consolidates virtual firewall infrastructure across multi-cloud environments under a single policy framework to reduce sprawl.

Cloud Security Posture · 2026-08-12

Aikido #53 adds agentic PR deep review, Android pentesting, custom AI-built reports, and free monthly credits.

• New Deep Review feature performs agentic PR analysis that goes beyond the diff, examining surrounding code and linked repositories to catch business logic mistakes and cross-service security issues.
• Aikido Pentest now covers native and hybrid Android apps, including those with biometric login.
• New Custom Reports capability lets users describe a report in plain language; Aikido Agent builds it from findings and makes it shareable across the workspace.

Cloud Security Posture · 2026-08-12

Aikido adds code-based DSPM: Data Exposure Audit maps sensitive data flows through source code without connecting production data stores.

• New Data Exposure Audit feature performs code-based DSPM by using LLM agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, application logic) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — no production data store connection required.
• Detects credentials in URLs, API over-exposure (endpoints returning excess fields, missing tenant ownership checks), unsafe logging of unredacted PII and secrets, over-broad third-party and AI data sharing, weak storage (unencrypted regulated data, base64/MD5/SHA-1 misused as encryption), and incomplete deletion flows leaving downstream records and caches intact.
• Runs against already-connected repositories with no new data source to onboard; each Data Exposure Audit consumes credits from the Aikido Wallet.

Endpoint Security (EDR/XDR) · 2026-08-12

Automox adds Pending Application Restart status to Device Details Software Table for Chrome, Edge, and OBS Studio on Windows.

• Adds a new Pending Application Restart status in the Device Details > Software Table Status column for Windows devices where a package was installed but the application has not yet restarted to finalize the update — currently supported for Google Chrome, Microsoft Edge, and OBS Studio.

General Utilities & Libraries · 2026-08-12

bpf-linker v0.11.0 adds BPF CPU v4 support, negative CPU feature flags, and upgrades to LLVM 23.

• Adds v4 as a valid value for --cpu to target BPF CPU v4 processors.
• Extends --cpu-features to accept disabled features using the -feature prefix (e.g., --cpu-features=-dwarfris), in addition to the existing +feature enable syntax.
• Updates the underlying LLVM backend to LLVM 23.

Secure Access (VPN / SASE / ZTNA) · 2026-08-12

Duo Desktop now routes passkey authentication in thick-client embedded browsers to the system default browser to complete the flow.

• Device registration now enables platform and roaming authenticator (passkey) authentication in thick-client applications that use an embedded browser, with Duo Desktop transferring the authentication to the system default browser to complete it.

Secure Access (VPN / SASE / ZTNA) · 2026-08-12

Duo Desktop now transfers passkey authentication to the system browser for thick-client apps using embedded browsers.

• Device registration enables platform and roaming authenticator (passkey) authentication in thick-client applications that use an embedded browser, with Duo Desktop transferring the authentication flow to the system default browser.

AI Coding Agents · 2026-08-12

Claude Code v2.1.228 hardens synced skills, improves cross-session messaging display, and lets newer models overwrite unread files.

• Hardens skills synced from claude.ai: they no longer shadow local commands or MCP prompts, descriptions are sanitized and labeled, and skill bodies cannot run ! commands or expand @ files on your machine.
• Changes the Write tool so newer models can overwrite an existing file they have not read in the current session, matching the Edit tool's rules; older models still require a prior read.
• Improves cross-session messages: sender and body now display inline instead of as a collapsed line, and messages to Remote Control sessions on other machines show your Remote Control session name as the sender.

AI Coding Agents · 2026-08-12

Cline CLI v3.0.53 adds claude-fable-5 to Vertex and fixes custom Vertex model ID routing.

• Adds claude-fable-5 (Fable 5) to the Vertex model catalog; cost displays as unknown rather than wrong because Vertex bills region-dependently.
• Custom Vertex model IDs are now passed through unchanged, routing Claude-style IDs to the Anthropic-on-Vertex path.

AI Coding Agents · 2026-08-12

Cline SDK v0.0.73 adds claude-fable-5 to the Vertex model catalog and passes custom Vertex model IDs through unchanged.

• Adds claude-fable-5 (Fable 5) to the Vertex model catalog; cost displays as unknown rather than a wrong fixed price because Vertex billing is region-dependent.
• Custom Vertex model IDs are now passed through unchanged, routing Claude-style IDs to the Anthropic-on-Vertex path automatically.
• The summarizer now honors an explicit max-output-tokens setting (defaulting to 4096, lowered when the model reports less capacity) instead of hardcoding a 1024-token cap, enabling compaction to work correctly on reasoning models.

Internet Services · 2026-08-12

Cloudflare adds custom email content blocking rules, GA hostname routing with new IP range, and Sandbox SDK 1.0 preview

• New Blocked content area under Policies & rules in Cloudflare Email Security lets admins define plaintext or regular expression rules to block messages by subject, body, or subject and body; matching messages receive a malicious disposition and are blocked from inboxes. Available on Enterprise and Enterprise + PhishGuard plans.
• Built-in regular expression checker in the Blocked content UI lets you validate patterns against sample text before saving to reduce false positives.
• Hostname routing is now generally available in Cloudflare One, enabling traffic routing by private hostname (e.g. wiki.internal.local) or public hostname (e.g. bank.example.com) across Cloudflare Tunnel connectors and Mesh nodes without managing static IP lists.

Internet Services · 2026-08-12

Cloudflare adds email content blocking rules, hostname routing GA, and WAF managed ruleset update.

• Adds blocked content rules for Email Security that block emails based on subject or body content using plaintext or regular expression matching.
• Releases Cloudflare WAF managed rulesets update (2026-08-11).

Internet Services · 2026-08-12

Cloudflare adds email content blocking rules, hostname routing GA, and WAF managed ruleset update.

• Adds blocked content rules in Email Security to block emails by subject or body content using plaintext or regular expression matching.
• Releases updated Cloudflare WAF managed rulesets (2026-08-11).

Internet Services · 2026-08-12

Cloudflare Status page rebuilt with independent notifications, Markdown API, and separate incident/maintenance feeds

• New notification system on www.cloudflarestatus.com delivers alerts independently of Cloudflare infrastructure via email, webhook, Slack, Discord, or Google Chat — fires even when Cloudflare itself is down.
• Every page on www.cloudflarestatus.com returns Markdown when requested with Accept: text/markdown, enabling AI agents to read current status without parsing HTML.
• Separate RSS and Atom feeds for incidents and maintenance: https://www.cloudflarestatus.com/api/v3/incidents.rss, https://www.cloudflarestatus.com/api/v3/incidents.atom, https://www.cloudflarestatus.com/api/v3/maintenance.rss, and https://www.cloudflarestatus.com/api/v3/maintenance.atom — subscribe to one without the other.

SAST / SCA / Code Security · 2026-08-12

Cloudsmith policy management (policy-as-code for software supply chain enforcement) is now generally available.

• Promotes policy management — Cloudsmith's policy-as-code system for enforcing rules across the software supply chain — to general availability across the web app, API, and Terraform provider.

SAST / SCA / Code Security · 2026-08-12

Cloudsmith continuous risk detection is now GA, replacing Trivy with OSV.dev as the vulnerability data source across the web app and API.

• Enables continuous, automatic vulnerability and malicious-package checking for every package in a workspace — no scheduled or manual rescans required.
• Replaces Trivy with OSV.dev as the data source powering vulnerability results in the web app and API, unifying it with the source that has driven policy evaluation since early access.

SAST / SCA / Code Security · 2026-08-12

Cloudsmith's policy editor now surfaces Rego errors inline as you type, before saving.

• Policy editor highlights Rego syntax and logic errors inline and in a dedicated error panel as you write, catching mistakes before saving.
• Autocomplete in the policy editor now suggests schema fields as you type.

General Utilities & Libraries · 2026-08-12

VS Code adds full MCP server support: gallery install, mcp.json config, CLI provisioning, sandboxing, and dev container integration.

• Adds MCP server gallery browsable via @mcp in the Extensions view, with Install for user profile or Install in Workspace to write to .vscode/mcp.json.
• Adds .vscode/mcp.json (workspace) and user-profile mcp.json (opened via MCP: Open User Configuration) for manually configuring stdio and HTTP MCP servers under a servers key.
• Adds --add-mcp CLI flag to provision MCP servers into the user profile from the command line, accepting a JSON server config as {"name":"server-name","command":...}.

General Utilities & Libraries · 2026-08-12

VS Code adds a Language Models editor with BYOK support, model pinning, thinking-effort controls, and a Custom Endpoint provider for self-hosted APIs.

• New Chat: Manage Language Models command and gear-icon entry point opens a Language Models editor where you can view, filter, and manage all available models.
• Model search and filtering in the Language Models editor supports text search plus @provider:, @capability: (values: tools, vision, agent), and @visible:true/false filter syntax.
• New chatLanguageModels.json config file stores built-in-provider and custom-endpoint model configuration (API key, endpoint URL, apiType, toolCalling, vision, maxInputTokens, maxOutputTokens, etc.).

General Utilities & Libraries · 2026-08-12

VS Code gains custom agents via .agent.md files with handoffs, subagents, hooks, and per-agent tool/model control

• Adds custom agents defined in .agent.md Markdown files, stored in .github/agents (workspace), .claude/agents (Claude format), or ~/.copilot/agents (user profile) to give chat personas their own instructions, tools, and model selections.
• Introduces handoffs frontmatter field in .agent.md to define handoff buttons that transition between agents after a response, with handoffs.label, handoffs.agent, handoffs.prompt, handoffs.send (auto-submit, default false), and handoffs.model (e.g. GPT-5 (copilot) or Claude Sonnet 4.5 (copilot)) subfields.
• Adds tools frontmatter field to restrict which tools (built-in, MCP, extension-contributed, or tool sets) are available per agent; use <server name>/* to include all tools from an MCP server.

General Utilities & Libraries · 2026-08-12

VS Code gains Agent Skills: portable, on-demand capability bundles for GitHub Copilot loaded via SKILL.md files

• Adds Agent Skills support, letting practitioners define reusable capability bundles in SKILL.md files that GitHub Copilot loads on-demand across VS Code, Copilot CLI, and the Copilot cloud agent.
• Supports project skills stored in .github/skills/, .claude/skills/, or .agents/skills/, and personal skills in ~/.copilot/skills/, ~/.claude/skills/, or ~/.agents/skills/.
• Adds chat.agentSkillsLocations setting to configure additional project skill directories beyond the defaults.

General Utilities & Libraries · 2026-08-12

VS Code adds structured custom instructions via .github/copilot-instructions.md, AGENTS.md, CLAUDE.md, and *.instructions.md files to shape AI chat responses.

• Adds .github/copilot-instructions.md as a workspace-wide always-on instruction file automatically applied to all chat requests.
• Adds AGENTS.md file support for always-on instructions, useful when working with multiple AI agents; can be placed in the workspace root or subfolders (experimental subfolder scoping).
• Adds CLAUDE.md file support for compatibility with Claude Code and other Claude-based tools, stored in the workspace root, .claude folder, or user home directory.

General Utilities & Libraries · 2026-08-12

VS Code gains an Agent Customizations editor, monorepo discovery setting, and a preview evaluation extension for AI customization files.

• Adds the Agent Customizations editor — a central UI with per-type tabs, syntax highlighting, and validation — opened via Chat: Open Customizations from the Command Palette or the Customizations panel in the left sidebar.
• Adds Chat: New <customization-type> Command Palette command to scaffold a new customization file at the correct location for the selected type.
• Adds the chat.useCustomizationsInParentRepositories setting (disabled by default) to make VS Code walk up the folder hierarchy to the nearest .git root and discover customizations — including copilot-instructions.md, AGENTS.md, CLAUDE.md, *.instructions.md, *.prompt.md, *.agent.md, and hooks — enabling monorepo setups where only a subfolder is opened.

General Utilities & Libraries · 2026-08-12

VS Code Copilot gains searchable session history sync, Chronicle query commands, and per-repo exclusion controls.

• Adds chat.sessionSync.enabled setting (default true) to sync local Copilot agent sessions to your GitHub account across devices; set to false to keep session data local only.
• Adds chat.sessionSync.excludeRepositories setting (default []) accepting exact owner/repo names or glob patterns (e.g. my-org/secret-*) to prevent specific repositories from syncing to the cloud.
• Adds github.copilot.chat.localIndex.enabled setting (default true) as the prerequisite toggle for local session tracking.

General Utilities & Libraries · 2026-08-12

VS Code adds full agent session management: multi-chat tabs, context compaction, side chats, and a cross-project sessions list.

• Adds github.copilot.chat.summarizeAgentConversationHistory.enabled setting (default true) to control automatic context compaction; set to false to disable.
• Adds /compact chat command to manually summarize earlier conversation history, with optional inline instructions (e.g. /compact focus on the database schema decisions).
• Adds /btw <question> chat command to open a side chat that privately inherits current conversation context without polluting the main chat transcript.

General Utilities & Libraries · 2026-08-12

VS Code gains subagent support — delegate subtasks to isolated AI agents with parallel execution, custom agent routing, and model selection.

• Adds the agent/runSubagent tool that the main agent uses to delegate subtasks to isolated subagents; must be enabled for subagent invocation to work.
• Adds chat.subagents.allowInvocationsFromSubagents setting to enable recursive nested subagent spawning (off by default to prevent infinite loops).
• Adds chat.subagents.useRichRendering setting to control whether subagents open in their own editor (default) or display activity inline in the parent chat.

General Utilities & Libraries · 2026-08-12

VS Code agents gain a local memory tool and Copilot Memory integration for persisting context across sessions and workspaces.

• Adds the chat.tools.memory.enabled setting to turn the built-in agent memory tool on or off.
• Adds chat.copilotMemory.enabled (experimental, disabled by default) to back repository memory with GitHub-hosted Copilot Memory instead of local files.
• New memory tool stores agent notes in three scoped local paths: /memories/ (user), /memories/repo/ (repository, workspace-scoped), and /memories/session/ (session, cleared when chat ends).

General Utilities & Libraries · 2026-08-12

VS Code Agents window gains remote agent sessions over SSH and dev tunnels, plus a browser-based client at insiders.vscode.dev/agents

• New Agents window lets you connect to remote machines and start or monitor agent sessions via SSH or dev tunnel, using the Agent Host Protocol (AHP); no extra agent installation required on the remote machine.
• Connect to a remote machine over SSH by selecting the Remote tab in the workspace dropdown, choosing SSH, and entering a user@hostname connection string — the VS Code CLI is installed and started automatically.
• Connect via dev tunnel by selecting Tunnels in the workspace dropdown and choosing an active tunnel, enabling remote agent sessions on machines running a dev tunnel.

General Utilities & Libraries · 2026-08-12

VS Code adds a preview artifacts panel surfacing screenshots, plans, and documents alongside chat, with three configurable extraction rules.

• New chat.artifacts.enabled setting (set to true) enables the preview artifacts panel, which surfaces screenshots, plans, and documents in a collapsible tree alongside the Chat view and Agents window.
• Adds chat.artifacts.rules.byMimeType setting to match tool results by MIME type pattern (e.g. 'image/*'), defaulting to { "image/*": { "groupName": "Screenshots", "onlyShowGroup": true } }.
• Adds chat.artifacts.rules.byFilePath setting to match workspace files by glob pattern (e.g. '**/*plan*.md'), defaulting to { "**/*plan*.md": { "groupName": "Plans" } }.

General Utilities & Libraries · 2026-08-12

VS Code agents docs surface new config keys for checkpoint display, auto-accept delays, sensitive-file approval, and single-file diff toggling.

• Adds chat.checkpoints.showFileChanges setting (set to true) to display a changed-files summary with diff statistics after each completed agent request.
• Adds chat.checkpoints.enabled setting to control whether VS Code creates per-request file snapshots, enabling Restore Checkpoint and Fork Conversation workflows.
• Adds sessions.changes.openSingleFileDiff setting to open a focused single-file diff instead of the default multi-file diff editor when selecting a file in the Changes view.

General Utilities & Libraries · 2026-08-12

VS Code agents get granular approval controls: permission levels, per-tool/URL/terminal policies, sandboxing, and Autopilot mode.

• Adds chat.permissions.default setting to configure the default permission level (Default Approvals, Assisted permissions, or Bypass Approvals) for new agent chat sessions.
• Adds chat.assistedPermissions.enabled setting to expose the Assisted permissions level in the permissions picker, which uses an LLM judge to auto-approve low-risk tool calls and prompt review for others.
• Adds chat.tools.eligibleForAutoApproval setting to control which tools are eligible for auto-approval; set a tool to false to force manual approval every time.

General Utilities & Libraries · 2026-08-12

VS Code adds built-in browser tools for agents, enabling autonomous web app testing and interactive feedback loops without an external MCP server.

• Adds workbench.browser.enableChatTools setting (on by default) to enable built-in browser tools for agents — no external MCP server required.
• Introduces built-in agent browser tool functions: openBrowserPage, navigatePage, readPage, screenshotPage, clickElement, hoverElement, dragElement, typeInPage, handleDialog, and runPlaywrightCode for custom Playwright automation.
• Adds Share with Agent action in the integrated browser toolbar, letting agents access an authenticated or stateful tab's cookies and storage.

General Utilities & Libraries · 2026-08-12

VS Code agents gain browser tools, background terminal commands, and new settings for tool call grouping and terminal control

• Adds chat.agent.thinking.collapsedTools setting (experimental) to control tool call grouping in chat: off keeps tool calls separate, withThinking groups with thinking when available, and always always groups.
• Adds chat.agent.thinkingStyle setting: when set to collapsed, reasoning and grouped tool calls appear in separate collapsible sections.
• Adds chat.tools.terminal.outputLocation setting (experimental) to configure whether terminal command output appears inline in chat or directly in the integrated terminal.

General Utilities & Libraries · 2026-08-12

VS Code agent harnesses doc introduces Local, Copilot, Claude, and Codex session targets with isolation modes, remote control, and slash commands.

• Adds the Session Target control in the Chat view and Agents window for selecting among Local, Copilot, Claude, Codex, and Cloud agent harnesses when starting a new session.
• Introduces git.worktreeIncludeFiles setting to specify Git-ignored files and folders (e.g. .env files, installed dependencies) that VS Code copies into new worktrees.
• Adds chat.assistedPermissions.enabled setting to enable Assisted permissions mode for Copilot folder sessions alongside Default Approvals and Bypass Approvals.

General Utilities & Libraries · 2026-08-12

VS Code gains a dedicated Agents window (Preview) for orchestrating parallel agent sessions across all workspaces from one place.

• Adds the Agents window, a dedicated VS Code window for chat-first, agent-first workflows that manages sessions across all workspaces in parallel — accessible via Chat: Open Agents Window from the Command Palette, the Open in Agents title-bar button, or code --agents from the command line.
• Adds https://insiders.vscode.dev/agents as a browser-accessible entry point for Agents window sessions from any device.
• Adds chat.agentHost.allowSignedOutWhenUsable setting to enable opening the Agents window without GitHub sign-in when Claude is configured with Anthropic credentials (off by default).

General Utilities & Libraries · 2026-08-12

VS Code adds agent sandboxing (preview) with OS-level file system and network isolation for terminal commands, plus new network domain filtering settings.

• Adds agent sandboxing (preview) that uses OS-level isolation to restrict file system and network access for terminal commands run during agent sessions, enforced via Apple Seatbelt on macOS and bubblewrap/socat on Linux/WSL2.
• Adds chat.agent.sandbox.enabled setting (accepts off (default) or on) to enable or disable agent sandboxing on macOS and Linux.
• Adds chat.agent.sandbox.allowNetwork setting to control whether sandboxed terminal commands have unrestricted outbound network access; when off, all outbound connections are blocked unless specific domains are explicitly allowed.

General Utilities & Libraries · 2026-08-12

VS Code introduces a dedicated Agent Host process with AHP protocol, remote execution, shared sessions, and new code agent host CLI command.

• Adds the chat.agentHost.enabled setting to enable the new dedicated Agent Host process, which runs agent sessions independently of editor windows and extension lifecycle.
• Introduces the Agent Host Protocol (AHP), an open JSON-RPC protocol over WebSocket for communication between the Agent Host and clients, with immutable state and pure reducers for synchronized session data.
• Adds code agent host CLI command to start a standalone Agent Host server; supports --tunnel option to expose it through a dev tunnel.

General Utilities & Libraries · 2026-08-12

VS Code agents gain a browser-integrated feedback loop so agents can run, exercise, inspect, and verify web apps autonomously.

• Adds browser tools integration for agents, enabling an agent to run a web app, exercise user flows in an integrated browser, inspect results, fix problems, and verify changes — forming a visual and interactive feedback loop.

Third-Party & Vendor Risk (TPRM) · 2026-08-12

Conveyor extends AI-powered auto-assignment of questionnaire questions to SME groups across all questionnaire types.

• Expands the Assign the suggested group automatically setting in Settings > Workflow Automation > Team Routing to cover all questionnaire types, not just intake questionnaires — unanswered or flagged questions are automatically routed to the matched SME group (e.g. Legal, Product) and that group is notified.
• Automatic SME group assignment now works for questionnaires arriving via Salesforce, Slack, or direct team submission.

Third-Party & Vendor Risk (TPRM) · 2026-08-12

Conveyor adds SharePoint sync so compliance docs in your knowledge base stay current automatically.

• Adds Microsoft SharePoint as a knowledge base integration, syncing documents and folders into Conveyor the same way Google Drive already does — including automatic ingestion of new files and nested subfolders for folder-level syncs.
• ConveyorAI answers draw from the live SharePoint version of a policy document rather than a stale exported copy, keeping compliance responses current without manual re-uploads.

Third-Party & Vendor Risk (TPRM) · 2026-08-12

Conveyor portals now auto-export answers back to the portal when auto-complete rules pass — no manual Export click needed.

• Portal questionnaires that pass auto-complete criteria now automatically export answers back into the portal, eliminating the manual Export step — enabled via Check auto-complete rules under Post answering in Settings > Sales Self-Serve > Automation Rules.

Detection Engineering · 2026-08-12

Cotool v0.63.0 adds Barracuda, OX Security, and Supabase integrations plus Slack emoji-reaction agent triggers.

• Adds a Barracuda email security integration for investigating and remediating email threats.
• Adds an OX Security integration to search applications, artifacts, and SBOMs and investigate issues and attack paths.
• Adds a Supabase integration for organization and project security posture, configuration review, and project logs.

AI Agent Frameworks · 2026-08-12

CrewAI 1.15.15 adds flow outcome, duration, and human-in-the-loop signal reporting to flow telemetry.

• Reports flow outcome, duration, and human-in-the-loop signals as part of flow telemetry.

Security Data Pipeline · 2026-08-12

Cribl adds Grok to its LLM observability integrations via OpenTelemetry

• Supports instrumenting Grok with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search for LLM observability.

AI/LLM Security · 2026-08-12

Daytona 0.204.0 adds snapshot ops by name, outbound proxy on sandbox create, and typed git transport errors.

• Adds support for snapshot delete and activate by ID or name across the SDK and CLI.
• Adds sourceSandboxId filter parameter to the snapshot list SDK call.
• Adds outboundProxyUrl parameter to the sandbox create SDK call for outbound proxy configuration.

AI/LLM Security · 2026-08-12

Daytona 0.200.0 enforces TLS verification, tightens config file permissions, and adds configurable Go SDK HTTP timeouts.

• Go SDK HTTP timeout is now configurable, enabling reliable long-running executions that previously timed out.
• Enforces TLS verification in the Ruby Socket.IO client for hardened client security.
• CLI config file is now created with 0600 permissions, restricting access to the owning user only.

Data Security & DLP · 2026-08-12

CertCentral adds Use CN/SANs from CSR option to replace Common name and SANs on certificate request forms

• Adds Use CN/SANs from CSR option on certificate request forms to overwrite existing Common name and SANs fields with values parsed directly from the uploaded CSR, with an Undo option to restore previous values — available on DV, OV, and EV TLS; QWAC and QWAC PSD2; X9 PKI for TLS; and Private TLS request forms.

Firewalls & Network Defense · 2026-08-12

Fastly Terraform Provider 9.6.0 adds a new resource and data source for managing Audit Log Event Mappings.

• Adds fastly_audit_log_event_mapping as a new Terraform resource and data source for managing Audit Log Event Mappings.

Firewalls & Network Defense · 2026-08-12

Fastly Historical Stats and Real-Time Analytics APIs gain two new Private Access Token challenge metrics.

• Adds two new PAT challenge metrics to the Historical Stats API and Real-Time Analytics API: count of issued PAT challenges and count of successful PAT challenges, enabling troubleshooting of Private Access Token flows.

Detection Engineering · 2026-08-12

Fibratus v3.1.0 adds kernel callstack enrichment, smart event filtering with approvers, and 11 new detection rules

• Introduces a kernel thread callstack summary filter field, resolving kernel return addresses to their corresponding driver modules and stitching callstack data to events via timestamps for more reliable callstack-based filtering and detection.
• Adds smart event filtering with approvers, dynamically evaluating and discarding events before they propagate through the full processing pipeline to substantially reduce processing volume while preserving detection-relevant events.
• Adds 11 new detection rules covering lateral movement, defense evasion, credential access, and suspicious DLL-loading techniques — including 'Untrusted DLL loaded from masqueraded Windows directory', Suspicious LSASS process access, 'Potential privilege elevation via arbitrary section creation', 'CldApi DLL loaded by an unusual process', 'BindFlt DLL loaded by an unusual process', Direct disk device access, Suspicious registry symbolic link creation, Activation Context memory section hijacking, Untrusted DLL loaded from unusual directory, Sensitive registry hive dump, and Potential operation evasion via direct syscall.

Secure Access (VPN / SASE / ZTNA) · 2026-08-12

Firezone now publishes an API — 75 endpoints across 21 areas: Clients, Actors, Groups, …

• Clients (7 endpoints) — read, update, delete
• Actors (6 endpoints) — create, read, update, delete
• Groups (6 endpoints) — create, read, update, delete

Endpoint Security (EDR/XDR) · 2026-08-12

Fleet API adds vulnerability details (CVSS scores, descriptions) via query params, and expands wipe support to company-owned Android devices.

• Adds vulnerability description, CVSS score, and other details to host software responses when using Fleet Premium (triggered by query parameter).
• Adds device_mapping=true query parameter support to host listing; noted as expensive — best practice is to pair with per_page=50 to avoid overloading the Fleet server.
• Expands wipe support to company-owned (fully managed) Android hosts in both Fleet Free and Fleet Premium (previously this action was labeled Unenroll).

AI Coding Agents · 2026-08-12

Gemini CLI gains experimental model steering: inject real-time guidance into a running agent via modelSteering in settings.json

• Adds experimental.modelSteering key to settings.json to enable real-time steering hints injected into a running agent's context mid-task (disabled by default).
• Adds Model Steering toggle accessible via the /settings command as an alternative to editing settings.json directly.
• New model steering capability lets practitioners type free-text hints while the agent spinner is active — correcting paths, skipping steps, adding context, or redirecting effort — without stopping and restarting the session.

AI Coding Agents · 2026-08-12

gemini-cli v0.55.1 adds tool registry discovery, an eval coverage report command, and a Cloud Run-based caretaker triage pipeline

• Adds feat(evals) eval coverage report command for measuring evaluation coverage across the codebase.
• Adds tool registry discovery, enabling the CLI to find and enumerate registered tools automatically.
• Introduces a Cloud Run webhook ingestion service for the caretaker agent, enabling automated issue intake from GitHub.

Secrets Detection & Management · 2026-08-12

GitGuardian adds use_only_detectors_with_validators to custom source APIs, filtering scans to only secrets with validity checks.

• Adds use_only_detectors_with_validators field to custom source create and update endpoints — when true, scans of that source retain only secrets whose detector supports validity checks; defaults to false on creation, omit to leave unchanged on update.

AI Coding Agents · 2026-08-12

Goose v1.46.0 adds hooks with PreToolUse denial, 25+ new providers, goose review, major CLI additions, and broad env-var configurability.

• Adds LOCAL_WHISPER_LANGUAGE environment variable to configure language for multilingual local voice transcription.
• Adds GOOSE_MAX_TOOL_RESPONSE_SIZE environment variable to configure the maximum size of tool output returned to the agent.
• Adds MAX_CODE_BLOCK_LINES environment variable to cap the number of lines rendered in code blocks.

Malware Analysis · 2026-08-12

GuardDog v3.2.0 adds Rust crates scanning, npm provenance-disappearance detection, and excludes devDependencies by default in verify.

• Adds guarddog crates scan <package> and guarddog crates verify <Cargo.lock> to scan Rust crates hosted on crates.io using the same YARA + metadata risk engine as other ecosystems.
• Adds a new npm metadata check that flags packages when provenance attestations disappear between releases, detecting a potential supply-chain tampering signal.
• Excludes npm devDependencies by default when running guarddog npm verify, reducing noise in CI pipelines that only care about production dependencies.

Agentic Infrastructure · 2026-08-12

Hugging Face adds per-resource-group feature access controls, enabling fine-grained permission scoping beyond org-wide roles.

• Enables feature access controls scoped to individual resource groups, allowing different permissions per group rather than a single org-wide role setting — e.g. Jobs open to all, Inference Endpoints restricted to admins, blog publishing limited to a specific resource group.

Endpoint Security (EDR/XDR) · 2026-08-12

Huntress adds executive summary reports, a remote access API, and a redesigned ITDR dashboard with rapid triage and login characterization.

• New API endpoint for querying remote access connections — including ConnectWise ScreenConnect hosts — returns agent hostname, relay host, port, and first/last seen timestamps, enabling automated audits and response workflows (see the Remote Access section of the API docs).
• New Rapid Identity Triage panel in the ITDR dashboard lets you enter a user's email to get an immediate overview of all activity over the past 24 hours, with the ability to export a timeline, revoke sessions, or disable the account.
• New Failed Login Characterization view surfaces failed login attempts globally with specific classification by residential proxies, VPNs, and datacenters.

Reverse Engineering · 2026-08-12

ILSpy v11.0 ports to Avalonia for Linux/Mac support and adds ilspycmd flags for agentic decompilation workflows.

• Adds --member flag to ilspycmd for single-member decompilation, reducing token spend in agentic/LLM workflows.
• Adds --dump-table metadata dump mode to ilspycmd.
• Adds fuzzy matching for -t type name resolution in ilspycmd.

Identity & Access Management · 2026-08-12

JumpCloud Agent 2.153.5 adds policy-controlled Self Service App Catalog and macOS menu bar UX improvements.

• Adds administrator control over Self Service App Catalog availability via policy, with the tray app reflecting the policy state for targeted software access.
• macOS menu bar app now simultaneously displays password reset and MDM enrollment actions when both are pending, ensuring users complete all required device setup steps.
• macOS menu bar app now keeps password status constantly visible with a more accessible Reset Password action.

AI Coding Agents · 2026-08-12

Kiro CLI gains cloud sandbox sessions with --cloud, --repo, and --resume-id flags, plus substring matching in the slash command menu.

• Adds --cloud flag to kiro-cli and kiro-cli chat to run sessions in a managed cloud sandbox instead of locally.
• Adds --repo flag (and /repo picker) to attach repositories to a cloud session.
• Adds --resume-id flag to reconnect to a running cloud session from any machine after disconnecting.

AI Coding Agents · 2026-08-12

Kiro adds Cloud Sessions to Agent Focus Mode plus collapsible rail, attention cards, and session navigation.

• Adds Cloud Sessions to Agent Focus Mode (preview): start a cloud-hosted session alongside local ones, pick the repositories it runs against, and keep those repositories visible below the chat using the same agent and model selectors as local sessions.
• Collapse the Agent Focus Mode sessions rail to an icon-only strip to reclaim chat space, with every session still one click away.
• New in-place attention cards surface next to the chat when a session needs input, showing the agent's question and options as buttons without forcing a session switch.

Container & Image Security · 2026-08-12

Kubescape v4.0.12 adds MCP server tools, new scan flags, Terraform scanning, cloud registry adaptors, markdown output, and more.

• Adds DELETE /v1/scan API endpoint to cancel an in-flight scan.
• Adds --api-version flag to the workload scan command to specify the API version of the scanned resource.
• Adds --label-selector flag to filter collected resources during a scan.

Reconnaissance & OSINT · 2026-08-12

Maigret adds -X/--xmind flag to generate legacy XML XMind mindmaps per username

• Adds -X / --xmind flag to generate a legacy XML XMind mindmap (with a manifest for modern readers) as a report output, one file per username.

Reconnaissance & OSINT · 2026-08-12

Maigret adds legacy XML XMind mindmap output format with manifest support for modern readers

• Adds generation of legacy XML XMind mindmaps with a manifest, compatible with modern XMind readers (one report per username).

Reconnaissance & OSINT · 2026-08-12

Maigret v0.6.4 adds QQ/Bilibili search, 32+ new sites, enriched profile extraction, and a live-scan web interface

• Adds QQ account search via the qq_id identifier type, enabling lookup of QQ users alongside usernames.
• Adds per-site encoding configuration to the site database, allowing correct handling of non-ASCII identifiers.
• Adds support for Bilibili account lookup.

SAST / SCA / Code Security · 2026-08-12

Noir adds live endpoint probing with proxy support and export to Elasticsearch, OpenSearch, and webhooks

• Adds --probe-via flag to route probed endpoints through a Burp/ZAP intercepting proxy; requires an explicit port (e.g. http://localhost:8080) — a portless URL is rejected.
• Adds --set-pvalue-path flag to override path placeholder values used during probing (e.g. id=42), applying to all HTTP verbs.
• Adds --export-es URL to POST the full endpoint catalog to an Elasticsearch index as a single document; portless http:// defaults to port 9200, portless https:// defaults to 443.

AI Agent Frameworks · 2026-08-12

OO Agents v0.0.7 adds a NOOA cybergym agent example, viewer ingest resource limits, and secret redaction from telemetry.

• Constrains playground custom-model endpoint and api_key_env to server-declared pairs, preventing clients from supplying arbitrary LLM endpoints.
• Adds resource limits on the viewer ingest path to cap memory and request size for the trace-viewer API.
• Requires an auth token and restricts CORS on the viewer API, narrowing the attack surface of the local trace viewer.

Local LLM Runtimes · 2026-08-12

Ollama API docs add a push-a-blob endpoint.

• New push a blob API operation documented in the Ollama API reference.

Secrets Detection & Management · 2026-08-12

OpenBao Proxy docs added: Auto-Auth, API proxy, caching, telemetry metrics, and full CLI/config reference for v2.6.x

• Adds POST /proxy/v1/quit endpoint to trigger proxy shutdown, enabled per listener via the proxy_api stanza with enable_quit: true.
• Adds -log-level CLI flag (also BAO_LOG_LEVEL env var, log_level config key) with supported values trace, debug, info, warn, error.
• Adds -log-format CLI flag (also BAO_LOG_FORMAT env var, log_format config key) supporting standard and json formats.

Threat Intelligence · 2026-08-12

OpenCTI 7.260811.0 adds mass-operation support for updating relation start/stop times via background tasks.

• Enables bulk updating of relation start_time and stop_time fields via mass background-task operations.

SAST / SCA / Code Security · 2026-08-12

Openlayer adds row-level test result API, project deletion API, MCP custom functions, and metric bundle downloads

• New API endpoint to pull individual rows from specific test results, enabling programmatic drill-down into evaluation data.
• New API endpoint to delete projects, available via the TypeScript SDK.
• MCP integration now supports custom functions callable from Openlayer.

Runtime Security · 2026-08-12

OpenShell v0.0.104 adds Windows compilation support, a credential-leak warning on --env, and a glibc-static supervisor variant.

• Adds a warning when --env values passed to the CLI look like credentials, helping catch accidental secret exposure at the command line.
• Adds Windows compilation support for the gateway and CLI components.
• Adds a glibc-static supervisor libc variant for environments that require static linking.

Identity & Access Management · 2026-08-12

Ory Network gains DNS-TXT record verification for organization SSO email domains.

• Workspace owners can now verify their organization's SSO email domains using a DNS-TXT record, replacing manual verification workflows.

Identity & Access Management · 2026-08-12

PingOne adds early-access support for creating verify policies.

• Introduces early-access capability to create verify policies in PingOne.

Identity & Access Management · 2026-08-12

PingOne adds attribute-to-scope mapping for custom resources, auto-enrollment from Verify to Recognize, and dynamic form outcomes in DaVinci.

• Adds attribute mapping for custom resource scopes, allowing control over which attributes are included in access tokens based on the requested scopes.
• Adds early-access auto-enrollment of a user's verified selfie into PingOne Recognize immediately after a successful PingOne Verify verification.
• Adds a Use Active Theme option in the DaVinci Form connector that applies whichever theme is currently active when a flow runs, enabling centralized theme control from Branding & Themes.

Identity & Access Management · 2026-08-12

PingOne adds attribute mapping for custom resource scopes, auto-enrollment in Recognize, and dynamic Show Form outcomes in DaVinci.

• Adds attribute mapping to scopes defined for custom resources, enabling control over which attributes are included in access tokens based on requested scopes.
• New Use Active Theme option in the Form connector applies whichever theme is currently active when a DaVinci flow runs, replacing the need to hard-code a theme ID.
• Show Form in DaVinci now generates outcomes dynamically based on the selected form configuration, with per-outcome branching directly from the node; prior behavior moves to Show Form (Legacy).

Cloud Security Posture · 2026-08-12

Plexicus v1.2.25 adds multi-account SCM connections and NVD-backed CVSS scoring for findings.

• Supports connecting multiple SCM accounts per provider, enabling flexible repository onboarding across different accounts.
• Upgrades CVSS scoring to use NVD-backed data, improving accuracy of vulnerability severity scores across findings.

Cloud Security Posture · 2026-08-12

Plexicus v1.2.31 expands GitLab onboarding to nested groups and broader access roles.

• GitLab repository connection now supports nested groups during onboarding.
• GitLab onboarding extended to broader access roles, reducing friction for teams with non-admin members.

Cloud Security Posture · 2026-08-12

Plexicus v1.2.36 delivers zero-touch first-boot onboarding, unified BYOAI model naming, and a hardened AI remediation path.

• Frictionless first-boot onboarding now completes end to end with zero manual intervention, covering initial boot, sample-repo scan, and the in-product GitHub App flow.
• Unified canonical naming for BYOAI (Bring Your Own AI) models across the platform for consistent model identification.
• Hardened Codex Remedium AI remediation path for more reliable remediation runs.

Wireless & RF · 2026-08-12

rfcat v3.0.0 adds PySide6 support and Python 3 compatibility, with a working spectrum analyzer button in Py3.

• Extends Python 3 compatibility across the codebase, resolving str/bytes and print-statement issues.

Compliance Automation & Trust Management · 2026-08-12

Scrut Automation adds an in-platform Policy Editor with rich formatting, collaboration, revision history, and offline autosave.

• New in-platform Policy Editor accessible via Compliance → Policies lets users create, edit, and format policy documents without leaving Scrut.
• Toolbar includes Import from Word to upload and edit existing MS Word documents directly in the editor.
• Built-in Find and Replace with advanced options including Match case and Whole words only for searching within policy documents.

Compliance Automation & Trust Management · 2026-08-12

Scrut Automation adds a configurable multilevel Policy Approval Workflow with a toggleable approval gate before policy publishing.

• New Policy Approval Workflow toggle (found under Compliance → Policies → Settings → Configurations) lets admins require one or more approvers to sign off before a policy can be published.
• Supports multilevel approval chains, allowing designated assignees or admins to add multiple approvers (e.g., QA Lead, CTO, CISO) even after a policy is created.
• When approval workflow is disabled, policies can be published by admins without requiring approver sign-off, preserving the prior lightweight flow.

Compliance Automation & Trust Management · 2026-08-12

Scrut adds 21 CFR Part 11, Hexnode MDM sync, flexible CSV/XLSX asset import, OpenProject integration, and Jira attachment sync

• New asset import wizard at Asset Management → Add Asset → Import via CSV/XLSX accepts CSV or Excel files without a predefined template, letting users map columns to Scrut fields on upload.
• Adds 21 CFR Part 11 to the Frameworks module with validation status tracking, control owner assignment, centralized evidence repository, and readiness reporting for life sciences teams.
• New Hexnode MDM integration syncs device inventory into Scrut for audit-ready asset visibility without manual exports.

Compliance Automation & Trust Management · 2026-08-12

Scrut Automation adds a Supabase integration for Access Reviews and automated compliance checks

• New Supabase integration syncs user names, emails, and roles into Scrut's People → Access Reviews module for access review workflows.
• Automated compliance tests for Supabase projects are available under Tests → Automated Tests, continuously checking for security misconfigurations against applicable compliance frameworks.
• Integration is configured by pasting a Supabase Personal Access Token (PAT) into the PAT Token field on the Supabase integration page under Integrations Library.

Compliance Automation & Trust Management · 2026-08-12

Scrut adds Supabase integration for access reviews and email notification configuration for compliance alerts.

• New Supabase integration syncs user access data into Scrut for Access Reviews and runs automated security and compliance tests against applicable frameworks.
• New email notification configuration supports email digests and individual alerts to keep teams informed about compliance tasks, assignments, and deadlines.

Endpoint Security (EDR/XDR) · 2026-08-12

• Sophos ITDR now assigns every identity a Risk Score — a single ML-derived number combining incident likelihood with potential impact — updated dynamically as findings and accounts change.
• DNS Protection adds a Generative AI category, enabling visibility into AI-service usage on the network and policy-level control over generative AI in DNS filtering rules.
• Partner portal now supports explicit selection of add-ons and products when applying bulk license changes to multiple monthly-usage customers simultaneously.

Firewalls & Network Defense · 2026-08-12

• Supports staging firewalls to validate firmware upgrades before rolling them out to the broader firewall fleet.

Firewalls & Network Defense · 2026-08-12

Sophos DNS Protection adds a Generative AI web category for granular AI-site access control in filtering policies.

• Adds the Generative AI category to the Business and generative AI category group, enabling filtering policies to block or allow generative AI websites independently of other categories.
• Supports an allowlist workflow: block the Generative AI category in a filtering policy, then create a domain list of approved AI URLs and allow that domain list in the same policy to permit only sanctioned services.
• Renames the Business-relevant site categories category group to Business and generative AI to reflect the new category.

Detection Engineering · 2026-08-12

Splunk Security Content v6.4.0 adds 27 new analytics spanning Linux privilege escalation, persistence, containers, and Windows endpoint threats.

• Adds Linux Binary Executed from Shared Memory Directory analytic to detect execution from shared-memory paths, a common evasion technique.
• Adds Linux EFI Bootloader File Deletion analytic for detecting bootloader tampering on Linux systems.
• Adds Linux File Creation In System Generator Directory analytic targeting persistence via systemd generator paths.

SAST / SCA / Code Security · 2026-08-12

StepSecurity Self-Hosted Runners page now shows a unified fleet inventory including unmonitored runners, requiring a new GitHub App permission.

• New Self-hosted runners: Read-only organization permission added to the StepSecurity GitHub App enables listing runners registered at the organization level via the GitHub API, not just those reporting from the Harden-Runner agent.
• Admins must approve the pending GitHub App permission request under Organization Settings → GitHub Apps for organization-level runners to appear in the inventory.
• The Self-Hosted Runners page now merges runners discovered from GitHub (org-level and repo-level) with agent-reported runners into a single consolidated inventory, surfacing runners with no Harden-Runner agent installed as Not installed in the Harden Runner column.

Cloud Security Posture · 2026-08-12

KSPM Analyzer v1.49.3 auto-evaluates CIS Kubernetes Benchmark 5.3.1 by detecting CNI plugins on each node.

• Adds automatic detection of Container Network Interface (CNI) plugins in use on each Kubernetes node, enabling CIS Kubernetes Benchmark v2.0.0 recommendation 5.3.1 to be evaluated automatically instead of requiring manual attestation.

AI-Powered Offensive Security · 2026-08-12

T3MP3ST gains LiteLLM gateway, Hugging Face + NanoGPT providers, SOCKS5 proxy, six OSINT adapters, subdomain-takeover detection, and multi-language white-box ingest.

• Adds SOCKS5 egress proxy support plus hardened local-model path, enabling outbound traffic routing through a SOCKS5 proxy.
• Adds LiteLLM as an AI gateway provider, broadening the range of LLM backends T3MP3ST can reach.
• Adds Hugging Face provider and selectable local Claude Code models as new LLM backends.

Secure Access (VPN / SASE / ZTNA) · 2026-08-12

Tailscale operator gains in-cluster PeerRelays via custom resource, Helm annotation support, and IPv6 egress on dual-stack clusters.

• PeerRelays are now deployable in-cluster via a Kubernetes custom resource.
• Per-attempt cert issuance timeout in Kubernetes proxies is increased to 30 minutes, enabling ACME challenges to complete under load.
• MTU values are now clamped on both input and output interfaces (previously only the output interface was clamped).

Secure Access (VPN / SASE / ZTNA) · 2026-08-12

Teleport adds teleport-acl-lifecycle agent skill for managing access list lifecycle via AI-driven workflows.

• Adds teleport-acl-lifecycle skill enabling agents to browse available servers, databases, applications, and Kubernetes clusters, then create, update, or retire access lists that grant users access to those resources.

Endpoint Security (EDR/XDR) · 2026-08-12

Helm Chart 3.5.1 adds visionOne.resourceId field to set cluster resource IDs like AWS ARNs during automated registration.

• Adds visionOne.resourceId field to the Helm chart values to explicitly set the cluster resource ID (e.g., an AWS cluster ARN) during automated registration.

SAST / SCA / Code Security · 2026-08-12

Veracode adds business unit selection for DAST targets and real-time in-app scan notifications.

• Adds business unit selection when creating a web application or API specification target, or on the DAST configuration page.
• Adds real-time in-app notifications when scans complete, fail, or are cancelled.
• Adds improved detection for CAA record checks on SSL certificates for CWE-862 in both Dynamic Analysis and DAST.

Cloud Security Posture · 2026-08-12

Wiz introduces Atlas, an autonomous AI system for vulnerability research that ranked #1 on CyberGym with 90.9% accuracy and found 200+ validated bugs.

• Introduces Atlas, an autonomous multi-agent AI system for AI SAST that maps attack surfaces via a code property graph (CPG), hunts vulnerabilities in parallel with independent agents, validates findings adversarially, and confirms them by dynamically executing a generated exploit in a dedicated execution environment.
• Atlas ranked #1 on CyberGym — the public benchmark for AI-driven vulnerability research — with a 90.9% success rate, and uncovered 200+ previously unknown vulnerabilities in heavily audited open-source projects including grpc, dnsmasq, Kubernetes, gVisor, the Linux kernel, and containerd.
• Each Atlas finding is autonomously validated end-to-end: an adversarial debate stage (one agent argues exploitability, one argues against, a third adjudicates) filters false positives before a dynamic proof-of-concept trigger confirms real security impact.

Identity & Access Management · 2026-08-11

1Password for Android now saves logins when username and password appear on separate screens.

• Offers to save logins when a site presents username and password on separate screens.

Identity & Access Management · 2026-08-11

1Password for Mac adds Claude AI integration for credential-safe website sign-in via 1Password for Claude.

• Adds 1Password for Claude integration, letting Claude sign in to websites on your behalf by filling logins or one-time codes after per-request user approval, without sharing credentials with Claude.
• Item date fields now respect the date format chosen in system settings, or the language set within 1Password when it differs from the system language.
• Adds a clear error message when attempting to move or duplicate an item with a custom icon while file storage is disabled by an admin policy.

Identity & Access Management · 2026-08-11

1Password for Windows 8.12.32 adds Auto-Type confirmation for untrusted apps and app icons in the Type in window menu.

• When using Auto-Type to fill into an unsigned or untrusted app, 1Password now prompts for confirmation instead of silently failing.
• The Type in window window selection menu now displays an app icon next to each open window when filling a username or password into another app.
• Item date fields now adopt the date format configured in system settings, or the language-specific format when a different language is set within 1Password.

Identity & Access Management · 2026-08-11

1Password in the browser adds Claude agentic sign-in, Secret Key paste blocking, and relocated phishing prevention settings.

• Adds 1Password for Claude integration, letting Claude sign in to websites on your behalf by filling logins or one-time codes after per-request approval, without sharing credentials with Claude.
• Adds a setting in Settings > Autofill & save to choose whether 1Password offers to save API credentials for shell plugins.
• Adds Secret Key paste protection: pasting your 1Password Secret Key into any website is now blocked and opens the extension to warn you.

AI/LLM Security · 2026-08-11

Adrian Python SDK v1.1.0 adds Claude Code plugin with HITL verdicts, PII filtering, and Anthropic SDK integration

• Adds Claude Code plugin (integrations/claude-code/adrian_cc/agent.py) that connects Claude Code hooks to the Adrian backend via WebSocket, supporting three server-driven execution modes: MODE_ALERT (fire-and-forget), MODE_BLOCK (wait for verdict, block per policy), and MODE_HITL (wait for human approval on the dashboard).
• Adds PII filtering for the Claude Code plugin (adrian_cc/pii/_patterns.py), detecting 12 PII categories: EMAIL, PHONE, SSN, CREDIT_CARD, IP_ADDRESS, DATE_OF_BIRTH, IBAN, PASSPORT, STREET_ADDRESS, POSTAL_CODE, DRIVER_LICENSE, and AWS_KEY.
• Adds Anthropic SDK integration, enabling Adrian instrumentation for agents built with the Anthropic Python SDK.

Exploitation & C2 · 2026-08-11

ADscan v11.1.0 adds cross-forest escalation chains, interactive SMB enrichment scoping, Tier 0 membership counts, and ADSCAN_TRUST_SCOPE trust-collection control.

• Adds ADSCAN_TRUST_SCOPE environment variable (values: all or origin) to control which domains are collected across forest trusts, overridable per scan via the web scan-setup domain-enumeration policy.
• Surfaces cross-forest Kerberos ticket delegation as an escalation route, drawing the two forests as one blast radius and adding remediation to disable the delegation.
• Extends MSSQL linked-server-chain compromise across forest boundaries, coupling SYSTEM-on-DC to directory replication in the target trusted domain and terminating the attack path there rather than at the controller.

Identity & Access Management · 2026-08-11

Auth0 Custom Prompts now enforce signup fields and consent checkboxes for Social and Enterprise connections, not just database/passwordless.

• Custom signup/login fields and consent checkboxes configured in Universal Login now apply to Social and Enterprise connections, closing the gap where users could bypass those prompts entirely when signing in via a social button or enterprise identity provider.
• No configuration changes required — existing Custom Prompts setups automatically extend to all connection types; review or update via Dashboard under Branding → Universal Login → Enhance screens with partials, or via the Management API.

Web Application Security · 2026-08-11

Bright Security adds EXIF metadata leakage detection, repeater infrastructure widget, per-project authentication management, and project classification.

• New EXIF Metadata Leakage security test uploads canary images with GPS coordinates, device identifiers, timestamps, and comment fields to file upload endpoints, then checks served copies across upload responses, redirects, API responses, rendered HTML, and linked image URLs; reports Medium severity findings under CWE-1230. Covers JPEG and PNG formats and supports multipart and JSON-encoded uploads.
• New Repeater Insights widget on the Organization Dashboard shows connected, active, idle, disconnected, and disabled repeaters alongside running, queued, and scheduled Scan and Discovery tasks across selected projects.
• New Authentications tab on the Project page lets teams view, create, and edit project-scoped authentications — with automatic assignment to the current project on creation — without leaving the project context.

Attack Surface & Exposure Management · 2026-08-11

Censys launches AI Investigations (beta) to autonomously pivot across indicators, cluster related infrastructure, and produce ranked reports

• New AI Investigations feature in the Censys Platform web console autonomously analyzes IP addresses, domain names, host/port pairs, URLs, and pasted intel reports to discover related infrastructure in the Censys Internet Map.
• Accepts historical time context in prompts — single dates, month/quarter/half-year/year ranges, or explicit closed ranges (e.g. '20 January 2025 through 5 February 2025') — to narrow the agent's focus.
• Investigation agent pivots on shared parsed data attributes, interactively prompts the analyst in the chat window when cluster choices arise, then delivers a CenQL query targeting the discovered asset cluster for immediate use in the Platform.

Attack Surface & Exposure Management · 2026-08-11

Censys adds AI Investigations, 64 KB HTTP body search, bulk tag management via cencli tags, and nine new fingerprints.

• Expands HTTP body search depth for host.services.endpoints.http.body and web.endpoints.http.body from 2 KB to the first 64 KB, enabling more targeted Platform queries across host service and IP-based web property endpoints.
• Adds tags commands to the cencli CLI for managing individual and bulk tags in the Censys Platform.
• Introduces AI Investigations (beta, requires Adversary Investigation module access) to automatically analyze indicators, pivot to related infrastructure, check entity history, profile web resources in parallel, and produce a ranked findings report.

Identity & Access Management · 2026-08-11

Clerk Billing gains percentage and fixed-amount discounts plus redeemable promo codes at checkout.

• Adds support for applying percentage or fixed-amount discounts directly to a customer's subscription in Clerk Billing.
• Adds promo codes that customers can redeem at checkout.

AI Coding Agents · 2026-08-11

Cline v4.1.8 adds custom Vertex model IDs, Fable 5 support, full regional catalogs, and consolidates auto-approve into a single control.

• Adds manual entry of any Vertex model ID, including models not yet listed in the catalog.
• Adds support for Fable 5 on Vertex.
• Shows the full Vertex model catalog for every region instead of a hardcoded list of global-endpoint models; unsupported region/model combinations now fail at request time with recovery guidance.

Internet Services · 2026-08-11

Cloudflare launches R2 Data Catalog: a managed Apache Iceberg REST catalog built directly into R2 buckets

• Introduces R2 Data Catalog, a managed Apache Iceberg REST catalog interface built into R2 buckets, enabling Spark, Snowflake, PyIceberg, DuckDB, Trino, and ClickHouse to query R2 as a data warehouse or lakehouse.
• Supports ACID transactions, optimized metadata indexing, and full schema evolution (add, rename, delete columns without rewriting data) via the open Apache Iceberg table format.
• Enables cross-cloud and cross-region analytical workloads — including log analytics, business intelligence, and data pipelines — with no egress fees under R2's zero-egress model.

Internet Services · 2026-08-11

Cloudflare R2 gains a managed Apache Iceberg data catalog, enabling R2 buckets to be queried as a data warehouse or lakehouse.

• New R2 Data Catalog turns any R2 bucket into a managed Apache Iceberg catalog queryable by engines like Spark, Snowflake, and R2 SQL — no separate catalog infrastructure required.

Internet Services · 2026-08-11

Cloudflare Sandbox adds outbound traffic control and Cloudflare Skills for coding agents, plus a @cloudflare/sandbox@next 1.0 preview SDK.

• Supports blocking, allowing, and intercepting outbound HTTP from sandboxes, with the ability to inject authorization headers in outbound handlers to keep credentials inside the Worker.
• Adds Cloudflare Skills for coding agents, with three install targets: sandbox-stable for the current stable package, sandbox-next for @cloudflare/sandbox@next (recommended for new projects), and sandbox-migrate-to-next to port existing apps.
• Introduces @cloudflare/sandbox@next as a 1.0 preview SDK, enabling early adoption of the upcoming Sandbox SDK 1.0 release.

Internet Services · 2026-08-11

Cloudflare Workers AI adds ByteDance Seedance 2.5, a 30-second audio-video generation model with reference control and editing.

• Adds seedance-2.5, ByteDance's audio-video generation model supporting 30-second video creation, extended storytelling, audio and visual editing, white-model control, and green-screen editing.

Internet Services · 2026-08-11

Cloudflare adds Tunnel live log streaming, MySQL in Hyperdrive GA, Turnstile Spin GA, unified AI billing, Mesh Docker/K8s images, and new Radar BGP endpoints.

• Adds wrangler turnstile widget create CLI command to create a Turnstile widget and return the sitekey and secret for manual frontend/siteverify wiring.
• New Live logs tab under Networking > Tunnels > (tunnel detail view) in the Cloudflare dashboard streams real-time logs from single or multiple cloudflared connectors, with filtering by log level, event type (HTTP, TCP, UDP, or cloudflared internal), and HTTP method.
• New /bgp/routes/paths/{asn} Radar BGP API endpoint returns ordered AS path segments an AS uses to reach Tier-1 networks, with collector parameter to scope to a single RouteViews collector.

Internet Services · 2026-08-11

Cloudflare API adds queue message peek/purge endpoints, URL intelligence lookup, and dataset deletion.

• New POST /accounts/{account_id}/queues/{queue_id}/messages/peek endpoint to inspect queued messages without consuming them.
• New GET /accounts/{account_id}/intel/url endpoint to retrieve URL intelligence data for a given URL.
• New endpoint to delete an account or zone dataset.

Internet Services · 2026-08-11

Cloudflare adds real-time Tunnel log streaming, MySQL in Hyperdrive GA, Turnstile Spin GA, unified Workers AI/AI Gateway billing, Mesh Docker support, and Radar upgrades.

• Cloudflare Tunnel detail view in the dashboard now supports real-time log streaming, including multi-connector aggregated streaming with filtering.
• MySQL and MySQL-compatible databases are now generally available in Hyperdrive, enabling connections from Workers.
• Turnstile Spin is now generally available — create a widget from the dashboard, Wrangler, or an AI coding agent, with server-side token verification.

Internet Services · 2026-08-11

Cloudflare adds live Tunnel log streaming, MySQL Hyperdrive GA, unified Workers AI/AI Gateway billing, and Radar Researcher beta

• The Tunnel detail view in the Cloudflare dashboard now supports real-time log streaming, including multi-connector aggregated streaming with filtering.
• MySQL and MySQL-compatible databases are now generally available in Hyperdrive, enabling Workers to connect to MySQL backends.
• Workers AI and AI Gateway unify model access, observability, and prepaid billing across Workers AI and third-party models through shared APIs.

Internet Services · 2026-08-11

Turnstile Spin is GA: create widgets and wire siteverify via dashboard, Wrangler CLI, or AI coding agent.

• Adds wrangler turnstile widget create CLI command to create a Turnstile widget and print the sitekey and secret for manual frontend and siteverify integration.
• New Set up with Spin flow in the Turnstile dashboard lets you enter domains, generate a widget, and receive a sitekey, secret, and agent prompt in one step.
• AI coding agent path supports pasting the Spin prompt into Claude Code, Cursor, Codex, OpenCode, or GitHub Copilot Chat — agent fetches the skill, creates the widget, embeds it, and wires siteverify automatically.

Vulnerability Management · 2026-08-11

Cloudmersive Private Cloud CDR API v2-13-4 adds metadata and tracking pixel removal; DLP AI API gains batch job API overrides; Virus API expands Python model file format support.

• Adds metadata removal and tracking pixel removal options to the Private Cloud CDR API v2-13-4.
• Adds additional batch job API overrides to the Cloud DLP AI API v2-8-0 and Private Cloud DLP AI API v2-8-0.
• Extends Cloud Virus API v11-10-10 to recognize additional Python model file formats.

SAST / SCA / Code Security · 2026-08-11

cve-lite-cli v1.29.0: --usage/--only-used now work in multi-folder scans, cooldown warnings in SARIF, and expanded DM001 maintenance-risk findings

• Extends --usage/--only-used flags to multi-folder scans: each subfolder now gets its own source-usage annotation and filtering, isolated from other subfolders (previously accepted but silently ignored outside single-folder mode).
• Surfaces release-cooldown warnings in SARIF output as properties.cooldownWarning on the result, making them visible in GitHub Code Scanning.
• Expands DM001 maintenance-risk detection (--check-maintenance): deprecated npm packages now produce their own medium-severity finding (separate from constraint-drag findings); severity is graduated — constraint drag is high, deprecation is medium; packages abandoned 2+ years show a Last release context line.

Web Application Security · 2026-08-11

Dalfox config reference adds state_file for resumable scans and documents raw-http, har, exact, and signature input options

• Adds state_file config option to record completed targets and skip them on re-run, enabling resumable XSS scans.
• Documents raw-http and har as supported input sources in the config reference, allowing scans driven by raw HTTP request files or HAR archives.

Web Application Security · 2026-08-11

Dalfox MCP integration gains detailed scan parameters including WAF bypass modes, remote payloads, and blocking scan support

• Adds data field to MCP scan parameters for POST/PUT request bodies, accepting form-urlencoded ("user=admin&pass=test") or JSON strings.
• Adds cookies and user_agent fields to MCP scan parameters for per-scan cookie injection and User-Agent override.
• Adds delay field (default 0, range 0–9999 ms) and follow_redirects field to control request pacing and 3xx handling in MCP scans.

Web Application Security · 2026-08-11

Dalfox server mode gains analyze_external_js and five WAF config fields for DOM XSS coverage and bypass control.

• Adds analyze_external_js config field (default false) to fetch same-origin <script src> bundles at preflight and AST-analyze them for DOM XSS sinks — useful for SPAs where sink logic lives in external bundles.
• Adds waf_bypass config field with modes "auto" (detect then bypass, default), "force" (use force_waf profile), or "off" (detect only) to control WAF handling behavior.
• Adds skip_waf_probe config field (default false) to skip the WAF fingerprinting probe entirely.

Vulnerability Management · 2026-08-11

DefectDojo API gains multi-format report generation endpoints and clearer background-import response documentation.

• Adds POST /api/v2/findings/generate_report/ to generate a findings report across all viewable findings in JSON, HTML, CSV, or Excel format.
• Adds POST /api/v2/products/{id}/generate_report/, POST /api/v2/engagements/{id}/generate_report/, POST /api/v2/tests/{id}/generate_report/, POST /api/v2/product_types/{id}/generate_report/, and POST /api/v2/endpoints/{id}/generate_report/ for scoped, per-object report generation.
• Adds Pro-alias report endpoints POST /api/v2/assets/{id}/generate_report/, POST /api/v2/organizations/{id}/generate_report/, and POST /api/v2/location/{id}/generate_report/.

Vulnerability Management · 2026-08-11

DefectDojo Pro unifies scanner imports and issue-tracker pushes under a single Connectors hub in the UI.

• Introduces the Connectors group in the DefectDojo Pro UI sidebar (under the Import header), merging the formerly separate API Connectors and Integrations pages into a single home for all tool connections.
• Adds Connectors > Upstream Connectors (replacing the old API Connectors entry under Import) for pulling findings and asset inventory in from scanners and cyber tools.
• Adds Connectors > Downstream Connectors (replacing the old Integrations entry under Settings) for pushing findings out to issue trackers and ticketing systems; currently in Beta for Cloud-hosted DefectDojo Pro instances.

Vulnerability Management · 2026-08-11

DefectDojo v3.2 adds visual rules engine, threat-intel GA, multi-CWE findings, new report formats, and 60+ new connectors

• Adds api/v2/findings/generate_report/ endpoint to produce reports as HTML, CSV, and Excel in addition to JSON.
• Adds set-based deduplication matching Findings on their full set of vulnerability IDs and CWEs, including partial/subset matches, plus a new global_locations cross-product deduplication algorithm for shared locations.
• Adds SPDX, CSAF 2.0, and OpenVEX interchange-format parsers, plus a Promptfoo (LLM eval and red-teaming) parser.

Vulnerability Management · 2026-08-11

DefectDojo 3.2.100 adds location migration tooling, raw CycloneDX VEX preservation, and scoped CI/CD infrastructure permissions.

• Adds migrate_locations_to_endpoints operation — the reverse of the endpoint-to-location conversion — letting teams move location data back to endpoints.
• Scopes CI/CD Infrastructure detail fields to the matching configuration permission, restricting access to infrastructure metadata by permission level.
• Preserves raw CycloneDX VEX analysis data on parsed findings, retaining the original vendor-supplied VEX analysis fields rather than discarding them.

Detection Engineering · 2026-08-11

dev-v2.1.0 adds 40+ new detection rules across AWS, Azure AKS, GCP GKE, NFS, SIP, AMQP, and database protocols, plus nested KQL query support.

• Adds nested KQL query support in lib/kql for more expressive rule authoring.
• New rule: Newly Observed RC4 Kerberos Service Ticket Request — detects unusual RC4 Kerberos ticket requests in the environment.
• New rule: Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension — surfaces potential abuse of the ACME TLS-ALPN challenge protocol.

AI Coding Agents · 2026-08-11

Devin Desktop API now supports Personal Access Tokens for direct user authentication without a service account.

• Adds Personal Access Token authentication to the API, letting users authenticate directly as themselves without a service user or separate account — sessions are automatically attributed to the authenticated user.

AI Coding Agents · 2026-08-11

Devin adds a plugin system, Terraform provider, and personal access tokens for programmatic access

• New plugin system supports installing, authoring, and governing plugins across Devin cloud sessions, the CLI, and Devin Desktop.
• New official Terraform provider enables managing Devin resources as infrastructure-as-code.
• New personal access tokens allow authenticating as yourself for programmatic API access.

AI Coding Agents · 2026-08-11

Devin Desktop v3.7.16 adds shareable local conversations, mid-turn reverts, composable permission rules, and per-MCP-server log channels.

• Adds "workbench.editor.useModal": "all" config key to restore the modal overlay for Settings and Keyboard Shortcuts, which now open as regular editor tabs by default.
• Separates each MCP server's logs into its own MCP: <server> output channel for isolated debugging.
• New Share Conversation action uploads a sanitized Devin Local transcript (system prompts and tool definitions dropped, secrets redacted, paths normalized) and copies a team-visible link; accessible from the actions menu below a completed turn.

AI Coding Agents · 2026-08-11

Devin Desktop adds shareable local conversations, composable permission rules, MCP per-server log channels, and queued-message editing.

• Adds "workbench.editor.useModal": "all" config key to restore Settings and Keyboard Shortcuts as modal overlays; they now open as regular editor tabs by default.
• Separates each MCP server's logs into its own MCP: <server> output channel for isolated debugging.
• New Share Conversation action uploads a sanitized Devin Local transcript — system prompts, tool definitions, and secrets stripped, paths normalized — and copies a team-visible link from the actions menu below a completed turn.

Secure Access (VPN / SASE / ZTNA) · 2026-08-11

DNSFilter Windows Roaming Client v3.6.10 adds DNS PreCheck v2 for policy enforcement on DNS-hijacking networks and automatic tray process recovery.

• Adds DNS PreCheck v2, which maintains policy enforcement on networks that hijack or redirect DNS traffic; rolls out gradually and is not automatically enabled on upgrade — tray updates to show DNS PreCheck v2 to confirm the active mode.
• Adds automatic tray process recovery so the system tray process restarts itself if it stops unexpectedly, keeping tray status and controls available without a manual client or machine restart.

Threat Intelligence · 2026-08-11

Feedly Threat Intelligence adds Ask AI Analyze/Research to Custom Intel Agents and Censys lookup to IP Insight Cards

• Custom Intel Agents now support Ask AI Analyze and Research actions, enabling AI-driven analysis and research workflows within agent configurations.
• IP Insight Cards gain a Censys lookup, surfacing Censys data directly in the IP context panel.
• Report Builder adds a progress indicator during generation, making long-running report creation more transparent.

Threat Intelligence · 2026-08-11

Echosec gains Natural Language Search and AI-powered discovery for geospatial OSINT.

• Adds Natural Language Search to Echosec, Flashpoint's geospatial open-source intelligence tool, enabling query-by-plain-language across geospatial data sources.

Container & Image Security · 2026-08-11

Gatekeeper docs add Helm-based auditPodAnnotations guidance for safe Cluster Autoscaler eviction of audit pods.

• Adds auditPodAnnotations Helm value to pass the cluster-autoscaler.kubernetes.io/safe-to-evict-local-volumes pod annotation, allowing Cluster Autoscaler to safely evict Gatekeeper audit pods that use the tmp-volume emptyDir volume.
• Documents that when exportBackend=disk violation export is enabled, a second local volume (tmp-violations by default, or the value of audit.exportVolume.name) is also present and must be explicitly included in safe-to-evict-local-volumes to permit eviction — with a warning that doing so risks losing unconsumed export files.

Secrets Detection & Management · 2026-08-11

GitGuardian adds honeytoken-based endpoint intrusion detection, programmatic PAT/SAT creation via API, and expanded VCS source health management.

• Adds ggshield honeytoken plant command to plant a decoy AWS credential on developer endpoints — any access to the decoy triggers an alert naming the compromised machine, its IP address, user agent, and timestamp.
• New Honeytoken protection card in the Endpoints dashboard reports the share of the fleet with active honeytoken coverage and lists unprotected endpoints.
• Adds API endpoints to create Personal Access Tokens (PATs) and Service Account Tokens (SATs) programmatically, enabling automated token rotation workflows; tokens created via the API must have a finite TTL.

Secrets Detection & Management · 2026-08-11

GitGuardian adds 10 new detectors/checkers for Lovable, Slack, n8n, Atlassian, AWS Cognito, OpenAI, Vercel, OpenCode, and Supabase.

• Adds Lovable Access Token detector for Lovable project access tokens.
• Adds Lovable Git Token detector for Lovable git tokens.
• Adds Slack Webhook Trigger URL detector for Slack Workflow Builder webhook trigger URLs.

Secrets Detection & Management · 2026-08-11

GitGuardian adds honeytoken-based endpoint intrusion detection via ggshield honeytoken plant, plus API-based PAT/SAT creation.

• New ggshield honeytoken plant command plants a decoy AWS credential on developer endpoints to detect credential-stealing malware the moment it reads the file.
• New Honeytoken protection card in the Endpoints dashboard reports fleet-wide coverage percentage and lists endpoints not yet protected.
• Adds Public API endpoints to create Personal Access Tokens (PATs) and Service Account Tokens (SATs) programmatically, enabling automated token rotation workflows; tokens created via the API must have a finite TTL.

Container & Image Security · 2026-08-11

Grype v0.117.0 adds vulnerable version ranges to CycloneDX output and fixes Rust CPE matching via match.rust.using-cpes.

• Adds vulnerable version ranges to CycloneDX output format, giving richer remediation context in CycloneDX SBOMs.

AI Agent Frameworks · 2026-08-11

Hermes Agent docs reveal CLI surface: install flags, config commands, and gateway setup for multi-platform deployments.

• Adds hermes setup --portal to log in to the Nous Portal, set Nous as the LLM provider, and enable the Tool Gateway (web search, image generation, TTS, cloud browser) in one command.
• Adds --skip-browser flag to the install script (install.sh) to bypass Playwright/Chromium installation for headless deployments that don't need browser automation.
• Adds hermes model command to interactively choose an LLM provider and model, including custom endpoints for local or self-hosted models.

AI Agent Frameworks · 2026-08-11

Hermes adds hermes import-agent claude-code migration, Cursor-style context variables, and per-user identity headers for remote MCP servers.

• Adds hermes import-agent claude-code command to migrate mcpServers blocks from ~/.claude.json — along with skills and instructions — into Hermes automatically.
• Supports Cursor-style context variable substitution in MCP config: ${userHome}, ${workspaceFolder}, ${workspaceFolderBasename}, ${pathSeparator}, and ${/} (case-sensitive).
• Adds identity_header config key for remote HTTP/SSE MCP servers, supporting value_from: static (sends a literal value) or value_from: profile (sends the active Hermes profile name) — enabling per-user rate limits, audit trails, and multi-tenant routing. Ignored with a warning on stdio transports.

AI Agent Frameworks · 2026-08-11

Hermes adds per-session container isolation, gateway agent cache with memory budgeting, and client-side STT silence trimming

• Adds container_persistent: false on the Docker backend to give every chat session its own fresh container, destroyed when the session closes or goes idle — no filesystem state, mounts, or background processes carry over between sessions.
• Adds gateway_turn_lease_timeout (default 1800 seconds) to cap how long a turn waits for a session lease before the gateway fails closed and returns a rejection notice instead of queueing the message.
• Adds agent_cache config block with max_size, idle_ttl_secs, memory_high_mb, max_evictions_per_pass, and protect_recent keys to bound the gateway's per-session agent cache by count, time, and anonymous RSS — evicting least-recently-used transcripts under memory pressure.

AI Agent Frameworks · 2026-08-11

Hermes adds session resume, kanban review routing, storage optimization, and database repair commands to its CLI.

• Adds --resume latest keyword to resume the most recent session, scoped to the current workspace.
• Adds --in <dir> flag to change into <dir> before starting or resuming, scoping --resume latest and -c lookups to that directory's workspace.
• Adds request-review <id> subcommand to move a task to review status with a reviewer handoff; supports --reviewer flag to reassign before dispatch.

AI Agent Frameworks · 2026-08-11

Hermes now supports repo-local reviewer checklists loaded from .agents/checks/*.md before PR reviews.

• Adds support for .agents/checks/*.md — per-repository, plain-markdown review checklists stored under .agents/checks/ (e.g. security.md, migrations.md, public-api.md) that Hermes loads before reviewing a change touching the matching area, giving review agents project-specific criteria instead of relying on generic prompts.

AI Agent Frameworks · 2026-08-11

Hermes adds hermes plugins subcommands for installing, enabling, and managing native and portable Agent Plugins.

• Adds hermes plugins install owner/repository --no-enable to install a native or portable Agent Plugin package without immediately activating it.
• Adds hermes plugins list to view all installed plugins.
• Adds hermes plugins enable <plugin-name> and hermes plugins disable <plugin-name> to toggle individual plugins.

AI Agent Frameworks · 2026-08-11

Hermes adds Actual Computer support for private inference and a hermes backup migration command.

• Supports Actual Computer as a private inference cluster backend, configurable via ACTUAL_API_KEY (hosted relay) or ACTUAL_BASE_URL=http://127.0.0.1:8080 (local daemon, no key required).
• Adds hermes backup command to migrate an entire setup or a single profile to another machine without rebuilding from scratch.

AI Agent Frameworks · 2026-08-11

HolmesGPT 0.39.0 adds Atlassian Rovo MCP integration and extends GitHub MCP to support multi-org GitHub App installs with credential-based skill pulling.

• Adds Atlassian Rovo MCP integration, enabling HolmesGPT to use Rovo as a data source via the MCP addon.
• Extends the GitHub MCP addon to support GitHub App installations spanning multiple organizations.
• Enables pulling skills using GitHub App credentials in the GitHub MCP integration.

Agentic Infrastructure · 2026-08-11

HF CLI gains --exclude-skill installer flag, model.args/model.command endpoint API fields, and auto-refresh of the hf-cli agent skill on update.

• Adds --exclude-skill flag to the standalone installer (curl -LsSf https://hf.co/cli/install.sh | bash -s -- --exclude-skill / -ExcludeSkill on PowerShell) to skip installing the hf-cli skill globally for Claude Code and agents reading ~/.agents/skills.
• Installs and auto-refreshes the hf-cli skill globally (in ~/.agents/skills) so agents always see the current command surface after an update — without reinstalling if the skill was previously skipped or removed.
• Exposes model.args and model.command API payload fields via hf endpoints update, applying to both custom and managed images; on existing endpoints the flags replace the current value rather than appending, and passing an empty string clears them.

Endpoint Security (EDR/XDR) · 2026-08-11

Huntress adds Monthly Executive Summary reports in GA, delivering a one-page stakeholder-friendly snapshot per organization each month.

• Adds Monthly Executive Summary reports (GA) — a one-page, plain-language snapshot per organization highlighting active protection layers (EDR, ITDR, SIEM, etc.), signals investigated, and threats contained, aimed at non-technical stakeholders.
• Reports are accessible under the Reports section of the Huntress portal and delivered via email link to partners for easy forwarding to end customers.
• Complements (does not replace) the existing full monthly/quarterly Threat Report; described as the first in a planned series of reporting improvements.

Endpoint Security (EDR/XDR) · 2026-08-11

Huntress adds a GA API for querying remote access connections, including ConnectWise ScreenConnect hosts.

• New Remote Access section in the Huntress API lets you programmatically query all remote access connections observed across your environment, returning agent hostname, relay host, port, and first/last seen timestamps — data previously confined to the portal's ScreenConnect Hosts view.

Secrets Detection & Management · 2026-08-11

Infisical v0.162.19 adds machine identity support for PAM access controls.

• Adds machine identity (MI) support to PAM access, enabling non-human identities to be granted privileged access management permissions.

Container & Image Security · 2026-08-11

Inspektor Gadget adds gpu-ebpf-bridge, a userspace daemon bridging NVML GPU telemetry into four bpffs-pinned BPF maps for eBPF gadget consumption.

• New gpu-ebpf-bridge daemon pins four BPF maps (gpu_meta, gpu_device, gpu_per_pid, gpu_per_pid_per_device) under /sys/fs/bpf/ at startup, allowing consumer eBPF gadgets to join GPU telemetry by PID or device index via a single hash lookup with no IPC.
• Adds --poll-interval duration flag to control time between NVML polls (default 100ms).
• Adds --mode string flag for backend selection: auto (default), real, or mock; auto tries the real NVML backend and falls back to mock on failure.

Container & Image Security · 2026-08-11

Inspektor Gadget adds gpu-ebpf-bridge daemon to enrich kernel eBPF events with per-process and per-device NVIDIA GPU telemetry via NVML

• Adds bridges.gpu.enabled: true and bridges.gpu.accessMode helm values to deploy the gpu-ebpf-bridge sidecar inside the existing IG DaemonSet; three access modes supported: toolkit-env (default), hostpath, and device-plugin.
• Adds --idle-if-no-gpu flag to gpu-ebpf-bridge so the sidecar stays in Running state on non-GPU nodes instead of crashing, preserving fleet-wide observability on mixed clusters; the helm chart passes it unconditionally when bridges.gpu.enabled=true.
• Adds --mode=real and --keep-pins=true flags to gpu-ebpf-bridge for standalone and kubectl debug node deployments; --keep-pins=true leaves the four bpffs-pinned BPF maps (gpu_device, gpu_per_pid, gpu_per_pid_per_device) visible after the bridge exits.

Container & Image Security · 2026-08-11

Inspektor Gadget adds three new GPU observability gadgets: per-device telemetry, per-process usage, and starvation detection.

• New gpu_top gadget reports real-time per-device GPU telemetry.
• New gpu_top_per_pid gadget reports per-process GPU usage.
• New trace_gpu_starvation gadget detects GPU starvation — identifying processes being starved of GPU access.

Container & Image Security · 2026-08-11

Inspektor Gadget adds gpu-ebpf-bridge daemon for per-device and per-process GPU telemetry via BPF-pinned maps.

• New gpu-ebpf-bridge daemon exposes per-device and per-process GPU telemetry to consumer gadgets via four bpffs-pinned maps.
• New gpu-ebpf-bridge CLI with configurable backends, flags, and a built-in --dump flag for live debugging of published BPF maps.

Threat Intelligence · 2026-08-11

IntelOwl's chatbot now surfaces the platform's job verdict — malicious/benign badge plus supporting analyzer evidence — in job summaries.

• Adds verdict reporting to chatbot job summaries: asking Summarize job #N, Evaluate the results of job #N, or 'Is job #N malicious?' now returns IntelOwl's own verdict (matching the job page badge), along with which analyzers support, disagree with, or produced no opinion on that verdict.
• Adds context-aware action chips to the chatbot: on a job page they suggest job-scoped actions (Summarize & evaluate, 'Which plugins ran?', Show job details), on an investigation page they suggest investigation-scoped actions, and elsewhere they offer general actions (Show my recent jobs, List my investigations).

Web Application Security · 2026-08-11

Invicti Platform adds LDAP sync, HashiCorp Vault integration, a dedicated API scan profile, custom scan speed, and client-certificate storage in Secrets Manager.

• Adds Custom scan speed option in scan configuration, letting you set the number of concurrent requests and their send frequency for precise control over scan throughput.
• Adds HashiCorp Vault integration with Invicti Platform's Secrets Manager, enabling credentials to be retrieved directly from Vault when configuring scan authentication.
• Adds support for storing client certificates in Secrets Manager by supplying the certificate in base64 format.

Web Application Security · 2026-08-11

Invicti adds HashiCorp Vault integration, gRPC ZIP proto upload, API scan profile, custom scan speed, and LSR HTTP traffic inspection.

• Adds support for uploading multiple gRPC proto file definitions as a single ZIP archive, eliminating the need to import proto files one by one for multi-file services.
• Adds HashiCorp Vault integration with Invicti Platform's Secrets Manager, enabling credentials to be retrieved directly from Vault when configuring scan authentication.
• Adds a new API-specific scan profile available by default for all new API targets, providing comprehensive API vulnerability coverage out of the box.

Web Application Security · 2026-08-11

Invicti now accepts a ZIP archive of multiple gRPC proto files for scanning multi-file gRPC services.

• Supports uploading multiple gRPC proto file definitions as a single ZIP archive for gRPC scanning, removing the need to import proto files one by one for services that span multiple files.

Web Application Security · 2026-08-11

Juice Shop v20.2.0 adds three new challenges, Dice Coefficient cheat detection, and a user profile role field.

• Adds allowScripts configuration key to package.json and frontend/package.json.
• Adds new -challenge Misplaced IaC Files to the challenge set.
• Adds new -challenge Login Cloud Admin (including coding challenge) to the challenge set.

AI Coding Agents · 2026-08-11

Kiro 1.0.288 adds Agent Plugin support, session pinning, and CLI hand-off in Agent Focus Mode.

• Supports Powers packaged in the open Agent Plugin format, installable from a local folder or GitHub URL, bundling skills and MCP for sharing across compatible agent tools.
• Pin sessions in Agent Focus Mode with Pin Session to keep them at the top of their section.
• Resume an existing session in Kiro CLI via Open with Kiro CLI directly from the Agent Focus Mode session rail.

AI Agent Frameworks · 2026-08-11

LangGraph 1.2.11 exposes trace_policy on add_node for per-node tracing control.

• Adds trace_policy parameter to add_node to control tracing behaviour on a per-node basis.

Exploitation & C2 · 2026-08-11

Metasploit Pro adds Malleable C2 Profile support to blend Meterpreter C2 traffic with legitimate patterns and evade NIDS.

• Adds a Modules > Malleable Profiles page in the workspace tab bar for managing custom and framework C2 profiles, with create, upload, edit, download, and delete capabilities.
• Supports attaching a Malleable C2 profile to a listener via Global Settings > Persistent Listeners > New Listener using the Malleable C2 Profile section — options include None, Choose an existing malleable profile, or Enter file path to a malleable profile (absolute path to a .profile file on the server filesystem).
• Supports attaching a Malleable C2 profile when running individual exploit modules via Advanced Payload Options in the Single Module Run interface, with the same three options as listener configuration.

AI/LLM Security · 2026-08-11

nono v0.73.0 adds glob pattern support in filesystem path fields for more flexible sandbox policies.

• Supports glob patterns in filesystem path fields (e.g. fs_read, fs_write) within profiles, enabling wildcard-based filesystem access rules in sandbox policies.

General Utilities & Libraries · 2026-08-11

Obsidian Mobile 1.13.6 adds swipe-to-close tabs in the tab switcher and icon labels in mobile toolbar settings.

• Adds swipe-to-close gesture to dismiss tabs directly from the tab switcher.
• Tabs now animate to their new position after a tab is closed from the tab switcher.
• Mobile toolbar settings page now displays icons alongside each command for easier identification.

Local LLM Runtimes · 2026-08-11

Ollama v0.32.8 adds Muse Glimmer model support across NVIDIA, AMD, and all platforms for local coding agents and personal assistants.

• Adds ollama run muse-glimmer to download and run the Muse Glimmer model locally on NVIDIA, AMD, and additional platforms.
• Adds ollama launch claude --model muse-glimmer to run Muse Glimmer with Claude Code as a local coding agent.
• Adds ollama launch pi --model muse-glimmer to run Muse Glimmer with the Pi coding agent integration.

Local LLM Runtimes · 2026-08-11

Ollama v0.32.7 adds Muse Glimmer 30B with DFlash and image input on Apple Silicon, plus streaming thinking traces and a ctrl+o trace toggle in the TUI.

• Adds muse-glimmer:30b-mlx model tag, enabling the Muse Glimmer 30B multimodal model via ollama run muse-glimmer:30b-mlx or ollama launch <integration> --model muse-glimmer:30b-mlx.
• Adds DFlash block-diffusion drafting support for the MLX engine on Apple Silicon, available with Muse Glimmer as of this release.
• Adds image input support to the MLX engine (Muse Glimmer on Apple Silicon), enabling multimodal vision workloads locally.

Local LLM Runtimes · 2026-08-11

Ollama v0.32.9 adds NVIDIA Nemotron 3.5 Lightning (30B MoE) with native MLX support and speculative decoding via built-in draft model.

• Adds nemotron-3.5-lightning, an NVIDIA 30B mixture-of-experts model with 3B active parameters, runnable via ollama run nemotron-3.5-lightning.
• Adds the Nemotron 3 architecture to the MLX backend, including Mamba2/recurrent layers, MoE routing, and quantized NVFP4/MXFP8 expert paths with Metal-optimized block-mapped kernels.
• Serves Nemotron 3's multi-token prediction head as a built-in self-draft speculator, enabling speculative decoding without a separate draft model.

AI Coding Agents · 2026-08-11

Codex CLI alpha.6.6 adds Amazon Bedrock web search support, Agent Plugin runtime boundaries, and expanded MCP namespace description limits.

• Raises the MCP namespace tool-spec description limit from 1,000 bytes to 512 KiB, truncating only at a UTF-8 character boundary when the new limit is exceeded.
• Enables hosted web search for Amazon Bedrock, resolving unsupported live and indexed modes to cached search and disabling the tool when cached search is prohibited by managed requirements.
• Gives externalAgentConfig/detect its own global serialization queue so configuration reads, writes, and external agent imports remain responsive while detection runs.

AI Coding Agents · 2026-08-11

Codex CLI adds dual-WebSocket code-mode transport, paginated TUI history, cached web search for Amazon Bedrock, and MCP conformance regression gates.

• Adds --psp flag to app-server to enable process-scoped PSP routing for first-party ChatGPT requests.
• Adds a dual-WebSocket transport for code mode, enabling a new host-transport path for code-mode sessions.
• Enables cached web search for Amazon Bedrock sessions.

SAST / SCA / Code Security · 2026-08-11

Openlayer Skills package conditions AI coding agents (Claude Code, Cursor, Codex, Copilot, Gemini CLI) to follow Openlayer's current best practices end to end.

• Adds npx skills add openlayer-ai/openlayer-skills --skill "openlayer" via the skills CLI to install the Openlayer agent skill into Codex, GitHub Copilot, Gemini CLI, Windsurf, opencode, and dozens of other coding agents in one step.
• Supports manual installation for any agent that reads a skills directory by symlinking or copying the skills/openlayer folder from github.com/openlayer-ai/openlayer-skills.
• Skill covers tracing/monitoring via the Python or TypeScript SDK, offline evals with openlayer.json + tests.json, test and guardrail creation from the catalog, and CI/CD build gating on eval regressions.

SAST / SCA / Code Security · 2026-08-11

Openlayer MCP server now available as a hosted, OAuth-protected remote connector at https://mcp.openlayer.com — no local install required.

• Adds a hosted, OAuth-protected remote MCP connector at https://mcp.openlayer.com — no API key or local install needed; sign-in is handled via OAuth against your Openlayer account.
• Supports workspace switching directly from the chat interface when a user belongs to multiple workspaces.
• Integrates with Claude desktop/claude.ai via Settings → Connectors → Add custom connector using https://mcp.openlayer.com.

SAST / SCA / Code Security · 2026-08-11

Openlayer adds semantic search filters for test subpopulations, matching rows by meaning rather than exact wording.

• Adds a semantic match type in test subpopulation filters, using embeddings to match rows by topic or intent rather than exact or keyword wording — useful for free-text columns like user messages, model outputs, and transcripts.
• Semantic filters compose with existing metadata conditions (date ranges, user IDs, tags) to narrow the exact data slice a test runs on.

SAST / SCA / Code Security · 2026-08-11

Openlayer adds AI-generated summaries for sessions, traces, and test results to surface failure patterns without raw log reading.

• New AI summaries on the session detail view explain what the user was trying to do, what the agent did, and where it struggled — accessible via Projects > Sessions > open a session.
• New AI summaries on the trace detail view replace line-by-line span reading — accessible by opening any trace from the Traces view.
• New AI summaries on test results surface dominant failure modes and link each mode to the exact matching rows — accessible by opening a test result above the row-level results.

SAST / SCA / Code Security · 2026-08-11

Openlayer adds support for monitoring IBM watsonx Orchestrate agents

• Adds integration to monitor IBM watsonx Orchestrate agents with Openlayer.

SAST / SCA / Code Security · 2026-08-11

Openlayer adds AI-generated summaries, semantic search filters, agent skills for coding assistants, and IBM Watson Orchestrate integration.

• Adds AI-generated summaries for sessions, traces, and test results so practitioners see a plain-language overview without reconstructing events span by span.
• Adds semantic search filters for building test subpopulations using embedding-based matching instead of exact or keyword matching.
• Adds Openlayer Agent Skills to teach AI coding assistants (Claude Code, Cursor) how to integrate a codebase with Openlayer.

SAST / SCA / Code Security · 2026-08-11

Openlayer adds AI summaries, semantic search, remote MCP, webhooks, per-user Gateway limits, and a Helm chart for the Gateway in its August 2026 release.

• Adds openlayer init CLI command to guide a fresh directory to a linked, monitored project with tracing instrumentation in one step.
• Adds non-interactive (headless) CLI mode — link, login, and resource creation now accept no user prompts, enabling use from AI coding agents and CI pipelines.
• Expands openlayer export to support CSV and XLSX output formats (previously JSON only) and adds a flag to include scores in the export.

SAST / SCA / Code Security · 2026-08-11

Openlayer adds remote MCP connector, Agent Skills, semantic search, webhooks for test results, and 25+ new capabilities in its August 2026 release.

• Adds openlayer init — one guided command takes a fresh directory to a pushable, linked, monitored project with tracing instrumentation.
• Adds non-interactive CLI mode — link, login, and resource creation run headless, enabling use from AI coding agents and CI pipelines.
• Expands openlayer export to support CSV and XLSX formats (previously JSON only) and adds the ability to include scores in exports.

Runtime Security · 2026-08-11

OpenShell v0.0.103 adds static credential binding to proxy provider endpoints.

• Adds the ability to bind static credentials to provider endpoints in the proxy, enabling credential injection for specific backend routes without dynamic resolution.

Secure Access (VPN / SASE / ZTNA) · 2026-08-11

OpenSSH 10.5 adds FIDO key flag editing, smart pubkey ordering, and a new ssh -Z auth-key inspection mode

• New ssh -Z user@host mode prints the public keys that will be tried during authentication, in the exact order they will be attempted.
• Adds ability in ssh-keygen(1) to set or clear the touch-required and verify-required flags on FIDO private keys when resetting a passphrase.
• ssh(1) now tries FIDO keys that require no user presence first, and FIDO keys requiring PIN or biometric verification last, reducing unnecessary friction during pubkey authentication.

Secure Access (VPN / SASE / ZTNA) · 2026-08-11

OpenSSH 10.5 adds ssh -Z key-preview mode, FIDO flag editing on passphrase reset, and smarter FIDO key ordering for pubkey auth.

• Adds ssh -Z user@host mode that prints the public keys that will be tried for pubkey authentication, in the order they will be used.
• Adds ability to set or clear the touch-required and verify-required flags on FIDO private keys when resetting a private key's passphrase.
• Reorders FIDO key trials during pubkey authentication to prefer low-friction keys (no user presence required) before high-friction keys (PIN or biometric verification).

Identity & Access Management · 2026-08-11

Ory Hydra gains oauth2.grant_types_disabled config key to block specific OAuth 2.0 grant types.

• Adds oauth2.grant_types_disabled config key to Ory Hydra's configuration schema, accepting a list of OAuth 2.0 grant types to explicitly disable.

Endpoint Security (EDR/XDR) · 2026-08-11

OSSEC 4.2.0 adds a multi-threaded analysisd pipeline and bundles OpenSSL DLLs in the Windows agent installer.

• Linux server installs of 4.2.0 gain an always-on multi-threaded analysisd pipeline; manager daemons also use pthreads and a shared thread pool — no configuration change required, but verify ossec-analysisd starts cleanly and alert volume matches expectations under load.
• Windows agent installer for 4.2.0 bundles the MinGW/OpenSSL runtime DLLs required by the agent, removing reliance on system DLLs.

CNAPP · 2026-08-11

Pleri can now open, review, and abandon pull requests in Azure DevOps repositories to remediate IaC issues.

• Pleri can check pull request status, request a review, or abandon a pull request with a reason inside Azure DevOps.

Integrated & IT Risk Management · 2026-08-11

Qualys Policy Compliance adds Audit Fix: autonomous closed-loop remediation via Cloud Agent with TruRisk-driven prioritization across 90+ frameworks.

• Introduces the Audit Fix add-on module, which deploys pre-built Custom Assessment and Remediation (CAR) scripts directly through the existing Qualys Cloud Agent to autonomously remediate failed compliance controls at scale.
• Each CAR script is version-controlled and mapped to its specific benchmark control (CIS, DISA STIG, or NIST requirement), enabling traceable, audit-ready remediation evidence.
• Adds closed-loop validation: after a CAR script executes, an automatic rescan runs and updates control status from Failed to Passed, generating timestamped audit evidence across more than 90 compliance frameworks.

CNAPP · 2026-08-11

InsightCloudSec 26.8.11 adds four new CIS compliance packs, seven new Insights, two new query filters, and Azure Data Factory resource harvesting.

• Adds Data Factory with/without Managed Identity query filter to identify Azure Data Factories based on Managed Identity configuration status (defaults to without).
• Adds Data Factory Linked Services Use Key Vault query filter to identify Data Factories based on whether linked services store credentials in Azure Key Vault (defaults to identifying inline storage).
• Adds the CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 compliance pack for Kubernetes EKS clusters.

Continuous Control Monitoring (CCM) · 2026-08-11

RegScale CLI 6.39.0 adds Splunk integration with asset/finding ingestion and evidence import via splunk sync

• Adds splunk sync command that runs saved searches listed in splunkSavedSearches and imports assets, findings, and control evidence into RegScale.
• New Splunk integration supports search, streaming export, saved searches, search job management, asset and finding processing, and evidence ingestion.

Continuous Control Monitoring (CCM) · 2026-08-11

RegScale 6.33.0 adds application hierarchy definition and global visibility controls in App Builder.

• Adds the ability to define a hierarchy of applications on the App Management page.
• Adds a global visibility toggle within the application's Advanced Security tab.

Identity & Access Management · 2026-08-11

SailPoint Agentic Fabric adds MCP client discovery and governance to the non-human identity registry

• Adds an MCP Clients page to the non-human identity registry, providing a central view of all discovered MCP clients connected to AI agents, discoverable from endpoint agents, browser extensions, and cloud connectors.
• Extends SailPoint sources to aggregate and govern MCP clients alongside AI agents, credentials, and IAM roles objects using datasets and resources.
• Treats MCP clients as governed non-human identity assets within Agentic Fabric, enabling review and management of agent access to tools, systems, data sources, and credentials.

Identity & Access Management · 2026-08-11

SailPoint adds access request support for Machine Identities, letting users request entitlements on behalf of machine identities via the ISC Request Center.

• Enables users to request entitlements on behalf of Machine Identities through the Identity Security Cloud (ISC) Request Center for Machine Identity Security customers.
• Routes manager-assigned approvals for Machine Identity access requests to the Machine Identity owner instead of a human manager.
• Requires requesters to select a target account when a Machine Identity has multiple accounts on a source, ensuring precise provisioning targeting.

Identity & Access Management · 2026-08-11

Non-Employee Risk Management gains report deletion and permission-scoped report list visibility on the Reports All tab.

• Report creators can now delete their own report definitions directly from the Reports page in Non-Employee Risk Management; deleting a report also removes all associated exports.
• The Reports All tab now shows only reports the logged-in user created or reports shared with them, preventing exposure of sensitive metadata in report titles to unauthorized users.

Identity & Access Management · 2026-08-11

SailPoint adds approval reminders/escalations UI, regional AWS SES routing, and CC:/BCC: support in email templates.

• Adds Admin > System Settings > Feature Settings > Approval Settings tab for globally configuring approval reminders, escalations, and timeouts — including cron-string cadence, multi-level escalation chains, and a fallback approver set to an identity or governance group.
• Adds per-access-item reminder and escalation configuration under the Access Requests section for Entitlements, Access Profiles, and Roles, overriding the global config for those items.
• Adds a region field to EMAIL_SENT audit events, reflecting the AWS region used to send each email.

Identity & Access Management · 2026-08-11

SailPoint Identity Security Cloud extends Data Segmentation to Human Identities, enabling least-privilege visibility across complex orgs.

• Extends Data Segmentation to cover Human Identities, so administrators can restrict which identities a given user can see — not just Roles and Entitlements.
• Enables delegated administration at subsidiary or team level without exposing cross-organizational identity data to scoped admins.

SAST / SCA / Code Security · 2026-08-11

Semgrep adds breaking_change and full_scan vocabulary to the public policies API, now in public beta.

• Adds breaking_change and full_scan fields to the public policies API vocabulary, enabling scan policies that use those options to be represented through the API (API is in public beta for organizations using unified policies).
• Run logs are now parsed into individual searchable and filterable fields instead of a single block of text.
• Unified policies migration banner now displays the migration schedule: migrations begin August 24, 2026, with the current Policies version sunsetting November 1, 2026.

SAST / SCA / Code Security · 2026-08-11

Semgrep adds structured step-log viewer for Agentic Workflows and expands the public policies API with breaking_change and full_scan vocabulary.

• Adds breaking_change and full_scan vocabulary to the public policies API (currently in public beta for organizations using unified policies), enabling scan policies that use those options to be represented through the API.
• Agentic Workflows step logs now use a structured viewer that parses run logs into individual searchable and filterable fields instead of a single block of text.

Endpoint Security (EDR/XDR) · 2026-08-11

Sophos adds AI Defense EAP, ITDR identity risk scores, new ITDR regions, and generative AI DNS filtering category

• Adds Generative AI as a new category in DNS Protection filtering policies, giving visibility into and control over AI services on your networks.
• Launches Sophos AI Defense Early Access Program for Sophos EDR, XDR, and MDR customers on Sophos Fusion — enables monitoring, control, and securing of AI usage across an environment.
• Introduces Identity Risk Scores in Sophos ITDR: a single ML-powered score per identity combining incident likelihood with potential impact, updating dynamically as findings and accounts change.

Endpoint Security (EDR/XDR) · 2026-08-11

Sophos Central adds Network Map visualization, Live Discover queries for AP6 access points, and a Protected Browser extension for Chrome and Edge.

• New Network Map provides a visual topology of all Sophos firewalls, switches, and AP6 access points in a Sophos Central account, with device relationship views and search capabilities.
• Live Discover queries now support AP6 Series access points, enabling on-demand querying of wireless data stored in the Sophos data lake.
• New Protected Browser extension lets administrators apply security policies and monitor user activity in Chrome and Edge without migrating users to the full Sophos Protected Browser.

Firewalls & Network Defense · 2026-08-11

Sophos Central Firewall Management gains recurring firmware upgrade schedules with weekly, monthly, and staged rollout options.

• Adds recurring firmware upgrade schedules in Sophos Central Firewall Management, supporting weekly or monthly cadences and staging firewalls to validate upgrades before broader rollout.

Endpoint Security (EDR/XDR) · 2026-08-11

Sophos Linux Sensor 5.18.2 adds DNS query event export to Taegis data lake and SNI details in connection events.

• Adds dns_query_events event type to the Taegis data lake hydration pipeline, enabled via Helm charts configuration.
• Adds SNI (Server Name Indication) details to connection events in the data lake.

Endpoint Security (EDR/XDR) · 2026-08-11

Sophos Protection for Linux 5.19.0 adds kernel 7.1 support.

• Adds support for kernel 7.1, extending the range of Linux environments where the sensor can run.

SIEM · 2026-08-11

Sumo Logic dashboards gain Shift+click drill-down on map charts, auto-populating Log Search with lat/long values.

• Adds Shift+click on map chart points or lines in dashboards to drill down into that location's data, automatically redirecting to Log Search with the query updated with the corresponding latitude and longitude values.

Container & Image Security · 2026-08-11

Syft v1.51.0 adds native Go FIPS 140 mode detection in binaries and extended stdlib scope for symbol capture.

• Detects native Go FIPS 140 mode in scanned binaries, surfacing FIPS compliance status in generated SBOMs.
• Adds extended-stdlib scope and expanded module patterns for symbol capture, improving Go binary analysis coverage.

Cloud Security Posture · 2026-08-11

Sysdig CLI Scanner v1.29.0 adds support for Allow/Deny Base Image supply chain rules in vulnerability policies.

• Adds support for Allow Base Image and Deny Base Image supply chain rules in the CLI Scanner, so vulnerability policies that allow or deny specific base images are now evaluated locally.

Secure Access (VPN / SASE / ZTNA) · 2026-08-11

Tailscale Kubernetes Operator v1.102.2 adds in-cluster PeerRelays, workload identity federation, 4via6 support, and IPv6 Egress ProxyGroups.

• Supports deploying PeerRelays in-cluster via a new custom resource.
• Adds workload identity federation configuration for the Tailnet custom resource.
• Supports 4via6 in connector and egress proxy resources when egressing from a dual-stack cluster.

Secure Access (VPN / SASE / ZTNA) · 2026-08-11

Termius now documents how to configure and pass environment variables in remote SSH sessions, including server-side AcceptEnv rules.

• New documentation covers how to configure, pass, and verify environment variables in remote SSH sessions, including server-side AcceptEnv rules.

SOAR · 2026-08-11

Tines 42.6.0 adds LDAP config UI, dashboard time granularity, time zone support in Cases, and Plan mode for Apps.

• Adds a self-hosted LDAP configuration UI, enabling on-premises deployments to configure LDAP directly from the Tines interface.
• Introduces Plan mode for Apps, giving practitioners a way to model or preview app behavior before execution.
• Adds time granularity controls to dashboard charts, allowing finer or coarser resolution when visualizing workflow data.

AI/LLM Security · 2026-08-11

ToolHive v0.42.1 adds deny-by-default vMCP visibility, MCP tool annotations for composite tools, external OIDC trusted_issuers, and TOOLHIVE_API_TIMEOUT

• Adds aggregation.defaultToolVisibility: deny to vMCP config so only workloads explicitly listed in aggregation.tools have their tools advertised, closing the fail-open gap where adding a workload to a group silently exposed it.
• Adds insecureAllowHTTP: true under spec.inline of MCPOIDCConfig to explicitly opt in to plain-HTTP issuer and JWKS URLs in dev/test environments; inline configs without it now validate both issuer and jwksUrl at reconcile time.
• Adds TOOLHIVE_API_TIMEOUT environment variable to override the CLI's API client timeout for thv skill and thv ai-plugin commands (new default is 10 minutes).

Endpoint Security (EDR/XDR) · 2026-08-11

AskAI in the Outlook add-in can now search and manage quarantined email via chat, with admin-controlled permissions.

• AskAI in the Outlook add-in now lets end users search quarantined email by sender or subject directly from the chat interface.
• Quarantine actions taken through AskAI enforce the permissions already assigned by administrators, keeping security teams in control while enabling end-user self-service.

Endpoint Security (EDR/XDR) · 2026-08-11

DLP templates gain an EXCEPT operator to exclude specific expressions or keywords from match conditions, reducing false positives.

• Adds the EXCEPT operator to DLP templates, allowing administrators to exclude specific expressions or keywords from a match condition alongside existing AND and OR logic.

Endpoint Security (EDR/XDR) · 2026-08-11

Trend Vision One Threat Intelligence Hub adds direct IoC search by file hash, IP, domain, or URL with bulk upload support.

• New IoC search in Threat Intelligence Hub (Threat Intelligence → Threat Intelligence Hub → Indicators) lets analysts enter a file hash (SHA-1 or SHA-256), IP address, domain, or URL to check whether Trend Micro threat intelligence has flagged it as malicious, linked it to a detection, or associated it with known threat campaigns or intelligence reports.
• Supports bulk IoC validation via list upload, enabling analysts to validate multiple suspicious objects in a single operation rather than one at a time.

Endpoint Security (EDR/XDR) · 2026-08-11

Agentless Vulnerability and Threat Detection adds vulnerability and malware scanning support for GCP Cloud Run Functions.

• Extends agentless vulnerability and malware scanning to GCP Cloud Run Functions, accessible via Cyber Risk Exposure Management → Continuous Risk Management → Threat and Exposure Management.

Compliance Automation & Trust Management · 2026-08-11

TrustRegister adds treatment plan tasks with Jira/ServiceNow linking, budget tracking, and Slack notifications.

• Adds treatment plan task management in TrustRegister under Action Plan > Treatment Plan Tasks, with fields for task name, owner, group, notes, due date, budget requested, and budget allocated.
• Supports linking treatment plan tasks directly to Jira and ServiceNow tickets for cross-team tracking of risk remediation work.
• Enables team collaboration on treatment plan tasks via comments for tracking approvals and managing change.

Digital Forensics & Incident Response · 2026-08-11

Velociraptor v0.77.2 adds a full-text index() plugin, VQL default parameters, hunt tags, dir_permissions in copy(), and more new VQL/UI capabilities.

• Adds index() VQL plugin to build local full-text indexes, with batch mode for faster indexing.
• Adds dir_permissions parameter to the copy() VQL function for controlling directory permissions during file operations.
• Adds Tags argument to the hunt() VQL function, enabling programmatic tagging of hunts at creation time.

Digital Forensics & Incident Response · 2026-08-11

Velociraptor v0.76.7 backports VQL default parameters, a new index() plugin, hunt tagging, and OIDC enhancements from the 0.77 cycle.

• Adds Tags argument to the hunt() VQL function to set hunt tags programmatically.
• Adds GUI.authenticator.claims.allow_unverified_email and GUI.authenticator.claims.override_acls config keys for finer OIDC role-assignment control.
• Adds index() VQL plugin to build local full-text indexes over collected data.

SAST / SCA / Code Security · 2026-08-11

Veracode integrations gain GitHub/ADO platform-managed installs, scan scheduling, autopackaging for Apex/VB6/Perl, and new Java API Wrapper endpoints.

• Adds analysis_branch key to veracode.yml in the Azure DevOps Workflow Integration v2.3.10: scheduled scans now run against the specified branch instead of the default branch.
• Adds debug configuration option to veracode.yml across Azure DevOps Workflow Integration v2.3.6, GitHub Workflow Integration v1.0.6, and GitLab Workflow Integration v2.1.4 for debugging and troubleshooting.
• Adds page size support to the Platform Applications API (/appsec/v1/applications) in Java API Wrapper v26.3.19.0 to improve efficiency when retrieving large application lists.

Local LLM Runtimes · 2026-08-11

vMLX 1.6.27 adds Muse Glimmer 30B with vision/video, expands prefix cache to 262,144 tokens, and wires up Anthropic thinking.budget_tokens and Ollama think string levels.

• Ollama think string levels ('low', 'medium', 'high') now engage thinking and select effort depth — previously they were silently ignored.
• Prefix cache index expanded from ~64,000 to 262,144 tokens, with automatic migration of existing sessions, so long conversations no longer report zero reuse.
• Adds full support for Muse Glimmer 30B: text tower, windowed vision tower, recipient-routed reasoning rail, and ATEM tool dialect — all three bundles (JANG_2D / 4M / 6M) supported.

Network Analysis & Monitoring · 2026-08-11

Wireblast v0.4.0 adds --pcap-memory to set a configurable memory budget for PCAP replay loads.

• Adds --pcap-memory flag to make the memory budget for loading PCAP files configurable at runtime.

Malware Analysis · 2026-08-11

YARA-X LNK module gains target_id_list array with full ShellItem parsing, enabling rules over shell item type, path, GUID, and raw bytes.

• Adds lnk.target_id_list, an array of ShellItem structs parsed from the LNK LinkTargetIDList structure, exposing the full chain of shell items (root folder, volume, file entry, network location, control panel, etc.) for YARA matching.
• Adds item_type field (ShellItemType enum) on each ShellItem, always populated, with named constants ShellItemType.CONTROL_PANEL_CPL (0x00), ShellItemType.ROOT_FOLDER (0x1F), ShellItemType.VOLUME (0x20), ShellItemType.FILE_ENTRY (0x30), ShellItemType.NETWORK_LOCATION (0x40), ShellItemType.COMPRESSED_FOLDER (0x52), ShellItemType.URI (0x61), ShellItemType.CONTROL_PANEL (0x71), ShellItemType.PRINTERS (0x72), ShellItemType.COMMON_PLACES_FOLDER (0x73), and ShellItemType.USERS_FILES_FOLDER (0x74).
• Adds data field on each ShellItem — the raw class-type-specific bytes after the indicator byte — always populated so rules can match shell item types not decoded into a named field.

Exploitation & C2 · 2026-08-10

ADscan v11 adds ESC5 end-to-end exploitation, generate_report, writeup, client-logo delivery, and a MITRE-mapped COVERAGE.md

• Adds adscan deliver --client-logo and adscan ci --client-logo flags accepting PNG, SVG, or JPG to embed a client logo in both the free and PRO report covers.
• Adds --no-telemetry and --offline flags to adscan start; also restores set telemetry off as per-workspace and introduces set telemetry off global for an operator-wide default.
• New generate_report command produces a free self-contained HTML and paginated A4 PDF exposure report from any scan; audit-mode scans run it automatically.

Exploitation & C2 · 2026-08-10

ADscan v10.1.0 adds SQL Server lateral movement, Shadow Credentials, GPO-to-code-execution chaining, and a new adscan execute attack_paths subcommand.

• New adscan execute attack_paths subcommand runs a single saved attack path or step against a workspace without a full rescan; resolves credentials automatically for already-owned accounts and a companion re-arm resets step status to re-run a path.
• REPL commands now accept flag-form arguments -d/--dc-ip/-u/-p/--host/--service alongside the existing positional form, with tab-completion for both flag names and values.
• Adds SQL Server attack coverage: linked-server lateral movement across domain and forest trusts, automated command execution with escalation to SYSTEM, and arbitrary file read via bulk import — each surfaced as a validated attack step in the report.

Exploitation & C2 · 2026-08-10

ADscan v10.0.0 adds integrated password cracking, broadcast poisoning capture, a harvest command, jobs command, resumable scans, and native macOS/ARM64 support.

• Adds a harvest command providing a single view of every credential obtained during a scan (captured, cracked, and sprayed), each tagged with its privilege tier and reachable assets, plus an end-of-scan harvest summary.
• Adds a jobs command to list, review, and stop long-running background tasks such as broadcast-name-resolution poisoning capture and password cracking.
• Adds cracking-effort and poisoning controls to the YAML scan-config file and the web platform.

AI/LLM Security · 2026-08-10

AI SAFE2 v3.0 adds lovable-sovereign-runtime with subagent file-access gating and 21 enforced controls for the Lovable platform.

• Adds scan_subagent_file_access() enforcement gate that intercepts file path lists before Lovable subagents read them, blocking access to credential files (e.g. .env.production) by path pattern to close the subagent exfiltration gap.
• Ships examples/lovable-sovereign-runtime enforcement package covering a new sixth attack surface, LV-SUBAGENT, missed by the prior five-surface design.
• Adds workspace-knowledge/ai-safe2-workspace-knowledge.md, a no-code drop-in for Lovable → Settings → Knowledge → Workspace knowledge that applies AI SAFE2 trust boundary rules to every future agent session workspace-wide.

AI/LLM Security · 2026-08-10

AI SAFE² adds CP.11 (Unbiased AI Standard): 27 controls, 8 bias classes, published test thresholds, and a GSAR 552.239-7001 evidence package.

• Adds STANDARD.md (Sections 1–8) as the normative specification for CP.11, covering scope, definitions, requirements, testing, evidence, and independent review criteria.
• Adds taxonomy/bias-taxonomy.md defining UAS-B1 through UAS-B8 — an 8-class bias taxonomy, each mapped to a pillar source, CSF domain, and GSAR trigger, including UAS-B8 (Foreign Regulatory Embedding) as the first published methodology for detecting model modifications made to satisfy foreign regulators.
• Adds controls/uas-controls-system.md with 27 controls: 14 system-side (pillars P1–P5 and NEXUS), 8 human-side sourced from Cognitive Sovereignty Framework Domains 1–6 (UAS-H1 through UAS-H8), and 5 cross-domain bridge controls.

Malware Analysis · 2026-08-10

CAPEv2 adds Remus malware detection, a threat-intelligence processing module (ThreatFox + Malpedia), and PCI vendor ID spoofing to defeat Al-Khaser VM checks.

• New modules/processing/threatintelligence.py processing module (runs at order=22) queries ThreatFox for contacted IPs/domains and Malpedia for malware family cards, annotating network hosts with threat tags and writing results to results['threatintelligence'] with providers, indicators, families, and stats keys.
• New Remus malware family detection and dynamic config extraction added to CAPE's detection pipeline.
• New PCI vendor ID spoofing capability to bypass Al-Khaser QEMU detection checks (Qemu.cpp vendor ID fingerprint).

Identity & Access Management · 2026-08-10

Clerk adds CIMD beta for OAuth clients, Google Workspace Directory Sync, and strict enumeration protection for combined sign-in-or-up flows.

• Adds organizations.title and customSchemas.<schema>.<field> (e.g., customSchemas.EmployeeInfo.costCenter) as mappable custom attribute paths in Google Workspace Directory Sync, including array paths for multi-valued attributes.
• Adds signUpIfMissing option for custom sign-in flows to enable sign-in-or-up behavior without enabling strict enumeration protection globally.
• Adds sign_up_if_missing_password_preferred console warning on development instances when <SignIn /> detects an incompatible strict-protection + password configuration.

Vulnerability Management · 2026-08-10

Cloudmersive Private Cloud CDR API v2-13-4 adds metadata removal and tracking pixel removal options.

• Adds metadata removal option to the CDR (Content Disarm and Reconstruction) API.
• Adds tracking pixel removal option to the CDR API.

Identity & Access Management · 2026-08-10

• New Identities & NHI dashboard (under the main navigation) provides a unified, filterable, searchable, and exportable inventory of human users, service accounts, API secrets, agents, and other non-human identities across all connected apps, with credential-to-identity linking and unowned NHI flagging.
• TypeScript typing and autocomplete for @c1/functions-sdk and @c1/test now available in the function editor, surfacing misspelled methods and wrong argument types at edit time rather than runtime.
• Task details drawer now shows what the reviewed resource has access to inline, so reviewers no longer need to leave the task to gather context.

SAST / SCA / Code Security · 2026-08-10

cve-lite-cli v1.28.0 adds --check-maintenance (DM001), advisories init, and release-cooldown-aware fix warnings

• New --check-maintenance flag (rule DM001) flags direct dependencies that block a transitive CVE fix via major-version constraint drag, or that are deprecated on npm; renders in terminal, JSON, multi-folder, and HTML report, and counts toward --fail-on (high severity for constraint drag, medium for deprecated packages).
• New advisories init subcommand creates an empty offline advisory database for air-gapped environments to populate manually.
• New cooldown-aware fix resolver reads min-release-age (npm .npmrc), minimumReleaseAge (pnpm), and npmMinimalAgeGate (yarn) and warns when a recommended fix version is newer than the configured release window; advisory only, on by default, no flag or exit-code change, renders in terminal, --verbose, JSON, and HTML report (npm/pnpm/yarn; Bun not yet covered).

SAST / SCA / Code Security · 2026-08-10

cve-lite-cli v1.27.0 adds two phantom-dependency rules, SARIF fingerprinting for GitHub Code Scanning, and flexible path-first argument ordering.

• Adds --sarif output with ruleIndex, kind: "open", and partialFingerprints fields for full GitHub Code Scanning compatibility; shared fingerprint logic extracted to src/utils/sarif.ts.
• Adds overrides --json output written to a timestamped file, consistent with the main scan path.
• Adds path-first argument ordering: cve-lite <path> overrides [flags] now works alongside cve-lite overrides <path> [flags].

AI/LLM Security · 2026-08-10

Daytona 0.199.0 adds time-to-live control over sandbox lifetimes and raises the Python floor to 3.10.

• Adds sandbox TTL (time-to-live) support, enabling automatic expiry control over sandbox lifetimes.

SAST / SCA / Code Security · 2026-08-10

• Ships one-shot Deepsec initialization (coordinator.ts) to scaffold a project from scratch without manual setup steps.
• Introduces stable, deterministic findingId values (SHA-256 of projectId + normalized path + title) assigned at append time and lazily backfilled on old records, so finding identity survives across revalidation runs.
• Adds permissive verdict reconciliation for revalidate: verdicts now match by alias/findingId → exact title → normalized title → unique 1:1 remainder, with a matchedBy diagnostic recorded per match, replacing the previous exact-equality-only approach that silently dropped mismatched verdicts.

SAST / SCA / Code Security · 2026-08-10

DependencyCheck v13.0.0 drops Nexus V2 and deprecated config options, adds OpenSSL 3.x detection.

• Adds OpenSSL 3.x detection to the OpenSSLAnalyzer, enabling accurate identification of modern OpenSSL versions in scanned dependencies.
• Drops Nexus V2 Search support and all previously deprecated configuration and integration options (see breaking changes).

Agentic Infrastructure · 2026-08-10

emisar v0.39.0 overhauls runbook versioning to track decisions, adds MCP slug-keyed API, and expands secret redaction.

• Adds get_runbook and update_runbook_draft MCP endpoints keyed by slug, so agents replace only the single unpublished change under the hash they read; publication remains human-only.
• Runbook versioning now tracks published releases (e.g. Run v3) rather than counting every save, with a single in-flight draft per runbook instead of unbounded version rows.
• Publishing now shows a diff of changed lines against the exact canonical text whose hash defines the release, requiring explicit consent plus the hash of what you read before an unpublished change can run.

Secure Access (VPN / SASE / ZTNA) · 2026-08-10

Gateway 1.6.0 enables GRO/GSO on Linux 6.2+ TUN devices, roughly doubling single-stream TCP throughput through the tunnel.

• Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.
• Lowers the system-wide net.core.wmem_max to 2 MB and net.core.rmem_max to 16 MB on the Gateway, reducing UDP send and receive socket buffer sizes.
• Speeds up recovery after all relays are lost by immediately requesting a fresh relay set from the portal.

Secure Access (VPN / SASE / ZTNA) · 2026-08-10

Linux GUI 1.5.16 enables GRO/GSO on the TUN device for Linux 6.2+, roughly doubling single-stream TCP tunnel throughput.

• Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.
• Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

Secure Access (VPN / SASE / ZTNA) · 2026-08-10

Firezone Linux Headless 1.5.11 enables GRO/GSO on TUN devices for Linux 6.2+, roughly doubling single-stream TCP tunnel throughput.

• Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.
• Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.
• Improves reconnection speed after a network change.

Container & Image Security · 2026-08-10

Kata Containers 4.0 rewrites the runtime in Rust, ships Dragonball VMM by default, and adds dm-verity, EROFS, virtio-mem, and VFIO cold-plug.

• Introduces runtime-rs, a full Rust rewrite of the Kata Containers runtime, now the default runtime replacing the original Go runtime.
• Adds Dragonball as a built-in VMM default, supporting virtio-net, virtio-blk, and VFIO device passthrough without requiring QEMU or Cloud Hypervisor.
• Adds support for EROFS snapshotter, available through Helm configuration, with kata-deploy validating EROFS prerequisites before installation.

Container & Image Security · 2026-08-10

Kubescape v4.0.11 adds GitLab SAST output, quarantine remediation, AWS ECR vuln adaptor, CEL controls scanning, and OCI/local patch exports

• Adds gitlab-sast as a new --format output option via feat(printer): add GitLab SAST report output format, enabling native GitLab Security Dashboard integration.
• Adds quarantine action to the kubescape operator remediate CLI subcommand for isolating non-compliant workloads.
• Adds OCI and local export targets to kubescape patch, expanding patched image delivery options beyond remote registries.

Reconnaissance & OSINT · 2026-08-10

Nmap gains TLS close_notify tolerance, SSL service portrule coverage, and signal propagation to child processes with -k.

• Adds -k signal propagation: termination signals (INT/TERM/HUP) are now caught and forwarded to the entire process group, then Ncat exits with 128 + signum, ensuring child processes are not orphaned.
• NSE scripts now include s (SSL-protected) service names — such as amt-soap-https — in their portrules, so scripts run against SSL-wrapped services as well as their standard unencrypted counterparts.
• Nmap now tolerates TLS peers that do not send close_notify, preventing spurious scan failures against non-compliant TLS targets.

SAST / SCA / Code Security · 2026-08-10

npq v3.25.0 auto-detects coding-agent environments and switches output and parsing to JSON mode

• Detects coding-agent environments automatically and defaults both audit output and package parsing to JSON mode when running inside one.
• Defaults audit output to JSON format when a coding-agent environment is detected, enabling structured, machine-readable results without manual flags.
• Defaults package parsers to JSON-safe mode in coding-agent environments, rejecting inputs like credential-bearing URLs that are unsafe to process as JSON.

SAST / SCA / Code Security · 2026-08-10

npq v3.24.0 adds a --json flag for non-interactive, machine-readable audit-only output

• Adds --json CLI flag that emits a versioned JSON audit report and never proceeds to install, enabling CI and scripted pipelines to consume npq results programmatically.
• Routes --json invocations to an audit-only output path, bypassing interactive prompts and auto-continue behaviour.
• Captures and surfaces incomplete audit check results within the JSON report so callers can distinguish fully-evaluated from partially-evaluated signals.

Endpoint Security (EDR/XDR) · 2026-08-10

numbat v0.1.1: initial release — endpoint visibility into AI agent activity with local detection, blocking, and forensic reconstruction.

• Adds numbat hook install --agent NAME|all and numbat hook uninstall --agent NAME|all to wire and remove live integrations for supported desktop, CLI, IDE, and gateway AI agents.
• Adds numbat hook status [--agent NAME|all] to inspect numbat-owned live integration configuration.
• Adds numbat scan [--agent NAME ... | --path FILE|DIR ...] for read-only forensic reconstruction from on-disk agent session artifacts, emitting versioned NDJSON records without prior instrumentation.

Identity & Access Management · 2026-08-10

Okta for AI Agents beta adds AI agent discovery for Microsoft Copilot Studio and an Agent Gateway

• Enables Identity Security Posture Management (ISPM) to discover AI agents for Microsoft Copilot Studio
• Introduces Endpoint AI agent discovery for identifying AI agents across endpoints
• Adds Agent Gateway as a new beta capability within the Okta for AI Agents platform

AI Coding Agents · 2026-08-10

OpenCode v1.18.16 adds right-click project menu in the desktop Home screen and resilient project picker fallback.

• Adds right-click on a project in the desktop Home screen to open the project menu.
• Unknown top-level config fields are now silently ignored instead of failing config parsing, making config files forward-compatible.
• Projects opened from the Home screen are now registered so they are available throughout the rest of the app.

SAST / SCA / Code Security · 2026-08-10

sbomify now publishes an API — 187 endpoints across 17 areas: Artifacts, Controls, Cle, …

• Artifacts (23 endpoints) — create, read, update, delete
• Controls (21 endpoints) — create, read, update, delete
• Cle (20 endpoints) — create, read

SAST / SCA / Code Security · 2026-08-10

sbomify v26.7.1 adds end-to-end VEX authoring/ingestion, CBOM support, and Trust Center posture downloads.

• Component SBOMs list endpoint gains version and format filtering parameters.
• Adds VEX end-to-end workflow: author, upload, and ingest VEX documents in CycloneDX, OpenVEX, and CSAF formats.
• Adds in-product VEX triage and lifecycle management, with opt-in Dependency-Track triage sync auto-pinned to releases.

Detection Engineering · 2026-08-10

Tenzir v6.10.0 adds beacon-detection analytics (deltas, mad, skewness, autocorrelation, dominant_period, ewma) and auto-detects NetFlow/IPFIX.

• Extends json and low_cardinality arguments of to_clickhouse to accept nested fields (e.g., json=file.xattributes), not just top-level ones.
• Adds ocsf::cast integration with to_clickhouse so freeform OCSF fields are automatically typed as ClickHouse JSON columns.
• Adds deltas() list method to compute successive differences of a sorted list of timestamps, yielding typed inter-arrival durations.

Detection Engineering · 2026-08-10

Tenzir v6.10.0 adds native time-series analytics for beacon detection

• Adds native time-series analytics capability for beacon detection.

Detection Engineering · 2026-08-10

Tenzir v6.10.0 adds native beacon detection with cadence analysis, periodicity, and exponentially weighted statistics in TQL

• Adds deltas, mad, and skewness TQL functions for cadence analysis, enabling time-between-events and jitter calculations needed for beacon detection.
• Adds autocorrelation, periodogram, and dominant_period TQL functions for periodicity detection to identify regularly scheduled C2 callbacks.
• Adds exponentially weighted moving average functions for streaming anomaly detection over time-series data.

Detection Engineering · 2026-08-10

Tenzir v6.10.0 adds native time-series analytics for beacon detection.

• Adds native time-series analytics capability aimed at beacon detection use cases.

Detection Engineering · 2026-08-10

Tenzir v6.10.0 adds native beacon-detection analytics with cadence and periodicity functions, plus ClickHouse JSON improvements.

• Adds cadence analysis functions deltas, mad, and skewness to TQL for research-grade beacon and anomaly detection.
• Adds periodicity detection functions autocorrelation, periodogram, and dominant_period to TQL for identifying periodic C2 beacon patterns.
• Adds non-top-level JSON column support and automatic JSON column detection to to_clickhouse, including detection after ocsf::cast.

Endpoint Security (EDR/XDR) · 2026-08-10

File Security Storage v4.4.0 adds configurable cloud classification timeouts, retry counts, and AWS China region support.

• Adds FileSecurityStorageScannerICRCQueryTimeoutMs deployment parameter to set a configurable timeout for cloud classification queries (default: 6000 milliseconds).
• Adds FileSecurityStorageScannerICRCQueryRetryCount deployment parameter to set a configurable retry count for timed-out cloud classification queries (default: 3 retries; set to 0 to disable retries).
• Supports deployment to AWS China (aws-cn) regions.

Endpoint Security (EDR/XDR) · 2026-08-10

Zero Trust Secure Access On-premises Gateway 1.0.90 upgrades prompt injection detection and enriches AI/MCP access logs.

• Adopts the latest Prompt Scan engine to improve detection accuracy for prompt injection and harmful prompts.
• Enriches activity and detection logs with greater visibility into AI service access and MCP server access.

Reconnaissance & OSINT · 2026-08-10

web-check 2.2.0 adds subdomain lookup, a Vulnerabilities panel, an Advisory panel, and configurable check disabling.

• Adds a new Vulnerabilities panel with improved WAF detection for scanned targets.
• Adds an Advisory panel surfacing security advisories in the results UI.
• Adds subdomain lookup as a new check capability.

Identity & Access Management · 2026-08-09

Auth0 adds Session Delegation via Custom Token Exchange, GA Google Workspace Group Sync, and advanced Organizations Search filtering.

• Adds Session Delegation via Custom Token Exchange: requesting a Custom Token Exchange token with a session_transfer audience returns a Session Transfer Token, preserving both sub (the delegated user) and the RFC 8693 act claim (the acting party) throughout the session.
• Google Workspace Inbound Directory Sync for Groups and Group Membership is now Generally Available for all Auth0 customers.
• New paginated, searchable table in the Auth0 Management Dashboard lets tenant admins browse, filter, and search synced Google Workspace groups.

Attack Surface & Exposure Management · 2026-08-09

Axonius 9.0.3 adds 7 new adapters, a Preferred Last Seen user field, Security Finding count fields by risk level, and dozens of adapter and enforcement enhancements.

• New AI Recommended Action Plans optional field in the Recommended Actions table enables exporting detailed AI-generated action plans to CSV.
• New Total SF Count: Critical/High/Medium/Low Axonius Risk Level fields on the Devices table let users query and count non-CVE Security Findings by risk level.
• Checkmarx SAST adapter adds an optional OData API connection method as an alternative integration path, configurable via a new connection setting.

Digital Forensics & Incident Response · 2026-08-09

Belkasoft X adds Mobile Passcode Brute-Force module for iOS and Android forensic passcode recovery

• New Mobile Passcode Brute-Force module in Belkasoft X recovers passcodes from supported iOS devices (iPhone 5 through iPhone 7 Plus, select iPads, iOS 9–15) by lifting login-attempt restrictions, including when iOS USB Restricted Mode is enabled, then unlocking the device for forensic acquisition.
• Android support covers MediaTek (MT6731–MT6893 chipsets at 60 passwords/second), Kirin 970/980-based Huawei/Honor devices (80 passwords/second), and Unisoc (A7862–T820 chipsets at 50+ passwords/second) via offline passcode recovery from acquired cryptographic data, followed by full image decryption.
• Supports custom passcode dictionaries alongside predefined PIN-priority dictionaries, enabling investigators to front-load case-specific combinations before falling back to full brute-force search.

Password & Credential Cracking · 2026-08-09

bruteforce-salted-openssl adds regex support for the -M magic-bytes matcher, enabling binary file-type matching

• The -M flag now accepts POSIX extended regex patterns in addition to exact strings, allowing magic-byte matching against binary file formats (PNG, JPEG, MP3, MP4, PDF, etc.) whose headers contain non-printable bytes that previously defeated the strncmp-based check.

Integrated & IT Risk Management · 2026-08-09

CISO Assistant v3.21.0 adds TTP/threat modeling with MITRE ATLAS, a visual workflow engine, focus-scoped permissions, and service account management.

• Introduces TTP support and threat modeling capabilities, including the MITRE ATLAS framework.
• New visual workflow engine with a drag-and-drop builder for automating security processes.
• Adds focus-mode with scoped permissions and enhanced user context controls.

AI Coding Agents · 2026-08-09

Cline desktop v0.0.11 adds clipboard image paste, OAuth prompts for MCP 401s, durable session context, and smarter checkpoint tracking.

• Supports pasting images directly from the clipboard into the composer.
• Remote SSE MCP servers now surface an OAuth authorization prompt on a 401 response instead of failing outright.
• LiteLLM requests now route through Chat Completions instead of the Responses API.

AI Coding Agents · 2026-08-09

Cline v4.1.7 restores View Changes checkpoint review, adds copy on turn responses, and supports pre-registered OAuth for remote MCP servers.

• Supports pre-registered OAuth clients for remote MCP servers, enabling use in setups where dynamic client registration is unavailable.
• Adds a copy button to turn-final response rows.
• Carries execution context in scheduled run reports, including readable headers, schedule metadata, durations, and lifecycle error details.

AI Coding Agents · 2026-08-09

Cline CLI v3.0.52 adds cline mcp uninstall, richer scheduled-run reports, and OAuth support for SSE MCP servers.

• Adds cline mcp uninstall subcommand for removing an installed MCP server.
• Scheduled run reports now carry execution context: readable headers, schedule metadata, durations, and lifecycle error details.
• Remote SSE MCP servers surface an OAuth authorization prompt on a 401 response instead of failing; pre-registered OAuth clients are supported for setups without dynamic client registration.

AI Coding Agents · 2026-08-09

Cline SDK v0.0.72 adds OAuth for remote MCP servers, durable session context, and richer scheduled run reports.

• Remote SSE MCP servers now surface an OAuth authorization prompt on a 401 instead of failing outright, and support pre-registered OAuth clients for setups where dynamic client registration is unavailable.
• Failed queued turns are now reported as run.failed instead of completing silently, giving callers a reliable error signal.
• Scheduled run reports now carry execution context including readable headers, schedule metadata, durations, and lifecycle error details.

Identity & Access Management · 2026-08-09

ConductorOne adds an NHI dashboard, AI campaign assistant, public API campaign reports, and date/user form fields in its August 7 release.

• New Identities & NHI dashboard (under Identity security) provides a unified, filterable, searchable, exportable inventory of human users, service accounts, API secrets, agents, and other non-human identities across all connected apps — with credentials automatically linked to their owning identity and unlinked credentials flagged separately.
• AI agents (both ConductorOne-managed and app-discovered) now appear as a first-class category in the NHI dashboard, with context on where they live.
• Bulk-revoke is now available for denied reviews: select multiple denied items from a campaign's Access reviews tab and revoke all at once.

Endpoint Security (EDR/XDR) · 2026-08-09

Corellium adds CoreHDL, letting developers plug simulated hardware into virtual devices for design, verification, and bring-up.

• New CoreHDL hypervisor feature enables developers to connect simulated hardware into virtual devices for hardware design, verification, and bring-up workflows.

Endpoint Security (EDR/XDR) · 2026-08-09

Corellium adds CoreHDL, enabling simulated hardware to be plugged into virtual devices for hardware design and verification.

• New CoreHDL hypervisor feature lets developers connect simulated hardware peripherals into virtual devices for hardware design, verification, and bring-up workflows.

AI/LLM Security · 2026-08-09

Daytona 0.200.0 enforces TLS verification, tightens config file permissions, and adds configurable HTTP timeouts to the Go SDK.

• Go SDK now supports a configurable HTTP timeout to handle long-running executions reliably.
• Enforces TLS verification in the Ruby Socket.IO client.
• CLI config file is now created with 0600 permissions, restricting access to the owner only.

Identity & Access Management · 2026-08-09

Didit MCP server adds 115 tools spanning AML, Travel Rule, webhooks, and billing to Claude

• Adds a Didit MCP server for Claude (MIT-licensed, source on GitHub) exposing 115 tools across sessions, workflows, AML, Travel Rule, marketplace, lists, webhooks, and billing.
• Provides a one-click Add Didit to Claude connector that pre-fills the Claude integration dialog for instant setup.

Identity & Access Management · 2026-08-09

Didit guarantees a retry on capture-condition failures even when face_liveness_max_attempts: 1 is set

• Adds a guaranteed retry for capture-condition failures (codes that describe the environment, not the person): when an attempt fails on those codes, the user always gets a second attempt with a coaching message, even when face_liveness_max_attempts: 1 is configured — all other failure codes still respect the configured attempt budget exactly.

Web Application Security · 2026-08-09

dirsearch exposes a public Python API and adds a --wordlist-status inspection mode; now requires Python 3.11+.

• Exports a public Python API via from lib.core.api import DirsearchFuzzer, FuzzerConfig, FuzzerResult, Wordlist, WordlistState, WordlistTemplate — enabling programmatic embedding of dirsearch fuzzing in other tools.
• Adds wordlist_status mode (driven by options['wordlist_status']) that prints wordlist file count, individual file paths, generated entry count, and the wordlist_max_size generation limit, then exits — useful for verifying wordlist configuration before a scan.
• Warns users when loading a session file via options['session_file'] that it will override current options, requiring explicit [c]ontinue confirmation.

Secure Access (VPN / SASE / ZTNA) · 2026-08-09

DNSFilter adds one-click Investigate Mode, a Policies filter in Query Log, customizable dashboards, and Splashtop AppAware support.

• Adds Investigate Mode to the Query Log — a one-click control that scopes the log to a specific query's timestamp and deployment context with ±5s, ±10s, and ±15s selectable time windows.
• Adds a Policies filter to the Query Log, letting admins scope traffic to one or more active policies alongside existing filters.
• Introduces a preview of Customizable Dashboards: build and rearrange widget layouts, apply dashboard-wide filters, save named views with personal defaults, and share views publicly or across an MSP's organizations.

Agentic Infrastructure · 2026-08-09

Emisar v0.38.0 adds invalid-glob warnings for policy overrides and fixes silent runbook drops and session disconnect failures.

• Adds a real-time advisory warning when a policy override glob cannot match any action ID (e.g. regex-style patterns like cassandra\.drop_*), flagging deny rules that appear protective but cover nothing — warning is non-blocking to allow rules targeting not-yet-installed packs.
• Ending a member's sessions now disconnects the live console session itself, not only the cookie behind it, so administrator-initiated session termination during an incident takes effect immediately.

Endpoint Security (EDR/XDR) · 2026-08-09

Fleet 4.90.0 adds multi-package deployments, in-place profile editing, custom host vitals, host naming templates, Python packages, Splunk HEC logging, and more.

• Adds PATCH /api/v1/fleet/configuration_profiles/:profile_uuid to edit existing configuration profiles (Apple .mobileconfig, Apple DDM declarations, Windows, and Android) in place.
• Adds POST /api/v1/fleet/host_name_template to set or clear a host naming template; omitting fleet_id or setting it to 0 targets No team, and an empty template clears enforcement without renaming any host.
• Adds name_template key under controls in GitOps for fleets and No team, included in fleetctl generate-gitops output.

Wireless & RF · 2026-08-09

hcxtools build system gains explicit curl, openssl, and zlib feature options in meson_options.txt

• Adds curl feature option to meson_options.txt to selectively build tools relying on libcurl.
• Adds openssl feature option to meson_options.txt to selectively build tools relying on OpenSSL.
• Adds zlib feature option to meson_options.txt to enable zlib support specifically for hcxpcapngtool.

Identity & Access Management · 2026-08-09

iDenfy Sprint 132 adds Age Estimation in the dashboard, new digital IDs, PAYG social login, and KYB risk results via API.

• Age Estimation is now available in the dashboard, covering session creation, filtering, and result details.
• Company verification API now returns risk assessment results in its response payload.
• Adds configurable KYB company expiration period.

Post-Exploitation · 2026-08-09

Impacket gains new atexec tampering flags, ADCS altSid embedding, MSSQL enhancements, ntlmrelayx options, and trust-key dumping.

• Adds --altSid flag to adcs to embed szOID_NTDS_CA_SECURITY_EXT in a CSR, enabling SID embedding in certificate requests.
• Adds -author-log and -overflow flags to atexec for Event 4698 Author field tampering.
• Adds --dump-userinfo option to ntlmrelayx to capture and display relayed user info.

Post-Exploitation · 2026-08-09

impacket gains native SOCKS proxy options, FILE-prefix KRB5CCNAME support, and new atexec Event 4698 tampering flags

• Adds -author-log and -overflow flags to atexec for Event 4698 Author field tampering.
• Adds support for the FILE: prefix in the KRB5CCNAME environment variable when specifying ccache paths.
• Adds Native SOCKS Proxy Options across impacket examples.

Post-Exploitation · 2026-08-09

Impacket gains -author-log and -overflow options to manipulate Task Scheduler Security Event 4698 Author field

• Adds mutually exclusive -author-log and -overflow options to poison or overflow the Task Scheduler Security Event 4698 Author field via task XML RegistrationInfo.

Post-Exploitation · 2026-08-09

atexec gains -author-log and -overflow flags for Event 4698 author field tampering

• Adds -author-log and -overflow flags to atexec to enable Event 4698 author field tampering for log evasion during scheduled task execution.

Post-Exploitation · 2026-08-09

Impacket gains native SOCKS proxy support, FILE-prefix KRB5CCNAME handling, and new relay servers

• Adds native SOCKS proxy options across example scripts (PR #1903, branch TheHackHouse:socks).
• Supports FILE: prefix in KRB5CCNAME environment variable for ccache credential loading (PR #2250, branch p-nowodzinski:fix-krb5ccname-file-prefix).
• Adds -author-log and -overflow flags to atexec for Event 4698 Author tampering (PR #2519).

SAST / SCA / Code Security · 2026-08-09

Lakera AI Guardrails adds custom PII/content detectors, unknown-link detection with allow lists, custom allow/deny lists, and a Policy Impact Simulator for incident response.

• Adds custom regex-based detectors for arbitrary content patterns — including internal employee IDs, national IDs, or competitor name mentions — matching case-insensitively and as standalone words.
• Adds an Unknown Links detector that flags URLs outside the top one million most popular domains to prevent phishing links being returned by an LLM via data poisoning or indirect prompt injection.
• Supports a custom domain allow list in policy configuration so that internal or niche-but-safe domains are never flagged by the Unknown Links detector.

SAST / SCA / Code Security · 2026-08-09

Lakera adds allow and deny lists to override AI Guardrails detector decisions using fuzzy match patterns.

• New allow list support lets practitioners override false positives by adding a full prompt string so matching content passes through without being flagged, regardless of policy configuration.
• New deny list support forces detection of specific content via fuzzy substring matching, flagging any close match in Flagging mode regardless of detector confidence — useful for overriding false negatives.
• Both lists use fuzzy match patterns and operate without modifying the underlying model behavior, enabling lightweight, on-the-fly tuning of Check Point AI Guardrails decisions.

SAST / SCA / Code Security · 2026-08-09

Lakera adds Off-Task Action detector and Tool Allow/Deny List controls for agent runtime protection via the Guard API.

• New Off-Task Action detector identifies tool calls inconsistent with the user's intent in the conversation, returning reason text explaining the inconsistency; enable it in your policy and include conversation history and the tool call in your Guard API request.
• New Tool Allow List mode detects tool calls for any tool not on a permitted list — use when an agent has a fixed, known set of tools it should ever use.
• New Tool Deny List mode detects tool calls for tools explicitly on a blocked list — use to restrict specific high-risk tools while leaving all others unrestricted.

SAST / SCA / Code Security · 2026-08-09

Lakera adds Detection and Flagging modes so threat response behavior can be switched without code changes.

• Introduces Detection and Flagging modes, letting practitioners change how an application responds to detected threats without modifying code.

SAST / SCA / Code Security · 2026-08-09

Lakera adds unknown-link phishing detection, Off-Task Action detector, and Tool Allow/Deny List for AI agents.

• New Off-Task Action detector identifies tool calls inconsistent with the user's intent, keeping AI agents within policy.
• New Tool Allow/Deny List controls which tools an agent may call at runtime.
• Adds unknown-link detection to prevent attackers manipulating an LLM into displaying malicious or phishing links to users.

Identity & Access Management · 2026-08-09

Ping Identity adds AI agent identities, SAML metadata import options, PKCS5S2 migration, and optional custom report parameters.

• Adds the ability to skip signature verification when importing SAML metadata (OPENAM-26721).
• Adds support for migrating user accounts from the deprecated PKCS5S2 password hashing scheme to a more secure algorithm (FRAAS-33086).
• Adds the ability to mark parameters in custom reports as optional, giving more flexibility when running reports (IAM-10610).

Vulnerability Management · 2026-08-09

SploitScan adds directory-based import, fast mode, granular method selection, keyword CVE search, and local CVE database cloning

• Adds -f / --fast-mode flag to display only basic CVE information, skipping additional exploit and enrichment lookups for quicker results.
• Adds -m / --methods flag to select specific data retrieval methods to run (e.g., cisa,epss,hackerone,ai,prio,references), limiting output to only the requested sources.
• Adds -local / --local-database flag to clone or update the full CVE List V5 repository locally for offline CVE lookups.

Secrets Detection & Management · 2026-08-09

TruffleHog Enterprise adds source archiving to retire integrations while preserving findings, with a verification-frozen state and activity log entries.

• Adds source archiving (Enterprise only) to stop scanning an integration source permanently while retaining all findings it has already reported — accessible via the three-dot menu on any source row in Integrations.
• Archived sources display a gray archived badge and are hidden from the Integrations list by default; selecting Show archived in the filter bar reveals them in a dimmed state.
• Introduces a verification frozen badge on findings whose every contributing source has been archived — frozen findings retain their last known verification status but stop re-verifying, and are excluded from MTTR calculations.

Secrets Detection & Management · 2026-08-09

TruffleHog adds self-hosted verification support via customVerifiers config and --verifier CLI flags for enterprise instances.

• Adds customVerifiers field to the TruffleHog config YAML to route secret verification against self-hosted/on-prem endpoints for Artifactory, Bitbucket, Confluence, GitLab, GitHub, HashiCorp Vault, and Jira.
• Adds --verifier CLI flag to trufflehog to pass custom verifier endpoints at scan time, e.g. --verifier github=example1.github.com,example2.github.com.
• Supports named verifier types in customVerifiers: artifactoryAccessToken, artifactoryReferenceToken, hashicorpVaultAuth, jiraDataCenterPat, confluenceDataCenter, bitbucketDataCenter, and gitlab/github, each accepting one or more endpoints.

Secrets Detection & Management · 2026-08-09

TruffleHog Enterprise adds Shared Secrets — scoped, expiring links that let non-users review and rotate findings via SSO

• New Share Secrets feature converts a detected finding into a secure, access-controlled URL generated from the secret's detail page via the Share button in the upper-right corner.
• Share links require recipients to authenticate through a configured identity provider (Google SSO or SAML SSO) and are validated against a trusted domains allowlist configured under Settings > Shared Secrets > Edit Trusted Domains.
• Supports four expiration window options per link at creation time: on read, 1 hour, 1 day, 7 days, or 1 month; on read links expire after the first successful read.

Data Security & DLP · 2026-08-09

Varonis Atlas adds Agent IBAC to detect intent drift and block rogue AI agent activity in real time.

• Introduces Agent Intent-Based Access Control (IBAC) in Varonis Atlas to monitor AI agents for intent drift — validating that an agent's reasoning, tool use, and data access align with its original instructions, and alerting on or blocking deviations.
• Enables automatic identity quarantine when an agent crosses policy boundaries, blocking all subsequent actions for a defined window.
• Provides a complete cross-session audit trail for every agent interaction so security teams can confirm agent behavior in real time.

Digital Forensics & Incident Response · 2026-08-09

Two new exchange artifacts bring agentless Hayabusa Sigma analysis of uploaded EVTX files to Velociraptor 0.74+

• New Server.Analysis.Windows.EventLogs.Hayabusa artifact post-processes EVTX files already uploaded to the server by running the curated Hayabusa Sigma ruleset via Velociraptor's built-in Sigma engine — no Hayabusa binary deployed to endpoint or server.
• Accepts ClientId and FlowId parameters to target a specific completed collection flow, with EvtxRegex (default (?i)\.evtx$) to filter which uploaded files are scanned.
• Supports RuleLevel filter (choices: Critical, Critical and High, Critical, High, and Medium, Critical, High, Medium, and Low, All; default Critical and High) and RuleStatus filter (choices: Stable, Stable and Experimental, Stable and Test, All Rules; default Stable) to tune detection noise.

Local LLM Runtimes · 2026-08-09

vMLX 1.6.25 brings a 29–58% DeepSeek V4 prefill speedup, sub-3s retry TTFT via KV rewind, and honest 413 errors instead of Metal OOM crashes on extreme context lengths.

• New indexed-attention prefill kernel (on by default) lifts DeepSeek V4 Flash prompt processing from 347 to ~449 tokens/s at 15k context (+29%) and from 199 to ~316 tokens/s at 40k context (+58%), while sustaining 33+ tokens/s decode at both lengths.
• KV cache rewind on abort/retry: engine rewinds the live KV cache to the shared prefix instead of re-prefilling, dropping retry time-to-first-token at 15k context from 46s to 2.3s.
• Two-pass answer path now reuses the first pass's KV cache, eliminating a full prompt re-prefill on the second pass.

Network Analysis & Monitoring · 2026-08-09

Wireblast v0.2.3 enables zero-copy AF_XDP on AWS ENA NICs by using page-sized UMEM frames.

• Uses page-sized UMEM frames on ENA (AWS Elastic Network Adapter) NICs so that AF_XDP zero-copy mode works on ENA-backed instances.

Network Analysis & Monitoring · 2026-08-09

Wireblast v0.2.1: reset now clears drop/error counters and hides per-queue drop lines by default in the dashboard.

• Reset action now clears drop and error counters alongside rate counters.
• Per-queue drop lines are hidden by default in the live dashboard to reduce noise.

Network Analysis & Monitoring · 2026-08-09

Wireblast v0.2.0 adds IPv6 traffic generation and keep-management receive mode

• Adds IPv6 support, enabling UDP blasts and multi-flow generation across IPv6 destinations (see 022-ipv6-udp and 023-ipv6-flows examples).
• Adds --rx-mode keep-management receive mode, allowing broad packet capture on a shared NIC without disrupting the management connection.

Network Analysis & Monitoring · 2026-08-09

Wireblast v0.1.0: AF_XDP-based Linux traffic generator hitting 138 Mpps at line rate from a single static Go binary

• Adds -i, --dst-ip, --packet-size, --pps, -d, -y, and --no-tui flags for fully scriptable, wizard-free packet generation.
• Supports --mode receive with --rx-mode (e.g. udp-port) and --rx-port flags for AF_XDP-based packet reception and counting.
• New AF_XDP traffic generator for Linux using a single static Go binary — no cgo, no libpcap, no DPDK, no kernel modules.

AI/LLM Security · 2026-08-08

Adrian gains a Claude Code plugin with HITL verdict forwarding, three execution modes, and PII filtering for agent conversations.

• New Claude Code plugin (integrations/claude-code/adrian_cc/agent.py) connects Claude Code hooks directly to the Adrian backend via WebSocket, sending SessionLogin + PairedEvent protobuf messages and returning allow/deny/advisory verdicts.
• Supports three server-driven execution modes read from PolicySnapshot on LoginAck: MODE_ALERT (fire-and-forget, never blocks), MODE_BLOCK (waits for verdict, blocks per policy), and MODE_HITL (waits for human approval on the dashboard).
• Adds HITL verdict forwarding: human approval decisions made on the Adrian dashboard are now forwarded inline to Claude Code integrations tagged with the CC source.

Identity & Access Management · 2026-08-08

Auth0 My Account API gains endpoints to list, verify, create, and delete user authentication methods

• Adds GET https://{yourDomain}/me/v1/authentication-methods endpoint to list a user's enrolled authentication methods
• Adds POST https://{yourDomain}/me/v1/authentication-methods endpoint to create/enroll a new authentication method for the authenticated user
• Adds POST https://{yourDomain}/me/v1/authentication-methods/{id}/verify endpoint to verify a specific authentication method by ID

Identity & Access Management · 2026-08-08

Auth0 adds Session Delegation via Custom Token Exchange, letting authorized actors establish web sessions as another user with full audit trails.

• Requesting a Custom Token Exchange token with a session_transfer audience returns a Session Transfer Token instead of an access token, authorized by the same Action logic already controlling delegation.
• Delegated sessions are redeemed through the standard /authorize endpoint — no extra login step required for the target user.
• Both identities are preserved throughout: the sub claim identifies the user the session belongs to, while the act claim (RFC 8693) identifies the acting party (e.g. support agent).

Exploitation & C2 · 2026-08-08

Bugcrowd adds a DNS Records Report generation capability.

• New DNS Records Report available for generation within the platform.

Exploitation & C2 · 2026-08-08

Bugcrowd adds a DNS Records Report generation capability

• Adds the ability to generate a DNS Records Report within the platform.

Malware Analysis · 2026-08-08

CAPEv2 adds Remus malware detection & config extraction, a ThreatFox/Malpedia threat-intel module, and PCI vendor ID spoofing to defeat QEMU fingerprinting

• New modules/processing/threatintelligence.py processing module (runs at order=22) enriches analysis reports with two phases: an indicator phase that queries ThreatFox to annotate contacted IPs/domains with threat tags, and a family phase that fetches descriptive cards (name, aliases, description, references, attribution) from Malpedia for detected malware families; results are written to results["threatintelligence"] and surfaced in a collapsible Threat Intelligence report-page section.
• Adds Remus malware detection and dynamic config extraction.
• Adds PCI vendor ID spoofing to bypass Al-Khaser QEMU detection checks.

AI Coding Agents · 2026-08-08

v2.1.225 adds gateway spend-limit warnings, workspace trust in claude agents, and SendMessage can now initiate Remote Control sessions by name.

• Adds gateway spend-limit support to Claude Code's usage warning — the limit-reached message now names the cap, its reset time, and the operator's message (requires gateway on 2.1.225).
• Adds a workspace trust prompt to claude agents for untrusted directories, matching the existing behavior of claude.
• SendMessage can now initiate a conversation with Remote Control sessions on other machines by name — ListAgents surfaces them as name [ref] — instead of only being able to reply after they message you first.

Internet Services · 2026-08-08

Cloudflare unifies Workers AI + AI Gateway billing, launches Kitesurf browser, adds BGP routing APIs, and more.

• Adds browser=kitesurf parameter to Browser Run CDP and Quick Action endpoints to opt into Kitesurf, a new stateless browser using 3–7× less CPU and memory than Chromium for agentic workloads.
• Adds /bgp/routes/paths/{asn} Radar BGP API endpoint returning ordered AS path segments to Tier-1 networks, with collector parameter to scope to a single RouteViews collector.
• Adds /bgp/routes/upstreams/{asn}/timeseries Radar BGP API endpoint returning each direct upstream's share of observed paths over time, with limit and ipVersion parameters.

SAST / SCA / Code Security · 2026-08-08

Codacy adds GolangCI-Lint as a client-side Go analysis tool, uploadable to the Codacy dashboard.

• Adds GolangCI-Lint as a supported client-side tool for Go projects: run it locally or in CI, then upload results to Codacy for analysis and reporting.
• GolangCI-Lint is not enabled by default on existing repositories — must be enabled manually in repository settings to avoid a large volume of new issues appearing unexpectedly.

SAST / SCA / Code Security · 2026-08-08

Codacy adds PHP CS Fixer as a new analysis engine and gains support for Checkov configuration files.

• Adds PHP CS Fixer as a new supported Codacy engine for PHP code-style analysis, configurable via the Codacy UI or your repository's own .php-cs-fixer.dist.php or .php-cs-fixer.php file (Codacy-selected patterns take precedence over the repo config file).
• Adds support for Checkov configuration files (.checkov.yaml or .checkov.yml) in the repository, enabled via Repository > Code Patterns > Checkov > "Use Checkov configuration file found in the repository".

SAST / SCA / Code Security · 2026-08-08

Codacy now reads a .shellcheckrc file from your repository so ShellCheck settings no longer have to be managed through the UI.

• Adds support for a .shellcheckrc configuration file in the repository root to drive ShellCheck analysis, replacing UI-only configuration.
• Adds a new toggle — "Use Shellcheck configuration file found in the repository" — under Repository > Code Patterns > Shellcheck to activate file-based config.

Secure Access (VPN / SASE / ZTNA) · 2026-08-08

VNS3 7.2.1 upgrades to Linux 7.0 kernel; Plugin Catalog gains ARM/Intel differentiation and multi-version management.

• Plugin Catalog now differentiates between ARM and Intel capable plugins, reflecting potential release timeline differences between platforms.
• Plugin Catalog supports more intelligent version management, with listings enhanced to provide multiple versions and platform compatibility information.
• Upgraded from Linux 6.17.x kernel line to 7.0.0 in response to reported local privilege escalation findings against the 6.17 line.

Identity & Access Management · 2026-08-08

ConductorOne adds a Campaign Assistant that configures access review scope, policy, and owners from plain-language descriptions.

• New Create with Campaign assistant option lets practitioners describe an access review in plain language (e.g., "Review all Salesforce access granted in the last 90 days") and automatically configures the campaign's policy, owners, and scope.
• Supports targeting all entitlements of a given type within a specific app via Entitlements > entitlement type selector (e.g., all groups within Google Workspace), in addition to individual entitlement or Application access selections.
• Adds Custom selectors as a scoping option when building campaigns, enabling more granular entitlement targeting alongside the standard entitlement-type and application-access approaches.

Identity & Access Management · 2026-08-08

ConductorOne adds Copilot Studio and ChatGPT/Cursor as supported AI tool integrations.

• Supports connecting Copilot Studio to ConductorOne, including publishing the agent to Microsoft 365 Copilot.

Identity & Access Management · 2026-08-08

ConductorOne adds NHI dashboard, public API for campaign reports, and TypeScript-aware function editor in its August 2026 release.

• New Identities & NHI dashboard provides a unified, filterable, searchable, exportable inventory of human users, service accounts, API secrets, agents, and other non-human identities across all connected apps — with unowned or risky NHIs flagged automatically.
• Campaign report generation (JSON/CSV/XLSX) is now available via the public API, including for in-progress campaigns — eliminating the manual UI-export-and-transfer step.
• New Create with Campaign assistant on the Campaigns page lets users describe an access review in plain language and have policy, owners, and scope configured automatically.

AI/LLM Security · 2026-08-08

Daytona 0.199.0 adds sandbox time-to-live (TTL) control via SDK and CLI.

• Adds sandbox TTL support to the SDK and CLI, enabling time-to-live control over sandbox lifetimes.

SAST / SCA / Code Security · 2026-08-08

deepsec gains --thinking-level, one-shot initialization, stable finding IDs, and a broadened SSRF matcher.

• Adds --thinking-level CLI flag to control agent reasoning depth during scans.
• Ships one-shot Deepsec initialization (PR #139) to bootstrap a workspace in a single command.
• Introduces stable finding IDs and permissive verdict reconciliation in the revalidate workflow, backed by ensureFindingIds and reconcileVerdicts.

SIEM · 2026-08-08

Elastic Agent CEL integration snapshots .npmrc on a 6-hour heartbeat to detect silent removal of npm's min-release-age setting

• Adds a ~40-line Common Expression Language (CEL) integration in Elastic Agent that snapshots every .npmrc on a 6-hour heartbeat and marks cooldown.absent = true in the ingest pipeline when min-release-age disappears between snapshots.
• Uses the file() and dir() CEL functions to enumerate user home directories at runtime (under /Users and /home) and machine-global npm config paths (/opt/homebrew/etc/npmrc, /usr/local/etc/npmrc, /etc/npmrc, /usr/lib/node_modules/npm/.npmrc), covering macOS and Linux with a single script.
• Sets resource.url: file:///dev/null to satisfy the CEL integration's required URL field without making an HTTP request, with global paths and poll interval supplied via the Custom request cursor YAML field in Fleet UI.

Digital Forensics & Incident Response · 2026-08-08

ElcomSoft releases EIFT Firewall, a free macOS companion app for safe iOS extraction agent sideloading

• New free macOS application EIFT Firewall creates a temporary, controlled USB network path between a Mac and a connected evidentiary device to safely sideload the Elcomsoft iOS Forensic Toolkit low-level extraction agent, replacing the macOS firewall script published in 2023.

Firewalls & Network Defense · 2026-08-08

Fastly CLI v15.6.0 adds the audit-log event-mapping command group for managing audit log event mappings.

• Adds audit-log event-mapping command group to the Fastly CLI for managing audit log event mappings.

Secrets Detection & Management · 2026-08-08

GitGuardian adds 7 new detectors, a Supabase JWT checker, and broader PostgreSQL username matching across two August 2026 releases.

• Adds OpenCode API Key detector for OpenCode API keys.
• Adds Lovable Access Token detector for Lovable project access tokens.
• Adds Lovable Git Token detector for Lovable git tokens.

SIEM · 2026-08-08

Google SecOps adds 26 new log source integrations and self-service Bindplane Enterprise license download for Enterprise Plus and GUS customers.

• Adds self-service Bindplane Enterprise (Google Edition) license key download directly from SIEM Settings > Collection Agents for Enterprise Plus and Google Unified Security (GUS) customers (Preview).
• Adds ARMIS_ALERTS (Armis Alerts) as a supported log ingestion source.
• Adds GCP_SECURITYCENTER_EXTERNAL_EXPOSURE (Security Command Center External Exposure) as a supported log ingestion source.

Agentic Infrastructure · 2026-08-08

API surface changed: +1 endpoint, 6 modified

• New endpoint GET /api/settings/metrics/live
• GET /api/organizations/{name}/service-accounts/{serviceAccountId}: response schema changed
• PATCH /api/organizations/{name}/service-accounts/{serviceAccountId}/tokens/{tokenId}: request body changed; response schema changed

Endpoint Security (EDR/XDR) · 2026-08-08

Huntress launches redesigned Managed ITDR Dashboard in Early Access with rapid triage, login characterization, and SIEM search.

• New Rapid Identity Triage panel lets you enter a user's email to get an immediate overview of all activity over the past 24 hours, with options to export a timeline, revoke sessions, or disable the account.
• New Failed Login Characterization view shows failed login attempts globally with specific categorization by residential proxies, VPNs, and datacenters.
• New Quick SIEM Search surface within the ITDR dashboard provides pre-populated queries against the full Entra Unified Audit Log, stored in Huntress SIEM at no cost for ITDR customers for up to one year.

Secrets Detection & Management · 2026-08-08

Infisical v0.162.18 adds gateway support for Chef app connections and a new Modify Role action for project members.

• Adds gateway support to the Chef app connection, enabling Chef integrations to route through Infisical gateways.
• Adds a Modify Role action directly on project member role rows in the UI, allowing inline role changes without navigating away.

Endpoint Security (EDR/XDR) · 2026-08-08

Iru adds Apple beta program enrollment as a library item assignment criterion and refreshes the AI chat experience.

• Enables assigning library items based on Apple beta program enrollment status.
• Refreshed Iru AI chat experience with faster, smarter responses.

AI Agent Frameworks · 2026-08-08

LangGraph checkpoint 4.2.0 adds opt-in omit_expired flag to skip expired rows when reading checkpoint state.

• Adds opt-in omit_expired parameter to checkpoint reads (supported in checkpoint and checkpoint-postgres) to skip expired rows, preventing stale state from surfacing in long-running workflows.

Reconnaissance & OSINT · 2026-08-08

Nmap 7.991 adds SSL service name matching for portrules and fixes Ncat HTTP proxy hang, libssh2 CVEs, and DNS case matching.

• Adds 's' service names (e.g. amt-soap-https) to NSE portrules so scripts that run on standard unencrypted services also run on their SSL-protected equivalents.
• Ncat now propagates termination signals (SIGINT, SIGTERM, SIGHUP) to child processes when using -k keep-open mode, preventing orphaned children on shutdown.

AI/LLM Security · 2026-08-08

nono v0.72.0 adds static seccomp network baseline on Linux, explicit deny-path reporting in why, and drops openclaw/swival built-in profiles.

• The why subcommand now reports explicit deny paths from the sandbox policy, making it easier to diagnose why a network or filesystem access was blocked.
• Removes openclaw and swival as built-in profiles; users relying on them must pull the equivalent packages from the registry.

AI Coding Agents · 2026-08-08

Codex CLI adds migrate-rollouts subcommand, Markdown conversation export, session forking in codex exec, MCP event subscriptions, and a Guardian circuit-breaker for cyber models.

• Adds migrate-rollouts subcommand to inspect or migrate legacy local sessions to paginated thread history.
• Adds Markdown conversation export to the TUI.
• Adds session forking to codex exec.

AI Coding Agents · 2026-08-08

Codex CLI gains session forking, Markdown conversation export, session archiving, MCP tool hook configs, and agent identity endpoint overrides.

• Adds fork subcommand to codex exec to branch a previous session into a new one, accepting a SESSION_ID, optional --image/-i file attachments, and an optional PROMPT (or - to read from stdin).
• Adds /export command in the TUI to export the full conversation history as structured Markdown, with clipboard and file destinations, default filename prompting, and explicit path argument support.
• Honors CODEX_AGENT_IDENTITY_AUTHAPI_BASE_URL and CODEX_AGENT_IDENTITY_JWKS_BASE_URL environment variables to override agent identity registration and verification endpoints.

Threat Intelligence · 2026-08-08

OpenCTI 7.260807.0 adds shareable saved searches, reusable saved filters in dashboards, XTMHub integration, and Lucene wildcard/fuzzy search.

• Adds TAXII feed tabs to the ingestion UI for improved feed management.
• Adds Admin UI (Settings) for custom fields configuration (Chunk 2 of custom-fields feature).
• Enables shareable and reusable saved searches across the platform.

AI Coding Agents · 2026-08-08

OpenHands v1.11.0 adds per-run LLM cost visibility, tag filtering for automations, and typed child-conversation actions.

• Shows per-run LLM cost in the Activity Log and exports, giving teams immediate spend visibility for each agent run.
• Adds automation tag filter and recognition so automations can be organized and surfaced by tag.
• Adds tag chips, overflow handling, and hovercard labels to the conversations list for richer conversation metadata display.

Runtime Security · 2026-08-08

OpenShell v0.0.101 adds credential driver targets and a VM driver built from GitHub sources via Bazel.

• Adds Bazel build targets for the credential driver, enabling it to be compiled as part of the standard build.

Web Application Security · 2026-08-08

OWASP ZAP adds LLM integration across multiple surfaces: Alert Filter, Authentication Helper, Chat, and MCP support.

• Adds LLM Support to the Alert Filter, enabling AI-assisted alert filtering.
• Adds Automation Framework Support to the Authentication Helper for automated auth configuration.
• Adds general LLM Support integration to ZAP's core desktop functionality.

Identity & Access Management · 2026-08-08

PingOne now supports provisioning users and groups between two PingOne environments within the same organization.

• Adds a PingOne provisioning connection that enables provisioning users and groups between two PingOne environments within the same organization.

Identity & Access Management · 2026-08-08

PingOne gains cross-environment user/group provisioning and Verify configuration in Verify policies.

• Adds PingOne provisioning connection, enabling provisioning of users and groups between two PingOne environments within the same organization.
• Adds Verify configuration support within PingOne Verify policies.

CNAPP · 2026-08-08

Plerion adds 46 new GCP AI posture checks across Vertex AI, Model Armor, Dialogflow CX, Cloud TPU, and more.

• Adds 46 new posture checks spanning Vertex AI, Vertex AI Workbench, Colab Enterprise, Agent Engine, Vertex AI Search, Gemini Enterprise, Model Armor, Dialogflow CX, Cloud TPU, and Gemini Code Assist.
• Adds project-level org-policy guardrails covering Vertex AI Workbench access and Model Garden model use.
• Extends asset discovery to 16 new GCP resource types behind the newly supported AI services.

Malware Analysis · 2026-08-08

Quark Engine v26.8.1 adds Claude Code /quark and /quark-rule-gen skills plus a new DexTrace core-library backend.

• Adds Claude Code skills /quark and /quark-rule-gen for AI-assisted malware analysis and rule generation directly in Claude Code.
• Adds DexTrace core-library backend for DEX analysis.
• Adds Quark malware analysis reports for AhRat, AndroRAT, and Sova.

Reverse Engineering · 2026-08-08

Radare2 6.2.0 adds Rust v0 demangling, resource extraction commands, WebAssembly type support, PPC64 ELFv2 calling convention, struct synthesis, and more.

• Adds iuo command to open binary resources inline and ix command to extract sections, segments, and resources.
• Adds iU command (with iUx extraction) and rabin2 -xU flag for listing and extracting binary resources; old iR is renamed to iU and old iU moved to iu.
• Adds anal.gpseed config key to seed a PIC base register during ESIL analysis.

Secure Access (VPN / SASE / ZTNA) · 2026-08-08

Sophos ZTNA 2025.02 adds Let's Encrypt certificate generation via Sophos Central and expands to all Sophos Central regions.

• Adds Let's Encrypt certificate generation for ZTNA gateways directly through Sophos Central, with automatic management and renewal handled by Sophos.
• Expands ZTNA availability to all Sophos Central regions.

Secure Access (VPN / SASE / ZTNA) · 2026-08-08

Sophos ZTNA 2025.23 adds on-premises traffic bypass and domain controller as an agent-based resource.

• Enables configuration to prevent the ZTNA agent from intercepting on-premises traffic, avoiding tunnel hairpinning for local resources.
• Supports adding a domain controller as an agent-based resource, providing seamless connectivity to resources behind it.

SAST / SCA / Code Security · 2026-08-08

API surface changed: 1 modified

• GET /api/v1/org/{orgId}/audit: response schema changed

SAST / SCA / Code Security · 2026-08-08

StackHawk adds hawk.scan.crashDetection to abort or warn when a scan target crashes mid-scan.

• Adds hawk.scan.crashDetection config block to detect and react when a target application crashes or becomes unresponsive during a scan — using a passive count of timeouts and connection failures to trigger an active liveness probe before taking action.
• Adds hawk.scan.crashDetection.maxTimeouts to set the threshold of new timeouts + connection failures that triggers a liveness probe; defaults to 5 x concurrentRequests when unset or zero.
• Adds hawk.scan.crashDetection.action to control what happens once the liveness probe confirms the target is down — supports ABORT, WARN, or DISABLED, defaulting to ABORT.

SAST / SCA / Code Security · 2026-08-08

StackHawk 6.3.0: faster rescans, crash detection, seedPaths validation, and unified CLI auth

• hawk rescan now replays the exact requests that produced findings — fetched from the platform — instead of re-crawling the app, making rescans substantially faster and scoped only to the findings being verified; falls back to normal spider automatically if replay cannot run.
• Adds hawk.scan.crashDetection configuration to detect a crashed or unresponsive target mid-scan: set action to ABORT (default, fails with scan.target-crashed), WARN (logs and continues), or DISABLED; tune the trigger threshold with maxTimeouts, which defaults to five times concurrentRequests, and uses app.waitForAppTarget as the liveness probe path.
• hawk.spider.seedPaths entries are now validated at configuration parse time by hawk scan: entries over 200 characters or with more than 12 path segments produce a warning; entries over 1000 characters fail validation outright.

SAST / SCA / Code Security · 2026-08-08

HawkScan 6.3.0 adds crash detection, faster rescans via request replay, and seedPaths validation.

• Adds hawk.scan.crashDetection config block to abort, warn, or disable scanning when a target crashes mid-scan; configure action: ABORT (default), WARN, or DISABLED, and tune the trigger with maxTimeouts (defaults to 5× concurrentRequests).
• hawk rescan now replays the exact requests that produced findings — fetched from the platform — instead of re-crawling the app, skipping all discovery (OpenAPI, SOAP, GraphQL, HAR) for substantially faster, tightly scoped retests.
• Adds hawk.spider.seedPaths validation at parse time (run by both hawk scan and hawk validate config): entries over 200 characters or with more than 12 path segments emit a warning; entries over 1,000 characters fail validation outright.

AI-Powered Offensive Security · 2026-08-08

Strix v1.5.1 expands Firebase Storage rules coverage in its vulnerability scanner.

• Expands Firebase Storage rules coverage for misconfiguration detection.

SIEM · 2026-08-08

API surface changed: +2 endpoints, 3 modified

• New endpoint GET /v1/featureSettings
• New endpoint PUT /v1/featureSettings
• POST /v1/oauth/clients: request body changed; response schema changed

Cloud Security Posture · 2026-08-08

Sysdig Secure vulnerability policy scopes now allow the same attribute in multiple AND-joined conditions for Admission Control and Runtime stages.

• Vulnerability policy scopes for the Admission Control and Runtime stages now support using the same attribute in more than one condition, enabling include and exclude patterns on a single attribute (e.g., all non-production clusters except one), with conditions joined by AND.

Network Analysis & Monitoring · 2026-08-08

tcpdump adds GENEVE (Generic Network Virtualization Encapsulation) as a supported filter keyword.

• Adds geneve as a recognized protocol keyword for filtering Generic Network Virtualization Encapsulation traffic.

Detection Engineering · 2026-08-08

Tenzir Platform v1.38.0 adds pipeline search by ID and opt-in telemetry consent on the Account page.

• Pipeline list search box now matches on pipeline ID in addition to name and definition, letting you paste a pipeline ID to jump straight to it.
• Telemetry collection is now gated behind explicit user opt-in, configurable through the Account page; telemetry is now also enabled on app.tenzir.com for opted-in users.

Detection Engineering · 2026-08-08

Tenzir Platform v1.38.0 makes telemetry opt-in and adds pipeline ID search.

• Pipeline list search box now matches on pipeline ID, letting you paste an ID to jump directly to a pipeline.
• Telemetry collection is now opt-in, gated behind explicit user consent via the Account page.

Detection Engineering · 2026-08-08

Tenzir Platform v1.38.0 adds pipeline search by ID and gates telemetry behind explicit user consent.

• Pipeline list search box now matches on pipeline ID, letting you paste an ID to jump directly to a pipeline.
• Telemetry collection is now opt-in, gated behind explicit user consent via the Account page.

Endpoint Security (EDR/XDR) · 2026-08-08

Agentless Vulnerability and Threat Detection now scans Azure Function Apps for vulnerabilities and malware.

• Adds vulnerability and malware scanning coverage for Azure Function Apps to Agentless Vulnerability and Threat Detection, accessible via Cyber Risk Exposure Management → Continuous Risk Management → Threat and Exposure Management.

Endpoint Security (EDR/XDR) · 2026-08-08

Agentless Vulnerability & Threat Detection v1.96.3a0922b adds customer-configured OCI resource tagging via Terraform.

• Adds support for customer-configured tags — both OCI defined tags and freeform tags — applied to all Terraform-deployed OCI resources, including the scanner VM, disk snapshots, and cloned scan disks.

Secure Access (VPN / SASE / ZTNA) · 2026-08-08

Twingate Admin Console gains resizable table columns with per-user persistence.

• Admins can resize table column widths in the Admin Console by hovering over a column edge and dragging, with sizing saved per-user and a reset-to-default option available.

Compliance Automation & Trust Management · 2026-08-08

API surface changed: 11 modified

• GET /trust-centers/{slugId}: response schema changed
• GET /trust-centers/{slugId}/control-categories: response schema changed
• GET /trust-centers/{slugId}/control-categories/{categoryId}: response schema changed

Identity & Access Management · 2026-08-07

Google Workspace Group and Group Membership sync is now GA in Auth0, with paginated dashboard UI and self-service selective group sync.

• Adds paginated, searchable, filterable table in the Auth0 Management Dashboard for browsing and selecting Google Workspace groups to sync.
• Enables self-service selective Google Workspace Directory Sync for Groups via the Self-Service assistant flow, letting enterprise IT admins choose all or a subset of groups to synchronize.

AI Coding Agents · 2026-08-07

Claude Code v2.1.224 adds self-hosted runners, cross-session messaging, archive plugin sources, and new sandbox credential-masking options.

• New claude self-hosted-runner subcommand turns your own machines or containers into execution environments for Claude Code web, mobile, and desktop sessions (Team and Enterprise plans).
• New ANTHROPIC_BEDROCK_REGION_PREFIX environment variable lets Bedrock users prefer a specific cross-region inference profile over the AWS_REGION-derived default.
• New crossSessionInbound and dialogExpiry settings: cross-session messages sent to a bypassed-permission session are held for approval; messages to other sessions auto-deliver.

AI Coding Agents · 2026-08-07

Cline desktop v0.0.10 adds OAuth for remote MCP servers, mcp uninstall/mcp rm CLI commands, and new keyboard shortcuts.

• Adds cline mcp uninstall <name> command (alias: cline mcp rm) to remove a registered MCP server from cline_mcp_settings.json.
• Adds CLINE_MCP_SETTINGS_PATH environment variable to point the CLI at a custom MCP settings file.
• Remote MCP servers can now authenticate with OAuth from Settings → MCP, including servers that require a pre-registered OAuth client (client ID/secret) instead of dynamic registration; stored tokens are invalidated when a server's client configuration changes.

Agentic Infrastructure · 2026-08-07

emisar runner 0.17.2 adds BunnyCDN operations, explicit runbook targets, and production MIG rollout zone placement.

• Adds BunnyCDN operations and explicit runbook targets.
• Allows production MIG rollout placement in available zones.

AI Coding Agents · 2026-08-07

Kiro adds open Agent Plugin format support, session pinning, and Kiro CLI hand-off in Agent Focus Mode.

• Supports installing Powers packaged in the open Agent Plugin format from a local folder or GitHub URL, bundling skills, steering, scripts, and assets for sharing across compatible agent tools.
• Adds Pin Session in Agent Focus Mode to keep a session pinned at the top of its section.
• Adds Open with Kiro CLI to resume an existing session directly in the Kiro CLI.

AI Coding Agents · 2026-08-07

Codex CLI v0.147.0 adds --approve-for-me, portable Agent Plugins, MCP 2026-07-28 protocol support, and Bedrock cached web search.

• Adds --approve-for-me CLI flag to codex exec to enable automatically reviewed approvals without manual confirmation prompts.
• Supports the opt-in MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup.
• Installs portable Agent Plugins and searches across local, personal, workspace, and remote plugin catalogs.

AI Coding Agents · 2026-08-07

Adds migrate-rollouts subcommand to inspect and migrate legacy local sessions to paginated thread history.

• Adds migrate-rollouts subcommand with --apply, --thread, --max-mib-per-second, --json, and --verbose flags to inspect or migrate legacy local sessions to paginated thread history.
• Adds a Guardian circuit-breaker policy that interrupts cyber model turns after the first Guardian denial, while retaining existing denial thresholds for all other models.
• Supports fetching remote installed plugins across all scopes.

AI Coding Agents · 2026-08-07

OpenCode TUI gains cursor config block to control terminal cursor style and blinking in input fields.

• Adds cursor config block with style and blinking keys to control the terminal cursor in TUI input fields; style accepts "block" (default), "underline", "line", or "default" (restores terminal default, making blinking ineffective).

AI Coding Agents · 2026-08-07

OpenCode adds cursor.style and cursor.blinking config keys to control terminal cursor appearance.

• Adds cursor.blinking config key to toggle cursor blinking; note it has no effect when cursor.style is set to "default", which restores the terminal's default cursor.

AI Coding Agents · 2026-08-07

OpenCode v1.18.15 adds session JSON export from the UI and broader desktop locale coverage.

• Adds Export... option to the session 3-dot dropdown, an Export session button in the Context tab, and a session.export command palette action (/export) to export full session transcripts as JSON from the UI.
• Expands locale coverage across the desktop app with much broader language support.

Vulnerability Management · 2026-08-07

OSV-Scanner adds ScanGoModVersion config key to optionally scan the Go version declared in go.mod files

• Adds ScanGoModVersion config key to enable scanning of the Go version from go.mod files, which is disabled by default because the go directive specifies a minimum required language version rather than the actual toolchain in use.

Vulnerability Management · 2026-08-07

OSV-Scanner now supports Ubuntu chiseled packages via /var/lib/chisel/manifest.wall

• Adds support for scanning Ubuntu chiseled packages by reading /var/lib/chisel/manifest.wall.

Vulnerability Management · 2026-08-07

OSV-Scanner v2.5.0 completes the OSV-Scalibr pipeline migration, adds VSIX scanning, and expands ecosystem support for SUSE, Azure Linux, and more.

• Enables most osv-scalibr plugins via the --experimental-plugins flag after migrating scanning, filtering, and matching to the full osv-scalibr end-to-end pipeline.
• Adds a javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
• Extends ecosystem mapping in osv-scalibr to cover SUSE, Azure Linux / Mariner, Alpaquita, Mageia, openSUSE Leap, and Debian/Ubuntu PURL.

AI Coding Agents · 2026-08-07

Pi v0.84.0 adds fullscreen TUI, AGENTS.override.md per-directory context, Baseten provider, custom samplingParams, and a remote-session client API.

• Adds opt-in Ctrl+P/Ctrl+N prompt history navigation in the TUI editor.

AI Coding Agents · 2026-08-07

Pi 0.84.1 adds Qwen Token Plan Individual provider, pi auth check preflight, extension terminate support, and fullscreen selection improvements.

• Adds QWEN_TOKEN_PLAN_API_KEY environment variable and Qwen Token Plan Individual as a built-in provider with its documented subscription model catalog.
• New pi auth check command runs provider/model auth preflight and optionally emits the resolved credential.
• Adds terminate support to blocked extension tool_call events, allowing all-terminating batches to skip the automatic follow-up model call.

AI Coding Agents · 2026-08-07

Pi v0.84.1 adds pi auth check for credential preflight, Qwen Token Plan Individual provider, and terminate support for blocked extension tool_call events.

• Adds pi auth check subcommand to verify provider or model credentials before a run, with optional resolved credential output.
• Adds QWEN_TOKEN_PLAN_API_KEY environment variable and Qwen Token Plan Individual as a built-in provider with its subscription model catalog.
• Adds terminate support to blocked extension tool_call event handlers, allowing all-terminating batches to skip the automatic follow-up model call.

AI-Powered Offensive Security · 2026-08-07

Strix v1.5.0 adds LLM_EXTRA_HEADERS, LLM_DISABLE_STREAMING, STRIX_REASONING_EFFORT, API spec/Postman targets, a Go/Bubble Tea TUI, and richer SCA reporting.

• Adds LLM_EXTRA_HEADERS environment variable to inject custom request headers into any OpenAI-compatible endpoint, enabling use with proxies, gateways, or auth-requiring local models.
• Adds LLM_DISABLE_STREAMING environment variable as an opt-in flag to disable streaming for OpenAI-compatible endpoints that don't support it.
• Adds STRIX_REASONING_EFFORT=max config option for providers that expose a reasoning-effort control.

SIEM · 2026-08-07

Sumo Logic adds threatlookup operator for searching threat intelligence indicators directly in log data.

• New threatlookup operator enables searching threat intelligence indicators against log data in Sumo Logic queries.
• Threat intelligence indicator search and Cloud SIEM entity enrichment now default to active indicators only.

SAST / SCA / Code Security · 2026-08-07

Veracode DAST adds business unit targeting, custom host-to-IP mappings, Directory Restrictions, enhanced scheduling, and open-port scanning.

• Adds custom host-to-IP address mapping configuration for DAST scans when DNS lookup is unavailable or not desired.
• Adds Directory Restrictions to target configuration to control DAST scan scope.
• Enhances the DAST Schedule feature with advanced scheduling capabilities and greater configuration flexibility; all existing schedules are automatically migrated.

1Password 4 changes

• 1Password for Android 8.12.32 (2026-08-11) · Feature · 2026-08-11
• 1Password for Mac 8.12.32 (2026-08-11) · Feature · 2026-08-11
• 1Password for Windows 8.12.32 (2026-08-11) · Feature · 2026-08-11
• 1Password in the browser 8.12.32 (2026-08-11) · Feature · 2026-08-11

Adrian 2 changes

• python-sdk-v1.1.0 · Feature · 2026-08-11
• commits-2026-07-09 · Code activity · 2026-08-08

adscan 4 changes

• v11.1.0 · Feature · 2026-08-11
• v11.0.0 · Feature · 2026-08-10
• v10.1.0 · Feature · 2026-08-10
• v10.0.0 · Feature · 2026-08-10

ai-safe2-framework 2 changes

• 2026-07-18_lovable-sovereign-runtime · Feature · 2026-08-10
• 2026-07-13_Unbiased_AI_Standard_(UAS) · Feature · 2026-08-10

Aikido Security 2 changes

• #53 - Deep Review, Android Pentests, Custom Reports and Free Credits · Feature · 2026-08-12
• New - DSPM: Find data exposure risks without connecting your data stores 🚀 · Feature · 2026-08-12

Auth0 6 changes

• Flexible Password Policy is now generally available (2026-08-13) · Feature · 2026-08-13
• Custom Prompts now capture the same fields on Social and Enterprise connections (2026-08-10) · Feature · 2026-08-11
• changelog · Aug 9, 2026 · Feature · 2026-08-09
• docs update · Docs · 2026-08-08
• Custom Token Exchange - Session Delegation is now available in Open Early Access (2026-08-07) · Feature · 2026-08-08
• Google Workspace Directory Sync for Groups - Now in General Availability! (2026-08-06) · Feature · 2026-08-07

Automox 1 changes

• New Software Status for a Device: "Pending Application Restart" (2026-08-11) · Feature · 2026-08-12

Axonius 1 changes

• Axonius Release Notes 9.0.3 (2026-07-22) · Feature · 2026-08-09

Belkasoft 1 changes

• docs update · Docs · 2026-08-09

bpf-linker 1 changes

• v0.11.0 · Feature · 2026-08-12

Bright Security 1 changes

• Release of August 11, 2026 · Feature · 2026-08-11

bruteforce-salted-openssl 1 changes

• docs update · Docs · 2026-08-09

Bugcrowd 2 changes

• changelog · Aug 8, 2026 · Feature · 2026-08-08
• docs update · Docs · 2026-08-08

CAPEv2 2 changes

• commits-2026-07-20 · Code activity · 2026-08-10
• commits-2026-07-20 · Code activity · 2026-08-08

Censys 2 changes

• docs update · Docs · 2026-08-11
• August 10, 2026 (2026-08-10) · Feature · 2026-08-11

Cisco Duo Desktop 2 changes

• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12

CISO Assistant 1 changes

• v3.21.0 · Feature · 2026-08-09

Claude Code 4 changes

• v2.1.229 · Feature · 2026-08-13
• v2.1.228 · Feature · 2026-08-12
• v2.1.225 · Feature · 2026-08-08
• v2.1.224 · Feature · 2026-08-07

Clerk 2 changes

• Discounts and promo codes for Billing (2026-08-10) · Feature · 2026-08-11
• changelog · Aug 10, 2026 · Feature · 2026-08-10

Cline 11 changes

• cli-v3.0.54 · Feature · 2026-08-13
• sdk/sdk/v0.0.74 · Feature · 2026-08-13
• desktop-v0.0.12 · Feature · 2026-08-13
• cli-v3.0.53 · Feature · 2026-08-12
• sdk/sdk/v0.0.73 · Feature · 2026-08-12
• v4.1.8 · Feature · 2026-08-11
• desktop-v0.0.11 · Feature · 2026-08-09
• v4.1.7 · Feature · 2026-08-09
• cli-v3.0.52 · Feature · 2026-08-09
• sdk/sdk/v0.0.72 · Feature · 2026-08-09
• desktop-v0.0.10 · Feature · 2026-08-07

Cloudflare 14 changes

• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• Turnstile - Turnstile Spin is now generally available (2026-08-10) · Feature · 2026-08-11
• changelog · Aug 8, 2026 · Feature · 2026-08-08

Cloudmersive 2 changes

• changelog · Aug 11, 2026 · Feature · 2026-08-11
• Cloudmersive Private Cloud CDR API v2-13-4 Released (2026-08-09) · Feature · 2026-08-10

Cloudsmith 3 changes

• Policy management is now generally available (2026-08-12) · Feature · 2026-08-12
• Continuous risk detection is now generally available (2026-08-12) · Feature · 2026-08-12
• Catch policy errors before you save (2026-08-12) · Feature · 2026-08-12

Codacy 3 changes

• Adding GolangCI-Lint as new supported tool January, 2026 · Feature · 2026-08-08
• Adding PHP CS Fixer and support to Checkov configuration files July, 2026 · Feature · 2026-08-08
• Support for Shellcheck configuration file - July, 2026 · Feature · 2026-08-08

code-oss 21 changes

• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12

Cohesive VNS3 Controller 1 changes

• updated · Aug 8, 2026 · Feature · 2026-08-08

ConductorOne 5 changes

• changelog · Aug 10, 2026 · Feature · 2026-08-10
• August 7, 2026 (2026-08-08) · Feature · 2026-08-09
• docs update · Docs · 2026-08-08
• docs update · Docs · 2026-08-08
• docs update · Docs · 2026-08-08

Conveyor 3 changes

• 🎯 Auto-Assign Questions to the Right SME Group on Every Questionnaire · Feature · 2026-08-12
• 🔗 New Integration: Sync SharePoint Docs Into Your Knowledge Base · Feature · 2026-08-12
• 🤖 Portals Now Auto-Export When Answers Meet Your Auto-Complete Rules · Feature · 2026-08-12

Corellium 2 changes

• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09

Cotool 1 changes

• v0.63.0 · Feature · 2026-08-12

CrewAI 1 changes

• 1.15.15 · Feature · 2026-08-12

Cribl 1 changes

• docs update · Docs · 2026-08-12

cve-lite-cli 3 changes

• v1.29.0 · Feature · 2026-08-11
• v1.28.0 · Feature · 2026-08-10
• v1.27.0 · Feature · 2026-08-10

Dalfox 3 changes

• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11

Daytona 6 changes

• updated · Aug 13, 2026 · Feature · 2026-08-13
• Snapshot operations by name and outbound proxy · Feature · 2026-08-12
• updated · Aug 12, 2026 · Feature · 2026-08-12
• updated · Aug 10, 2026 · Feature · 2026-08-10
• updated · Aug 9, 2026 · Feature · 2026-08-09
• updated · Aug 8, 2026 · Feature · 2026-08-08

deepsec 3 changes

• commits-2026-08-09 · Code activity · 2026-08-13
• commits-2026-07-11 · Code activity · 2026-08-10
• commits-2026-07-09 · Code activity · 2026-08-08

defectdojo 4 changes

• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• 3.2.100 · Feature · 2026-08-11

DependencyCheck 1 changes

• v13.0.0 · Feature · 2026-08-10

Detection Rules 1 changes

• dev-v2.1.0 · Feature · 2026-08-11

Devin Desktop 4 changes

• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• v3.7.16 · Feature · 2026-08-11
• changelog · Aug 11, 2026 · Feature · 2026-08-11

Didit 2 changes

• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09

DigiCert CertCentral 1 changes

• August 11, 2026 · Feature · 2026-08-12

dirsearch 1 changes

• docs update · Docs · 2026-08-09

DNSFilter 2 changes

• 08/10 August 10 – Windows Roaming Client v3.6.10 (2026-08-10) · Feature · 2026-08-11
• changelog · Aug 9, 2026 · Feature · 2026-08-09

Dradis 7 changes

• docs update · Docs · 2026-08-13
• docs update · Docs · 2026-08-13
• docs update · Docs · 2026-08-13
• docs update · Docs · 2026-08-13
• docs update · Docs · 2026-08-13
• docs update · Docs · 2026-08-13
• New in Dradis Pro v5.3 (2026-08-13) · Feature · 2026-08-13

Elastic Security Labs 2 changes

• 13 million tool calls: auditing every AI coding agent action with Elastic Agent (2026-08-11) · Feature · 2026-08-13
• The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent (2026-08-07) · Feature · 2026-08-08

ElcomSoft 1 changes

• changelog · Aug 8, 2026 · Feature · 2026-08-08

emisar 3 changes

• v0.39.0 · Feature · 2026-08-10
• v0.38.0 · Feature · 2026-08-09
• runner-v0.17.2 · Feature · 2026-08-07

Fastly 3 changes

• Fastly Terraform Provider 9.6.0 (2026-08-11) · Feature · 2026-08-12
• Add Private Access Token (PAT) challenge metrics to Historical Stats and Real-Time Analytics APIs (2026-08-11) · Feature · 2026-08-12
• CLI v15.6.0 (2026-08-07) · Feature · 2026-08-08

Feedly Threat Intelligence 1 changes

• changelog · Aug 11, 2026 · Feature · 2026-08-11

Fibratus 1 changes

• v3.1.0 · Feature · 2026-08-12

Firezone 4 changes

• 1.0 · API · 2026-08-12
• Gateway 1.6.0 (2026-08-10) · Feature · 2026-08-10
• Linux GUI 1.5.16 (2026-08-10) · Feature · 2026-08-10
• Linux Headless 1.5.11 (2026-08-10) · Feature · 2026-08-10

Flashpoint 1 changes

• changelog · Aug 11, 2026 · Feature · 2026-08-11

Fleet 2 changes

• api-docs-242c73444f82 · API · 2026-08-12
• fleet-v4.90.0 · Feature · 2026-08-09

Gatekeeper 1 changes

• docs update · Docs · 2026-08-11

gemini-cli 2 changes

• docs update · Docs · 2026-08-12
• v0.55.1 · Feature · 2026-08-12

GitGuardian Detection Engine 1 changes

• changelog · Aug 8, 2026 · Feature · 2026-08-08

GitGuardian SaaS 4 changes

• api-docs-1c2e4c9efcfd · API · 2026-08-12
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• Catch credential stealers on your endpoint fleet (2026-08-10) · Feature · 2026-08-11

Google SecOps 3 changes

• docs update · Docs · 2026-08-13
• August 12, 2026 (2026-08-12) · Feature · 2026-08-13
• changelog · Aug 8, 2026 · Feature · 2026-08-08

Goose 1 changes

• v1.46.0 · Feature · 2026-08-12

Grype 1 changes

• v0.117.0 · Feature · 2026-08-11

GuardDog 1 changes

• v3.2.0 · Feature · 2026-08-12

hcxtools 1 changes

• docs update · Docs · 2026-08-09

Hermes 7 changes

• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11

holmesgpt 1 changes

• 0.39.0 · Feature · 2026-08-11

Hugging Face 3 changes

• Granular Feature Access · Feature · 2026-08-12
• docs update · Docs · 2026-08-11
• 0.0.1 · API · 2026-08-08

Huntress 4 changes

• changelog · Aug 12, 2026 · Feature · 2026-08-12
• Monthly Executive Summary reports are now available (GA) · Feature · 2026-08-11
• Remote access connections API is now available (GA) · Feature · 2026-08-11
• Now Live: Managed ITDR Dashboard in Early Access · Feature · 2026-08-08

iDenfy 1 changes

• changelog · Aug 9, 2026 · Feature · 2026-08-09

ILSpy 1 changes

• v11.0 · Feature · 2026-08-12

impacket 5 changes

• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09

infisical 2 changes

• v0.162.19 · Feature · 2026-08-11
• v0.162.18 · Feature · 2026-08-08

Inspektor Gadget 4 changes

• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11

IntelOwl 1 changes

• docs update · Docs · 2026-08-11

Invicti 3 changes

• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• Release 20260806 (2026-08-06) · Feature · 2026-08-11

Iru 1 changes

• What's New in Iru | August 7th · Feature · 2026-08-08

juice-shop 1 changes

• v20.2.0 · Feature · 2026-08-11

JumpCloud 1 changes

• JumpCloud Agent Release Notes for August 11, 2026 (2026-08-11) · Feature · 2026-08-12

kata-containers 1 changes

• 4.0.0 · Feature · 2026-08-10

Kiro 5 changes

• Voice Mode, Opt-In Cloud Sessions, and Spec Review · Feature · 2026-08-13
• Cloud Sessions Preview and Smarter Command Menus · Feature · 2026-08-12
• Cloud Sessions and Agent Focus Mode Upgrades · Feature · 2026-08-12
• changelog · Aug 11, 2026 · Feature · 2026-08-11
• Agent Plugin Support and Session Pinning · Feature · 2026-08-07

kubescape 2 changes

• v4.0.12 · Feature · 2026-08-12
• v4.0.11 · Feature · 2026-08-10

Lakera 5 changes

• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09

LangGraph 2 changes

• 1.2.11 · Feature · 2026-08-11
• checkpoint==4.2.0 · Feature · 2026-08-08

Maigret 3 changes

• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• v0.6.4 · Feature · 2026-08-12

Metasploit Pro 1 changes

• docs update · Docs · 2026-08-11

Nmap 2 changes

• commits-2026-07-11 · Code activity · 2026-08-10
• commits-2026-07-09 · Code activity · 2026-08-08

noir 1 changes

• docs update · Docs · 2026-08-12

nono 2 changes

• v0.73.0 · Feature · 2026-08-11
• v0.72.0 · Feature · 2026-08-08

npq 3 changes

• v3.26.0 · Feature · 2026-08-13
• v3.25.0 · Feature · 2026-08-10
• v3.24.0 · Feature · 2026-08-10

numbat 1 changes

• v0.1.1 · Feature · 2026-08-10

Object-Oriented Agents 1 changes

• v0.0.7 · Feature · 2026-08-12

Obsidian 2 changes

• changelog · Aug 13, 2026 · Feature · 2026-08-13
• Obsidian 1.13.6 Mobile (Public) (2026-08-10) · Feature · 2026-08-11

Okta for AI Agents 1 changes

• updated · Aug 10, 2026 · Feature · 2026-08-10

Ollama 4 changes

• api-docs-94d22f0572de · API · 2026-08-12
• v0.32.8 · Feature · 2026-08-11
• v0.32.7 · Feature · 2026-08-11
• v0.32.9 · Feature · 2026-08-11

OpenAI Codex CLI 7 changes

• rust-v0.148.0-alpha.12 · Feature · 2026-08-13
• rust-v0.147.0-alpha.6.6 · Feature · 2026-08-11
• rust-v0.148.0-alpha.6 · Feature · 2026-08-11
• rust-v0.148.0-alpha.5 · Feature · 2026-08-08
• rust-v0.148.0-alpha.2 · Feature · 2026-08-08
• rust-v0.147.0 · Feature · 2026-08-07
• rust-v0.148.0-alpha.1 · Feature · 2026-08-07

openbao 1 changes

• docs update · Docs · 2026-08-12

OpenCode 5 changes

• docs update · Docs · 2026-08-13
• v1.18.16 · Feature · 2026-08-10
• docs update · Docs · 2026-08-07
• docs update · Docs · 2026-08-07
• v1.18.15 · Feature · 2026-08-07

OpenCTI 2 changes

• 7.260811.0 · Feature · 2026-08-12
• 7.260807.0 · Feature · 2026-08-08

OpenHands 4 changes

• docs update · Docs · 2026-08-13
• docs update · Docs · 2026-08-13
• v1.13.0 · Feature · 2026-08-13
• v1.11.0 · Feature · 2026-08-08

Openlayer 9 changes

• updated · Aug 12, 2026 · Feature · 2026-08-12
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• docs update · Docs · 2026-08-11
• updated · Aug 11, 2026 · Feature · 2026-08-11
• changelog · Aug 11, 2026 · Feature · 2026-08-11

OpenShell 3 changes

• v0.0.104 · Feature · 2026-08-12
• v0.0.103 · Feature · 2026-08-11
• v0.0.101 · Feature · 2026-08-08

OpenSSH 2 changes

• OpenSSH 10.5 · Feature · 2026-08-11
• changelog · Aug 11, 2026 · Feature · 2026-08-11

Ory 2 changes

• Ory Network, Ory Oathkeeper, Ory Polis, Ory Elements v26.3.6 released · Feature · 2026-08-12
• Ory Hydra, Ory Kratos, Ory Keto v26.3.5 released · Feature · 2026-08-11

OSSEC HIDS 1 changes

• docs update · Docs · 2026-08-11

OSV-Scanner 3 changes

• docs update · Docs · 2026-08-07
• docs update · Docs · 2026-08-07
• v2.5.0 · Feature · 2026-08-07

OWASP ZAP 1 changes

• docs update · Docs · 2026-08-08

Palo Alto Networks 1 changes

• changelog · Aug 13, 2026 · Feature · 2026-08-13

Palo Alto Prisma Cloud 1 changes

• changelog · Aug 13, 2026 · Feature · 2026-08-13

Pi 3 changes

• v0.84.0 · Feature · 2026-08-07
• docs update · Docs · 2026-08-07
• v0.84.1 · Feature · 2026-08-07

Ping Identity 6 changes

• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• changelog · Aug 9, 2026 · Feature · 2026-08-09
• docs update · Docs · 2026-08-08
• docs update · Docs · 2026-08-08

Plerion 2 changes

• Pleri now raises pull requests in Azure DevOps: · Feature · 2026-08-11
• GCP AI coverage widens further: · Feature · 2026-08-08

Plexicus 3 changes

• Plexicus v1.2.25: Multiple SCM Accounts & Smarter CVSS Scoring · Feature · 2026-08-12
• Plexicus v1.2.31: Smoother GitLab Onboarding & Reliable AI Pentest Model Selection · Feature · 2026-08-12
• Plexicus v1.2.36: Frictionless First-Boot Onboarding, BYOAI Canonical Naming & Reliable Codex Remedium · Feature · 2026-08-12

Prowler 4 changes

• docs update · Docs · 2026-08-13
• docs update · Docs · 2026-08-13
• docs update · Docs · 2026-08-13
• 5.39.0 · Feature · 2026-08-13

Qualys Policy Compliance 1 changes

• changelog · Aug 10, 2026 · Feature · 2026-08-11

quark-engine 1 changes

• v26.8.1 · Feature · 2026-08-08

Radare2 1 changes

• 6.2.0 · Feature · 2026-08-08

Rapid7 InsightCloudSec 1 changes

• changelog · Aug 11, 2026 · Feature · 2026-08-11

RegScale 2 changes

• CLI 6.39.0 (2026-08-11) · Feature · 2026-08-11
• RegScale 6.33.0.1 (2026-08-10) · Feature · 2026-08-11

rfcat 1 changes

• v3.0.0 · Feature · 2026-08-12

SailPoint 5 changes

• docs update · Docs · 2026-08-11
• New Capability: Machine Identity Access Requests (2026-08-10) · Feature · 2026-08-11
• New Capability: Non-Employee Risk Management Report Delete & Visibility (2026-08-10) · Feature · 2026-08-11
• Enhancement: Approvals Migration and Notification Reminders and Escalations, Regional Routing, and CC:/BCC: (2026-08-10) · Feature · 2026-08-11
• Enhancement: Data Segmentation for Identities (2026-08-10) · Feature · 2026-08-11

sbomify 2 changes

• 26.7.1 · API · 2026-08-10
• v26.7.1 · Feature · 2026-08-10

Scrut Automation 5 changes

• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12
• docs update · Docs · 2026-08-12

Semgrep 2 changes

• updated · Aug 11, 2026 · Feature · 2026-08-11
• changelog · Aug 11, 2026 · Feature · 2026-08-11

SkillSpector 1 changes

• v2.9.4 · Feature · 2026-08-13

Sophos Central 3 changes

• changelog · Aug 12, 2026 · Feature · 2026-08-12
• Latest news · Feature · 2026-08-11
• July 20, 2026 · Feature · 2026-08-11

Sophos Central Firewall 2 changes

• changelog · Aug 12, 2026 · Feature · 2026-08-12
• 2026.35Released on August 11, 2026 · Feature · 2026-08-11

Sophos DNS Protection 1 changes

• changelog · Aug 12, 2026 · Feature · 2026-08-12

Sophos Protection for Linux 2 changes

• Version 5.18.2 · Feature · 2026-08-11
• Version 5.19.0New · Feature · 2026-08-11

Sophos ZTNA 2 changes

• 2025.02 · Feature · 2026-08-08
• 2025.23 · Feature · 2026-08-08

sploitscan 1 changes

• docs update · Docs · 2026-08-09

Splunk Security Content 1 changes

• v6.4.0 · Feature · 2026-08-12

StackHawk 4 changes

• 0.0.1 · API · 2026-08-08
• docs update · Docs · 2026-08-08
• docs update · Docs · 2026-08-08
• updated · Aug 8, 2026 · Feature · 2026-08-08

StepSecurity 1 changes

• Self-Hosted Runners: Full Fleet Visibility and a New GitHub App Permission (2026-08-11) · Feature · 2026-08-12

Strix 2 changes

• v1.5.1 · Feature · 2026-08-08
• v1.5.0 · Feature · 2026-08-07

Sumo Logic 3 changes

• Drill Down from Map Charts (Dashboards) (2026-08-11) · Feature · 2026-08-11
• 1.0.0 · API · 2026-08-08
• Threat Intelligence (Security) (2026-08-06) · Feature · 2026-08-07

syft 1 changes

• v1.51.0 · Feature · 2026-08-11

Sysdig Secure 3 changes

• Secure SaaS - August 12, 2026 · Feature · 2026-08-12
• Secure SaaS - August 11, 2026 · Feature · 2026-08-11
• Secure SaaS - August 3, 2026 · Feature · 2026-08-08

T3MP3ST 1 changes

• commits-2026-07-13 · Code activity · 2026-08-12

tailscale 2 changes

• changelog · Aug 12, 2026 · Feature · 2026-08-12
• Tailscale Kubernetes Operator v1.102.2 (2026-08-11) · Feature · 2026-08-11

tcpdump 1 changes

• docs update · Docs · 2026-08-08

teleport 1 changes

• docs update · Docs · 2026-08-12

Tenzir 8 changes

• docs update · Docs · 2026-08-10
• docs update · Docs · 2026-08-10
• docs update · Docs · 2026-08-10
• docs update · Docs · 2026-08-10
• Tenzir Node v6.10.0: Native time-series analytics for beacon detection (2026-08-10) · Feature · 2026-08-10
• docs update · Docs · 2026-08-08
• docs update · Docs · 2026-08-08
• Tenzir Platform v1.38.0: Opt-in telemetry collection (2026-08-07) · Feature · 2026-08-08

Termius 1 changes

• docs update · Docs · 2026-08-11

Tines 1 changes

• changelog · Aug 11, 2026 · Feature · 2026-08-11

ToolHive 1 changes

• v0.42.1 · Feature · 2026-08-11

Trend Vision One 9 changes

• Helm Chart 3.5.1 (2026-08-06) · Feature · 2026-08-12
• AskAI quarantine search and management in the Outlook add-in (2026-08-12) · Feature · 2026-08-11
• DLP templates now support the EXCEPT operator for exception conditions (2026-08-12) · Feature · 2026-08-11
• Search Threat Intelligence by IoC (2026-08-10) · Feature · 2026-08-11
• Agentless Vulnerability and Threat Detection GCP Cloud Run Functions support (2026-08-06) · Feature · 2026-08-11
• File Security Storage template version 4.4.0 for AWS (2026-08-10) · Feature · 2026-08-10
• Zero Trust Secure Access On-premises Gateway version 1.0.90 (2026-08-10) · Feature · 2026-08-10
• Agentless Vulnerability and Threat Detection Azure Function Apps support (2026-08-06) · Feature · 2026-08-08
• Agentless Vulnerability & Threat Detection version 1.96.3a0922b (2026-08-04) · Feature · 2026-08-08

trufflehog 3 changes

• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09
• docs update · Docs · 2026-08-09

TrustCloud 1 changes

• docs update · Docs · 2026-08-11

Twingate 1 changes

• changelog · Aug 8, 2026 · Feature · 2026-08-08

Vanta 1 changes

• 1.0.0 · API · 2026-08-08

Varonis 1 changes

• changelog · Aug 9, 2026 · Feature · 2026-08-09

Velociraptor 3 changes

• v0.77.2 · Feature · 2026-08-11
• v0.76.7 · Feature · 2026-08-11
• docs update · Docs · 2026-08-09

Veracode 3 changes

• changelog · Aug 12, 2026 · Feature · 2026-08-12
• Integration updates (2026-08-10) · Feature · 2026-08-11
• DAST updates (2026-08-06) · Feature · 2026-08-07

vMLX 2 changes

• v1.6.27 · Feature · 2026-08-11
• v1.6.25 · Feature · 2026-08-09

web-check 1 changes

• 2.2.0 · Feature · 2026-08-10

Wireblast 5 changes

• v0.4.0 · Feature · 2026-08-11
• v0.2.3 · Feature · 2026-08-09
• v0.2.1 · Feature · 2026-08-09
• v0.2.0 · Feature · 2026-08-09
• v0.1.0 · Feature · 2026-08-09

Wiz 1 changes

• changelog · Jul 27, 2026 · Feature · 2026-08-12

YARA-X 1 changes

• docs update · Docs · 2026-08-11

Zscaler 1 changes

• changelog · Aug 13, 2026 · Feature · 2026-08-13

Zscaler Data Protection 1 changes

• changelog · Aug 13, 2026 · Feature · 2026-08-13

Zscaler Internet Access 1 changes

• changelog · Aug 13, 2026 · Feature · 2026-08-13

Auth0 Flexible Password Policy is now generally available (2026-08-13) · 2026-08-13

PATCH /api/v2/connections/{id} returns 400 invalid_body if a request contains both password_options and any legacy password field (passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary) simultaneously — automation that reads a connection and writes it back with legacy fields appended will break and must be updated to send only password_options.

Auth0 Flexible Password Policy is now generally available (2026-08-13) · 2026-08-13

New database connections created without an explicit password configuration now default to options.password_options with a minimum password length of 15 (up from legacy defaults) — pipelines that create connections and expect legacy defaults will receive the new NIST-aligned defaults instead.

Claude Code v2.1.229 · 2026-08-13

Self-hosted runner Windows startup now requires an explicit --base-dir; launches that previously relied on a default checkout directory will fail without it.

Claude Code v2.1.229 · 2026-08-13

/commit-push-pr no longer auto-approves git/gh commands that include dangerous flags (--force, --amend, --no-verify, etc.); workflows depending on silent approval of these flags will now prompt for confirmation.

Google SecOps docs update · 2026-08-13

The upgraded rich-text editor no longer supports formatting inside table cells.

Google SecOps docs update · 2026-08-13

The Cut, Copy, and Paste buttons have been removed from the rich-text editor toolbar (standard OS keyboard shortcuts remain supported).

Kiro Voice Mode, Opt-In Cloud Sessions, and Spec Review · 2026-08-13

Cloud sessions (v3) are now opt-in: organizations that never configured the Cloud Sessions toggle in the Kiro console will find cloud sessions disabled after upgrading until an admin explicitly enables them.

SkillSpector v2.9.4 · 2026-08-13

HTTP MCP clients can no longer scan local filesystem paths or provide local YARA-rule directories; switch to a remote repository or URL for HTTP requests, or use stdio transport for local scans.

Cloudflare docs update · 2026-08-12

Sandbox SDK 1.0 (@next) removes session execution — shell state is no longer maintained between executions; each sandbox.exec() launch is independent. Pass cwd explicitly or combine multi-step logic in a single shell command.

Cloudflare docs update · 2026-08-12

Sandbox SDK 1.0 (@next) removes SANDBOX_TRANSPORT, the transport option on getSandbox(), and setTransport() — RPC is now the only transport.

Cloudflare docs update · 2026-08-12

Hostname routing initial resolved IPs are moving from the CGNAT range to a public Cloudflare IP range — firewall or routing rules that reference the previous CGNAT addresses may need to be updated.

code-oss docs update · 2026-08-12

The github.copilot.chat.anthropic.thinking.effort and github.copilot.chat.responsesApiReasoningEffort settings are deprecated; thinking effort must now be configured from the language model picker UI.

code-oss docs update · 2026-08-12

The github.copilot.chat.customOAIModels setting is deprecated; custom endpoint models must now be configured via the Custom Endpoint provider in chatLanguageModels.json.

code-oss docs update · 2026-08-12

The built-in Ollama provider is deprecated; users relying on it for BYOK local models must install the official Ollama extension and remove the built-in provider configuration to continue using Ollama models.

code-oss docs update · 2026-08-12

When Agent Host is enabled, user-level custom agents are read from ~/.copilot/agents instead of VS Code profile user data — existing user-level agents stored elsewhere must be moved to ~/.copilot/agents to continue working.

code-oss docs update · 2026-08-12

The infer frontmatter field is deprecated; infer: false behavior (hiding from picker and blocking subagent invocation) must now be expressed with the separate user-invocable: false and disable-model-invocation: true fields.

code-oss docs update · 2026-08-12

When Agent Host is enabled, user-level instructions are read from ~/.copilot/instructions and ~/.claude/rules rather than VS Code profile user data — existing user-level instructions stored elsewhere will not be picked up.

code-oss docs update · 2026-08-12

The infer frontmatter property is deprecated; replace with user-invocable and disable-model-invocation in custom agent .agent.md files.

code-oss docs update · 2026-08-12

Agent Host sessions apply edits directly to the session folder or worktree (reviewed as diffs before commit/merge/discard), replacing the extension-host behavior of tracking edits as pending until kept or undone.

code-oss docs update · 2026-08-12

The Agent Host does not read .vscode/mcp.json directly; MCP servers requiring interactive input (e.g. ${input:...} variables) are not forwarded to the Agent Host.

code-oss docs update · 2026-08-12

Customizations stored only in VS Code profile user data are a legacy location that the Copilot agent on the Agent Host does not read — user-level customizations must be placed in ~/.copilot or ~/.claude.

Fibratus v3.1.0 · 2026-08-12

Malicious/vulnerable driver filter fields have been removed, along with their associated detection rules.

Goose v1.46.0 · 2026-08-12

The goose project command (and its p alias) has been removed; CLI project support is no longer available.

GuardDog v3.2.0 · 2026-08-12

guarddog npm verify now excludes devDependencies by default; setups that previously relied on devDependencies being scanned will no longer flag them unless explicitly included.

ILSpy v11.0 · 2026-08-12

The WPF frontend has been entirely removed; ILSpy now uses the Avalonia frontend exclusively.

ILSpy v11.0 · 2026-08-12

The VS2017/2019 add-in has been removed; only VS2022–2026 add-ins are supported going forward.

kubescape v4.0.12 · 2026-08-12

Rego policies are now evaluated with RegoV1 only — the v0 compatibility shim has been removed. Policies relying on v0 Rego syntax will break.

Openlayer updated · Aug 12, 2026 · 2026-08-12

Openlayer system tags are renamed to categories; user-defined labels remain tags.

Sophos DNS Protection changelog · Aug 12, 2026 · 2026-08-12

The Business-relevant site categories category group is renamed to Business and generative AI; any documentation, runbooks, or references to the old name will need to be updated.

Splunk Security Content v6.4.0 · 2026-08-12

The Onboarding Assistant beta is removed from ESCU and is no longer available; it will be reintroduced in Detection Studio in a future release.

Splunk Security Content v6.4.0 · 2026-08-12

The following detections are permanently removed: PowerShell - Connect To Internet With Hidden Window, Regsvr32 with Known Silent Switch Cmdline, Rundll32 CreateRemoteThread In Browser, Splunk App for Lookup File Editing RCE via User XSLT, Splunk Code Injection via custom dashboard leading to RCE, Splunk Enterprise KV Store Incorrect Authorization, Splunk Information Disclosure on Account Login, Splunk Path Traversal In Splunk App For Lookup File Edit, Splunk RCE PDFgen Render, Windows Process Injection Of Wermgr to Known Browser, and Windows Process Injection With Public Source Path. Users relying on any of these detections should review the deprecated analytics documentation and migrate to recommended replacements before upgrading.

Cline v4.1.8 · 2026-08-11

The Yolo Mode toggle (yoloModeToggled) is removed from settings; users who had it enabled are migrated to auto-approving every action via the auto-approve menu.

defectdojo docs update · 2026-08-11

API-based pull parsers, Tool Type/Tool Configuration, and dbbackup are deprecated with end-of-life scheduled for v3.5.0 — integrations relying on these surfaces will break at that release.

Devin Desktop changelog · Aug 11, 2026 · 2026-08-11

Settings and Keyboard Shortcuts now open as regular editor tabs instead of modal overlays by default; set "workbench.editor.useModal": "all" to restore the previous modal behavior.

Devin Desktop changelog · Aug 11, 2026 · 2026-08-11

The Plugins section for IDE extension marketplaces has been renamed to Extensions.

GitGuardian SaaS docs update · 2026-08-11

The Amadeus OAuth credentials detector and checker have been disabled as the Amadeus self-service API has been discontinued.

Openlayer updated · Aug 11, 2026 · 2026-08-11

configure() is deprecated in favor of init() for trace configuration in the SDK; settings now merge incrementally instead of resetting on each call.

OpenSSH OpenSSH 10.5 · 2026-08-11

Portable OpenSSH now requires ECC (Elliptic Curve Cryptography) support — including the NISTP521 curve — in libcrypto; builds against a libcrypto without ECC will fail. The --without-openssl build configuration is not affected.

OpenSSH changelog · Aug 11, 2026 · 2026-08-11

Portable OpenSSH now requires ECC (Elliptic Curve Cryptography) support in libcrypto, including support for the NISTP521 curve; builds against a libcrypto without ECC will fail. The --without-openssl build configuration is not affected.

SailPoint Enhancement: Approvals Migration and Notification Reminders and Escalations, Regional Routing, and CC:/BCC: (2026-08-10) · 2026-08-11

Pending approvals that have been open for longer than 90 days will begin expiring starting August 10, 2026; any remaining open pre-migration approvals will be closed.

SailPoint Enhancement: Approvals Migration and Notification Reminders and Escalations, Regional Routing, and CC:/BCC: (2026-08-10) · 2026-08-11

Domains with a custom MAIL FROM attribute configured will NOT be automatically migrated to the primary region — owners must manually re-add and re-verify the domain in their primary region or emails risk being blocked by SMTP servers.

SailPoint Enhancement: Approvals Migration and Notification Reminders and Escalations, Regional Routing, and CC:/BCC: (2026-08-10) · 2026-08-11

Existing verified sender email addresses are not auto-migrated and continue to send from us-east-1; they must be manually removed and re-added to trigger verification in the primary region.

ToolHive v0.42.1 · 2026-08-11

With Cedar authorization enabled (--authz-config or authzConfig in the CRD), POST requests without Content-Type: application/json (including a missing header) now return 400 instead of being forwarded; all MCP POST requests must send Content-Type: application/json.

ToolHive v0.42.1 · 2026-08-11

vMCP tools excluded via aggregation.tools filter, per-workload excludeAll, or global excludeAllTools are no longer directly callable on the Modern (2026-07-28) path — direct tools/call now returns JSON-RPC error -32602 at HTTP 400 instead of executing; un-filter the tool or wrap it in a composite tool to keep it reachable.

ToolHive v0.42.1 · 2026-08-11

MCPOIDCConfig resources of spec.type: inline with a plain-HTTP, malformed, or scheme-less issuer or jwksUrl now flip to Valid=False on their next reconcile and block reconciliation of every MCPServer, MCPRemoteProxy, and VirtualMCPServer referencing them; switch to HTTPS or add insecureAllowHTTP: true under spec.inline.

Velociraptor v0.77.2 · 2026-08-11

Support for old client APIs has been removed (Remove support for old client APIs).

Velociraptor v0.76.7 · 2026-08-11

The --config_override / -o flag has been removed from the CLI.

Velociraptor v0.76.7 · 2026-08-11

Support for old client APIs has been removed (Remove support for old client APIs).

Veracode Integration updates (2026-08-10) · 2026-08-11

The Veracode Flaw Importer task (with spaces) in the Veracode Azure DevOps extension is deprecated and scheduled for removal in a future release; replace it with VeracodeFlawImporter.

Veracode Integration updates (2026-08-10) · 2026-08-11

Support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x ends November 30, 2026; upgrade to Jira 10 or later to maintain a supported configuration.

adscan v10.1.0 · 2026-08-10

Nine REPL commands were renamed to native names; the previous command names are no longer accepted.

adscan v10.1.0 · 2026-08-10

The Blocked by Active Controls report category was removed.

adscan v10.1.0 · 2026-08-10

Running the ADscan core directly on the host machine is now refused; the tool runs only inside its container.

adscan v10.0.0 · 2026-08-10

Bundled external third-party command-line cyber tools have been removed; any workflow that relied on them directly must now use ADscan's native engine equivalents.

CAPEv2 commits-2026-07-20 · 2026-08-10

The suspended parameter has been removed from execute() methods in process.py and abstracts.py; any custom modules or scripts passing suspended= will break on upgrade.

Daytona updated · Aug 10, 2026 · 2026-08-10

Minimum supported Python version raised to 3.10; setups running Python below 3.10 will break on upgrade.

DependencyCheck v13.0.0 · 2026-08-10

Nexus V2 Search support has been removed along with all previously deprecated configuration keys and integration options — any working setup relying on Nexus V2 or deprecated settings will break on upgrade.

emisar v0.39.0 · 2026-08-10

The portal migration collapses all runbook version rows into a single runbook per slug, renumbers published versions into releases, and repoints execution history — this runs automatically before the instance serves on upgrade.

Firezone Gateway 1.6.0 (2026-08-10) · 2026-08-10

The Gateway now sets net.core.wmem_max to 2 MB (down from a previously higher value) and net.core.rmem_max to 16 MB system-wide, which reduces UDP socket buffer sizes and may affect other processes sharing those kernel parameters on the same host.

kata-containers 4.0.0 · 2026-08-10

The original Go runtime is deprecated and kata-deploy sets the RuntimeClass to runtime-rs by default — existing users may encounter minor differences in configuration and behavior when upgrading.

kata-containers 4.0.0 · 2026-08-10

Unsafe emptyDir setting that allowed volumes to exceed their sizeLimit has been removed.

kata-containers 4.0.0 · 2026-08-10

Unused VFIO configuration options were removed.

kubescape v4.0.11 · 2026-08-10

The vap deploy-library subcommand no longer downloads the VAP bundle from the network by default — it serves the embedded bundle instead. Pass --from-release to restore the previous download behaviour.

Axonius Axonius Release Notes 9.0.3 (2026-07-22) · 2026-08-09

Amazon Web Services (AWS) adapter: the Correlate EKS Containers with their EC2 Instance advanced setting has been removed; cloud identifiers are now applied automatically.

Axonius Axonius Release Notes 9.0.3 (2026-07-22) · 2026-08-09

Qualys Cloud Platform adapter: the Fetch software install paths (CSAM API) advanced setting has been removed; software install paths are now fetched inline from the Inventory API.

Axonius Axonius Release Notes 9.0.3 (2026-07-22) · 2026-08-09

Sectigo adapter: the default Page size changed from 200 to 100.