The week in full · Aug 14–20

Attack Surface & Exposure Management · 2026-08-20

Axonius Ingestion Rules gain post actions — skip_field, remove_values, remove_items, trim_prefix/suffix/regex, and set_value — for pre-ingest data shaping

• Adds skip_field post action to remove specified fields from an entity before ingestion, preventing them from being written to the database (e.g., device key_exists ["id"] then skip_field ["physical_location", "qualys_agent_ports"]).
• Adds remove_values post action to drop specific values from list fields or list-object fields before ingestion, supporting operators like starts_with, ==, etc.
• Adds remove_items post action to drop entire list items (e.g., full network interface entries) when a subfield condition matches, using syntax like then remove_items network_interfaces.ip4 in_net ["10.20.0.0/24"].

Attack Surface & Exposure Management · 2026-08-20

Axonius documents the full operator set for ingestion rule primary statements, including IP, regex, and cross-field comparisons.

• Adds == / != (equal/not equal) operators for ingestion rule primary statements, with a noted behavior: asset.key != "value" only matches assets where the field exists, requiring key_not_exists to also capture missing fields.
• Adds < / > date comparison operators supporting date(YYYY-MM-DD), date(now-nd), and date(now+nd) syntax; >= / <= are explicitly unsupported for dates.
• Adds <, >, >=, <= numeric comparison operators for ingestion rule conditions (e.g., device.confidence_level < 65).

Attack Surface & Exposure Management · 2026-08-20

Axonius adds Ingestion Rules configuration: filter, combine, and test which adapter data enters the platform per connection.

• Adds Ingestion Rules Configuration page under Advanced Settings for each adapter, with a toggle to enable rules that control which entities are ingested from the adapter into Axonius.
• Supports OR, AND, and Custom logical operators (selectable via Select logical operator for all rules drop-down) to combine multiple ingestion rule statements.
• Adds a Custom Logical Expression field (activated when Custom operator is selected) accepting parenthesized boolean expressions of rule numbers (e.g. 1 AND (2 OR 3), (1 OR 2) AND (3 OR 4)) — AND/OR keywords are case-sensitive and must be uppercase.

Attack Surface & Exposure Management · 2026-08-20

Axonius adds parallel connection fetching control for scheduled adapter discovery cycles.

• Adds Number of connections to fetch in parallel field in the Discovery Configuration pane for select adapters, letting practitioners set simultaneous connection counts (between 1 and the adapter's maximum) during scheduled discovery cycles — default is 1 (sequential).

Attack Surface & Exposure Management · 2026-08-20

Axonius 9.0.5 adds OAuth 2.1 for service accounts, GitHub Advisory Database CVE enrichment, parallel adapter fetching, and 7 new adapters.

• Adds OAuth 2.1 authentication support for service accounts; access tokens are issued via the /api/oauth2/token endpoint and invalidated automatically on credential reset or new token generation.
• Adds Number of connections to fetch in parallel setting under Adapter Discovery Configuration to enable parallel connection fetching for Claroty CTD, F5 BIG-IP iControl, Infoblox DDI, Salesforce, VMware ESXi, and vSphere adapters.
• Adds Workstation OS Types to Exclude setting to Network Routes Enrichment Configurations in Global Settings to exclude specific device operating systems from enrichment.

Post-Exploitation · 2026-08-20

API surface changed: +3 endpoints, −2 endpoints, 2 modified

• New endpoint GET /api/v2/attack-paths/finding-types
• New endpoint GET /api/v2/node-kinds/{node_kind_id}
• New endpoint GET /api/v2/relationship-kinds/{relationship_kind_id}

Web Application Security · 2026-08-20

Caido v0.58.0 adds race-condition testing via Replay Pipelines, HTTPQL header/body fields, and a reworked Plugin page.

• Adds req.header, req.header["<name>"], req.body, resp.body, and resp.header fields to HTTPQL, enabling targeted matching on headers and body without scanning raw; supports .eq, .cont, and .regex operators.
• Adds a new Pipeline Replay session type for race-condition testing, with two strategies: Sequential (ordered) and Last Byte Synchronization (holds the final byte of every request and releases them simultaneously).
• Reworked Plugin page now shows an Official badge, quality rating, author, download count, and version per plugin; supports filtering by Official or Community and bulk install/update.

Container & Image Security · 2026-08-20

API surface changed: +79 endpoints, −78 endpoints, 14 modified

• New endpoint DELETE /events/v2/subscriptions/{uid}
• New endpoint DELETE /iam/v2/accountAssociations/{uid}
• New endpoint DELETE /iam/v2/externalGroupRoleMappings/{uid}

Internet Services · 2026-08-20

Cloudflare Wallets introduces programmable Account and Virtual Wallets for AI agents, with handle reservation now live at cloudflare.pay.

• Introduces Cloudflare Wallets, a programmable wallet system giving Cloudflare accounts and AI agents a stable identity and a mechanism to pay for APIs and content using stablecoins.
• Introduces Account Wallets for human account owners, supporting fund management, spend delegation to agent-controlled Virtual Wallets, and a stable cloudflare.pay identifier.
• Introduces Virtual Wallets for AI agents, operated via API keys, with spend permissions and a maximum spend cap set by the Account Wallet owner — enabling autonomous agent spending without per-action manual approval.

Internet Services · 2026-08-20

Cloudflare AI Models catalog adds nine new models spanning image generation, video, and agentic LLMs from Alibaba, Anthropic, ByteDance, Google, Lightricks, and xAI.

• Adds qwen-image-3.0-pro (Alibaba): text-to-image model supporting up to 6 image variants per call, negative prompts, seed control, and optional prompt rewriting, with strengths in complex layout generation, small-text precision, and multilingual font rendering.
• Adds qwen3.7-max (Alibaba): flagship agent-centric LLM in the Qwen3.7 series, served via DashScope's OpenAI-compatible endpoint, with deep strengths in programming, office/productivity, and long-horizon autonomous execution.
• Adds qwen3.7-plus (Alibaba): cost-effective Qwen3.7 model with image and video understanding plus full-stack agent intelligence for coding, tool use, and GUI-based automation, served via DashScope's OpenAI-compatible endpoint.

Internet Services · 2026-08-20

Cloudflare adds HTTP Basic Auth leaked-credential scanning, R2 us jurisdiction, post-quantum SMTP, and Tunnel origin settings in the dashboard.

• R2 now supports a us jurisdiction guaranteeing data is stored and processed within the United States; access buckets via the jurisdiction-specific S3 endpoint https://<ACCOUNT_ID>.us.r2.cloudflarestorage.com or set jurisdiction = "us" in a [[r2_buckets]] Workers binding.
• Cloudflare Email Security now negotiates X25519MLKEM768 post-quantum hybrid key exchange on inbound MX and outbound SMTP delivery connections when the peer supports it, protecting mail traffic against harvest-now, decrypt-later attacks; backwards compatible and enabled automatically for all Email Security packages.
• AI Gateway adds support for the openai/gpt-5.6-sol model at 50% promotional pricing ($2.50/1M input tokens, $15/1M output tokens, $0.25/1M cache-read tokens) through September 18, 2026 for non-BYOK users.

Internet Services · 2026-08-20

Cloudflare Wallets lets accounts and agents reserve a stable, human-readable wallet handle for agentic payments.

• New Cloudflare Wallets product lets you reserve a wallet handle to give your account and its agents a stable, human-readable identity for agentic payments.

Internet Services · 2026-08-20

Leaked credentials detection gains Authorization header scanning, Tunnel gets dashboard origin config, and Email Security adds post-quantum key exchange

• Cloudflare Tunnel now supports configuring origin application parameters — including TLS verification, HTTP Host header, and connection timeouts — directly in the Cloudflare dashboard when editing a published application.
• Cloudflare Email Security adds post-quantum hybrid key exchange support for inbound and outbound SMTP connections on MX deployments.
• Load balancing analytics pool filter now queries by pool name instead of pool ID, aligning filter behavior with the UI dropdown display.

Internet Services · 2026-08-20

Cloudflare adds Basic Auth leaked credential scanning, post-quantum email SMTP, and dashboard-configurable Tunnel origin settings

• Cloudflare Tunnel now supports configuring origin parameters — including TLS verification, HTTP Host header, and connection timeouts — directly in the Cloudflare dashboard when editing a published application.
• Cloudflare Email Security supports post-quantum hybrid key exchange on inbound and outbound SMTP connections for MX deployments.
• Load balancing analytics pool filter now queries by pool name instead of pool ID, aligning the filter with the UI dropdown display.

Internet Services · 2026-08-20

Cloudflare WAF leaked credentials detection now automatically scans Authorization: Basic headers by default.

• Matches populate existing fields such as cf.waf.credential_check.password_leaked and trigger the Exposed-Credential-Check managed transform header when configured, so existing custom rules and rate limiting rules apply without modification.

Web Application Security · 2026-08-20

DataDome iOS Alamofire SDK 4.1.0 automatically merges DataDome cookies with manually added request cookies.

• Adds automatic merging of the DataDome cookie with cookies manually added to a request inside DataDomeInterceptor instances.

Identity & Access Management · 2026-08-20

API surface changed: +1 endpoint

• New endpoint POST /v3/document-ai/

SAST / SCA / Code Security · 2026-08-20

CodeQL 2.26.3 adds Vue/Sails/WinReg flow models, file-scoped custom models, and tightens several GitHub Actions queries.

• Adds support for file:<path> package name syntax in JavaScript/TypeScript custom models, letting analysts define sources and sinks based on a file's public exports.
• Adds flow models for Vue Composition API helpers ref, shallowRef, toRef, reactive, and computed.
• Recognizes Vue Router's useRoute() Composition API as a client-side remote flow source, including its query, params, path, fullPath, and hash members.

SIEM · 2026-08-20

Google SecOps adds AI-powered Detection Engineering Agent, event simulation, Health Hub latency tables, and Cloud Logging for ingestion pipelines.

• New Detection Engineering Agent (DEA) evaluates threat coverage and auto-drafts YARA-L detection rules via Model Context Protocol (MCP) tools, accessible from compatible AI clients such as Google Antigravity or Claude Code.
• New event simulation capability programmatically delivers realistic threat sequences into the live ingestion pipeline for full-funnel detection coverage evaluation — covering UDM normalization, multi-event correlation, YARA-L 2.0 rule validation, and alerting — without disrupting production SOC workflows.
• Health Hub gains two new latency tables: ingestion latency at the source level and at the log-type level, with drill-down into the Data Health Deep Dive page for detailed per-source or per-log-type analysis.

Endpoint Security (EDR/XDR) · 2026-08-20

Iru admins can now control which apps may act as credential managers in Android work profiles via a new policy setting.

• Adds a Credential managers setting to the Android Restrictions Library Item, letting admins set a default policy to block all credential managers or allow the device's pre-loaded system credential managers in the work profile on managed Android devices.

Endpoint Security (EDR/XDR) · 2026-08-20

Iru now surfaces iOS/iPadOS hardware component health statuses in device records and the enterprise API.

• Exposes device system health statuses for hardware components (camera, NFC, baseband, Touch ID, and others) in the device record UI for supported devices running iOS or iPadOS 27 beta.
• Makes hardware component health status values available via the enterprise API device details endpoint for iOS and iPadOS devices.

Endpoint Security (EDR/XDR) · 2026-08-20

Iru Mac Auto Apps now support enforcing a specific hosted version instead of always installing the latest.

• Mac Auto Apps now support enforcing a specific version, selectable from a list of Iru-hosted versions, so devices installing for the first time or that are out of date install the pinned version rather than the latest available.

Endpoint Security (EDR/XDR) · 2026-08-20

Iru Identity 2026.08.19 lets you set per-integration sync frequency and trigger on-demand syncs.

• Adds configurable sync frequency per directory sync integration, with intervals including Manual Only, Every 30 minutes, every hour, 2 hours, 4 hours, 8 hours, 12 hours, daily, every 2 days, or weekly.
• Adds a Refresh and Sync Now capability for directory sync integrations.

Endpoint Security (EDR/XDR) · 2026-08-20

Iru adds a managed Google Account requirement setting for company-owned Android devices with work profiles.

• Adds a managed Google Account setting to the Android Restrictions Library Item, with two modes controlling which managed Google Accounts are permitted on company-owned Android devices with work profiles.

Identity & Access Management · 2026-08-20

API surface changed: 2 modified

Endpoint Security (EDR/XDR) · 2026-08-20

Process Monitor gains IPC event class; ZoomIt macOS adds DemoMirror; RDCMan re-enables RD gateway support

• Adds the IPC event class to Process Monitor v4.1, enabling real-time observation of named pipe and mailslot activity alongside existing file system, Registry, and process/thread events.
• Introduces DemoMirror in ZoomIt 12.3 for macOS, allowing the screen, a screen region, or a window to be mirrored onto a second monitor.
• Re-enables Remote Desktop gateway support in RDCMan v3.21.

Identity & Access Management · 2026-08-20

Ory Network v26.3.9 refreshes the Console UI with a new design system for self-hosted and enterprise deployments.

• Refreshed Console UI adopts Ory's new design system for self-hosted and Ory Enterprise deployments.

Network Analysis & Monitoring · 2026-08-20

PCAPdroid v2.0.0 adds Capture List, app isolation, settings export/import, port mapping exemptions, and configurable connection log size.

• Adds Capture List screen showing past captures and their size on disk.
• Implements per-app allowlist (app isolation) to restrict which apps' traffic is captured.
• Adds settings export and import for backing up and restoring PCAPdroid configuration.

CNAPP · 2026-08-20

Plerion adds API access to detection exemptions — read, write, or clear without opening the platform.

• New API endpoints to read, write, and clear detection exemptions on any detection without using the platform UI.
• Exemption matching supports asset name, tags, region, principal, or API Gateway route as match criteria.
• Existing findings on the dashboard are re-evaluated immediately when exemptions are written, rather than waiting for the next scan.

SAST / SCA / Code Security · 2026-08-20

API surface changed: +4 endpoints

• New endpoint GET /api/v1/exports/findings.csv
• New endpoint GET /api/v1/exports/inventory.csv
• New endpoint GET /api/v1/exports/licenses.csv

SAST / SCA / Code Security · 2026-08-20

StackHawk's wingman plugin for GitHub Copilot bundles hawkscan, stackhawk-api, data-seed, and optimize skills in a single install.

• Introduces wingman, a StackHawk umbrella plugin for GitHub Copilot that bundles four skills — hawkscan, stackhawk-api, data-seed, and optimize — in one install, since Copilot has no plugin-dependency resolution mechanism.
• Adds separate hawkscan-ci skill installable via copilot plugin install hawkscan-ci@stackhawk for CI-focused scanning scenarios.
• Plugins installed via copilot plugin install are stored in ~/.copilot/installed-plugins/ and are available across all projects.

SAST / SCA / Code Security · 2026-08-20

StackHawk adds in-place Application Team ownership management, broader Team visibility for Members and View Only users, and a required Team assignment when creating applications.

• Adds a Team ownership column to the Applications table, letting users change a Team assignment in place; applications without a Team are marked Unassigned and can be assigned by selecting the label and searching for a Team.
• Adds a Team field in Application Settings > General (with Unassigned at the top) so clearing or changing ownership works uniformly alongside the table view.
• Moving an application between Teams no longer requires removing it from its current Team first.

SAST / SCA / Code Security · 2026-08-20

StackHawk adds inline Team ownership for applications, Team visibility for Members and View Only users, and required Team assignment on app creation.

• Adds a Team ownership column to the Applications table, letting users change a Team assignment in place; applications without a Team are marked Unassigned and can be searched and assigned from the same row.
• Adds a Team field to Application Settings > General, with Unassigned at the top so clearing ownership works the same way as changing it.
• Enables Members to view the Teams they belong to, and View Only users to review every Team in the organization, without requiring Team management permissions.

SAST / SCA / Code Security · 2026-08-20

API surface changed: +2 endpoints

• New endpoint GET /api/v1/org/{orgId}/teams/available/applications
• New endpoint GET /api/v1/org/{orgId}/teams/available/users

SIEM · 2026-08-20

API surface changed: +5 endpoints, 12 modified

• New endpoint DELETE /v2/search/jobs/{jobId}
• New endpoint GET /v2/search/jobs/{jobId}
• New endpoint GET /v2/search/jobs/{jobId}/messages

Secure Access (VPN / SASE / ZTNA) · 2026-08-20

Tailscale container image v1.102.3 adds TS_BOOT_TIMEOUT env var to extend initial coordination server connection wait.

• Adds TS_BOOT_TIMEOUT environment variable to the container image, accepting a duration value (e.g. 90s or 3m) to extend how long the container waits for its initial connection to the coordination server; defaults to 60s.

Endpoint Security (EDR/XDR) · 2026-08-20

Trend Vision One lets IR teams add Forensics evidence directly into a Workbench insight timeline for unified chronological investigation.

• Enables adding selected evidence from a Forensics evidence package to a Workbench insight timeline via Add selected to Workbench insight timeline, giving IR and SOC teams one shared chronological record per insight.
• Supports adding selected Forensics evidence to a Forensics timeline from the same evidence package selection workflow.

Endpoint Security (EDR/XDR) · 2026-08-20

Virtual Network Sensor 1.0.1737 adds GTP, NSH, and Teredo protocol support plus new CLI toggle commands.

• Adds new CLI commands for enabling and disabling GTP, NSH, Teredo, VXLAN, and VXLAN GPE protocol inspection.
• Adds support for decoding and inspecting GPRS Tunnelling Protocol (GTP), Network Service Header (NSH), and Teredo traffic.

Identity & Access Management · 2026-08-19

1Password SCIM Bridge 2.9.16 adds per-IP rate limiting and post-quantum TLS key exchange support.

• Adds per-IP rate limiting to all SCIM Bridge routes.
• Adds TLS support for post-quantum key exchange.

Identity & Access Management · 2026-08-19

1Password SCIM Bridge 2.9.16 adds per-IP rate limiting and post-quantum TLS key exchange to all bridge routes.

• Adds per-IP rate limiting to all SCIM Bridge routes, protecting provisioning endpoints from abuse.
• Adds TLS support for post-quantum key exchange across SCIM Bridge connections.

AI/LLM Security · 2026-08-19

Adrian Python SDK v1.2.0 adds reasoning capture for LangChain and TypeScript OpenAI SDK integrations.

• Adds a reasoning field to the LLM event payload emitted by on_llm_end in sdk/python/adrian/handler.py, capturing chain-of-thought output from reasoning models via the new _extract_reasoning() helper.
• Adds reasoning capture to the TypeScript OpenAI SDK integration, collecting delta.reasoning_content from OpenAI-compatible streaming responses into a reasoning string alongside the existing output.
• Extends reasoning capture to new integrations and additional models across both Python and TypeScript SDKs, with support for multiple block layouts: summary lists (OpenAI Responses / LangChain default), bare reasoning strings (LangChain output_version='v1'), and Anthropic thinking strings.

Digital Forensics & Incident Response · 2026-08-19

ALEAPP v2026.3.1 adds parsers for Instagram, Tinder, Netflix, Reddit, Amazon Shopping, Proton Mail MailX, expanded Snapchat/TikTok/WhatsApp/Wire/LINE/GroupMe/Chrome artifacts.

• Adds new Proton Mail db-mail (MailX) Room store parser via protonmailDbMail.py, surfacing four artifacts: MailX Messages (time, subject, sender/recipient addresses decoded from JSON, read/replied/forwarded flags, attachment count, size, conversation ID, message ID), MailX Attachments (name, size, MIME type, disposition, saved content URI from MessageAttachmentMetadataEntity), MailX Contacts (ContactEmailEntity rows), and MailX Account (UserEntity + AccountEntity including createdAtUtc in Unix millis).
• Adds six WhatsApp add-on artifacts: reactions, edits, revokes, polls, receipts, and system events.
• Adds Snapchat chat media, core.db, and session artifacts; TikTok Account artifact; TikTok activity artifacts with multi-account database handling for IM data and deduplication of duplicate extraction paths.

Managed Detection & Response (MDR) · 2026-08-19

Arctic Wolf Data Explorer lets customers query raw logs and analyzed platform data to investigate security questions.

• Enables customers to examine raw logs ingested by the Arctic Wolf platform to support incident investigations and answer critical security questions.
• Provides access to analyzed, processed data from the Arctic Wolf platform alongside raw logs for deeper operational context.

Identity & Access Management · 2026-08-19

authentik adds a dedicated email configuration guide covering global SMTP env vars, ak test_email CLI, and TLS cert mounting.

• Adds AUTHENTIK_EMAIL__HOST, AUTHENTIK_EMAIL__PORT, AUTHENTIK_EMAIL__USERNAME, AUTHENTIK_EMAIL__PASSWORD, AUTHENTIK_EMAIL__USE_TLS, AUTHENTIK_EMAIL__USE_SSL, AUTHENTIK_EMAIL__TIMEOUT, and AUTHENTIK_EMAIL__FROM environment variables (in .env) for configuring global SMTP settings in Docker deployments.
• Adds email.host, email.port, email.username, email.password, email.use_tls, email.use_ssl, email.timeout, and email.from keys under the authentik: block in values.yaml for Helm/Kubernetes deployments.
• Introduces the ak test_email <to_address> CLI command to verify global SMTP delivery from the authentik worker, with -S <stage_name> flag to test a specific Email stage's SMTP settings instead.

Identity & Access Management · 2026-08-19

authentik adds automated install env vars including AUTHENTIK_BOOTSTRAP_PASSWORD_HASH for pre-hashed akadmin setup and a /api/v3/core/users/<id>/set_password_hash/ endpoint.

• Adds AUTHENTIK_BOOTSTRAP_PASSWORD_HASH environment variable on the worker container to set the akadmin password via a pre-hashed Django password value at first startup, bypassing the Out-of-box experience; generate the hash with docker compose run --rm server hash_password.
• Adds AUTHENTIK_BOOTSTRAP_PASSWORD environment variable to set the akadmin plaintext password at first startup (setting both AUTHENTIK_BOOTSTRAP_PASSWORD and AUTHENTIK_BOOTSTRAP_PASSWORD_HASH together results in an error).
• Adds AUTHENTIK_BOOTSTRAP_TOKEN environment variable to create an API token for the akadmin user at first startup, usable immediately for API authentication.

Identity & Access Management · 2026-08-19

authentik documents PostgreSQL read replicas, direct connection pooler bypass, and full TLS/SSL config via environment variables.

• Adds AUTHENTIK_POSTGRESQL__READ_REPLICAS__<n>__HOST/NAME/USER/PORT/PASSWORD/SSLMODE/SSLROOTCERT/SSLCERT/SSLKEY/CONN_MAX_AGE/CONN_HEALTH_CHECKS/DISABLE_SERVER_SIDE_CURSORS environment variables to configure indexed PostgreSQL read replicas, with automatic read/write routing to the primary.
• Adds AUTHENTIK_POSTGRESQL__DIRECT__HOST, AUTHENTIK_POSTGRESQL__DIRECT__PORT, AUTHENTIK_POSTGRESQL__DIRECT__NAME, AUTHENTIK_POSTGRESQL__DIRECT__USER, AUTHENTIK_POSTGRESQL__DIRECT__PASSWORD, AUTHENTIK_POSTGRESQL__DIRECT__SSLMODE, AUTHENTIK_POSTGRESQL__DIRECT__SSLROOTCERT, AUTHENTIK_POSTGRESQL__DIRECT__SSLCERT, and AUTHENTIK_POSTGRESQL__DIRECT__SSLKEY to route LISTEN/NOTIFY and advisory-lock connections (Channels, dramatiq, startup migrations) through a separate direct or session-mode endpoint, keeping them off a transaction-pooling pooler.
• Adds AUTHENTIK_POSTGRESQL__SSLMODE (default: verify-ca), AUTHENTIK_POSTGRESQL__SSLROOTCERT, AUTHENTIK_POSTGRESQL__SSLCERT, and AUTHENTIK_POSTGRESQL__SSLKEY environment variables to control TLS/SSL and mutual TLS for the primary PostgreSQL connection.

Identity & Access Management · 2026-08-19

authentik now supports one-click AWS deployment via a CloudFormation template with full HA infrastructure.

• New AWS CloudFormation template deploys a production-ready authentik stack including a VPC, RDS PostgreSQL Multi-AZ cluster, ECS cluster (server + worker tasks), ALB with ACM certificate, EFS filesystem, and AWS SSM secrets for credentials.
• The CloudFormation stack accepts a Certificate ARN input (from AWS Certificate Manager) and outputs the ALB endpoint for DNS configuration.
• Initial setup is accessible at http://<domain_you_configured> and prompts for the akadmin default user password.

Identity & Access Management · 2026-08-19

authentik Enterprise adds identity provisioning, device-aware access, audit/compliance tools, and network authentication features.

• New Google Workspace integration synchronizes users and groups from authentik to Google Workspace.
• New Microsoft Entra ID integration synchronizes users and groups from authentik to Microsoft Entra ID.
• New Shared Signals Framework provider sends security events to subscribed applications, including Apple Business Manager.

Identity & Access Management · 2026-08-19

authentik documents unified file picker supporting uploaded files, static assets, external URLs, Font Awesome icons, and theme-aware %(theme)s paths

• Adds %(theme)s placeholder support in file picker paths and URLs, resolving to light or dark based on the active theme — works across Brand Logo, Brand Favicon, Brand Default flow background, Flow Background, Application Icon, and Source Icon fields, including S3 presigned URLs.
• Supports fa://fa-circle-user-style Font Awesome icon references in icon fields (not background image fields) via the shared file picker.
• Enforces upload path rules: relative paths only (no leading slash, no .., no //, no leading .), max 25 MB per file, max 1024-character full path, max 255-character per segment, allowed characters limited to letters, numbers, ., _, -, /, and %(theme)s.

Identity & Access Management · 2026-08-19

authentik adds centralized file management UI and S3-backed media storage with theme-aware asset resolution

• New Customization > Files section in the Admin interface provides centralized upload, delete, and search for image files used in branding and application icons.
• Supports S3 storage as a backend for uploaded media files in addition to the default /data directory on disk.
• File picker fields (brand logos, favicons, flow backgrounds, application icons, source icons) now accept uploaded files, built-in static assets, external URLs, Font Awesome icons via fa://... references, and theme-aware paths using %(theme)s.

Identity & Access Management · 2026-08-19

authentik proxy provider docs detail dynamic host-header control via ak_proxy.host_header scope mapping (2025.6.1+) and per-path unauthenticated access rules.

• Adds host_header key inside ak_proxy scope-mapping expression to dynamically override the host header sent to upstream, available from authentik 2025.6.1+.
• Adds backend_override key inside ak_proxy scope-mapping expression to dynamically select the upstream backend per user in proxy mode.
• Adds Unauthenticated Paths and Unauthenticated URLs fields on the proxy provider to allow unauthenticated access to specific paths or URLs via per-line Rust regex crate regular expressions; in proxy and single-application forward-auth modes expressions match the request path, in domain-level forward-auth mode they match the full URL including scheme and host.

Identity & Access Management · 2026-08-19

authentik introduces AKQL, a structured query language for filtering events, users, and groups in the Admin UI and REST API.

• Adds AKQL (authentik Query Language) — a structured search syntax built on DjangoQL — for filtering events, users, and groups in the Admin interface with expressions like action = "login" or context.geo.country = "Germany".
• Exposes AKQL via the search query parameter on REST API list endpoints that return an AKQL autocomplete schema, e.g. GET /api/v3/core/users/?search=username%20%3D%20%22bob%22.
• Adds a Query field on Event Matcher policies that accepts AKQL expressions to match events, combinable with existing policy fields such as Action or App.

Identity & Access Management · 2026-08-19

authentik now supports multiple simultaneous user account sessions with in-browser account switching.

• Enables multiple user accounts to remain signed in within the same browser simultaneously, with switching available from the User interface header.

Identity & Access Management · 2026-08-19

authentik 2026.8.0 adds SAML audience override, back-channel logout on deactivation, and configurable source-stage failure actions.

• Adds an audience override field to SAML sources, allowing operators to specify a custom audience value in the SAML source configuration.
• Adds a configurable failure action to enterprise source stages, controlling what happens when a source stage fails.
• Sends back-channel logout requests to OAuth2 providers when a user is deactivated, ensuring downstream sessions are terminated.

Endpoint Security (EDR/XDR) · 2026-08-19

Automox Remote Tools gains Windows System Tools access and org-level Screen Recording Controls for Remote Control sessions.

• New System Tools option under the Remote Tools button on Device Details opens Task Manager, Registry Editor, Device Manager, and Service Manager on managed Windows devices in a background session — no desktop takeover required.
• On macOS, System Tools surfaces Activity Monitor as the native equivalent of Task Manager for background process triage.
• New Auto-record all sessions setting on the Remote Tools Settings tab automatically begins recording every Remote Control session at the organization level.

Firewalls & Network Defense · 2026-08-19

CoPilot 4.36.0 adds Session Count and Logging columns to the security rules tab for gateways.

• Adds Session Count and Logging columns to the security rules tab for gateways to improve traffic visibility.

SAST / SCA / Code Security · 2026-08-19

Polaris adds two-way bug tracker sync across five systems, AI-assisted SAST fix PRs, secure tunnels to on-prem SCMs, and central rule governance.

• Adds CI-native AI-assisted SAST fix pull request generation via the Bridge CLI, triggerable from GitHub Actions, GitLab CI, Bitbucket Pipelines, Jenkins, or Azure DevOps pipeline configuration — no server-side scheduling required.
• Adds policy-driven and on-demand fix PR creation from the UI (individually or in bulk) and via issue policy actions, with per-branch or per-run caps on open PRs and filtering by CWE, issue type, language, and file pattern.
• Adds a View issue policies action that surfaces which policies, compliance requirements, and governance rules are attached to a SAST finding.

Post-Exploitation · 2026-08-19

BloodHound v9.6.0 adds GitHub self-hosted runner attack path modeling, Kind Metadata APIs, PostgreSQL storage optimization, and OpenGraph improvements.

• Adds Kind Metadata APIs to retrieve node and relationship kind details by graph-assigned kind ID, enabling OpenGraph automation and integrations.
• Adds GitHub Self-Hosted Runner Modeling to identify membership, delegation, and access paths for enterprise and organization-scoped GitHub Actions self-hosted runners and runner groups.
• Extension Management is now enabled by default — OpenGraph extensions can be managed without manually enabling the feature first.

Post-Exploitation · 2026-08-19

BloodHound v9.6.0 adds management-operation APIs, client artifact endpoints, S3 configuration, a findings severity filter, and webhook table wiring.

• Adds api/v2/relationship-kinds/{relationship_kind_id} endpoint to retrieve a specific relationship kind by ID.
• Adds a new GET node kind endpoint (BED-8756) for querying individual node kinds via the API.
• Adds queue management operation endpoints for submitting and managing background operations via the API.

Malware Analysis · 2026-08-19

CAPEv2 adds a task_id_1 MongoDB index on the calls collection and ships a Tracee Docker setup script for Linux agent deployments.

• Adds task_id_1 index on the MongoDB calls collection (field task_id, ascending) during standalone processor startup, eliminating full collection scans on task-scoped delete and replace operations.
• Adds exit_on_connection_failure parameter to check_webgui_mongo(), allowing the standalone processor (utils/process.py) to log a warning and continue when MongoDB is temporarily unavailable instead of hard-exiting.
• Reconciles required MongoDB indexes at standalone processor startup by calling check_webgui_mongo(exit_on_connection_failure=False) early in main(), so existing installations receive missing indexes automatically on upgrade.

Malware Analysis · 2026-08-19

CAPEv2 gains reserved-machine API selection, platform-aware demux routing, and Proxmox read-retry logic

• Validates explicitly named machines against db.list_machines(include_reserved=True) so callers can submit file, URL, and download-and-execute tasks to a reserved machine by name without the API rejecting it.
• Defers platform assignment for archive/container submissions until after demultiplexing, then routes each extracted file's tasks to machines compatible with the detected platform; machine='all' expansion now uses the extracted platform.
• Adds _get_with_retry helper to the Proxmox machinery module that retries proxmoxer.ResourceException and requests.RequestException on VM enumeration, snapshot enumeration, task-status polling, and post-task VM-status reads, bounded by the existing machinery timeout.

Identity & Access Management · 2026-08-19

Clerk adds biometric sign-in for returning users on Expo, iOS, and Android.

• Enables biometric sign-in (device-trusted prompt) for returning mobile users on Expo, iOS, and Android.

SAST / SCA / Code Security · 2026-08-19

Cloudsmith Go upstreams now support any GOPROXY-compatible module proxy, not just proxy.golang.org.

• Go upstream sources can now be configured to point to any GOPROXY-compatible module proxy, expanding beyond the previously supported public mirror at proxy.golang.org.

General Utilities & Libraries · 2026-08-19

VS Code adds experimental migration flow to move user customizations to agent-host folders via chat.customizations.userDataMigration.enabled

• Adds experimental Migrate User Data Customizations flow, enabled via the chat.customizations.userDataMigration.enabled setting, to move user-level agents and instructions from VS Code profile user data into harness-agnostic folders readable by the active agent host.
• Migration UI appears in the Agent Customizations editor (opened via Configure Chat gear icon) under the active agent host, letting users select individual agents and instructions — with per-file preview — before committing; a confirmation step offers optional deletion of the originals from profile user data.

General Utilities & Libraries · 2026-08-19

code-oss gains multi-group chat layouts, side chats, and cross-app session discovery with chat.agentSessions.showExternal

• Adds chat.agentSessions.showExternal setting to control visibility of external sessions (values: None, Recent, Last 24 Hours, Last 7 Days, All); defaults to hiding external sessions.
• Adds Sessions: Split Chat Group Right, Sessions: Split Chat Group Down, Sessions: Move Chat to Previous Group, and Sessions: Move Chat to Next Group Command Palette commands for keyboard-driven chat layout management.
• Supports multi-group chat layouts in agent host sessions — drag chat tabs to edges to split into side-by-side or stacked groups, with focus navigation via Ctrl+K Ctrl+Left / Ctrl+K Ctrl+Right (macOS: ⌘K ⌘← / ⌘K ⌘→).

General Utilities & Libraries · 2026-08-19

VS Code adds ChatGPT subscription support and experimental Agent Host for Codex, with dual-provider model picking in Chat view.

• Adds ChatGPT subscription as a second authentication option for Codex on the Agent Host — sign in via the account menu (Sign in to ChatGPT) using a free ChatGPT account, no Copilot Pro+ required.
• Adds dual-provider model picker in the Chat view that groups models under ChatGPT and Copilot when both accounts are signed in, identifying same-named models by provider and persisting the chosen provider per session.
• Adds experimental Use Codex without GitHub sign-in option so ChatGPT-signed-in users can run ChatGPT-backed Codex models in the desktop Agents window without a GitHub account.

General Utilities & Libraries · 2026-08-19

VS Code Agents window gains ChatGPT/Codex sign-in, Anthropic credential support, and multi-chat layout within a single session

• Enables chat.agentHost.codexAgent.enabled to use a ChatGPT subscription as the Codex backend — open the account menu in the Agents window and select Sign in to ChatGPT to authenticate without requiring a GitHub sign-in.
• Supports opening the Agents window on desktop without GitHub sign-in when Claude is configured with Anthropic credentials or Codex is already signed in to ChatGPT.
• Model picker now filters to only providers with available credentials when signed out of GitHub, and disambiguates by provider name when Copilot and ChatGPT both offer a model with the same name.

Third-Party & Vendor Risk (TPRM) · 2026-08-19

ConveyorAI now maintains full conversation context across Slack thread follow-ups, enabled by default for all Slack integrations.

• ConveyorAI retains full conversation history within a Slack thread so follow-up questions carry the product line and prior answers forward without restarting context — enabled by default for every Slack integration and can be turned off in Organization Settings.

Third-Party & Vendor Risk (TPRM) · 2026-08-19

Conveyor Labs gets a rebuilt Word experience with editable question outlines and instant document export.

• New Labs opt-in Word experience renders security questionnaire documents in-browser exactly as they appear in Word, builds an editable question outline, and lets users remove misdetected questions or drag to rescan sections.
• AI-drafted answers are placed back into the Word document in one to two minutes, with blue highlights marking AI-touched content that clear on edit.
• Instant export replaces the previous ten-to-fifteen minute wait for Word document export.

Third-Party & Vendor Risk (TPRM) · 2026-08-19

Conveyor exposes Trust Center survey feedback via a new GET /api/v2/trust_center/feedbacks endpoint and MCP tool.

• Adds GET /api/v2/trust_center/feedbacks endpoint returning Trust Center survey responses, including ratings, comments, and source, with filtering by source, rating, and date range plus standard pagination.
• Exposes Trust Center feedback data as an MCP tool so AI agents can read survey responses directly.
• Access to the new endpoint and MCP tool is governed by the Trust Center Designer permission set.

Third-Party & Vendor Risk (TPRM) · 2026-08-19

Conveyor Trust Center adds an MCP server so customers' AI agents can run vendor reviews programmatically.

• Adds a new MCP server for Trust Centers, enabled via the Enable visitors to connect via MCP toggle in Settings > Trust Center > Trust Center Agent, letting visitor AI agents pull documents and ask questions without human involvement.
• Enforces existing access groups, NDA gates, and gating rules against the authenticating visitor email even when access is agent-driven, preserving all existing access controls.
• Logs every agent login, document access, and question the same as a human visit, and supports scheduled reassessments by the customer's agent.

Security Data Pipeline · 2026-08-19

Cribl introduces AWS Cloud Connections for automated log discovery and onboarding across multi-region, multi-account AWS environments.

• New AWS Cloud Connections feature automatically enumerates log destinations (S3, CloudWatch, Firehose, and Firehose destinations) across AWS accounts and regions without manual hunting or custom scripts.
• Generates CloudFormation templates to provision a read-only AWS STS role granting Cloud Connections access to discover logging configurations via AWS APIs.
• Produces CloudFormation configuration files deployable as a CloudFormation stack to onboard discovered log sources directly into Cribl Stream.

Security Data Pipeline · 2026-08-19

Cribl LLM Observability adds LlamaIndex support via OpenTelemetry instrumentation

• Supports instrumenting LlamaIndex applications with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.

Security Data Pipeline · 2026-08-19

Cribl Marketplace launches in Cribl.Cloud, enabling in-product discovery and one-click installation of apps from Cribl, partners, and community developers.

• Introduces Cribl Marketplace, a central in-product hub within Cribl.Cloud (available to cloud and hybrid leaders) for browsing, discovering, and installing prebuilt apps without manually importing GitHub URLs or configuring endpoints.
• Supports filtering the app catalog by solution type, publisher, product, tags, support model, certification status, and recency to help practitioners find relevant apps quickly.
• Surfaces per-app detail pages showing overview, permissions, external API access, files, support information, and version history before installation, giving administrators visibility into what an app requires.

Web Application Security · 2026-08-19

Magento module 1.2.247 adds the datadome_enable_mcp_support property.

• Adds datadome_enable_mcp_support property to the Magento module configuration to enable MCP support.

Vulnerability Management · 2026-08-19

DefectDojo v3.2.201 adds Amazon Bedrock LLM, CSPM via Sensei license, configurable scanner parallelism, asset export, and new connectors.

• Adds --max-parallel CLI flag, MAX_PARALLEL environment variable, and sensei.maxParallel Helm key to configure scan-and-fix scanner parallelism.
• Exposes a flat test_type_name field on the finding serializer REST API.
• Adds Amazon Bedrock as an on-prem LLM connection option.

Public Key Infrastructure (PKI) · 2026-08-19

CertCentral adds Persistent DNS TXT record bulk revalidation, 2- and 3-year X9 PKI for TLS validity, and in-place ACME Directory URL ICA updates.

• Adds Revalidation by Persistent DNS TXT record option to the bulk domain revalidation workflow under Certificates > Domains, allowing a one-time DNS TXT record containing a DigiCert-provided persistent URI to be reused for every subsequent domain revalidation — no new record or URI value required each cycle.
• Extends X9 PKI for TLS certificate validity options from a maximum of 397 days to selectable 1-, 2-, or 3-year terms (custom validity capped at 1,095 days), available in the Validity period section of the Request X9 PKI for TLS Certificate page.
• Enables updating the issuing intermediate CA (ICA) certificate on an existing ACME Directory URL via Automation > ACME Directory URLs > Actions > Update ACME Directory URL, replacing the previous requirement to create a new ACME Directory URL to change the certificate chain.

Runtime Security · 2026-08-19

Docker Sandboxes adds dynamic secret sources via --ref and --command flags, with configurable caching and fallback keychain storage on Linux.

• Adds --ref flag to register a dynamic secret source using a 1Password secret reference (op://...) or AWS Secrets Manager ARN (arn:aws:secretsmanager:...), resolved at runtime by the host CLI rather than stored as a plaintext value.
• Adds --command flag to register any host tool that prints a secret to stdout (e.g., 'gh auth token') as a dynamic secret source, with the command text stored and replayed by the daemon.
• Adds --refresh <duration> flag to control how long resolved service secrets are cached (default 55 minutes); pass --refresh on-demand to resolve on every credential use instead of caching.

Runtime Security · 2026-08-19

Docker Sandboxes gains experimental NVIDIA GPU passthrough via VFIO, exposed through a new --gpu flag on sbx create and sbx run.

• Adds --gpu flag to sbx create and sbx run for NVIDIA GPU passthrough into sandboxes on x86_64 Linux hosts using VFIO.
• Adds sbx settings set platform.allowExperimentalFeatures true and sbx settings set feature.sandbox-gpu true to enable the hidden --gpu flag.
• Introduces prepare-nvidia-bundle.sh build script (distributed via nerdbox-nvidia-modules-x86_64.zip per release) to assemble and install the required EROFS driver bundle at /usr/libexec/nerdbox-nvidia-bundle.erofs.

Runtime Security · 2026-08-19

Docker Sandboxes adds remote control support and Ollama provider option for Claude Code sandboxes

• Enables Claude Code's /remote-control command inside a sandbox via the claude.remoteControl setting.
• Adds --provider ollama flag to sbx run to use an existing Ollama installation instead of the default provider, e.g. sbx run --model gemma4 --provider ollama claude.

Runtime Security · 2026-08-19

Docker Sandboxes gains sbx env commands and .sbxenv.yaml environment files for repeatable, shareable sandbox configs

• Adds sbx env run [PATH...], sbx env create [PATH...], sbx env exec [PATH...] -- COMMAND [ARG...], and sbx env rm [PATH...] lifecycle commands (requires sbx 0.39.0+) for managing sandbox environments from a declarative file.
• Introduces .sbxenv.yaml (fallback: .sbxenv.yml) environment files with schemaVersion, name, agent, kits, workspace, additionalWorkspaces, env, sandboxOptions, secrets, bindings, registries, mcp, and ports top-level fields.
• Supports multi-file merge via sbx env run base.sbxenv.yaml local.sbxenv.yaml: nested mappings merge by key, lists concatenate, and later scalar values override earlier ones — enabling team base configs plus per-machine overrides.

Runtime Security · 2026-08-19

Docker Sandboxes adds dynamic credential sources: host CLI commands, 1Password, and AWS Secrets Manager for proxy-injected secrets.

• Supports --command as a dynamic secret source, running a host CLI command (e.g. gh auth token) to resolve credentials at runtime, with a 55-minute cache and --refresh on-demand to bypass caching per credential use.
• Supports --ref with 1Password CLI references (e.g. op://Work/GitHub/token) so the daemon calls 1Password on the host at proxy time — the real value never enters the sandbox.
• Supports --ref with AWS Secrets Manager ARNs (e.g. arn:aws:secretsmanager:…) so the daemon calls AWS Secrets Manager when the proxy needs the credential.

Runtime Security · 2026-08-19

Docker Sandboxes gains sbx prune for cleanup and -e/--env/--env-file flags for environment variable injection.

• Adds sbx prune to remove all stopped local sandboxes, with --dry-run to preview removals and --filter since=<duration> (e.g. since=168h) to exclude recently stopped sandboxes.
• Adds -e/--env flag to sbx run and sbx create to set individual environment variables in a sandbox, including copying values from the host by specifying a name without a value (requires v0.39.0+).
• Adds --env-file flag to sbx run and sbx create to load multiple environment variables from one or more files, following docker run precedence rules (requires v0.39.0+).

Runtime Security · 2026-08-19

Docker Sandboxes adds .sbxenv.yaml for declaring repeatable local sandbox configurations

• Adds .sbxenv.yaml sandbox environment files to declare and share repeatable local sandbox configurations; requires version 0.39.0 or later.

Runtime Security · 2026-08-19

Docker Sandboxes introduces the sbx CLI for running AI coding agents in isolated microVMs on macOS, Windows, and Linux.

• Adds the sbx CLI to run AI coding agents in isolated microVMs — no Docker Desktop or Docker Engine required.
• Installs on macOS via brew install docker/tap/sbx after brew trust docker/tap.
• Installs on Windows via winget install -h Docker.sbx.

Runtime Security · 2026-08-19

Docker Sandboxes v0.39.0 adds declarative .sbxenv.yaml environments, USB passthrough, bulk pruning, and kit signing via Sigstore.

• Adds sbx env run to provision a complete, reproducible sandbox from a .sbxenv.yaml file (defining agent, workspace, kits, env vars, secrets, registry credentials, ports, and resource limits) and open an interactive session.
• Adds sbx env create, sbx env exec, and sbx env rm to manage the full lifecycle of declarative sandbox environments.
• Adds experimental --usb flag to sbx create (enabled via DOCKER_SANDBOXES_FEATURE_SANDBOX_USB environment variable) to re-attach specified USB devices inside a sandbox via usbfs; Linux x86_64/ARM64 only.

Web Application Security · 2026-08-19

DOMPurify 3.4.14 expands its SVG allow-list with pointer-events and vector-effect presentation attributes.

• Adds SVG pointer-events and vector-effect presentation attributes to the built-in allow-list, enabling their use in sanitized SVG content without custom configuration.

AI-Powered Offensive Security · 2026-08-19

Dreadnode adds a versioned item type registry, ScopeGuard in remote/headless sessions, Caido MCP server, and a response-queue-poisoning skill.

• Adds a versioned item type registry backing structured agent output: platform admins can define, publish, and manage structured output contracts (findings, assets, and custom types) via Operations → Objects, with capabilities binding to approved registry versions and all item writes validated against the canonical schema.
• Adds ScopeGuard policy support in remote and headless sessions via the SDK (experimental); the session UI renders tool-call policy decisions when ScopeGuard metadata is present — opt-in, with no workspace setting or picker entry yet.
• Adds the full Caido MCP server (66 tools, 6 resources) as a second MCP server in the web-security capability, alongside the existing Python wrapper, both targeting the same Caido instance.

SAST / SCA / Code Security · 2026-08-19

Endor Labs adds Agents Hub for AI agent discovery and Agent Governance for monitoring and policy enforcement over coding agents.

• Adds Agents Hub — a catalog where practitioners can browse, filter by category, and select published Endor Labs security agents (covering workflows such as finding triage, dependency remediation, and scan-failure diagnosis), and monitor team usage including task counts and last-run time.
• Adds Agent Governance — an inventory and control plane for AI coding agents, models, MCP servers, and skills running across developer workstations and cloud environments, with real-time monitoring of agent actions (commands, file access, tool calls).
• Adds policy enforcement in Agent Governance that can block, alert on, or require approval for risky agent behavior before it executes, with a built-in policy catalog extensible by custom rules.

SAST / SCA / Code Security · 2026-08-19

Endor Labs open-sources two complete Endor Patch examples with reproducible builds, attestations, and auditable diffs in the endor-patches repository.

• Patched JARs in patches/<library>/artifacts/ can be installed to a local Maven repository via mvn install:install-file and declared as dependencies using the -endor-YYYY-MM-DD version string, with transitive override support via <dependencyManagement> in Maven or resolutionStrategy in Gradle.

SAST / SCA / Code Security · 2026-08-19

Endor Labs AI SAST adds full C language support with buildless scanning in the IDE and on PRs.

• Adds full C language support to Endor Labs AI SAST, with buildless scans that run in the IDE and on pull requests — no compiler hook or reproducible build required.
• Pairs deterministic program analysis (call-graph and reachability engine) with LLM reasoning for C, tracing data flow across functions and files to catch buffer overflows, use-after-free, integer overflows, and other cross-function memory-safety flaws that pattern-based rules miss.
• C SAST is available alongside C SCA in the same platform, covering first-party C code and its open-source dependencies together.

Threat Intelligence · 2026-08-19

Feedly Threat Intelligence adds a Suricata Rules AI Model to continuously collect, extract, and export Suricata rules from open-web reporting.

• New Suricata Rules AI Model for AI Feeds automatically collects articles containing Suricata rules from 5,000 vetted CTI sources, extracts the rules, and makes them exportable for direct import into detection pipelines.
• API access allows pulling collected Suricata rules programmatically into a detection pipeline.
• Feedly Threat Intelligence now recognizes six detection rule formats across open-source reporting: Suricata, Snort, Sigma, YARA, Splunk, and KQL-based Hunting Queries for Microsoft Defender and Sentinel.

Threat Intelligence · 2026-08-19

Feedly Threat Intelligence adds continuous collection of Suricata rules matched to your requirements.

• Continuously collects Suricata rules matching user-defined requirements, enabling automated rule harvesting for network detection pipelines.

Threat Intelligence · 2026-08-19

Feedly Threat Intelligence adds a Suricata Rules AI Model to continuously collect, filter, and export detection rules from open-source reporting.

• Adds a new Suricata Rules AI Model that can be paired with an AI Feed to automatically collect articles containing Suricata rules from 5,000 vetted CTI sources and repositories as new reporting is published.
• Enables export and programmatic API pull of extracted Suricata rules directly into detection pipelines, IDS, or SIEM tooling.
• Extends detection rule AI Model coverage to six formats — Suricata, Sigma, YARA, Snort, Splunk, and KQL-based Hunting Queries for Microsoft Defender and Sentinel — spanning network traffic inspection, file and malware matching, and log-based detection.

SAST / SCA / Code Security · 2026-08-19

GitHub Copilot for JetBrains gains enterprise-managed controls for plugins, MCP servers, OpenTelemetry, and permission modes.

• Adds enabledPlugins enterprise managed setting to require Copilot plugins to be enabled or disabled across JetBrains IDEs.
• Adds extraKnownMarketplaces enterprise managed setting to make approved plugin sources available in JetBrains IDEs.
• Adds strictKnownMarketplaces enterprise managed setting to restrict plugin installation to approved sources only.

SAST / SCA / Code Security · 2026-08-19

GitHub adds token-type-specific credential revocation and deauthorization for enterprises and organizations via UI and REST APIs.

• Adds token-type-specific bulk deauthorization via the enterprise REST APIs and UI, letting enterprise owners revoke all SSO authorizations for a specific credential type (Personal access tokens, SSH keys, OAuth app tokens, or GitHub App user access tokens) across the enterprise or for a single user — without touching other credential types.
• Adds token-type-specific bulk revocation via the enterprise REST APIs and UI, enabling deletion or revocation of all user-level credentials of a specific type (e.g., all personal access tokens for an individual EMU user) while leaving other credential types intact.
• Extends all bulk credential-revocation actions previously available only at the enterprise level to the organization level through the organization REST APIs and web UI, giving organization admins incident-response parity.

SAST / SCA / Code Security · 2026-08-19

GitHub Code Quality dashboard gains a Trends tab showing open findings over 7, 14, or 30-day windows across repositories.

• Adds a Trends tab to the organization-level Code Quality dashboard, plotting open findings over time grouped by health score or severity across date ranges of 7, 14, or 30 days.
• Adds most improved and needs support repository ranking tables alongside the trend graph, showing net change in open findings since the start of the selected period.
• Trend graph and ranking tables respect repository filters applied at the top of the dashboard page.

SAST / SCA / Code Security · 2026-08-19

GitLab introduces Git Clone Override Policy: a Go binary + .afullhistorycloneoverridepolicy.toml that auto-enforces optimized clones.

• Adds .afullhistorycloneoverridepolicy.toml (TOML, schema_version = 2) stored in the repository root to declaratively configure clone optimization policy, including [git_config], [fetch], [sparse_checkout], exclude_extensions, conemode, includes, excludes, and case_variants fields.
• Adds a self-contained Go binary (git-clone-override-policy) that intercepts bare git clone <URL> calls and automatically executes a fixed 13-step shallow-and-partial-clone sequence, applying the repo's policy file before any source hits disk.
• Supports [fetch] flags such as --depth=1 and --filter=blob:none in policy config to defer blob content and limit history depth on initial clone.

SAST / SCA / Code Security · 2026-08-19

GitLab Personal Access Tokens now expose last-five connection IPs and per-scope usage timestamps in token detail view.

• Token detail view now surfaces usage dates alongside scopes, assigned roles, and expiration dates — usage times refresh every 10 minutes via API.

Exploitation & C2 · 2026-08-19

NodeZero Rapid Response exposes a GraphQL API for querying advisories, listing affected assets, annotating remediation status, and exporting data.

• Adds a Rapid Response GraphQL API to query advisories, list affected assets, annotate remediation status, and export data programmatically.

Exploitation & C2 · 2026-08-19

NodeZero adds a Rapid Response API for programmatic access to time-sensitive attack surface intelligence.

• Introduces the Rapid Response API, enabling programmatic access to rapid-response findings and intelligence.

Endpoint Security (EDR/XDR) · 2026-08-19

Huntress adds a transparent SOC Investigation dashboard with timelines, summaries, and CSV/Excel export.

• New Investigations dashboard (accessed via Investigations in the top navigation) shows a chronological timeline of SOC signals reviewed, actions taken, remediations applied, and final outcomes for both closed-benign and reported investigations.

Compliance Automation & Trust Management · 2026-08-19

Hyperproof adds Risks and Risk Registers API endpoints for programmatic access to organizational risk data.

• New GET https://api.hyperproof.app/v1/riskregisters endpoint returns all risk registers for your organization.
• New GET https://api.hyperproof.app/v1/riskregisters/{riskRegisterId} endpoint returns a specific risk register by ID.

Digital Forensics & Incident Response · 2026-08-19

iLEAPP v2026.3.1 adds Snapchat, Tinder, TikTok, Reddit, OneDrive, and Google Drive artifacts plus WhatsApp add-on and logarchive dialed-number coverage.

• Adds new logarchive dialed numbers artifact extracting CommCenter call.provider setup/teardown blocks, Call(StatusUpdate) state chains, and ContactSearchManager digit-sequence entries from unified log archives.
• Adds Snapchat iOS artifacts including Memories Search Index.
• Adds Tinder iOS artifacts.

Threat Intelligence · 2026-08-19

IntelOwl 6.8.0 adds an optional self-hosted MISP instance deployable with a single --misp flag alongside IntelOwl.

• Adds --misp flag to spin up a self-hosted MISP threat intelligence platform alongside IntelOwl via docker/misp.override.yml, starting three containers: misp-core (MISP web app at https://misp-core), misp-db (MariaDB 10.11), and misp-redis (Valkey/Redis-compatible cache).
• Supports pushing IntelOwl analysis results into the local MISP instance and searching MISP for known IOCs without a separate MISP deployment.
• Configures the IntelOwl MISP connector/analyzer (via Django Admin or GUI plugin configuration) with url_key_name set to https://misp-core and api_key_name set to the default admin API key.

Threat Intelligence · 2026-08-19

IntelOwl 6.8.0 adds optional self-hosted MISP deployment via --misp flag with full env-file configuration

• Adds --misp flag to deploy a self-hosted MISP instance alongside the main IntelOwl stack (available from version 6.8.0).
• Configures the bundled MISP instance via docker/env_file_misp, with a full template provided at docker/env_file_misp_template; key variables include ADMIN_EMAIL, ADMIN_PASSWORD, ADMIN_KEY (must be exactly 40 characters), ADMIN_ORG, BASE_URL, MYSQL_PASSWORD, and REDIS_PASSWORD.
• Supports exposing the MISP web GUI by adding a port mapping for the misp-core service in docker/custom.override.yml (used with the --custom flag), e.g. mapping port 8443:443.

Threat Intelligence · 2026-08-19

IntelOwl 6.8.0 adds an optional self-hosted MISP instance deployable with a single --misp flag alongside IntelOwl.

• Adds --misp flag to deploy a self-hosted MISP instance via the docker/misp.override.yml compose file, starting three containers: misp-core (MISP web app at https://misp-core), misp-db (MariaDB 10.11), and misp-redis (Valkey/Redis-compatible cache).
• Default MISP credentials are pre-configured in docker/env_file_misp (admin email admin@admin.test, API key mispdefaultintelowladminapikeychgme01234, org IntelOwl) — changeable before production deployment.
• Connects IntelOwl to the local MISP instance via the Django Admin or GUI plugin configuration using url_key_name, api_key_name, and ssl_check parameters, enabling push of analysis results to MISP and IOC lookups against it.

Attack Surface & Exposure Management · 2026-08-19

Intruder adds dark theme and a redesigned single-click navigation with pinnable Favourites.

• Redesigned navigation gives single-click access to every page, with pages grouped into expandable theme sections and icon/pill indicators flagging new data or activity.
• Adds pinnable Favourites shortcut bar in the sidebar for quick access to most-visited pages.

Endpoint Security (EDR/XDR) · 2026-08-19

Iru Compliance Automation action filters now include an Unassigned option for Owner and Delegate fields.

• Adds an Unassigned option to the Owner and Delegate filters on the Actions list in Compliance Automation, letting admins surface ownerless actions without manually scanning the table.

Endpoint Security (EDR/XDR) · 2026-08-19

Iru adds Google Cloud Platform as a live compliance source, covering IAM, Cloud Storage, Cloud KMS, and Cloud Logging.

• Adds Google Cloud Platform to the Iru Compliance connector catalog, enabling configuration and inventory evidence collection across Google Cloud IAM, Cloud Storage, Cloud KMS, and Cloud Logging.
• Connects to a Google Cloud project via a read-only service account and JSON key for scoped, least-privilege access.

Endpoint Security (EDR/XDR) · 2026-08-19

Iru adds 209 SSO pre-configuration templates covering SAML, OIDC, and SCIM setup for popular web apps.

• Adds 209 pre-configuration templates for SAML and OIDC single sign-on across commonly used web applications, including Slack, Zoom, and Google Workspace.
• Templates also cover SCIM user provisioning configuration, guiding identity administrators through the full setup process.

SAST / SCA / Code Security · 2026-08-19

JFrog AI Assistant (Ask AI) launches with platform guidance, navigation help, and Rego policy authoring for AppTrust users.

• Introduces Ask AI, an AI-powered assistant accessible via the top bar of the JFrog Platform, able to answer how-to questions, navigate users to relevant pages and workflows, and provide contextual guidance.
• AppTrust users can use AI to help write unified policies in Rego, making policy creation and management easier.
• Enables JFrog AI platform-wide from MyJFrog > Settings > AI by approving the AI Addendum; Primary Admins can also require JPD-level activation via the Require JPD level activation checkbox.

SAST / SCA / Code Security · 2026-08-19

LavaMoat adds scriptsConfig to assign Node.js permission profiles per package.json script, enforcing least-privilege on build, test, and release commands.

• Adds scriptsConfig key to package.json that maps each script name to a JSON file containing NODE_OPTIONS permission flags, letting you assign distinct Node.js permission profiles to lint, test, build, release, and other scripts individually.
• Introduces #default key in scriptsConfig to set a fallback permission profile for all scripts not explicitly listed, supporting both security-first (strict default) and compatibility-first (no default) strategies.
• Ships two starter permission profiles — lavamoat/scripts.strict.json (read/write ./, no network, no native modules) and lavamoat/scripts.loose.json (broad file reads, temp-dir writes, child processes and native addons allowed, no network) — auto-generated when script hardening is enabled.

SAST / SCA / Code Security · 2026-08-19

@lavamoat/harden CLI applies opinionated security hardening to npm/yarn/pnpm project configs via three commands: defaults, wizard, and check.

• New harden defaults command writes hardening config at a chosen level (baseline, moderate, strict) into .npmrc, .yarnrc.yml, pnpm-workspace.yaml, and package.json; accepts --level (-l) and --package-manager (-p) flags.
• New harden check command audits the current package manager config against a hardening level without modifying files, printing a pass/fail checklist and exiting with code 0 (all satisfied) or 1 (gaps found) — designed for CI enforcement.
• New harden wizard command interactively walks through hardening decisions and applies only the settings the user selects, with optional --package-manager (-p) pre-selection.

SAST / SCA / Code Security · 2026-08-19

@lavamoat/harden CLI applies opinionated security hardening to npm/yarn/pnpm configs via harden defaults, harden wizard, and harden check commands.

• Adds harden defaults --level <level> command to write hardening config into .npmrc, .yarnrc.yml, pnpm-workspace.yaml, and package.json at baseline, moderate, or strict levels without manual edits.
• Adds --package-manager (-p) flag to harden defaults and harden check to explicitly target npm, yarn, or pnpm instead of relying on auto-detection.
• Adds --decisions-snapshot (-d) flag to load a JSON file of saved hardening decisions, and --save-decisions (-s) to write the final choices to ./decisions-snapshot.json for reuse across teams or CI.

Reconnaissance & OSINT · 2026-08-19

Maigret now caches per-site activation tokens (guest tokens, JWTs, session cookies) in ~/.maigret/activation.json to skip redundant round trips.

• Adds ~/.maigret/activation.json as a per-user activation token cache, storing short-lived credentials (Twitter guest token, Vimeo JWT, Weibo/Wikimapia session cookie, OnlyFans signed header pair, ProtonMail bearer token) minted during a run so subsequent runs skip the extra challenge round trip.
• Cache file is created with 0600 permissions, treating minted tokens as session credentials.
• Supports a system-wide settings path at /etc/maigret/settings.json for administrator-set policies.

Reconnaissance & OSINT · 2026-08-19

Maigret caches per-site activation tokens (guest tokens, JWTs, session cookies) in ~/.maigret/activation.json to skip redundant round trips on subsequent runs.

• Introduces ~/.maigret/activation.json to cache short-lived activation tokens (Twitter guest tokens, Vimeo JWTs, Weibo/Wikimapia session cookies, OnlyFans signed header pairs, ProtonMail bearer tokens), created with 0600 permissions so subsequent runs start with a warm token and skip the extra challenge round trip.

Reconnaissance & OSINT · 2026-08-19

Nmap gains a libfuzzer-based fuzzing framework covering Ncat HTTP, traceroute, DNS, and packet validation routines.

• Adds a libfuzzer-based fuzzing framework for Nmap internals, with fuzzers for Ncat HTTP functions, decode_reply() in traceroute, gettcpopt_ts, validatepkt(), and several libnetutil functions.
• Switches DNS transaction IDs (TXID) from sequential to random to reduce predictability in DNS requests.
• Improves DNS resolver correctness: timeout now starts only after the write completes, late replies are accepted without clobbering existing results, and request ID lookup is tracked per-server.

SAST / SCA / Code Security · 2026-08-19

Noir adds an errors key to JSON/YAML/SARIF output and a --strict flag to signal degraded scans.

• Adds an errors key to JSON output that records per-tech analyzer failures and skipped files, distinguishing an empty result from an analyzer that never ran.
• Skipped files are tallied per tech with up to five example paths rather than one entry each, preventing a broken checkout from flooding the report.
• Propagates the errors key to -f yaml output and maps it to runs[0].invocations[0].executionSuccessful in -f sarif output.

SAST / SCA / Code Security · 2026-08-19

Noir adds 12 new language/framework targets: ServiceStack, Kratos, Helidon MP/SE, Feathers, Oak, Sails.js, Phalcon, CherryPy, Masonite, Padrino, and LoopBack

• Adds endpoint analysis support for ServiceStack, Kratos, Helidon MP, Helidon SE, Feathers, Oak, Sails.js, Phalcon, CherryPy, Masonite, Padrino, and LoopBack frameworks.

SAST / SCA / Code Security · 2026-08-19

Noir adds --strict flag to exit with code 2 when any analyzer fails or skips a file

• Adds --strict flag that exits with code 2 if any analyzer failed or skipped a file during a scan, while still reporting all collected results — enables CI pipelines to catch incomplete scans.

SAST / SCA / Code Security · 2026-08-19

Noir v1.3.0 adds HTTP QUERY method (RFC 10008) support, 11 new framework analyzers, and scan-integrity reporting with --strict.

• Adds --strict flag to exit non-zero when any analyzer fails or file is skipped, surfacing scan-integrity failures that were previously silently dropped.
• Adds end-to-end support for the HTTP QUERY method (RFC 10008) across ~24 frameworks including Express, Fastify, Hono, NestJS, Flask, aiohttp, Rails, Laravel, Phoenix/Plug, Echo, Fiber, Go net/http, axum, Ktor, http4k, Micronaut, Vert.x, JAX-RS/Quarkus/Dropwizard, ASP.NET Core, and Kemal — including OAS3 serialization and HTML report rendering.
• Adds 11 new framework analyzers: Oak (Deno), Feathers.js, Sails.js, LoopBack 4, CherryPy, Masonite, Padrino, Phalcon, Helidon, ServiceStack, and Kratos.

AI/LLM Security · 2026-08-19

nono v0.74.0 adds remote session connect/ps, subtool audit surfacing, export_env pass-through, and configurable approval backends

• Adds nono connect subcommand to attach this terminal to a session hosted by nono-console; accepts a session ID (e.g. local:host:abc123) or URL directly.
• Extends nono ps with --remote flag to list sessions hosted by the enrolled tenant's nono-console, combinable with --all and --json.
• Adds export_env field to tool-sandbox CommandPolicyConfig and top-level session_export_env list in CommandPoliciesConfig, letting callers explicitly pass named env vars (exact names, trailing-* prefixes, or bare *) through to child processes, bypassing the dangerous-var blocklist.

Identity & Access Management · 2026-08-19

Nudge Security now discovers AI agents built on Datadog and HubSpot via its browser extension, surfacing them in the AI agents inventory.

• Discovers AI agents your team builds on Datadog and HubSpot through browser-based detection, flowing each agent into the AI agents inventory under Identities with creator, components, and risk insights.
• Requires browser-based agent discovery to be enabled in browser extension settings; accessible as part of the AI agent discovery research preview.

Identity & Access Management · 2026-08-19

Omada Identity Cloud adds timezone-aware access requests, per-account password reset config, new REST nested HTTP verb option, and a hosted CAG instance group.

• Adds DisableAutoAccountsWithOnlyBlockedAssignments customer setting to block auto-created system accounts when all justifying role/permission assignments are blocked by Separation of Duties constraints, preventing unnecessary provisioning.
• Adds DefaultTimeZone (Default time zone) customer setting (integer code) to set an organization-wide fallback time zone for access requests; requested date/time values display in the UI with a tooltip showing the time zone name and corresponding UTC value.
• Adds Nested HTTP verb option to the Nested Requests tab in REST data import, allowing separate HTTP method configuration for parent and nested requests (e.g. GET -> POST, POST -> GET).

Identity & Access Management · 2026-08-19

Omada Identity removes the need to install connectivity packages via Connectivity Manager; all packages now available by default.

• All connectivity packages are now pre-available in your environment — no additional installation via the Connectivity Manager is required.
• Uploaded scripts (.ps1 format) are listed in a dialog and can be reused across the environment, with per-file size limit of 1 MB and a requirement for unique file names.
• New script management actions available from the Actions column: download scripts to review their content, or delete scripts that are no longer needed.

Identity & Access Management · 2026-08-19

Omada Identity GraphQL API gains Omada-Client request header for telemetry attribution and exposes IDS schema via ApiDoc.aspx?api=ids.

• Adds optional Omada-Client request header to the GraphQL API so requests can be tracked and attributed to their originating client in telemetry; requests without the header are tracked under the default client name omada-es.
• Exposes the Internal Data Store (IDS) schema for Horizons data through the ApiDoc.aspx?api=ids suffix on the API documentation viewer, enabling GraphQL queries against IDS data.

SAST / SCA / Code Security · 2026-08-19

Openlayer MCP server launches with remote and local connectors, OAuth, and purpose-built tools for LLM pipeline management.

• Adds a remote MCP connector at https://mcp.openlayer.com/mcp using Streamable HTTP transport with OAuth sign-in — no local install or API key required.
• Adds a local MCP server via uvx openlayer-mcp using stdio transport, authenticated with the OPENLAYER_API_KEY environment variable.
• Adds OPENLAYER_BASE_URL environment variable to the local server to point at a self-hosted Openlayer instance instead of Openlayer Cloud.

SAST / SCA / Code Security · 2026-08-19

Openlayer CLI gains a tests command to export, archive, and delete project tests (goals)

• Adds tests subcommand to the Openlayer CLI, enabling export, archive, and deletion of tests (goals) within an Openlayer project.

AI/LLM Security · 2026-08-19

OpenShell v0.0.109 adds OCSF AI inference event emission via the ai_operation profile on ApiActivity, bumping OCSF schema to v1.8.0.

• Emits AI inference events using the ai_operation profile on OCSF ApiActivity class [event class 6003], with the OCSF schema bumped to v1.8.0.

Identity & Access Management · 2026-08-19

PingOne adds Microsoft Entra ID provisioning, external group name mapping, and credential reset/delete capabilities.

• Adds a Microsoft Entra ID provisioning connection, enabling bidirectional provisioning of users and groups between Microsoft Entra ID and PingOne.
• Supports mapping attributes from Microsoft Entra ID to the External Group Names attribute in PingOne, enabling group-based application access control using Microsoft group membership.
• Adds reset and delete capabilities for credential records directly from a user's profile in PingOne.

Identity & Access Management · 2026-08-19

PingOne adds Microsoft Entra ID provisioning, external group name mapping, and credential reset/delete capabilities.

• Adds bidirectional user and group provisioning between Microsoft Entra ID and PingOne via a new provisioning connection.
• Adds the ability to map Microsoft Entra ID attributes to the External Group Names attribute in PingOne, enabling group-based application access control using Microsoft group membership.
• Adds reset and delete actions for credential records directly from a user's profile in PingOne.

Identity & Access Management · 2026-08-19

Ping Identity adds continuous identity creation, ESV support in connector server config, and script editor ESV error visibility.

• Enables use of an ESV for the connector server name in the New Connector Server modal.
• Surfaces errors in the script editor when scripts reference environment ESVs incorrectly.
• Allows creating another identity immediately after creating one, without closing the modal.

AI/LLM Security · 2026-08-19

Promptfoo adds an Unverifiable Claims Detection plugin to test AI systems for susceptibility to unverifiable assertions.

• New Unverifiable Claims Detection plugin tests AI systems' susceptibility to unverifiable claims.

Vulnerability Management · 2026-08-19

Qualys Patch Management adds AI-Powered Patch Reliability Scoring combining LLM sentiment analysis and telemetry signals.

• New Qualys AI-Powered Patch Reliability Scoring predicts patch deployment success before rollout by combining LLM-analyzed global public sentiment (technical discussions, release feedback) with Qualys telemetry on patch rollback rates and vulnerability reopen rates into a single reliability score.
• TruRisk Eliminate now reports true remediation state — including reboot completion — so teams can verify KEV deadline compliance after deploying cumulative updates.

Attack Surface & Exposure Management · 2026-08-19

runZero self-hosted instances gain per-entitlement kill switches via RUNZERO_DISABLE_<ENTITLEMENT> environment variables

• Adds RUNZERO_DISABLE_<ENTITLEMENT> environment variables to force-disable any license entitlement instance-wide, overriding the license for every account and organization — supported variables include RUNZERO_DISABLE_AUTOSCAN, RUNZERO_DISABLE_AI, RUNZERO_DISABLE_PASSIVE_MONITORING, RUNZERO_DISABLE_API_ORG, RUNZERO_DISABLE_API_ACCOUNT, RUNZERO_DISABLE_DATA_RETENTION, RUNZERO_DISABLE_OFFLINE, RUNZERO_DISABLE_METAMIN, RUNZERO_DISABLE_FINDINGS, RUNZERO_DISABLE_ISSUES, RUNZERO_DISABLE_SUPPRESSION, RUNZERO_DISABLE_RISK_EVENTS, RUNZERO_DISABLE_RULES_BASIC, RUNZERO_DISABLE_REPORTS_BASIC, RUNZERO_DISABLE_REPORTS_ADVANCED, RUNZERO_DISABLE_CERTIFICATE_INVENTORY, and integration-specific variables such as RUNZERO_DISABLE_INT_CROWDSTRIKE, RUNZERO_DISABLE_INT_SENTINELONE, RUNZERO_DISABLE_INT_TENABLE, RUNZERO_DISABLE_INT_SPLUNK, RUNZERO_DISABLE_INT_SERVICENOW, RUNZERO_DISABLE_INT_QUALYS, RUNZERO_DISABLE_INT_INSIGHTVM, RUNZERO_DISABLE_INT_CLOUD, RUNZERO_DISABLE_INT_LDAP, RUNZERO_DISABLE_INT_AZURE_AD, RUNZERO_DISABLE_INT_INTUNE, RUNZERO_DISABLE_INT_WIZ, RUNZERO_DISABLE_INT_JIRA, RUNZERO_DISABLE_INT_PAN, and more.

Attack Surface & Exposure Management · 2026-08-19

runZero adds OCSF 1.9.0 export for asset inventory, outputting Device Inventory Info and Live Evidence Info events.

• Adds OCSF 1.9.0 export for the asset inventory, producing assets.ocsf.jsonl and assets.ocsf.json files — assets export as Device Inventory Info events and their observed services as Live Evidence Info events, with unmapped fields preserved under the event's unmapped object.
• Exposes the OCSF 1.9.0 inventory export via the inventory export menu and the Export API, supporting both .jsonl and .json formats.

Attack Surface & Exposure Management · 2026-08-19

runZero 5.1 adds OCSF 1.9.0 export for asset inventory, surfacing assets and services as standardized events.

• Adds OCSF 1.9.0 export for the asset inventory, producing assets.ocsf.jsonl and assets.ocsf.json files downloadable from the inventory export menu and the Export API.
• Exports assets as Device Inventory Info events and their observed services as Live Evidence Info events under the OCSF schema.
• Preserves fields without an OCSF equivalent under the event's unmapped object, ensuring no asset data is silently dropped on export.

Identity & Access Management · 2026-08-19

SailPoint SoD policies now support Roles and Access Profiles as criteria alongside entitlements in List A and List B.

• Adds support for SailPoint Roles in Separation of Duty (SoD) policy List A and List B criteria, configurable via Admin → Policies → Separation of Duty.
• Adds support for Access Profiles in SoD policy criteria, enabling mixed criteria across lists (e.g., entitlements in List A and a Role in List B).
• Preserves existing conflict detection, access-request approval visibility, and violation management workflows for policies that use Role or Access Profile criteria.

SAST / SCA / Code Security · 2026-08-19

Semgrep adds multi-finding Autofix PRs, branch filtering on workflow jobs, and experimental v2 API for agentic workflow issues.

• Exposes issues created by Semgrep Agentic Workflows through the experimental v2 API.
• Supports fixing multiple Code findings from the same rule in a single Autofix pull request or merge request when they appear in the same file.
• Adds advisory affected-projects list directly below the description on the Rules & Policies > Advisories Details page.

SAST / SCA / Code Security · 2026-08-19

Evo by Snyk replaces Risk Index with a 0–1,000 impact-weighted model risk score and adds Continuous Offensive Security (COS) capability.

• Introduces Continuous Offensive Security (COS) in Evo by Snyk, a new offensive scanning capability covering Targets, Scans, and Findings and Reports — with dedicated docs for defining target scope, configuring authentication, managing targets, monitoring scans, and interpreting results.
• Replaces the previous Risk Index with a new model risk score (0–1,000) that combines attack success rate with impact weighting, tested across prompt injection, data exfiltration, and insecure code generation attack categories.
• Adds four severity bands to the model risk score: low (0–249), medium (250–499), high (500–749), and critical (750–1,000) for at-a-glance triage.

SIEM · 2026-08-19

Scheduled Searches now support up to 10 independent notifications per search, all sharing one trigger condition.

• Scheduled Searches now support up to 10 notifications per search, each configured independently, all sharing the same trigger condition and firing from the same search execution.

General Utilities & Libraries · 2026-08-19

SysReptor 2026.68 adds encrypted note file downloads, AI agent Q&A, default note structures, and retest status color customization.

• Supports downloading note files via an encrypted channel to prevent proxies from inspecting downloads.
• AI agent can now ask the user questions during agent interactions.
• Adds default note structures to HTB, OffSec, and demo designs.

Secure Access (VPN / SASE / ZTNA) · 2026-08-19

Tailnet list API now paginates with limit and cursor query parameters, returning 100 results per page by default.

• Adds limit and cursor query parameters to the list tailnets endpoint, enabling paginated retrieval of tailnet results (default 100 per page); the response includes totalCount and a cursor value to pass into the next request until the cursor is empty.

Secure Access (VPN / SASE / ZTNA) · 2026-08-19

Tailscale's list tailnets API endpoint now paginates results with limit and cursor query parameters.

• Adds pagination to the list tailnets API endpoint via limit and cursor query parameters, returning up to 100 results per page by default and a totalCount in the response.
• Returns a cursor value in the list tailnets response to pass as the cursor query parameter on subsequent requests; iteration ends when the returned cursor is empty.

Detection Engineering · 2026-08-19

Tenzir Test v2.0.0 adds node output capture with log files and environment variables for inspecting node stdout/stderr in tests.

• Adds node-stdout.log and node-stderr.log log files capturing tenzir-node output from startup through teardown, accessible via TENZIR_NODE_STDOUT_LOG and TENZIR_NODE_STDERR_LOG environment variables in tests.
• Adds --keep flag to retain per-test log files in the scratch directory after a test run.
• When the node exits while its fixture is active, the harness now reports the exit code and a tail of stderr instead of leaving dependent tests to fail with opaque connection errors.

Detection Engineering · 2026-08-19

Tenzir Test v2.0.0 adds deterministic diagnostic baselines and node output capture for easier integration test diagnosis.

• Records diagnostics before pipeline output in test baselines, making baseline ordering deterministic.

SOAR · 2026-08-19

Tines 42.7.0 adds customizable AI credit alerts, SSO access for Apps and Collections, and new case list layouts.

• Enables customization of AI credit usage alerts so teams can tune notification thresholds for their consumption.
• Adds SSO-based sharing and access for Apps, allowing practitioners to gate automation apps behind their identity provider.
• Adds SSO-based sharing and access for Collections, extending identity-provider-controlled access to grouped resources.

SOAR · 2026-08-19

Tines Stories gains a first-party MCP server endpoint, letting AI clients like Claude, Cursor, and ChatGPT author stories via plain language.

• Adds a first-party MCP server endpoint built into Tines Stories tenants, enabling AI clients (ChatGPT, Codex, Cursor, Claude Code, Claude Desktop) to create and modify stories through natural-language instructions against the same story-authoring capabilities as the storyboard UI.
• Distinguishes the built-in Tines Stories MCP server (for AI clients to author stories externally) from custom MCP servers built inside Tines Stories (for running production integrations), with both surfaces usable simultaneously.

SOAR · 2026-08-19

Tines adds Workbench, an AI chat interface that can execute Stories actions and access proprietary data within your tenant.

• New Workbench AI chat interface lets practitioners ask questions and take action in real-time using Tines Stories-powered tools, with data staying private within the tenant.
• Workbench supports per-user scoping — tool configurations, chats, and custom instructions are individual to each user.
• Users can enable credentials or stories they have access to run directly within Workbench.

SOAR · 2026-08-19

Tines Stories gains sample dashboard templates and scheduled email snapshots for stakeholder reporting.

• Adds sample dashboard templates so practitioners can create a pre-built dashboard ready to rename or edit immediately.
• Adds dashboard Snapshots to email a copy of a dashboard on a configurable schedule, including control over recipients, frequency, and which charts to include — enabling recurring reports for stakeholders without Tines Stories access.

SOAR · 2026-08-19

Tines adds primitive support in Apps, a Workbench for Cases, and a redesigned events panel.

• Adds support for Tines primitives inside Apps.
• Introduces Workbench for Cases, integrating Cases with AI in Tines.
• Delivers a more flexible events panel.

SOAR · 2026-08-19

Tines Apps can now read cases, records, and resources via built-in functions without requiring an endpoint.

• Apps can now call built-in functions to read cases, records, and resources directly from your tenant, eliminating the need to create or call an endpoint.

AI/LLM Security · 2026-08-19

ToolHive v0.44.0 adds actor_token support in RFC 8693 token exchange and hardens OAuth/delegation security.

• Supports actor_token parameter in RFC 8693 token exchange flows, enabling richer delegation chains in outgoing authentication.
• Guards OAuth token and DCR (Dynamic Client Registration) endpoints against SSRF attacks.

Endpoint Security (EDR/XDR) · 2026-08-19

Trend Vision One extends Application Control to macOS agents, including Lockdown mode support.

• Adds Application Control support for macOS agents in Endpoint Security Policies, enabling the same allow/block application rules previously available for Windows and Linux agents.
• Supports Lockdown mode for macOS agents via Application Control policy settings.
• Configurable under Endpoint Security → Endpoint Security Configuration → Endpoint Security Policies in the Vision One console.

SAST / SCA / Code Security · 2026-08-19

Veracode eLearning reports now support date ranges up to one year in the past.

• eLearning reports now support a start date up to one year in the past, enabling longer historical reporting windows.

Cloud Security Posture · 2026-08-19

Wiz Penetration Test Findings reaches GA, unifying bug bounty, red team, third-party audit, and AI pen-test results in a single platform.

• Wiz Penetration Test Findings is now Generally Available, providing a single home for pen-test results from bug bounties, third-party audits, internal red team exercises, and AI pen-test scanning — connected to real-time cloud context on the Wiz Security Graph.
• Pen-test findings are automatically linked to continuous prioritization, ownership assignment, and remediation tracking, closing the loop between offensive assessment and ongoing exposure management.
• Introduces support for Continuous Threat Exposure Management (CTEM) workflows by bridging the Validation stage back to Discovery, Prioritization, and Mobilization within a single platform.

CNAPP · 2026-08-19

Wiz GA's Pen Test Findings with Security Graph correlation, adds Google Threat Intelligence enrichment and hybrid/SaaS coverage expansions.

• Adds Graph Controls that surface attack paths tied to pen-test findings, enabling blast-radius visualization correlated against external network exposure, identity privileges, secrets, data, and lateral movement paths in the Wiz Security Graph.
• Integrates Google Threat Intelligence — enriching Wiz risk and threat findings with Mandiant frontline intelligence, VirusTotal crowdsourced intelligence, and Google threat insights, available out of the box to all Wiz customers.
• Extends Google Threat Intelligence enrichment to malware findings, providing rich context beyond a simple verdict to accelerate investigation prioritization.

Identity & Access Management · 2026-08-18

1Password for Linux beta adds passwordless account onboarding, KDE Plasma Wayland auto-lock, and Offline Items sidebar access.

• Adds passwordless account onboarding — users can add a 1Password account to the app without re-entering their password, Secret Key, or SSO verification code.
• Enables auto-lock support in KDE Plasma on Wayland and other Wayland environments that implement the ext_idle_notifier_v1 protocol.
• Adds an Offline Items entry to the sidebar for items that cannot be synced with a 1Password account, including deleted items.

Identity & Access Management · 2026-08-18

1Password for Mac beta adds passwordless account setup, Claude access-reason transparency, and offline item sidebar selection.

• Adds the ability to add a 1Password account to the app without re-entering your password, Secret Key, or an SSO verification code.
• Enables 1Password for Claude to sign in with logins configured to use supported sign-in providers.
• Shows the reason Claude is requesting access to specific items by selecting the button to the right of each item in the 1Password for Claude prompt.

Identity & Access Management · 2026-08-18

1Password for Windows beta adds passwordless account onboarding, offline item sidebar access, and moves MCP Server to Settings > Developer.

• Moves 1Password MCP Server from Settings > Labs to Settings > Developer now that it has graduated from experimental status.
• Adds the ability to add a 1Password account to the app without re-entering your password, Secret Key, or SSO verification code.
• Adds Offline Items as a selectable entry in the sidebar for items that cannot be synced with your 1Password account.

Identity & Access Management · 2026-08-18

1Password for Claude gains support for signing in with logins that use supported sign-in providers.

• 1Password for Claude now supports signing in with logins configured to use supported sign-in providers.

Identity & Access Management · 2026-08-18

Auth0 adds Custom Rate Limits (Early Access) to cap per-client Authentication API RPS via API-driven policy configuration.

• Adds Custom Rate Limit Policies (Early Access) enabling API-based self-service configuration to cap the number of Authentication API / OAuth requests consumable by individual clients or groups (all third-party apps, or CIMD apps), preventing any single client from exhausting a tenant's rate limit entitlement.
• Supports two enforcement modes per Custom Rate Limit Policy: blocking (reject requests that exceed the limit) or non-blocking (trigger notifications only), allowing safer staged rollouts.

Exploitation & C2 · 2026-08-18

Bugcrowd launches Savant Pathseeker: autonomous outside-in pentesting with authenticated testing, WAF evasion, and Security Inbox integration.

• New Savant Pathseeker product runs autonomous, controlled outside-in penetration tests against approved internet-facing domains, web apps, and APIs, producing validated findings with evidence.
• Authenticated testing support lets Pathseeker log in with stored credentials and test content behind login pages, including apps that redirect through external identity providers such as Okta, Entra ID, or Google.
• Bot detection and WAF evasion capability adapts to perimeter controls within authorized boundaries so test coverage reflects what a real attacker could reach.

Exploitation & C2 · 2026-08-18

Bugcrowd launches Savant Pathseeker Early Access (1.0) for customers.

• Introduces Savant Pathseeker, now available in Early Access (1.0) for customers.

Exploitation & C2 · 2026-08-18

Bugcrowd launches Savant Pathseeker Early Access (1.0), an autonomous pentesting capability.

• Introduces Savant Pathseeker (Early Access 1.0), a new autonomous pentesting offering on the Bugcrowd platform.

Exploitation & C2 · 2026-08-18

Bugcrowd launches Savant Pathseeker Early Access: autonomous penetration testing with authenticated test support and findings integration.

• New Savant Pathseeker product enables autonomous penetration testing, now available in Early Access.
• Supports authenticated tests behind login, including external identity providers.
• Enables adding assets mid-setup during an autonomous test run.

Malware Analysis · 2026-08-18

CAPEv2 adds a ColoredFormatter class to utils/dist.py for color-coded, ANSI-highlighted log output.

• Adds ColoredFormatter class in utils/dist.py that color-codes log level labels by severity: cyan for DEBUG, green for INFO, yellow for WARNING, red for ERROR, and bold-red for CRITICAL, using ANSI escape codes.
• Dynamically highlights key entities in log messages — worker names, task IDs, main/analysis IDs, and performance timings — using pre-compiled regex patterns (RE_WORKER, RE_SETSTAT, RE_MAIN_TASK, RE_WORKER_TASK, RE_PERF).

Attack Surface & Exposure Management · 2026-08-18

Censys adds AI-generated ASM reports, a Kibana/Elasticsearch connector, nine new fingerprints, and two new ASM risk detections.

• Adds two new ASM risk fingerprints queryable via risks.name: "Exposed Copeland XWEB Pro Refrigeration Controller" and risks.name: "Exposed Payara Server Default Page"; new risk types may be disabled by default — review risk type configuration in the ASM web console.
• New Elasticsearch Kibana connector lets practitioners enrich IPs, web properties, and certificates with Censys Platform data; initiate rescans of hosts or web properties; retrieve event history for an IP address; and launch CensEye automated pivoting jobs to find assets related to an IP, web property, or certificate.
• Censys Assistant in ASM can now generate custom PDF-ready reports about your attack surface; requires the organization to be migrated to the Platform for team management and the AI Features toggle enabled under Platform Organization Settings > Privacy.

Container & Image Security · 2026-08-18

Chainguard adds an Agent Skills Public Skills MCP server with five tools for searching, inspecting, and running hardened images.

• New Chainguard Agent Skills Public Skills MCP server provides five tools to search, inspect, and run hardened images from an AI agent context.

Container & Image Security · 2026-08-18

Chainguard launches a Public Skills MCP server at skills.cgr.dev/mcp with five tools for agents to search, inspect, and run hardened skills

• New Public Skills MCP server reachable at https://skills.cgr.dev/mcp over Streamable HTTP with OAuth 2.0, letting any MCP-capable agent discover and load hardened agent skills without a separate install step.
• Exposes five MCP tools — search_skills, list_skills, read_skill, read_skill_reference, and run_skill — covering ranked keyword search, paginated catalog browsing, skill manifest inspection, single-file fetching, and full skill bundle loading.
• search_skills accepts query (required), page_size (default 50, max 200), and page_token parameters, returning ranked { name, description } matches plus next_page_token and total; signals the agent to ask before sourcing skills outside the hardened catalog when no match is found.

Container & Image Security · 2026-08-18

Chainguard adds npm 403 error codes for blocked packages, GitHub Actions migration via Guardener, and build pinning for Libraries cache.

• Chainguard Libraries now returns a 403 HTTP status with a named reason code (e.g., MALWARE_DETECTED) when npm requests a blocked package or version, replacing the previously unexplained 404.
• Chainguard Guardener GitHub App (beta) extends automated migration to GitHub Actions: inventories Actions across org repositories, maps them to hardened Chainguard equivalents, and opens pull requests pinned to a specific SHA rather than a mutable tag.
• Guardener runs in two modes: an upfront pass that surfaces existing Actions usage and opens migration PRs, and an ongoing standardization mode that watches workflow files and suggests equivalents as new upstream Actions appear.

AI Coding Agents · 2026-08-18

Claude Code v2.1.234 adds CLAUDE_CODE_PROJECT_DIR_NAME, selection:clear keybinding, GitLab MR badges, auto-resume at usage limits, and mid-turn /permissions edits.

• Adds optional CLAUDE_CODE_PROJECT_DIR_NAME environment variable so hosts that give each session its own config directory can choose a short name for the per-project transcript directory.
• Adds CLAUDE_CODE_GOAL_CHECKIN_MINUTES environment variable (set to 0 to opt out) to control how long /goal waits before checking in on background tasks that have been running 30+ minutes.
• Adds selection:clear keybinding action, bindable to any key, that clears an in-app text selection in both the main view and the agents view.

Identity & Access Management · 2026-08-18

Clerk Billing adds discounts and promo codes — apply percentage or fixed-amount deals to subscriptions or share redeemable codes at checkout.

• Adds discount support to Clerk Billing: create reusable percentage or fixed-amount discounts and apply them manually to any active subscriber's subscription from the Dashboard, with the ability to revoke at any time.
• Adds promo codes (e.g. LAUNCH20) that customers can enter at checkout to self-redeem discounts, with optional redemption caps, new-subscriber restrictions, and per-code usage tracking.
• Supports per-period discount amounts, letting you set different discount values for monthly and annual billing cycles.

AI Coding Agents · 2026-08-18

Cline desktop-beta adds realtime voice, model-driven image generation, cloud agent sessions, microphone transcription, and media playback

• Adds realtime voice sessions with UI refinements and improved session lifecycle management.
• Adds a media player to the desktop app with support for generated audio artifact playback and generated video support.
• Adds cloud agent sessions (remote provisioning, transcript synchronization, approval recovery, model switching, branch picker, and onboarding panel) gated behind an explicit settings toggle.

AI Coding Agents · 2026-08-18

Cline desktop beta adds cloud sessions with cross-device sync, SSH remote environments, voice input, and model-driven image generation.

• Adds cloud sessions (preview) controllable via the Cloud sessions toggle in Settings — connect GitHub, pick a repository and branch, hand sessions off between devices with transcripts, approvals, and queued prompts kept in sync, and switch models mid-session.
• Adds early proof-of-concept support for running sessions in SSH remote environments.
• Adds microphone voice input in the composer.

Internet Services · 2026-08-18

Cloudflare Workers AI adds four new models: Grok 4.6, DeepSeek-V4-Flash-0731, DeepSeek V4 Pro, and Qwen 3.8 27B.

• Adds grok-4.6 (xAI Grok 4.6) to Workers AI — a flagship reasoning model supporting text and image inputs, function calling, and structured outputs, suited for coding and agentic tasks.
• Adds deepseek-v4-flash-0731 (DeepSeek-V4-Flash official release) to Workers AI, superseding the preview version with substantially enhanced agentic capabilities.
• Adds deepseek-v4-pro-0813 (DeepSeek V4 Pro) to Workers AI — a high-capability reasoning model with a one-million-token context window built for long-horizon agentic and multi-step workflows.

Internet Services · 2026-08-18

Cloudflare adds package registry security with pkg.* selectors, Qwen/DeepSeek models on Workers AI, Worker-level Access policies, and CT Monitoring GA

• Adds pkg.ecosystem, pkg.name, pkg.version, pkg.namespace, and pkg.purl selectors to Cloudflare Gateway HTTP policies so teams can allow or block software package downloads by ecosystem (npm, PyPI, RubyGems, Cargo, Go, Maven, NuGet), package name, version, or PURL; pkg.purl is API-only. Requires TLS decryption.
• Adds ctx.access.getIdentity() on the ctx.access object inside Workers so authenticated requests expose the user's email, name, and groups without manual JWT validation.
• Adds an access.dev block to wrangler.jsonc for locally simulating Cloudflare Access — set aud and a mock identity (e.g., email) to test authenticated and unauthenticated flows without deploying.

Internet Services · 2026-08-18

Cloudflare API adds Image Transformations settings, R2 catalog metadata deletion, and MCP Portal/Server management endpoints.

• Adds GET /accounts/{account_id}/settings/transformations to list Image Resizing configurations for an account.
• Adds GET /zones/{zone_id}/settings/transformations_allowed_origins and PUT /zones/{zone_id}/settings/transformations_allowed_origins to read and change the Image Transformations Allowed Origins setting per zone.
• Adds GET /zones/{zone_id}/settings/transformations_c2pa and PUT /zones/{zone_id}/settings/transformations_c2pa to read and change the Image Transformations C2PA (Content Credentials) setting per zone.

Internet Services · 2026-08-18

Cloudflare adds Workers AI models, pkg.* Gateway selectors, Access-on-Worker policies, and Realtime SFU DataChannel delivery controls.

• Gateway HTTP policies can now detect and control software package downloads across seven major package ecosystems using pkg.* selectors.
• Two new ways to protect Workers with Cloudflare Access: apply a policy to a single Worker across all its domains, or set a default policy for every Worker in an account.
• Realtime SFU DataChannels now support configurable unordered and partially reliable delivery for latency-sensitive applications.

Internet Services · 2026-08-18

Cloudflare adds Workers AI models, Access policy controls, package registry security, and Realtime SFU DataChannel configuration.

• Gateway HTTP policies can now detect and control software package downloads across seven major package ecosystems using pkg.* selectors.
• Two new ways to protect Workers with Cloudflare Access: apply a policy to a single Worker across all its domains, or set a default policy for every Worker in an account.
• Realtime SFU DataChannels now support configuring unordered and partially reliable delivery for latency-sensitive use cases.

Internet Services · 2026-08-18

Cloudflare WAF adds HTTP/2 request smuggling and JavaScript event handler coercion detections, scheduled for 2026-08-24.

• Adds rule ...1489d892 — HTTP/2 Request Smuggling - Request Body Anomaly detection, deploying in Log mode on 2026-08-24.
• Adds rule ...20646260 — XSS - JavaScript Event Handler Coercion - Headers detection, deploying in Log mode on 2026-08-24.
• Adds rule ...d706d517 — XSS - JavaScript Event Handler Coercion - Body detection, deploying in Log mode on 2026-08-24.

Identity & Access Management · 2026-08-18

ConductorOne adds Findings: automated detection, triage, transformation rules, and routing rules for identity risk (early access).

• Adds a new Findings module (early access) under Identity security > Findings that continuously monitors for identity risk conditions — unowned service accounts, exposed credentials, misclassified identities, decoy credential use, and more — on every connector sync.
• Adds per-finding actions — Accept risk (requires justification and expiration date), Suppress (permanent, requires reason), Snooze (1, 7, 30, or 90 days or custom date, requires reason), and Remediate (where supported) — accessible from the finding detail view.
• Adds bulk actions from All findings: select up to all findings matching the current filter and apply Snooze, Suppress, Accept risk, or Reopen in one step; the confirmation dialog shows how many of the selected findings each action can change.

Identity & Access Management · 2026-08-18

ConductorOne adds Findings — automated access-risk detection with decoy tripwire credentials and dashboard integration.

• New Findings capability continuously checks for access risks (unowned service accounts, exposed credentials, misclassified identities) on every connector sync, replacing manual periodic reviews.
• Supports transformation and routing rules so findings can be triaged, escalated, or resolved automatically without hand-reviewing each result.
• New Decoys feature lets you plant a tripwire credential that looks real but grants no access — any use attempt raises a Critical finding while the actor sees only a normal authentication failure.

Identity & Access Management · 2026-08-18

ConductorOne adds Findings (automated access-risk detection) and Decoys (tripwire credentials) with triage routing and dashboard integration.

• New Findings capability automatically checks every connector sync for access risks — unowned service accounts, exposed credentials, misclassified identities — without requiring manual review.
• New Decoys feature lets teams plant tripwire credentials that look real but grant no access; any use attempt raises a Critical finding while showing the actor only an ordinary authentication failure.
• Findings surface on the Identities & NHI dashboard, with every inventory table now filterable to identities with open findings.

AI Coding Agents · 2026-08-18

Cursor Origin enters early beta with team-level codebase settings, third-party app integrations, and an API access model.

• New Origin platform (early beta) at cursor.com/codebase adds team-level repo hosting with git push/pull, GitHub mirroring, code browse/search, pull request open/merge, and team sharing.
• Codebase settings at cursor.com/codebase/settings/apps let admins install and manage third-party apps (Vercel, Depot, Buildkite) across all Origin repos, with per-repo activation visible from the repository's Apps tab in Repository settings.
• Internal apps can be created under codebase settings to generate app credentials for calling the Origin API, authenticating via app JWTs and installation access tokens.

AI Coding Agents · 2026-08-18

Cursor Origin (early beta) adds per-repo settings for sync, permissions, branch protections, and CI integrations via Vercel, Depot, and Buildkite.

• New Settings tab in Origin (at cursor.com/codebase) provides per-repository configuration across General, Permissions, Rules and Protections, and Apps sections.
• New Sync Status indicator under General shows mirror/source relationship for GitHub-mirrored repositories.
• Permissions panel lets you review and manage per-repo access, with Internal (visible to all Cursor team members) and Private (explicit grant required) visibility modes.

AI Coding Agents · 2026-08-18

Cursor Origin gains pull request support: create, review, comment, and merge PRs from the browser with CI checks and conflict resolution.

• New Pull Requests tab in Cursor Origin (at cursor.com/codebase) lists open pull requests and lets you open one to review activity, commits, checks, and changed files.
• Pull request review page provides four tabs — Activity, Commits, Checks, and Files Changed — supporting line-level comments, reviewer requests, and reviews from the diff.
• Supports merging pull requests once reviews and CI checks are satisfied, with conflict surfacing before merge.

AI Coding Agents · 2026-08-18

Cursor Origin gains GitHub mirror sync: browse, search, and run agents on mirrored repos with bi-directional PR sync.

• New Sync from GitHub workflow at cursor.com/codebase mirrors a GitHub repository into Origin, copying git history, branches, tags, and pull requests.
• Mirrored repos keep Origin continuously updated as the GitHub source changes, with sync status visible under Settings → General.
• Pull requests on a mirrored Origin repo sync bi-directionally with GitHub, enabling PR review on Origin while changes flow back to the GitHub source.

AI Coding Agents · 2026-08-18

Cursor Origin enters early beta with git hosting, GitHub mirroring, pull requests, and a new Origin CLI

• New Cursor Origin git hosting platform (early beta) at cursor.com/codebase supports creating repos, pushing and pulling with standard git, mirroring from GitHub, browsing and searching code, opening and merging pull requests, and sharing with Cursor teams.
• Supports HTTPS clone via https://origin.cursor.com/{owner}/{repo}.git from the Code dropdown on any Origin repo page.
• New origin CLI installable via curl -fsSL https://downloads.cursor.com/origin/install.sh | sh, with origin auth login for authentication before git operations.

AI Coding Agents · 2026-08-18

Cursor launches Origin, a git forge for hosting repos, mirroring GitHub, and collaborating via pull requests at cursor.com/codebase.

• Introduces Origin, Cursor's git forge, accessible at cursor.com/codebase/{owner}/{repo}, supporting create, clone, push, pull, and mirror workflows.
• Supports mirroring a GitHub repository into Origin via Sync from GitHub from the repo list at cursor.com/codebase.
• Adds pull request workflows — open, review, and merge PRs — directly within Origin.

AI Coding Agents · 2026-08-18

Cursor Cloud Agent API gains endpoints for listing pool workers, listing/deregistering pools, queuing pending requests, and atomically claiming work.

• New GET /v0/private-workers endpoint lists connected self-hosted pool workers with filterable status and scope (team_pool / personal) query params, returning per-worker fields including workerId, labels, isInUse, repoOwner, repoName, workspaceRootPath, connectedAtMs, teamId, serviceAccountId, and displayName, plus totalCount and nextPageToken for pagination.
• New GET /v0/private-workers/pools endpoint lists durable self-hosted pools for a team, filterable by scope and includeStale; each pool entry exposes poolName, connectedWorkerCount, inUseWorkerCount, firstSeenAtMs, lastSeenAtMs, isStale, and optional repo metadata — enabling scale-to-zero autoscaling dashboards.
• New DELETE /v0/private-workers/pools endpoint deregisters a durable pool by scope and poolName, with optional repoOwner/repoName for repo-scoped pools, returning { "deregistered": true }.

AI Coding Agents · 2026-08-18

Cursor launches Origin Code Hosting in early beta: repos, pull requests, GitHub sync, and app integrations at cursor.com/<codebase>.

• GitHub sync lets you connect a GitHub org and pull selected repos into Origin alongside Cursor-hosted ones; synced repos update in real time, pushes continue to GitHub as source of truth, and access mirrors existing GitHub read/write permissions.
• Pull requests are available on every repo with a timeline, commits, checks, and file diffs; comments and reactions sync bidirectionally with GitHub within seconds, and GitHub-assigned reviews can be completed and merged from Cursor.
• Agent integration in every repo lets you ask Cursor questions about browsed code, request changes, update PRs, or push branches from within the same interface.

Data Security & DLP · 2026-08-18

Cyera Access Trail extends audit visibility to Outlook and NetApp on-prem file shares for sensitive data activity tracing.

• Extends Access Trail coverage to Outlook, enabling audit of message access, attachment access, send activity, deletions, inbox rules, folder permissions, and delegated access.
• Extends Access Trail coverage to NetApp on-prem file shares, enabling audit of sensitive file activity across on-premises storage environments.

Data Security & DLP · 2026-08-18

Cyera Agent Guardian delivers discovery, inventory, and runtime enforcement for AI agents across sanctioned and unsanctioned deployments.

• Builds a live inventory of sanctioned and unsanctioned AI agents, mapping their models, tools, identities, and data connections.
• Identifies which agents introduce real risk by analyzing the resources and data connections behind each agent.
• Monitors risky tool calls at runtime and blocks unsafe actions before sensitive data is exposed.

Data Security & DLP · 2026-08-18

Cyera expands on-prem database coverage to MySQL, MariaDB, Oracle RAC, MSSQL, and IBM Db2 for i, plus new partner integrations.

• Adds support for MySQL, MariaDB, Oracle RAC, MSSQL, and IBM Db2 for i, enabling discovery, classification, and governance of sensitive data in on-prem enterprise databases.
• Extends data context into partner workflows to support exposure prioritization, guardrail enforcement, automated remediation, and audit-ready evidence.

Data Security & DLP · 2026-08-18

Cyera's Incident Materiality Assessment delivers targeted data scanning and expert analysis to define true incident blast radius.

• New Incident Materiality Assessment service uses targeted data scanning and enriched classification to identify exactly what sensitive data was exposed, who accessed it, and when during a security incident.
• Produces a defensible incident impact view suitable for legal, board, regulator, and disclosure decisions — replacing broad blast-radius assumptions.

Data Security & DLP · 2026-08-18

Cy gains deeper AI-assisted investigation across DSPM and DLP with Saved Prompts and suggested next steps.

• Adds Saved Prompts so teams can store and reuse proven natural-language investigation workflows across DSPM and DLP.
• Adds suggested next steps inside Cy investigations, surfacing recommended follow-on actions after each query.
• Expands Cy natural-language investigation to cover risky alerts, sensitive data exposure, access activity, and data movement patterns in one unified path.

Data Security & DLP · 2026-08-18

Cyera launches Projects to delegate scoped data, alert, identity, and API access across teams within a single tenant.

• Introduces Projects, a new construct that lets security teams define scoped workspaces limiting user visibility to specific data, alerts, and identities within a single Cyera tenant.
• Enables scoped API access per project, so integrations and automations only surface data relevant to their assigned scope.
• Preserves organization-wide visibility for global users while restricting project-scoped users to their defined perimeter, supporting safe cross-functional collaboration.

Web Application Security · 2026-08-18

DataDome Cloudflare Worker Terraform module v2.7.0 adds DATADOME_GRAPHQL_ENDPOINT and DATADOME_MCP_ENDPOINT configuration settings.

• Adds DATADOME_GRAPHQL_ENDPOINT config setting (module v2.7.0+) to specify one or more GraphQL endpoints (comma-separated) from which the operation name and type are extracted for analysis.
• Adds DATADOME_MCP_ENDPOINT config setting (module v2.7.0+) to specify one or more MCP endpoints (comma-separated) so that requests targeting those endpoints are analyzed to extract MCP properties.

Web Application Security · 2026-08-18

DataDome Cloudflare Worker v2.7.0 adds MCP endpoint analysis, GraphQL endpoint config, and enriched headers access.

• Adds graphQLEndpoint config setting to customize which endpoints have GraphQL operation name and type extracted; accepts multiple endpoints as a comma-separated list.
• Adds mcpEndpoint config setting to designate MCP endpoints for automated MCP-property extraction; accepts multiple endpoints as a comma-separated list.
• Exposes enriched headers in ctx.dataDomeEnrichedHeaders after calling dataDomeHandler.fetch(), making DataDome's request metadata available for downstream Cloudflare Worker logic.

Web Application Security · 2026-08-18

DataDome Cloudflare Worker adds MCP endpoint inspection and configurable GraphQL/MCP endpoint settings in v2.7.0

• Adds DATADOME_MCP_ENDPOINT config setting (v2.7.0) to designate one or more MCP endpoints (comma-separated) for MCP property extraction and analysis.
• Adds DATADOME_GRAPHQL_ENDPOINT config setting (v2.7.0) to customize one or more GraphQL endpoints (comma-separated) from which operation name and type are extracted.

Web Application Security · 2026-08-18

DataDome Cloudflare Worker adds DATADOME_GRAPHQL_ENDPOINT and DATADOME_MCP_ENDPOINT settings for targeted request analysis.

• Adds DATADOME_GRAPHQL_ENDPOINT config setting to specify one or more GraphQL endpoints (comma-separated) from which operation name and type are extracted for analysis.
• Adds DATADOME_MCP_ENDPOINT config setting to specify one or more MCP endpoints (comma-separated) so that requests targeting them are analyzed to extract MCP properties.

Web Application Security · 2026-08-18

DataDome Cloudflare integration 2.7.0 adds enriched headers for log enhancement and new DATADOME_GRAPHQL_ENDPOINT and DATADOME_MCP_ENDPOINT config parameters.

• Adds DATADOME_GRAPHQL_ENDPOINT environment parameter to specify the GraphQL endpoint (defaults to /graphql).
• Adds DATADOME_MCP_ENDPOINT environment parameter to specify the MCP endpoint (defaults to /mcp).
• Adds enriched headers in context to enable log enhancement across all requests.

Web Application Security · 2026-08-18

Apache module 3.0.0 splits URL exclusion config and adds three new directive defaults for static-asset and encoded-path handling.

• Adds DomeStaticAssetExclusion directive (enabled by default) to handle static-asset extension exclusions, now including avif, gz, json, xml, and zip in the standard list.
• Adds DomeRemoveMatrixParams directive (enabled by default) to ignore matrix parameters during DataDome URL regex evaluation per RFC 3986.
• Adds DomeEncodedCharInclusion directive (enabled by default) to inspect static-looking paths carrying encoded delimiters %23, %25, %2f, %3b, and %3f.

Web Application Security · 2026-08-18

DataDome Apache module 3.0 splits URL exclusion settings and adds matrix-param and encoded-char inspection by default.

• Adds DomeStaticAssetExclusion config directive to hold static-asset extension exclusions separately from DomeURIRegexExclusion, which now holds only custom URL exclusions.
• Adds DomeRemoveMatrixParams directive (default: On) to strip matrix parameters (;...) per path segment before the exclusion regex is evaluated.
• Adds DomeEncodedCharInclusion directive to force inspection of static-looking paths containing encoded characters such as %23, %25, %2f, %3b, or %3f (default: "%23|%25|%2f|%3b|%3f").

Web Application Security · 2026-08-18

DataDome OpenResty module 1.7.0 adds GraphQL endpoint and body-size config parameters

• Adds datadome_graphql_endpoint configuration parameter to specify the GraphQL endpoint (defaults to graphql).
• Adds datadome_graphql_max_body_size configuration parameter to limit the request body size parsed for GraphQL requests.

Web Application Security · 2026-08-18

DataDome Node.js module 2.6.0 adds a graphQLEndpoint parameter to designate GraphQL paths for bot protection.

• Adds graphQLEndpoint parameter to specify the path(s) for the GraphQL endpoint, defaulting to /graphql.
• Adds validation of the logger parameter to ensure it contains every required method with the correct signature.

Web Application Security · 2026-08-18

DataDome Cloudflare Worker 2.7.0 adds enriched request headers and configurable GraphQL/MCP endpoint parameters.

• Adds DATADOME_GRAPHQL_ENDPOINT parameter to specify the GraphQL endpoint (defaults to /graphql).
• Adds DATADOME_MCP_ENDPOINT parameter to specify the MCP endpoint (defaults to /mcp).
• Adds enriched headers in context to enable log enhancement across all requests.

AI Coding Agents · 2026-08-18

Daytona 0.205.0 adds warm pool management APIs, spot GPU support, and OpenTelemetry endpoint override for sandboxes.

• Adds otelEndpointOverride to sandbox creation, enabling per-sandbox OpenTelemetry endpoint configuration.
• Adds spot GPU support for sandboxes.
• Adds warm pool management APIs across SDKs.

AI Coding Agents · 2026-08-18

Daytona promotes sandbox fork and snapshot creation to stable API, with improved client-side error signaling in the TypeScript SDK.

• Promotes fork and create-snapshot operations from experimental to stable API, retiring the experimental aliases.
• Distinguishes client-side argument validation errors from server-side 400 responses in the TypeScript SDK for clearer error handling.

Vulnerability Management · 2026-08-18

DefectDojo 3.2.100 enforces true private notes — visible only to the author and superusers across API, UI, and reports.

• Private notes are now actually private: a note marked private is returned only to its author and to superusers, with consistent enforcement across the API, the UI notes tab, note popovers, finding/test/engagement note counts, generated reports, and issue-tracker sync.

Vulnerability Management · 2026-08-18

DefectDojo Pro 3.2.200 moves Locations to a self-service toggle with on-demand data-migration backfills.

• Adds a self-service Locations toggle on the Settings > Feature Flags page in DefectDojo Pro, replacing the previous environment-variable-only deployment change; once enabled the toggle locks (Cannot Be Disabled) because reversing the location data migration is not yet supported.
• The DD_V3_FEATURE_LOCATIONS environment variable continues to govern the Classic UI and /api/v2 route wiring at boot time; a restart is recommended when enabling the toggle if either surface is in use, so all surfaces stay aligned.
• Introduces a data-migration suite under the Locations row on the Feature Flags page with four on-demand, idempotent items: migrate_endpoints_to_locations (converts existing Endpoint rows to URL Locations), migrate_components_to_dependencies (converts component_name/component_version to Dependency Locations), migrate_findings_to_code_locations (converts file_path/line to Source Code Locations), and an identity rehash that recomputes deduplication digests — each also available as a management command for scripted or air-gapped runs.

Vulnerability Management · 2026-08-18

DefectDojo Pro adds SCIM 2.0 provisioning, CycloneDX VEX round-trip, Messaging Connectors, and customizable page layouts

• Adds SCIM 2.0 provisioning under Connect > Authorization (tagged Provisioning): identity providers can now create, update, and deactivate DefectDojo users and manage groups directly; deactivating a user over SCIM also deletes that user's API tokens.
• Adds CycloneDX SBOM / VEX / VDR export and import as a full round trip: a document exported from DefectDojo can be imported back in, and the raw CycloneDX VEX analysis is now preserved on parsed Findings.
• Adds Messaging Connectors (beta) that send alerts to Slack, Microsoft Teams, email, or an Amazon SNS topic, routed by Rules Engine 2.0 rules; requires the Messaging Connectors and Rules Engine 2.0 feature flags.

Vulnerability Management · 2026-08-18

DefectDojo 3.2.200 adds a flat test_type_name field on the finding serializer and scopes Location API access by RBAC.

• Adds a flat test_type_name field on the finding serializer, surfacing the test type name directly on finding API responses without a nested lookup.
• Scopes GET /api/v2/location/ by RBAC instead of requiring superuser access, enabling non-superuser roles to query location data within their permissions.

Secure Access (VPN / SASE / ZTNA) · 2026-08-18

DNSFilter Windows Roaming Client v3.7.11 Beta adds SecureTransit encrypted VPN-layer privacy enforcement and a new DNSFilter One Agent UI.

• Adds SecureTransit, a policy-enforced encrypted privacy layer supporting WireGuard or IKEv2 protocols, routing traffic through a DNSFilter-managed secure gateway to prevent network-level visibility of destinations on untrusted networks.
• Adds admin-controlled SecureTransit policy modes — Always On, Manual, or Disabled — configurable per organization or per device from the existing DNS filtering dashboard.
• Adds tracker blocking at the network layer via SecureTransit, cutting off location trackers, mail trackers, data brokers, and ad networks before data leaves the device, on any network.

Container & Image Security · 2026-08-18

Docker Compose v5.5.0 overhauIs image digest reconciliation and makes compose pull honor pull_policy refresh windows.

• New image digest reconciliation logic in compose up prevents unnecessary container recreation by re-evaluating digests more accurately.
• compose pull now honors pull_policy refresh windows (daily, weekly, every_N), skipping redundant pulls within the configured window.

Agentic Infrastructure · 2026-08-18

emisar v0.41.0 adds role-scoped consoles, live session reconnection on permission changes, and 100-pack catalog with new GCP, Consul, and HCP Terraform actions.

• Role and scope changes (member role, runner access, pack access) now take effect immediately in open web sessions, reconnecting the session before stale authority can be acted on.
• Billing managers now receive a finance-only console; operators can manage agents, approvals, and runbooks without gaining team or policy administration rights.
• Scoped admins are blocked from delegating more reach than they hold or triggering account-wide pack cleanup.

Exploitation & C2 · 2026-08-18

getsploit gets full offline FTS5 search, multi-format output, mirror mode, and color/terminal controls

• Adds --update to download the full exploit corpus archive over eight parallel range connections and build/atomically replace the local FTS5 index (~1.7 GB) at ~/.getsploit/getsploit.db (or $GETSPLOIT_HOME).
• Adds --status to report the local database location, size, and document count without requiring an API key.
• Adds --format flag supporting json, jsonl, and tab-separated (TSV) output; --json remains an alias for --format json; redirected output automatically switches to tab-separated values.

Exploitation & C2 · 2026-08-18

getsploit 3.0.0 overhauls search with async Vulners SDK, Rich terminal output modes, and a versioned SQLite FTS5 index

• Adds asynchronous online search through the official Vulners Python SDK 4.1, replacing direct HTTP access to Vulners endpoints.
• Adds adaptive Rich terminal output with table, compact, JSON, and JSONL display modes.
• Adds a versioned SQLite FTS5 index with integrity checks and atomic replacement, converting existing local FTS4 archives during --update.

Exploitation & C2 · 2026-08-18

Getsploit gains offline FTS5 search, multi-format output, mirroring, and pipe-friendly TSV/JSON/JSONL modes

• Adds --local flag for fully offline exploit search against a local SQLite FTS5 index, supporting literal keyword queries and full FTS5 expressions with searchable columns id, title, published, description, source_data.
• Adds --update to download the full exploit corpus archive over eight parallel range connections and build or atomically replace the local FTS5 index (~1.7 GB); a running search against the old database finishes undisturbed.
• Adds --status to report local index location, size, and document count without requiring an API key.

Exploitation & C2 · 2026-08-18

Getsploit gains offline FTS5 search, multi-format output, mirroring, and color/layout control against the full Vulners exploit corpus

• Adds --local flag for fully offline search against a local SQLite FTS5 index of the full exploit corpus (~1.7 GB), stored at ~/.getsploit/getsploit.db or $GETSPLOIT_HOME.
• Adds --update to download the exploit archive over eight parallel range connections and atomically build or replace the local FTS5 index without interrupting in-progress searches.
• Adds --status to report the local index location, size, and document count without requiring an API key.

Exploitation & C2 · 2026-08-18

getsploit v3.0.0 adds async Vulners SDK search, FTS5 local index, Rich output modes (table/compact/JSON/JSONL), and paginated --count.

• Adds VULNERS_API_KEY environment variable and --set-key as the supported methods for supplying API credentials, replacing the removed --api-key VALUE option.
• Adds adaptive Rich terminal output with table, compact, JSON, and JSONL modes for search results.
• Adds local database status reporting via --status, now showing database size and full database path.

AI/LLM Security · 2026-08-18

Giskard v1.0.1rc1 ships PEP 561 type stubs, tightened public types, and expanded prompt-injection scenarios.

• Ships py.typed marker files (PEP 561) for giskard-core, giskard-llm, giskard-checks, and giskard-scan, enabling static type checking in downstream projects.
• Exports and tightens public Literal/status types from giskard.types for stricter API contracts.
• Expands the prompt-injection test suite with additional scenarios and templates covering more injection attack patterns.

AI Agent Frameworks · 2026-08-18

Hermes Agent launches with CLI + desktop install, multi-platform messaging gateway, Tool Gateway, and full configuration surface.

• Adds hermes setup --portal to log in to Nous Portal, set Nous as the LLM provider, and enable the Tool Gateway (web search, image generation, TTS, cloud browser) in a single command.
• Adds hermes model command to choose and configure the LLM provider and model.
• Adds hermes tools command to configure which tools are enabled.

AI Agent Frameworks · 2026-08-18

Hermes adds NVIDIA SkillEvaluator advisory scanning and project-local skills with per-repo trust controls.

• Advisory scan findings are printed with file and line before install confirmation; credential-class findings (private keys, cloud access keys, tokens, credentialed connection strings) are highlighted in red; PII findings are informational and never block install.
• The dashboard's Browse-hub scan button now returns advisory scan data in a tier1 field alongside the built-in scanner verdict.
• Adds project-local skills loaded from <project-root>/.hermes/skills/ (Hermes-native) or <project-root>/.agents/skills/ (cross-tool convention) when Hermes is launched inside a git checkout.

AI Agent Frameworks · 2026-08-18

Hermes adds hermes peer subcommand for cross-machine bot-to-bot messaging via registered peer gateways.

• Adds hermes peer add <name> --url <URL> [--key <KEY>] [--note TEXT] to register or update a remote Hermes gateway as a peer, storing the key as HERMES_PEER_<NAME>_KEY.
• Adds hermes peer list to display all registered peers and whether each has an API key configured.
• Adds hermes peer dm <peer>[/<agent>] [message] to message a remote agent's canonical Bot Chat over a peer gateway and print the reply to stdout; <peer> targets the gateway's main agent, <peer>/<agent> targets a named profile routed via its /p/<profile>/ mirror.

AI Agent Frameworks · 2026-08-18

Hermes v2026.8.18 adds Browser Use mode, hermes peer, Meta Muse Spark provider, per-plugin durable storage, and inline message components.

• Adds hermes peer subcommand for bot-to-bot DMs across machines and gateways.
• Adds Meta Model API (Muse Spark) as a bundled provider plugin, with Meta Muse Spark 1.2 available in the OpenRouter curated picker.
• Adds per-plugin durable data directory that survives plugin updates and removal.

AI Agent Frameworks · 2026-08-18

Hermes v2026.8.16.2 adds Bot Mode plugin, remote gateway headers, Cua Driver 0.20 support, and /rollback --all flag.

• Bundles Bot Mode (hermes-bots) as a built-in, default-on plugin with the core teammate protocol for Bot Chat sessions.
• Adds support for remote gateway headers, carried through the connections registry, test probes, and Settings UI.
• Supports Cua Driver 0.20 runtime contracts for computer-use, with auto-repair of installed drivers that fail the runtime contract.

Endpoint Security (EDR/XDR) · 2026-08-18

Huntress GA's a chronological investigation timeline dashboard with CSV/Excel export across Managed EDR, ITDR, and SIEM.

• New Investigations dashboard (accessible via the top navigation in the Huntress portal) shows a chronological timeline of signals reviewed, actions taken, remediations applied, and final outcomes for both reported and closed-benign investigations.
• Supports export of investigations to CSV and Excel for reporting and recordkeeping.
• Covers investigations across Managed EDR, ITDR, and SIEM in a unified view.

Secrets Detection & Management · 2026-08-18

Infisical v0.162.20 adds KMIP auto certificate renewal and a shared provider form for dynamic secrets.

• Adds KMIP auto certificate renewal, reducing manual overhead for certificate lifecycle management.
• Adds a shared provider form contract for dynamic secrets, standardizing how dynamic secret providers are configured.
• Adds dismiss of selected actions via the Escape key in the UI.

Identity & Access Management · 2026-08-18

JumpCloud Agent 2.156.0 adds structured Winget diagnostics on Windows and read-only Device Admin controls when only one option is available.

• Device Admin controls are now read-only when only one selection is available on macOS and Windows, giving managed users clearer and safer control over eligible device actions.

Endpoint Security (EDR/XDR) · 2026-08-18

numbat v0.2.0 adds live assistant/reasoning text capture and explicit message output controls for content inspection.

• Adds explicit message output controls for governing what content is emitted from inspected message bodies.
• Supports bounded message body inspection, limiting content analysis to defined byte ranges.

AI Coding Agents · 2026-08-18

Codex CLI gains endpoint-protection detection in codex doctor, improved network diagnostics, and sandbox-isolated editor buffers.

• Improves codex doctor network diagnostics with proxy-environment details, macOS system-proxy configuration reporting (automatic/PAC, manual, direct, unavailable), and detection of proxy authentication challenges (HTTP 407).
• Adds CodexOptions.configOverrides to the TypeScript SDK for passing ordered --config key=value arguments to the Codex CLI unchanged, applied after structured config values.
• Adds working-directory commands to the TUI.

Threat Intelligence · 2026-08-18

OpenCTI 7.260817.0 adds score field to Threat Actor Group, Intrusion Set, and Malware entity types.

• Adds score field to the Threat Actor Group data model entity type.
• Adds score field to the Intrusion Set data model entity type.
• Adds score field to the Malware data model entity type.

AI Coding Agents · 2026-08-18

OpenHands Activity Log now shows LLM cost in USD and lets you export run data as CSV or JSON.

• Activity Log displays the LLM cost (in USD, four decimal places) for each completed run; a zero cost shows as $0.0000 and an unavailable cost shows nothing.
• New Activity Log export controls let you download run data as CSV or JSON, each including a raw numeric cost field per run (exported as null when the backend reports no cost).
• Automate pane in the sidebar lists all automations on the active backend with name, trigger type, and enabled state, and surfaces an add option when no automations exist yet.

AI Coding Agents · 2026-08-18

OpenHands v1.14.0 adds Git Sync automation, LLM pre-flight validation, structured Canvas error display, and Kimi K3 as the free default Canvas model.

• Adds a Git Sync page under Automations for managing repository synchronization workflows.
• Adds LLM pre-flight validation that checks and rejects misconfigured LLM profiles before they can be saved.
• Canvas now presents structured error outcomes so failures surface with actionable detail rather than raw errors.

Vulnerability Management · 2026-08-18

InsightVM 8.55.0 adds authenticated Oracle Database fingerprinting for more accurate vulnerability assessment.

• Adds authenticated fingerprinting for Oracle Database, enabling identification of the installed Oracle Database version and associated patches for more accurate vulnerability assessment.
• Improves the Security Console scheduler for more reliable handling of scheduled tasks, including jobs responsible for integrating data into the Console.

Attack Surface & Exposure Management · 2026-08-18

Surface Command adds ControlUp DEX and CyCognito connectors for unified endpoint and external attack surface visibility.

• New ControlUp DEX connector imports device inventory and platform user data from ControlUp for Desktops into Surface Command, including health scores, hardware details, OS information, and connectivity status.
• New CyCognito connector imports IP addresses, domains, certificates, web applications, IP ranges, and security issues from the CyCognito API into Surface Command for external attack surface visibility.

Attack Surface & Exposure Management · 2026-08-18

runZero adds AWS Inspector findings for EC2/Lambda, broader IPMI vulnerability detection, and improved geolocation and reporting.

• The AWS integration now supports AWS Inspector findings for EC2 and Lambda assets.
• The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities.
• The scanner now detects a broader range of IPMI vulnerabilities.

Identity & Access Management · 2026-08-18

SailPoint adds nine new connectors: Cobot, Losant, Prismatic, Productboard, ServiceM8, StoryChief, SupportBee, UpCloud, and Ziflow.

• Adds connectors for Cobot, Losant, Prismatic, Productboard, ServiceM8, StoryChief, SupportBee, UpCloud, and Ziflow to the SailPoint compliance integration catalog.

Identity & Access Management · 2026-08-18

Non-Employee Risk Management workflows now emit structured audit events and expose version context via the Audit Events API.

• Adds dedicated audit events to the Audit Events API for Non-Employee Risk Management workflow definition lifecycle actions — create, fork, deprecate, and delete — each with structured payload fields including workflow identity, definition label, actor, and timestamp.
• Adds dedicated audit events for workflow step changes (add, edit, delete, reorder) with definition context in the event payload, retrievable via the existing Audit Events query API.
• Enriches existing workflow session audit events with a workflow_version_label field (and workflow_version_id) identifying the workflow definition version in effect when the session started, enabling correlation of session behavior to configuration without extra tooling.

Identity & Access Management · 2026-08-18

IQService-August-2026 requires explicit enablement and TLS for ScriptExecutor and gMSAPasswordData privileged services.

• Adds IQService.exe -g --enable <Service Name> command to explicitly enable privileged services; ScriptExecutor and gMSAPasswordData will not run unless enabled this way.
• Extends mandatory TLS-only enforcement to the ScriptExecutor (native before/after script execution) and gMSAPasswordData (gMSA password retrieval) privileged services — both are silently disabled if TLS is not exclusively configured on the IQService instance.
• Auto-update push via UpdateService begins October 19, 2026, with a 60-day manual configuration window starting August 18, 2026 for administrators to download, configure, and validate before auto-updates begin.

SAST / SCA / Code Security · 2026-08-18

Semgrep adds multi-finding Autofix PRs, workflow search in remediation policies, and an experimental v2 API for Code issues.

• Adds multi-finding Autofix: when several findings in the same file share a rule, Semgrep now offers a single pull request or merge request to fix them all at once.
• Code findings are now available through the experimental v2 API.
• Adds a branch filter to the Workflow jobs tab on a project's Details page, with the primary branch pinned to the top of the list.

SAST / SCA / Code Security · 2026-08-18

StepSecurity Threat Center now evaluates incidents against your environment and surfaces only the ones that affect you.

• Adds an Affecting You filter at the top of Threat Center to switch between All incidents and a scoped view showing only incidents that match your environment, each with a live count.
• Adds a You are affected badge to incidents in both the All and Affecting You views so exposure is visible directly from the list.
• New matched-components breakdown per affected incident lists compromised packages found in your repositories, split by open pull request vs. default branch, down to the affected files, head commit, and matched version.

SAST / SCA / Code Security · 2026-08-18

Harden Runner gains a deny list egress policy via denied-endpoints and denied_endpoints, plus AWS CodeBuild custom image support.

• Adds denied-endpoints input to the Harden-Runner GitHub Action (v2.21.0) to block specific destinations while leaving all other traffic reachable — use with egress-policy: block to stop known-bad hosts without building a full allow list.
• Adds denied_endpoints config key to Self-Hosted VM Harden Runner (v1.9.0) with egress_policy: block for the same deny list capability on self-hosted VMs.
• Deny lists for both the GitHub Action and Self-Hosted VM runner can be managed centrally through the Policy Store, eliminating the need to edit workflow or config files per job.

Detection Engineering · 2026-08-18

Stratus Red Team adds Deregister an Amazon EC2 AMI attack technique for AWS.

• Adds a new AWS attack technique: Deregister an Amazon EC2 AMI, expanding coverage for EC2 image tampering scenarios.

Detection Engineering · 2026-08-18

Stratus Red Team adds Deregister an Amazon EC2 AMI attack technique to its MITRE ATT&CK coverage.

• Adds Deregister an Amazon EC2 AMI attack technique to the MITRE ATT&CK coverage matrix.

Detection Engineering · 2026-08-18

Stratus Red Team adds execution isolation via STRATUS_RED_TEAM_CORRELATION_ID for safe concurrent attack technique runs

• Adds STRATUS_RED_TEAM_CORRELATION_ID environment variable to isolate each execution's Terraform state under $HOME/.stratus-red-team/<technique-id>/<correlation-id>, preventing concurrent runs from sharing or destroying each other's resources.
• Adds runner.WithCorrelationID(id) to the Go library for passing a correlation ID when using Stratus Red Team programmatically.
• Exposes var.correlation.short (8-character form) and var.correlation.id (full form) as Terraform variables for technique authors to embed correlation IDs in cloud resource names, enabling true concurrent execution of the same technique.

Detection Engineering · 2026-08-18

Stratus Red Team adds Deregister an Amazon EC2 AMI attack technique to its library.

• Adds a new attack technique: Deregister an Amazon EC2 AMI, extending coverage for destructive/impact actions against Amazon EC2 resources.

Detection Engineering · 2026-08-18

Stratus Red Team adds tags and prefix config settings for AWS technique prerequisites, enabling custom tagging and resource-name prefixing.

• Adds tags config setting to apply custom tags (via AWS provider default_tags) to Terraform-managed prerequisites for AWS techniques — enabling correlation IDs, ownership labels, and environment markers per technique.
• Adds prefix config setting to prepend a custom string (with templating support) to the names of Terraform-managed prerequisite resources for AWS techniques.

Detection Engineering · 2026-08-18

Stratus Red Team v2.36.0 adds EC2 AMI deregistration, concurrent execution isolation via correlation ID, and configurable AWS resource tags/prefixes.

• Adds STRATUS_RED_TEAM_CORRELATION_ID environment variable to isolate concurrent attack-technique executions in the same environment, preventing errors and duplicate state.
• Adds configurable AWS resource tags and prefixes for resources created during warmup, controlled via the Stratus Red Team configuration file.
• New attack technique aws.impact.ec2-deregister-ami: deregisters an Amazon EC2 AMI to simulate disruption.

Detection Engineering · 2026-08-18

Tenzir v6.12.0 adds PCAPNG capture support and a new accept_relp operator for Syslog over RELP.

• Adds format = "pcapng" option to write_pcap to explicitly generate PCAPNG output; read_pcap now auto-detects PCAPNG input including multi-interface captures, variable timestamp resolutions, byte orders, and multiple sections.
• New accept_relp operator receives Syslog over the Reliable Event Logging Protocol (RELP) with support for plaintext, TLS, and mutual TLS connections, preserving message boundaries and providing at-least-once delivery acknowledgement.

Detection Engineering · 2026-08-18

Tenzir v6.12.0 adds reliable Syslog ingestion over RELP

• Supports reliable Syslog ingestion over RELP (Reliable Event Logging Protocol), enabling guaranteed delivery for syslog pipelines.

Detection Engineering · 2026-08-18

Tenzir v6.12.0 adds RELP-based reliable Syslog ingestion with TLS/mTLS and PCAPNG capture support.

• Adds PCAPNG capture support for network traffic ingestion.
• Adds reliable Syslog ingestion over RELP, including TLS and mutual TLS, with bounded acknowledgements and backpressure.

Detection Engineering · 2026-08-18

Tenzir v6.12.0 adds reliable Syslog ingestion over RELP

• Adds reliable Syslog ingestion over RELP (Reliable Event Logging Protocol) in Tenzir Node v6.12.0.

Detection Engineering · 2026-08-18

Tenzir v6.12.0 adds reliable Syslog ingestion over RELP with TLS/mTLS and PCAPNG capture support.

• Supports receiving Syslog over RELP (Reliable Event Logging Protocol), including TLS and mutual TLS, with bounded acknowledgements and backpressure.
• Adds PCAPNG capture support for network traffic ingestion.

Endpoint Security (EDR/XDR) · 2026-08-18

Cloud Email Gateway Protection adds header address rewriting for From, Reply-To, To, and Cc fields in Content Filtering policies.

• Adds header address rewriting to Content Filtering policies in Cloud Email Gateway Protection, supporting both inbound and outbound email traffic.

Endpoint Security (EDR/XDR) · 2026-08-18

Trend Vision One now excludes Entra ID security-defaults tenants from MFA Disabled risk events, reducing false positives.

• Accounts in Microsoft Entra ID tenants with security defaults enabled no longer surface under the Microsoft Entra ID Account with Weak Sign-In Security Policy - MFA Disabled risk event, eliminating false positives for those organizations.

Endpoint Security (EDR/XDR) · 2026-08-18

Cloud Email Gateway Protection adds URL, URL domain, and final URL domain age conditions for Correlated Intelligence custom detection signals.

• Adds a URL condition for Correlated Intelligence custom detection signals in Cloud Email Gateway Protection, matching email URLs against a specified list of up to 1,024 URLs.
• Adds a URL domain condition for Correlated Intelligence custom detection signals, matching the domain of any URL in an email against a specified list of up to 1,024 domains.
• Adds a Final URL domain registration age condition for Correlated Intelligence custom detection signals, triggering when the domain of the final destination URL (after all redirects and short-link expansions) was registered within a configurable window of 0 to 366 days.

Endpoint Security (EDR/XDR) · 2026-08-18

Trend Vision One security playbooks now support operating system as a condition parameter for targeting or excluding endpoints.

• Adds operating system as a condition parameter in both Endpoint Response Playbooks and Automated Response Playbooks, with include or exclude modes to precisely target automated actions by OS.

Endpoint Security (EDR/XDR) · 2026-08-18

XFA adds eight browser-privacy device checks for Chrome and Firefox, with warn-or-block policy controls.

• Adds Chrome Safe Browsing device checks (standard and enhanced modes) as configurable per-organization policies.
• Adds Chrome Do-Not-Track device check as a configurable per-organization policy.
• Adds Chrome DNS-over-HTTPS device check as a configurable per-organization policy.

Endpoint Security (EDR/XDR) · 2026-08-18

XFA lets organizations set a default language for emails and messages when a user's language is unknown.

• Adds an organization-level default language setting under Settings > Organization, used for emails and messages when a user's own language cannot be detected or is not set on their profile.

AI/LLM Security · 2026-08-17

AI-Infra-Guard v4.5.2 adds SkillJack research, GET-only fingerprints for Qdrant/Chroma/Weaviate, and a v5.0.0 mutation engine refactor merging workflow-attack into mutation-attack.

• Adds GET-only fingerprints for Qdrant, Chroma, and Weaviate to the fingerprint library, enabling passive identification of these vector databases.
• Introduces the SkillJack research project, expanding the platform's AI security research surface.
• Upgrades the aig-agent-redteam skill to v5.0.0 with a refactored mutation engine that merges workflow-attack into mutation-attack for consolidated adversarial testing.

Identity & Access Management · 2026-08-17

Auth0 GA's Flexible Password Policy with unified options.password_options object and extends Custom Prompts to Social and Enterprise connections.

• Adds options.password_options object to database connections, replacing legacy fields (passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary) with granular controls for composition, history, dictionary (10,000- or 100,000-word lists plus custom entries), and profile-data blocking — configurable via the Auth0 Dashboard under Authentication > Database > [your connection] > Authentication Methods > Password, or through the Management API.
• New database connections created from July 2026 onward default to Flexible Password Policy with a minimum password length of 15, no required character types, and no legacy fields — applies whether the connection is created via Dashboard, Management API, Deploy CLI, Terraform, or an Auth0 SDK.
• Custom Prompts (custom signup/login fields and consent checkboxes configured in Universal Login) now capture data on Social and Enterprise connections in addition to database and passwordless connections, with no configuration changes required — reviewable under Branding → Universal Login → Enhance screens with partials, or via the Management API.

Attack Surface & Exposure Management · 2026-08-17

Axonius now lets practitioners create asset records manually from the table view.

• Adds the ability to create a new asset manually directly from the table view in the Axonius console.

Vulnerability Management · 2026-08-17

Brinqa Risk Intelligence adds CISA Vulnrichment SSVC decision points to CVE records.

• New CISA Vulnrichment fields are delivered via the underlying risk intelligence data feed — no connector version update required; CVEs not yet enriched by CISA leave these fields empty.

Vulnerability Management · 2026-08-17

Brinqa adds connectors for Akto, Cortex Cloud, and SysReptor alongside expanded Tanium Comply support.

• New Akto connector ingests Api Endpoint, Dynamic Code Finding, and Dynamic Code Finding Definition data objects.
• New Cortex Cloud connector ingests Asset Group, Cloud Account, Cloud Resource, Container, Container Image, Host, Installed Package, Package, Serverless, Violation, Violation Definition, Vulnerability, and Vulnerability Definition data objects.
• New SysReptor connector ingests Pentest Finding and Pentest Finding Definition data objects.

Malware Analysis · 2026-08-17

CAPEv2 Distributed REST API migrated to FastAPI/Uvicorn with self-healing DB connections and expanded admin CLI

• Migrates the Distributed REST API in utils/dist.py from Flask/Flask-RESTful to FastAPI and Uvicorn, with type-safe Pydantic JSON schemas replacing Flask-SQLAlchemy and python-multipart.
• Adds a restart_db_connection() helper and SessionWrapper in utils/dist.py that automatically disposes and recreates the SQLAlchemy connection pool when a TimeoutError or QueuePool limit is hit.
• Expands utils/dist.py into a fully-featured administrative CLI tool with grouped command sets: Daemon Options, Cluster Management, VM Maintenance, and GCS/Sync — adding subcommands to list, register, modify, and view cluster status from the command line.

Container & Image Security · 2026-08-17

Chainguard now publishes an API — 260 endpoints across 59 areas: Registry, Registryentitlements, Identityprovidersservice, …

• Registry (33 endpoints) — create, read, update, delete
• Registryentitlements (11 endpoints) — Registry Entitlements API
• Identityprovidersservice (9 endpoints) — create, read, update, delete

Container & Image Security · 2026-08-17

Chainguard adds AWS Security Hub Extended integration, console malware visibility, PKCE for custom IdPs, and 23 new container images.

• Adds Chainguard Libraries distribution through AWS Security Hub Extended, with findings normalized to the Open Cybersecurity Schema Framework (OCSF) and AWS Enterprise Support (Level 1) for eligible customers; subscribe and pay via existing AWS account from the Security Hub console.
• New Malware tab in the Libraries section of the Console (beta) shows malicious and suspicious packages blocked before reaching your environment, with a weekly chart covering Python and JavaScript ecosystems and a per-package search explaining why a package was flagged; enabled by default for all Libraries-entitled organizations.
• Adds Proof Key for Code Exchange (PKCE) support for the OAuth token exchange with custom OIDC identity providers (aligned with OAuth 2.1), configurable via chainctl or the Chainguard API, usable alongside an existing client secret or as a secret-free public client.

Integrated & IT Risk Management · 2026-08-17

CISO Assistant v3.21.1 adds MCP HTTP transport, CyFun2025/ISO27001 mapping, TPRM audit link modes, and a streamlined approval UI.

• Adds http transport support to the aggregated MCP (Model Context Protocol) architecture, expanding AI coverage and reducing token usage on context.
• Adds CyFun2025 and ISO27001 framework mapping to the library (lib).
• Adds audit link mode options in the TPRM data wizard for entity configuration.

Vulnerability Management · 2026-08-17

Cloudmersive Private Cloud Convert API v7-7-1 adds a customizable PDF Creator setting.

• Adds a customizable PDF Creator setting to the Convert API.

SAST / SCA / Code Security · 2026-08-17

Cloudsmith GA: policy-as-code management and continuous OSV.dev-powered risk detection now fully available.

• Policy management is now generally available across the web app, API, and Terraform provider, enabling policy-as-code enforcement rules across the software supply chain.
• Continuous risk detection is now generally available, automatically checking every package in a workspace against known vulnerabilities and malicious packages with no scheduled or manual rescans required.
• OSV.dev now replaces Trivy as the vulnerability data source shown in the web app and API for risk detection.

Identity & Access Management · 2026-08-17

ConductorOne adds service principals — machine identities with client credentials or secretless OIDC workload federation for CI/CD and automation.

• Introduces service principals: non-human machine identities assignable C1 roles, usable in scripts, CI/CD pipelines, Terraform runs, and API integrations, separate from any human user account.
• Supports two authentication methods per service principal: client credentials (client_credentials grant type using a client ID + Ed25519 private key) and secretless workload federation (urn:ietf:params:oauth:grant-type:token-exchange grant type via external OIDC JWT), usable independently or together.
• Recognizes CONDUCTORONE_CLIENT_ID, CONDUCTORONE_CLIENT_SECRET, CONDUCTORONE_ACCESS_TOKEN, CONDUCTORONE_OIDC_TOKEN, CONDUCTORONE_TENANT_DOMAIN, and CONDUCTORONE_SERVER_URL environment variables across all C1 client tools (Go SDK, Terraform provider, Cone CLI, oidc-token-action), with a defined priority order: CONDUCTORONE_ACCESS_TOKEN first, then CONDUCTORONE_OIDC_TOKEN, then CONDUCTORONE_CLIENT_ID + CONDUCTORONE_CLIENT_SECRET.

Identity & Access Management · 2026-08-17

ConductorOne adds admin controls for org-wide notification defaults, per-type locking, and digest scheduling via Settings > Notifications.

• Adds Settings > Notifications admin UI to set organization-wide default notification preferences across Email, Slack, and Teams delivery channels, with bulk checkboxes per channel header.
• Adds per-notification-type lock icons in Settings > Notifications so admins can prevent users from overriding specific notification settings — locked settings override individual user preferences with the tenant default.
• Adds C1 digest configuration in Settings > Notifications to set default digest frequency (Daily at 9 AM Pacific on weekdays, or Weekly at 10 AM Pacific on a chosen weekday) and delivery channel (email, Slack, or Microsoft Teams).

Identity & Access Management · 2026-08-17

ConductorOne launches Cone CLI with entitlement search, request, and revocation commands plus AWS SSO integration

• New cone search command lists all entitlements currently available to you across applicable access profiles.
• New cone get <entitlement_alias> command requests access to a named entitlement, automatically creates an approval request if access is not yet granted, and may prompt for justification or access duration based on entitlement settings.
• New cone drop <entitlement_alias> command creates a revocation request for a held entitlement and deprovisions access after any required review.

Identity & Access Management · 2026-08-17

ConductorOne adds a Microsoft Teams app for approving access requests, tracking open requests, and receiving connector sync alerts without leaving Teams.

• New Microsoft Teams app lets users track open access requests, approve or deny requests, and request new access without leaving the Teams interface.
• Connector sync alerts delivered via Teams: notifies users when a connector has a sync issue or a significant drop in synced resources.
• Connect the C1 Teams app via Admin > Settings > Notifications > Microsoft Teams section; supports connecting multiple Teams directories by repeating the auth flow per directory.

Identity & Access Management · 2026-08-17

ConductorOne launches a Slack app with an AI assistant for access requests, reviews, and org data queries.

• Adds /c1 request slash command in Slack to submit access requests from anywhere in the workspace.
• Enables the C1 AI assistant (available via the Chat tab in the C1 Slack app, @C1 mentions in channels, or direct messages) to answer natural-language questions about org access data — who has access to what, entitlement catalog contents, IdP-sourced org structure, and more.
• C1 AI assistant can generate downloadable files in CSV, JSON, PDF, or plain text format on request (e.g. 'give me a CSV of everyone with admin access'), with a download link appearing directly in the Slack thread.

Identity & Access Management · 2026-08-17

ConductorOne introduces Automations: custom workflows with triggers, steps, CEL expressions, versioning, and an AI assistant.

• New Automations engine lets Super Admins build custom multi-step workflows triggered by employee lifecycle events (onboarding, offboarding, role transfers, access reviews) via Admin > Automations.
• Automation triggers and steps are fully configurable: 11 trigger types and 15 step types available, with step reordering and deletion from the setup UI.
• Supports CEL expressions via the Advanced tab of each step's setup drawer — including the ctx object, {{ }} template syntax, and step-output references using each step's Step ID — to conditionally skip steps or define dynamic values.

Identity & Access Management · 2026-08-17

ConductorOne adds OCSF-formatted system logs exportable to S3/Azure Blob with SIEM integration for Splunk, Panther, and CrowdStrike

• New system log feature stores all C1 API activity (end-user and administrative) in OCSF (Open Cybersecurity Schema Framework) format, accessible via API or exported to an external data source.
• Adds GET <YOUR C1 TENANT URL>/api/v1/ocsf-events.yaml and GET <YOUR C1 TENANT URL>/api/v1/ocsf-events.json endpoints to download the authoritative list of all API events in Sigma Detection Format.
• New system log exporter, configured under Settings > System Log > Add exporter, syncs logs to an external data source (S3 bucket or Azure Blob container) every four to five minutes, generating files of up to 2.5 MB of uncompressed data per run (~280 files per day).

Identity & Access Management · 2026-08-17

ConductorOne adds custom key/value annotations to policies, apps, entitlements, and more — editable via UI, Terraform, and API.

• Adds annotations key/value metadata to ConductorOne objects (policy, app, app entitlement, app resource, access profile, automation, access review template), stored on the object, returned on every read, and tracked in change history.
• Adds annotations block to the Terraform provider for all supported resources (conductorone_policy, conductorone_app, conductorone_app_entitlement, conductorone_custom_app_entitlement, conductorone_app_resource, conductorone_access_profile, conductorone_automation, conductorone_access_review_template).
• Terraform provider automatically sets IaC well-known annotation keys managed_by, iac_workspace (from TF_WORKSPACE), and iac_resource_address; iac_tool_version must be set manually.

Identity & Access Management · 2026-08-17

ConductorOne adds External Insights: CrowdStrike and Wiz risk scores surface in access reviews and drive CEL policy automation

• New External Insights feature syncs identity risk data from CrowdStrike Falcon Identity Protection and Wiz Insights into C1, matching scores to identities by email address and surfacing them across access reviews, approvals, and task logs.
• Enables or disables identity risk score syncing via the Identity Risk Score toggle under Resource capabilities on a connector's Details tab — no additional setup required when a supported connector is already syncing.
• Exposes CrowdStrike risk scores via account.risk_score (map keyed by source display name, returns integer) and account.risk_scores (list of score objects) in CEL policy conditions for automated access decisions.

Identity & Access Management · 2026-08-17

ConductorOne adds an Inventory page with unified Identities, Resources, and Secrets tabs across 8 integrations.

• New Inventory page (under Identity security > Inventory) provides a single-pane-of-glass view of all identities, resources, and secrets synced to ConductorOne.
• New Identities tab on the Inventory page shows all user, service, and system accounts synced to C1.
• New Resources tab on the Inventory page lists all resources with associated entitlements and per-resource account-grant counts.

Identity & Access Management · 2026-08-17

ConductorOne adds Access Explorer queries and a Security dashboard for auditing high-risk and orphaned access.

• New Access Explorer query library at Explore > Search surfaces pre-built queries covering orphaned accounts, inactive accounts, high-risk accounts, standing privileges, past grants, apps/entitlements/resources with deactivated or single owners, and more — each with available filters (by app, user, entitlement, resource type, or risk level).
• New Security dashboard at Explore > Analytics > Security tab aggregates six high-risk access categories — Orphaned accounts, High-risk accounts, Inactive accounts (past 30 days), High-risk role grants (permanent), High-risk role grants (temporary), and Standing privileges — with drill-through to full query results and report download.

Identity & Access Management · 2026-08-17

ConductorOne AI assistant now available to all users, with fast trend charts built from pre-aggregated metrics.

• Extends the C1 AI assistant to all C1 users, supporting questions and actions in the same language the user writes in.
• Adds trend charts (grants vs. revocations, review decisions, automation runs over time) built from pre-aggregated metrics, returning exact, traceable numbers without on-the-fly computation.

Identity & Access Management · 2026-08-17

ConductorOne MCP server list now shows an inline restart button for paused servers.

• Adds an inline restart button to the MCP servers list to make it easier to find and restart paused servers.

AI Coding Agents · 2026-08-17

• Adds autoDestroyAt range filter to the sandbox list endpoint, enabling lifecycle-aware queries that scope results by scheduled destruction time.
• Adds structured error responses with typed error codes to the SDK, giving programmatic access to failure reasons instead of raw HTTP status parsing.

Reverse Engineering · 2026-08-17

Detect-It-Easy adds distribution bundles for Fedora, openSuse, AppImage, S390X, RISC-V, PPC64, Nix, and FreeBSD.

• Adds pre-built distribution bundles for Fedora, openSuse, AppImage, S390X, RISC-V, PPC64, Nix, and FreeBSD, expanding platform coverage for deployment without manual compilation.

Secure Access (VPN / SASE / ZTNA) · 2026-08-17

DNSFilter adds DNS PreCheck v2 for policy enforcement on DNS-hijacking networks, plus policy dropdown organization headers.

• Adds DNS PreCheck v2, which maintains policy enforcement on networks that hijack or redirect DNS traffic, closing a gap where certain network conditions could allow content through that should have been blocked; the agent tray updates to show DNS PreCheck v2 when active.
• Policy/Schedule dropdown now groups an organization's own policies under an Organization header, with sections ordered Organization, Global, then Scheduled, across Sites, Roaming Clients, Relays, Subnets, Users, and Collections.

Post-Exploitation · 2026-08-17

evil-winrm v3.9 adds Kerberos ccache/kirbi ticket file auth, reverse DNS FQDN resolution, and a custom user-agent flag

• Adds -K/--ccache TICKET_FILE flag to load a Kerberos ticket directly from a ccache or kirbi file, with auto-detection of format and automatic KRB5CCNAME environment variable management (including cleanup on exit).
• Adds --spn SPN_PREFIX flag to override the SPN prefix used for Kerberos authentication (default HTTP).
• Adds -a/--user-agent USERAGENT flag to specify a custom WinRM connection user-agent string (default Microsoft WinRM Client).

SAST / SCA / Code Security · 2026-08-17

GitHub OAuth apps gain expiring tokens with refresh, up to 10 redirect URIs, and wildcard redirect matching.

• OAuth apps can now include the offline_access scope in authentication requests to opt into short-lived access tokens (8-hour lifetime) paired with 6-month refresh tokens.
• OAuth app registrations can be set to always issue short-lived tokens, forcing all clients — including old ones — onto the refresh token flow.
• Short-lived tokens are enabled by default for all newly created OAuth applications; the behavior can be disabled while updating an incompatible SDK.

SAST / SCA / Code Security · 2026-08-17

Grok 4.6 arrives in GitHub Copilot for agentic coding and complex multi-step workflows across VS Code, CLI, and more.

• Adds Grok 4.6 as a selectable model in the Copilot model picker across Visual Studio Code, Visual Studio, Copilot CLI, GitHub Copilot cloud agent, GitHub Copilot app, JetBrains, Xcode, and Eclipse.
• Grok 4.6 is available to Copilot Pro, Pro+, Max, Business, and Enterprise SKUs, billed at provider list pricing under usage-based billing.
• Copilot Enterprise and Business administrators must enable the Grok 4.6 policy in Copilot settings — the policy is off by default.

SAST / SCA / Code Security · 2026-08-17

GitHub Copilot gains Kimi K3, Agent Plugins 1.0 GA, new CLI task management, Ollama BYOK in JetBrains, and cross-session memory.

• Adds Agent Plugins 1.0 (now generally available) enabling a plugin built once to run across VS Code, Copilot CLI, the GitHub Copilot SDK, and the GitHub Copilot app.
• New /tasks subcommand in GitHub Copilot CLI to manage all subagents and their tasks, with support for queuing prompts, shell commands, and supported slash commands while an agent turn is running.
• New --plan combined with --mode autopilot in headless mode (-p) lets the Copilot CLI agent produce a plan and then implement it automatically.

AI Agent Frameworks · 2026-08-17

Hermes adds AGENTS.override.md for personal, per-directory overrides of committed AGENTS.md instructions.

• Adds AGENTS.override.md support: when placed next to AGENTS.md, the override file is loaded instead of the committed file — intended to be gitignored so individuals can maintain personal agent instructions without modifying the tracked AGENTS.md.

AI Agent Frameworks · 2026-08-17

Hermes adds MCP suggestion metadata, invisible Unicode TAG stripping, and selective _meta passthrough for tool results.

• Adds suggest block support in MCP server manifests, with keywords and hosts lists that trigger one-click Add <server> pills in the Desktop app composer when a matching word or hostname is detected in a draft.
• Strips invisible Unicode TAG characters (U+E0000–U+E007F range) from MCP tool results, resource content, and tool descriptions to block prompt-injection smuggling, while preserving legitimate emoji tag sequences such as regional flags.
• Surfaces vendor _meta mappings (e.g. com.example/handoff) from MCP tool results to the model, while dropping protocol-reserved keys under modelcontextprotocol and mcp prefixes (e.g. modelcontextprotocol.io/..., tools.mcp.com/...); omits _meta entirely when no model-facing keys remain.

AI Agent Frameworks · 2026-08-17

Hermes agent now annotates signal-killed terminal exits and auto-transcodes UTF-16 files to UTF-8.

• Terminal commands killed by a signal now carry a human-readable annotation in the result — e.g. exit code -9/137 becomes 'terminated by signal 9: SIGKILL — often the kernel OOM killer on memory exhaustion, or an explicit kill -9'; segfaults, aborts, SIGTERM, broken pipes, and CPU/file-size limit signals are labeled the same way.
• UTF-16 files (detected via BOM or byte-pattern heuristic, either endianness — covering Windows Notepad files and PowerShell redirects) are now transcoded to UTF-8 for display instead of being refused as binary; the result includes a hint disclosing the conversion, and edits via write_file re-encode as UTF-8; files over 10 MB and genuinely binary files still receive the binary-file refusal.

AI Agent Frameworks · 2026-08-17

Hermes adds tail_mode compaction control, delegation.* subagent routing, and new CLI multiline/scrollback config keys.

• Adds tail_mode config key with legacy (0.20× window verbatim tail) and lean (clamped 2.5% tail, 10K–25K tokens, with digests, anchor index, and session_search recovery pointers) modes — lean yields ~3× fewer retained tokens after compaction.
• Adds delegation.* config section for subagent model routing: the entry key controls which provider, model, and credentials subagents inherit, with inherit meaning 'use the parent agent's settings'; persists to delegation.* rather than auxiliary.* because subagents are full child agents.
• Adds cli_multiline_shortcuts config key to enable Ctrl+J, \ + Enter, and Shift+Enter as newline-insert shortcuts in the CLI (false restores legacy Ctrl+J submit behavior).

AI Agent Frameworks · 2026-08-17

Hermes adds CLI health checks, macOS permission management, and an interactive session picker with search and resume.

• Adds doctor [--include CHECK] [--skip CHECK] [--json] command to run cua-driver's health report and display platform checks.
• Adds permissions status [--json] command to report macOS Accessibility and Screen Recording grant status.
• Adds permissions grant command to request macOS Accessibility and Screen Recording grants for Cua Driver.

AI Agent Frameworks · 2026-08-17

Hermes v2026.8.16 adds key_cmd credential sourcing, lean compaction mode, multi-source agent fan-out, and plugin SDK exports for MCP and toolset config panels.

• Adds key_cmd credential source to provider config, letting operators specify a shell command that prints a short-lived token instead of storing a static key — output can be a bare token or JSON with access_token and optional expires_in fields; token is cached until near expiry.
• Exports McpTab, ToolsetConfigPanel, and HermesGateway type from @hermes/plugin-sdk, plus a host.getGateway() method returning the live $gateway instance, so desktop plugins can render full credential, OAuth, and MCP server configuration panels matching Settings → Capabilities.
• Adds multi-source agent support to the desktop app — sockets, roster, SDK, and fan-out updates are now handled end-to-end.

Exploitation & C2 · 2026-08-17

NodeZero WebApp Pentest launch page documented: AI-driven Extended Agents, user-registration crawling, WAF IP allowlisting, and per-run request-rate control.

• Adds Extended Agents option to WebApp pentests, enabling AI-driven exploratory testing that dynamically selects application areas to investigate and designs its own follow-up requests — intended to surface business-logic flaws that rules-based testing misses.
• Adds Enable User Registration check box so NodeZero can self-register test accounts through the application's registration flow, then feed those credentials into authenticated coverage expansion.
• Adds Get IP before starting pentest check box for External WebApp pentests, causing NodeZero to pause before testing begins and email the source IP so it can be added to WAF or rate-limiter allowlists before the run resumes.

Exploitation & C2 · 2026-08-17

NodeZero adds a full Web Application pentest configuration surface: scoping, testing rules, credentials, and route discovery.

• New Inventory > Applications > Custom page serves as the central hub for managing WebApp configurations, test runs, and test results — including per-pentest coverage gaps via Last Tested links.
• New Inventory > Applications > Potential Web Applications tab surfaces applications NodeZero discovered through prior pentests; clicking Designate and selecting Custom promotes them to the configurable Custom tab.
• New Configure Custom Web Application flow lets practitioners define a web application by Name, Main URL (FQDN), Access Type (Yes - external, cloud to cloud or No - internal via runner), and Application Environment (Dev/Staging/Trial or Production).

Exploitation & C2 · 2026-08-17

NodeZero adds autonomous WebApp Pentest with authenticated crawling, attack execution, and proof-based findings across public and private apps.

• New WebApp Pentest test type autonomously crawls, authenticates, and attacks web applications, producing proof-based findings rather than unvalidated scanner assertions.
• Supports both internet-reachable and private/VPN-gated applications via a NodeZero Runner with network connectivity to the target.
• Accepts an optional endpoints specification in Swagger/OpenAPI format to guide route discovery during test configuration.

Wireless & RF · 2026-08-17

hostapd-mana 2.12 ports to hostapd 2.12 with full 802.11be 6 GHz support and all 16 EAP credential-intercept modes.

• Supports 802.11be (Wi-Fi 7) and 6 GHz band operation, enabling rogue AP and credential-intercept testing against modern 802.11be clients.
• Maintains all 16 EAP mode interceptions (credential capture and credential-material capture) on 802.11be 6 GHz networks.

Agentic Infrastructure · 2026-08-17

API surface changed: 3 modified

• GET /api/datasets/{namespace}/{repo}/jwt: param expires_in (query) added
• GET /api/models/{namespace}/{repo}/jwt: param expires_in (query) added
• GET /api/spaces/{namespace}/{repo}/jwt: param expires_in (query) added

Post-Exploitation · 2026-08-17

Impacket gains SMB 3.1.1 server support, PKINIT RFC 4556 client, AES-128-GCM for SMB3, shadow credentials backup, and LSA dump in ntlmrelayx

• Adds --shadow-credentials and --interactive options to backup and clear existing msDS-KeyCredentialLink attributes.
• Adds SMB 3.1.1 dialect support to smbserver.
• Adds a PKINIT client implementing RFC 4556, RFC 5349, and RFC 4557.

Post-Exploitation · 2026-08-17

impacket smbserver gains SMB 3.1.1 dialect support

• Adds SMB 3.1.1 dialect support to smbserver, enabling modern Windows clients to connect without falling back to older negotiated dialects.
• Adds RC4 retry logic when no PA-ETYPE-INFO is present for the requested encryption type during Kerberos pre-authentication.

Post-Exploitation · 2026-08-17

Impacket gains SMB 3.1.1 server dialect, AES-128-GCM for SMB3 client, PKINIT RFC 4556 client, shadow credentials backup, and PAC claims parsing.

• Adds --shadow-credentials and --interactive options to backup and clear existing msDS-KeyCredentialLink attributes.
• Adds SMB 3.1.1 dialect support to smbserver.
• Adds AES-128-GCM encryption support to the SMB3 client.

Attack Surface & Exposure Management · 2026-08-17

Intruder adds a dark theme toggle in Settings, with preference saved automatically across sessions.

• Adds a dark/light theme toggle in Settings, with the chosen preference persisted automatically across sessions and applied consistently across dashboards, search, and widgets.

Web Application Security · 2026-08-17

Invicti adds HashiCorp Vault integration, multi-file gRPC ZIP upload, API scan profile, custom scan speed, and LSR HTTP traffic logging.

• Adds support for uploading multiple gRPC proto file definitions as a single ZIP archive, eliminating one-by-one imports for multi-file services.
• Adds HashiCorp Vault integration with Invicti Platform's Secrets Manager, enabling credentials to be retrieved directly from Vault when configuring scan authentication.
• Adds a new dedicated API scan profile applied by default to all new API targets for comprehensive API vulnerability coverage.

SAST / SCA / Code Security · 2026-08-17

Lakera adds Off-Task Action detector and tool-response screening to catch dangerous agent tool calls and poisoned tool results.

• Adds the Off-Task Action detector, which flags dangerous tool calls (data exfiltration, privilege escalation, data destruction) that are inconsistent with the user's stated intent in the conversation history.
• Enables screening of tool responses as untrusted content: pass tool results as role messages in the Guard API request to run Prompt Defense and Data Leakage detection on poisoned tool responses.
• Off-Task Action detector ships in a conservative, low-false-positive configuration; the documentation recommends enabling in Detect mode first, then switching to Enforce mode after validating accuracy on real traffic.

SAST / SCA / Code Security · 2026-08-17

Lakera Guard projects now support a Detect mode alongside Enforce mode, letting teams tune policies against live traffic before enforcing.

• Adds Detect and Enforce modes per project, letting teams roll out a new policy or tune detector thresholds against production traffic in Detect mode before switching to Enforce mode.
• Allows switching a project between Enforce and Detect at any time; changes take effect within a few minutes on future requests.
• Requests processed without a project ID are always handled in Enforce mode regardless of project-level settings.

Container & Image Security · 2026-08-17

Minimus adds per-CVE package-level advisory tracking and action rule success/failure logging with Activity Log integration.

• Adds a Package column alongside the existing Origin Package column in the Advisories table, enabling filtering by both the origin package and the affected package.
• Adds a breakdown of affected packages within each origin package per CVE/GHSA in the image vulnerabilities tab summary, with a link to a pre-filtered advisories view.
• Action rules now display a status indicator for their most recent invocation and a running count of how many times they have triggered.

AI Agent Frameworks · 2026-08-17

NemoClaw adds DGX Spark, DGX Station, and Windows WSL platform support with NEMOCLAW_PROVIDER routing logic

• Adds NEMOCLAW_PROVIDER=install-vllm as the managed vLLM provider, now the sole admitted provider on N1x hardware (Deferred preview) using model nvidia/Qwen3.6-35B-A3B-NVFP4.
• Adds NEMOCLAW_PROVIDER=vllm for existing vLLM server reuse on localhost:8000, available on all supported platforms except N1x.
• Adds confirmed support for DGX Spark via dedicated Express instructions.

Agentic Infrastructure · 2026-08-17

Ollama v0.32.14 adds WebP image transcoding for vision models and tolerates non-leading system messages in Qwen.

• Automatically transcodes WebP image payloads to PNG before forwarding to llama-server, enabling WebP support for vision model integrations alongside existing JPG and PNG formats.
• Qwen renderer now passes non-leading system messages through the raw ChatML path instead of returning an HTTP 500, allowing coding clients that inject runtime system prompts mid-conversation to function correctly.

CNAPP · 2026-08-17

Plerion rebuilds 40 compliance frameworks with 15,250 mappings, adds CIS AWS Benchmark v7.0.0, and retires superseded editions.

• Rebuilds 40 compliance frameworks from scratch against the current detection catalog, producing 15,250 control-to-detection mappings across AWS, Azure, GCP, and now Kubernetes (29 frameworks).
• Promotes 18 frameworks to their publisher's latest edition, including PCI DSS 4.0.1, NIST SP 800-53 Rev 5 Release 5.2.0, CSA CAIQ v4.1, UK NCSC CAF 4.0, and FedRAMP Rev 5 CR26 baselines.
• Adds CIS Amazon Web Services Foundations Benchmark v7.0.0 with all 70 recommendations mapped to Plerion detections, including six new AWS Organizations controls (centralized root access, authorization guardrails, organizational unit structure, delegated administrators) and a check for reaching AWS services over VPC endpoints, each tagged with CIS Level 1 or Level 2 profile.

SAST / SCA / Code Security · 2026-08-17

Socket splits legacy Alert Triage into two new APIs: policy rules and alert resolutions, each with distinct endpoints and selectors.

• Adds POST /orgs/{org_slug}/alert-policies/default/rules to create policy rules with vigil_selector, action, note, and placement controls (position, before_rule_id, after_rule_id, or rank).
• Adds GET .../rules returning { "items": [...] } in evaluation order, PUT .../rules/{rule_id} for partial-update and rule reordering, and DELETE .../rules/{rule_id} for removal.
• Adds POST /orgs/{org_slug}/alerts/resolutions to create alert resolutions scoped by vigil_selector fields including finding.cveId, finding.ghsaId, location.repo, artifact.version, with optional reason, comment (up to 1024 chars), and reason_text (up to 256 chars).

SAST / SCA / Code Security · 2026-08-17

Socket replaces the legacy Security Policy API with a baseline-preset plus explicit rules model, exposing new policy and rule endpoints.

• Adds GET /orgs/{org_slug}/alert-policies to list all policies, returning the default policy first followed by custom policies in creation order.
• Adds GET /orgs/{org_slug}/alert-policies/{policy_id}/rules returning { "items": [ ... ] } in evaluation order, replacing the single-response legacy GET.
• Adds PUT /orgs/{org_slug}/alert-policies/{policy_id} accepting name, description, repository_ids, and baseline fields; only sent fields are updated, and repository_ids replaces the entire set.

SAST / SCA / Code Security · 2026-08-17

Socket adds new alert-policies and alert-resolutions REST API endpoints, replacing legacy security-policy and triage endpoints.

• Introduces GET /orgs/{org_slug}/alert-policies and GET /orgs/{org_slug}/alert-policies/{policy_id}/rules as replacements for GET /orgs/{org_slug}/settings/security-policy.
• Introduces POST /orgs/{org_slug}/alert-policies, PUT /orgs/{org_slug}/alert-policies/{policy_id}, and rule endpoints as replacements for POST /orgs/{org_slug}/settings/security-policy.
• Introduces GET /orgs/{org_slug}/alerts/resolutions, POST /orgs/{org_slug}/alerts/resolutions, and DELETE /orgs/{org_slug}/alerts/resolutions/{uuid} to handle specific finding suppressions previously mixed into POST /orgs/{org_slug}/triage/alerts.

SAST / SCA / Code Security · 2026-08-17

Socket introduces Policies: ordered alert-action rules with baseline presets, per-repo scoping, and full REST API management.

• Adds a Policies system where each policy is an ordered list of rules that assigns one of four actions — error (Block), warn, monitor, or ignore — to every alert Socket raises.
• Introduces four baseline presets (Essential, Balanced, Comprehensive, None) that sit beneath custom rules, with Balanced as the default for new policies and the Default policy.
• Supports per-repository policy scoping: each repository belongs to exactly one policy, and the Default policy governs any repository not explicitly assigned to another.

Firewalls & Network Defense · 2026-08-17

Sophos Central 2026.29 adds AP6 registration validation and WMM-EDCA traffic prioritization configuration for access point profiles.

• Adds WMM-EDCA (Wireless Multimedia - Enhanced Distributed Channel Access) traffic prioritization settings, configurable on the Advanced Wireless tab of access point profiles.
• Adds real-time serial number validation during AP6 registration — surfaces format and licensing errors before registration starts.
• Adds registration account validation — shows an error when an access point connects but is already registered to another account.

Endpoint Security (EDR/XDR) · 2026-08-17

Sophos Central adds AI Defense EAP, ITDR Identity Risk Scores, new ITDR regions, and a Generative AI DNS filtering category.

• Adds a Generative AI category to DNS Protection filtering policies, giving visibility into AI service usage on networks and enabling policy-based control.
• Introduces Identity Risk Scores in Sophos ITDR — a single ML-derived score combining incident likelihood and compromise impact, updated dynamically as findings and accounts change.
• Launches Sophos AI Defense Early Access Program for Sophos EDR, XDR, and MDR customers on Sophos Fusion, enabling monitoring, control, and security of AI usage across an environment.

Endpoint Security (EDR/XDR) · 2026-08-17

Sophos Central adds Network Map topology visualization, AP6 Live Discover queries, and a Protected Browser extension for Chrome and Edge.

• New Network Map provides a visual representation of Sophos network topology, showing relationships and connections between all Sophos firewalls, switches, and AP6 access points in a Central account, with search capabilities.
• Live Discover queries now support AP6 Series access points, enabling on-demand querying of wireless data stored in the Sophos data lake.
• New Workspace Protection: Protected Browser extension lets administrators apply security policies and monitor user activity in Chrome and Edge without requiring migration to the full Sophos Protected Browser.

Firewalls & Network Defense · 2026-08-17

Sophos DNS Protection adds a Generative AI web category for granular access control to AI services.

• Adds a Generative AI category to the Business and generative AI category group, enabling filtering policies to block or allow generative AI service websites independently of other business categories.
• Renames the Business-relevant site categories category group to Business and generative AI to reflect the new category.

Firewalls & Network Defense · 2026-08-17

Sophos Email 2026.32 adds customizable block/warning messages for unverified URLs and CSV/PDF export of per-message URL lists.

• Adds CSV and PDF export of the URL list from the URLs tab in Message Details, including basic message metadata to identify the source message.
• Allows custom block and warning messages for unverified Time-of-Click (ToC) links to be configured separately from messages shown for risky URLs, enabling less alarming messaging for URLs that are unverified but not known to be malicious.

Endpoint Security (EDR/XDR) · 2026-08-17

Sophos Intercept X for Mobile 9.7.7 adds URL support to the User Activity Verification API.

• Adds URL support to the Sophos User Activity Verification API, enabling requests that open a web page or initiate a phone call when a user selects an option.

Endpoint Security (EDR/XDR) · 2026-08-17

Sophos Mobile 9.7 adds Apple User Enrollment, Android Enterprise Kiosk notifications, expanded iOS Web Content Filter and Per App VPN settings.

• Adds a new Show notifications setting to the Android Enterprise Kiosk mode policy, enabling notifications to be toggled on or off for kiosk devices.
• Adds Apple User Enrollment management mode for user-owned iPhones and iPads, isolating work apps and data in a separate volume from personal data.
• Adds additional settings to the iOS Web Content Filter policy for integrating third-party web filtering services.

Endpoint Security (EDR/XDR) · 2026-08-17

Helm chart 1.0.4 adds environment variable configuration and alert/event output control for Sophos Linux Sensor.

• Helm chart 1.0.4 adds configuration of alert and event outputs, allowing operators to control where detections are routed.

Endpoint Security (EDR/XDR) · 2026-08-17

Sophos Protection for Linux 2023.1 adds on-access file scanning and automatic malware quarantine for the Linux agent.

• Adds on-access file scanning for the Sophos Linux Agent, configurable via server threat protection policies in Sophos Central (off by default).
• Introduces malware quarantine for the Sophos Linux Agent, covering both on-access and on-demand scanning, automatically isolating files on signature match.

Endpoint Security (EDR/XDR) · 2026-08-17

Sophos Protection for Linux 2023.4 adds ARM64 server support and flexible installer options including custom install paths and pre-install checks.

• Supports installing the SPL Agent on ARM64-based Linux servers, enabling Linux Runtime Detections on ARM64 hardware.
• Adds installer option to designate a custom install location for the SPL Agent.
• Adds installer option to run pre-installation checks without installing the SPL Agent, enabling environment verification and troubleshooting.

Endpoint Security (EDR/XDR) · 2026-08-17

Sophos Protection for Linux 2024.1 adds device isolation, runtime detection health status, and allow-list-by-path for applications.

• Adds allow-list-by-path support for Linux, letting users permit applications by filename or path — configurable from event details or at General Settings > Allowed Applications.
• Adds Device Isolation for Linux: isolate a Linux endpoint from the network via Sophos Central while retaining management connectivity, using existing isolate/remove-from-isolation/exclusion controls.
• Includes the Sophos Linux Runtime Detections service in the Security Health view in Sophos Central, updating the health state reported for Linux devices.

SIEM · 2026-08-17

Sumo Logic adds AI Parse Assist to auto-generate parse statements and field names from highlighted log text.

• New AI Parse Assist feature automatically generates a parse statement and field names from any text highlighted in a log message, accelerating query building for complex or unfamiliar log formats.

Detection Engineering · 2026-08-17

Tenzir v6.11.0 adds Sigma 2.1 and YARA-X detection; v6.10.0 brings native time-series analytics for beacon detection.

• Adds Sigma 2.1 detection support in Tenzir Node v6.11.0.
• Adds YARA-X detection support in Tenzir Node v6.11.0.
• Introduces native time-series analytics for beacon detection in Tenzir Node v6.10.0.

Digital Forensics & Incident Response · 2026-08-17

Volatility 3 adds an optional Arrow/Parquet format renderer for output via the pyarrow dependency.

• Adds an Arrow/Parquet format renderer for output, available when the pyarrow dependency is installed (not included in the EXE distribution due to size).

Network Analysis & Monitoring · 2026-08-17

Wireshark docs add JSON export options (deduplication, compact mode, values, raw bytes) and Aggregation View for packet-list grouping.

• Adds No duplicate keys JSON export option: merges duplicate keys in a JSON object into a single key whose value is a JSON array containing all values.
• Adds Compact (no indentation) JSON export option: outputs compact JSON without indentation or extra whitespace, reducing output size and improving export performance.
• Adds Values JSON export option: exports a name/value pair for each field with the decoded field value.

Malware Analysis · 2026-08-16

CAPEv2 adds advanced configuration options in this release.

• Adds advanced configuration options to extend sandbox behavior (see PR #3160 for details).

AI/LLM Security · 2026-08-16

Certiv now publishes an API — 2 endpoints across 1 area: Lead Capture

• Lead Capture (2 endpoints) — Public endpoints for requesting a demo or subscribing to the newsletter.

AI/LLM Security · 2026-08-16

Certiv introduces Privacy Mode, making agent session visibility proportional to risk with auditable access for compliant sessions.

• New Privacy Mode changes session visibility defaults so only sessions with policy violations are automatically surfaced to security teams, while compliant sessions stay private unless an authorized user records an explicit justification for access.
• Certiv logs who accessed a private compliant session and the recorded reason, creating an auditable trail for governance, privacy teams, and works councils.
• Privacy Mode integrates with the existing Policy Engine and Scout endpoint observer: policy verdict determines session visibility without altering real-time Block, Pause, and Steer interventions.

SAST / SCA / Code Security · 2026-08-16

API surface changed: 4 modified

• GET /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens: response schema changed
• GET /user/tokens: response schema changed
• POST /organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens: response schema changed

AI Coding Agents · 2026-08-16

• CLI config file is created with 0600 permissions, restricting access to the owning user.
• TLS verification is now enforced in the Ruby Socket.IO client.

IDS / IPS · 2026-08-16

Fail2ban 1.1.1 adds file-based IP allowlists, a new OpenVPN jail, CSF firewall action, and extended filter modes for exim and sshd.

• Extends ignoreip with file:... (or file://path/file-with-ip-set) syntax to load ignored IPs, subnets, DNS/FQDN, or raw strings from an external file; the file is read lazily and reloaded dynamically when it changes.
• Adds filter.d/exim.conf mode more (several rules split out from mode normal) and extends mode aggressive to catch ACL-dropped failures such as ACL: Country is banned.
• Extends filter.d/sshd.conf modes ddos and aggressive with regex for timeout-before-authentication connections.

Secure Access (VPN / SASE / ZTNA) · 2026-08-16

API surface changed: +9 endpoints, 27 modified

• New endpoint GET /intune_devices
• New endpoint GET /intune_devices/{id}
• New endpoint GET /intune_integration

Secure Access (VPN / SASE / ZTNA) · 2026-08-16

Firezone 1.5.19 adds firezone-cli for headless macOS management; 1.6.0 doubles Linux tunnel throughput with GRO/GSO.

• Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel (1.6.0, #14011).

Secrets Detection & Management · 2026-08-16

GitGuardian API adds three new endpoints: secret-location listing by incident or source, and live scan progress polling.

• New GET /v1/incidents/secrets/{incident_id}/locations endpoint lists every file on a source's default branch that still holds a secret, with exact line positions, filterable by source, number_of_mentions_min, number_of_mentions_max, code_fix_request_status (processing, created, error), and search (filepath substring), sortable by last_updated_at, number_of_mentions, or source.
• New GET /v1/sources/{source_id}/locations endpoint lists all files in a single source that still hold any secret on the default branch, carrying the same per-match line positions, filters (number_of_mentions_min, number_of_mentions_max, code_fix_request_status, search), and sort options as the incident-level endpoint.
• New beta GET /v1/scans/{scan_id}/live-progress endpoint returns the live status (queued, in_progress, completed) and real-time counters (elements_scanned, elements_total, elements_skipped, elements_failed, data_downloaded_bytes, data_scanned_bytes) for a running historical scan, and includes an audit_url field once the scan reaches completed.

Secrets Detection & Management · 2026-08-16

GitGuardian adds custom secret validity via API, honeytoken endpoint protection, and programmatic PAT/SAT token creation.

• New API endpoint lets teams push their own validity status (valid or invalid) for secrets on unreachable internal systems, using a personal access token with the secrets:write scope; the status propagates to all incidents for that secret, appears as Custom validity with a datestamp, and is recorded in the incident activity log and audit log.
• New ggshield honeytoken plant command (existing agent binary) plants a decoy AWS credential on developer endpoints; any use of the decoy triggers an alert naming the compromised machine, its IP address, user agent, and timestamp — no new agent required.
• New Honeytoken protection card in the Endpoints dashboard reports fleet coverage percentage and lists unprotected endpoints.

SIEM · 2026-08-16

Google SecOps adds 30+ new REST endpoints spanning tenant management, case evidence, remediation actions, AI-assisted parsing, and BigQuery export subscriptions.

• New POST /v1beta/{parent}:runThreatHunt endpoint initiates a threat hunt programmatically via the v1beta API.
• New GET /v1beta/{parent}/tenants and PATCH /v1beta/{tenant.name} endpoints enable tenant listing and updates under the v1beta.projects.locations.instances.tenants resource for MSSP/partner management.
• New POST /v1alpha/{instance}:evaluateRuleCoverageLongRunning endpoint (evaluateRuleCoverageLongRunning) evaluates whether detection rules provide coverage for input UDM events.

Identity & Access Management · 2026-08-16

Nudge Security adds a risk dashboard, passkey adoption tracking, and in-browser AI data-loss nudges with optional enforcement.

• New Dashboards > Risk dashboard (open beta) shows residual risk scores, a trend chart filterable to business-critical apps, a business-criticality-vs-residual-risk matrix with drill-down, and a ranked highest-risk-apps table built automatically from Nudge's per-app risk scoring.
• New Dashboards > Passkey usage dashboard surfaces passkey adoption rate, top apps using passkeys, storage provider breakdown (toggle between passkey count and user count), device-loss survivability, and per-login verification status — populated by the browser extension.
• Passkey usage is also surfaced per individual employee on their user details page.

AI Coding Agents · 2026-08-16

Codex CLI alpha adds disk space diagnostics to codex doctor, MCP tool hook handlers, and Guardian-routed permission requests.

• Adds storage diagnostics to codex doctor, checking free disk space for both CODEX_HOME and the current worktree, with a warning threshold at 5 GiB and a failure threshold at 1 GiB.
• Adds Windows Dev Drive check to codex doctor on Windows targets.
• Supports pending environment attachment configuration so threads start without blocking while ensuring turns do not use an attachment prematurely; adds a Failed configuration state and environment_failed callback for per-thread failure and recovery.

Runtime Security · 2026-08-16

OpenSandbox execd v1.0.22 adds background runs, read-only PTY viewers, SDK attach(), and uid_mode probing

• Adds background: true to the run API, returning a JSON handle; new runs/{runId} and runs/{runId}/logs endpoints enable status polling for long-running sessions without blocking the caller.
• Adds ?mode=viewer query parameter to PTY sessions, letting multiple read-only clients watch a live PTY alongside the exclusive holder, with replay, live output, and backpressure isolation.
• Adds attach(sessionId) to all five SDKs, rebuilding a fully functional session handle from a bare session ID (e.g. after a worker restart); SessionState now echoes creation parameters.

Firewalls & Network Defense · 2026-08-16

Rspamd 4.1.5 adds fuzzy sender facts over encrypted connections, font-aware PDF text extraction, /ToUnicode CMap support, and structured fuzzy results in Elastic.

• Adds fuzzy_nested option to the elastic plugin to toggle nested-type per-match fuzzy result objects (replacing the flat fuzzy_hashes list with per-match objects from task:get_fuzzy_results() containing rule, symbol, found and queried hashes, type, probability, flag, and exactness), and adds message size to the schema mapping.
• Adds allow_file_and_shm_inputs = true explicitly to the normal, controller, and proxy worker configurations with documentation noting it applies to TCP listeners only and must not be exposed to untrusted networks; the default becomes false in the next major release.
• Introduces fuzzy sender facts: rules sharing extensions with their storage now attach a sender-facts extension to check commands over encrypted connections, carrying SPF, DKIM, and DMARC results, PTR state (including generic/dynamic hostname verdict from hfilter), bucketed recipient count, and TLS usage; FUZZY_CALLBACK gains ordering dependencies so authentication results are available when commands are built.

Firewalls & Network Defense · 2026-08-16

Rspamd 4.1.5 adds file/SHM input gating, controller auth rate-limiting, per-key fuzzy ACL fix, and Elastic nested fuzzy schema.

• Adds allow_file_and_shm_inputs boolean to normal, controller, and proxy workers in local.d/worker-normal.inc / local.d/worker-controller.inc / local.d/worker-proxy.inc to gate TCP access to File, Path, and Shm message inputs; unix-socket connections always retain the capability.
• Adds max_auth_failures and auth_failure_window to local.d/worker-controller.inc to rate-limit failed controller password attempts per source (default: 10 failures in 60 s triggers HTTP 429; set max_auth_failures = 0 to disable).
• Adds max_connections and max_connections_per_source limits to the controller and proxy workers.

Firewalls & Network Defense · 2026-08-16

Rspamd 4.1.5 adds sender-fact sharing over fuzzy encrypted rules, font-aware PDF text extraction, and richer Elastic schema.

• Adds sender facts (SPF, DKIM, DMARC, PTR state, recipient bucket, TLS) sharing with fuzzy storages over encrypted rules.
• Adds font-aware PDF text extraction: decodes simple font text via the font's /Encoding (Annex D base encodings and /Differences overrides) and parses /ToUnicode CMaps to decode composite (Type0) fonts.
• Extends the Elastic schema with structured fuzzy match results and message size.

AI/LLM Security · 2026-08-16

SkillSpector v2.9.5 adds Ollama, Azure OpenAI, and generic OpenAI-compatible providers, opt-in .skillspector-baseline.yaml auto-discovery, and static detection for insecure deserialization (AST10, TT6, DS1–DS4).

• Adds opt-in auto-discovery of a top-level .skillspector-baseline.yaml file, keeping explicitly supplied baselines authoritative when both are present.
• Adds Ollama support for local OpenAI-compatible inference, Azure OpenAI deployment routing, and a configurable provider for generic OpenAI-compatible endpoints.
• Adds static analyzer coverage for insecure deserialization patterns represented by findings AST10, TT6, DS1, DS2, DS3, and DS4.

Cloud Security Posture · 2026-08-16

Sysdig Secure adds image layer analysis, base image allow/deny list rules, and CNI plugin detection for CIS benchmark automation.

• Adds a Vulnerability Policies tab to the Resource Details drawer in Vulnerability Findings, showing how each resource was evaluated against configured policies, with a details panel listing CVEs, components, or remediation guidance and inline exception creation.
• Adds a Layers tab to the Resource Details drawer for container image resources, showing the image layer stack grouped by base image or Application Layers, with the Dockerfile instruction and per-severity vulnerability counts per layer.
• Adds a Layer filter to the CVE list in Vulnerability Findings so practitioners can slice findings directly by image layer.

Secure Access (VPN / SASE / ZTNA) · 2026-08-16

Twingate adds HTTP web app protection with JWT/header injection and a new Helpdesk admin role for scoped support access.

• Twingate injects a JWT identifying the user plus custom headers carrying user and group attributes into requests to protected web apps, enabling integration with both legacy and modern apps without requiring re-authentication at the app layer.
• Adds a Helpdesk role assignable to support staff, granting read-only access to select Admin Console areas plus scoped support actions: resetting MFA, verifying and unverifying devices, and managing trusted serial numbers.

Local LLM Runtimes · 2026-08-16

vMLX 1.6.29 adds hybrid prefix cache for 20x faster follow-ups and proves stable 100k-context multiturn with 99.9% cache reuse.

• Hybrid prefix cache delivers up to 20x faster follow-up turns on long documents (43.7k-token document follow-ups drop from 107s to 5s, byte-identical at temperature 0).
• Chunked SSM re-derive ships enabled by default, restoring long-context cache reuse from 0% to 99.9% above 12.5k tokens on hybrid SSM model families.
• 100k-context multiturn proven stable: 97.6k-token conversations retrieve planted facts with 99.9% cache reuse and no memory faults.

Web Application Security · 2026-08-15

Acunetix 360 adds PATCH semantics for scan profile/policy APIs, 730-day scan data retention, and .NET 10 upgrades.

• Adds PATCH semantics to scan profile and policy API endpoints, allowing partial updates that preserve existing values without resubmitting the full configuration object.
• Extends scan data retention configuration to up to 730 days (two years), providing longer access to historical scan results.
• Upgrades the Auth Verifier Service and scan agent to .NET 10 for long-term support, improved performance, and enhanced stability.

Digital Forensics & Incident Response · 2026-08-15

ALEAPP v2026.3.0 adds Signal/Telegram/Session decryption, 15+ new app parsers, and deep Android system artifact expansion

• Adds Signal for Android parsing with full SQLCipher decryption, attachment and thumbnail decryption, and message-linking.
• Adds Telegram for Android artifacts covering accounts, chats, peers, group/channel members, VoIP call logs, and service message actions parsed from cache4.db and shared preferences.
• Adds Session messenger account parsing from shared preferences.

Web Application Security · 2026-08-15

Arcjet Guard adds Vercel Eve and Mastra agent framework integrations with inbound screening, connection approvals, and lifecycle hooks

• Adds Vercel Eve agent guard integration: gate zero-authored-tool agents via guardApproval() on OpenAPI/MCP connections, screen inbound channel text with guardInbound(), and observe lifecycle events with void-returning hooks; defaults to onGuardError: 'deny'.
• Adds Mastra agent guard integration: screen inbound text with guardProcessor, gate authored tools with tool wrappers, gate MCP/workspace tools with guardHooks beforeToolCall (which can deny), with no guardInbound or guardApproval since Mastra uses processInput and human HITL; defaults to onGuardError: 'deny'.

Exploitation & C2 · 2026-08-15

Bugcrowd adds FedRAMP support for government and compliance-sensitive customers.

• Adds FedRAMP support, enabling government and compliance-sensitive organizations to use Bugcrowd within FedRAMP-authorized environments.

Exploitation & C2 · 2026-08-15

Bugcrowd adds on-demand Vulnerability Detections dashboard and DNS Records CSV export for audit and leadership reporting.

• Adds a Vulnerability Detections tab under Organization > AI Analytics with filters for date range, vulnerability priority, asset group, and asset owner to scope posture views to a specific business unit or asset owner.
• Adds a DNS records (csv) report type under Organization > Reports that exports a point-in-time inventory of discovered assets — names, types, and discovery source — filterable by creation date range, for auditors and board reporting.
• Generated reports are delivered via email when ready and are accessible by all Owner roles from the Reports page as timestamped point-in-time snapshots.

Exploitation & C2 · 2026-08-15

Bugcrowd adds FedRAMP support for government and compliance-sensitive customers.

• Adds FedRAMP support, enabling use of Bugcrowd in federal and compliance-regulated environments.

Exploitation & C2 · 2026-08-15

Bugcrowd Researcher Platform adds FedRAMP support for hacking on Bugcrowd Gov (US) engagements.

• Supports researcher participation in Bugcrowd Gov (US) engagements under FedRAMP compliance.

Web Application Security · 2026-08-15

c/side adds CSP Builder to turn observed script hosts into a deployable Content-Security-Policy across seven directives.

• New CSP Builder feature generates a suggested Content-Security-Policy from hosts c/side has already observed on your site, covering seven directives: script-src, connect-src, img-src, style-src, frame-src, font-src, and media-src.
• Lets you review, toggle off unexpected hosts, and add hosts not yet observed before deploying the policy.
• Supports a report-only header workflow — deploy in report-only mode first, monitor violations in the dashboard, then switch to enforce mode once the policy is clean.

Malware Analysis · 2026-08-15

CAPEv2 integrates Google Magika deep-learning content-type detection alongside libmagic for headerless and obfuscated file identification.

• Adds [magika] section to processing.conf (via processing.conf.default) to enable/disable Google Magika content-type detection and tune confidence thresholds.
• Adds get_magika() method to the FileObject class (lib/cuckoo/common/objects.py), returning a dict with label, description, mime_type, group, and score fields; runs below get_type() and never modifies the libmagic verdict.
• Adds magika block to file info in CAPE's processing pipeline (modules/processing/CAPE.py), backfilling results for files retrieved from the MongoDB cache that predate Magika being enabled.

AI Coding Agents · 2026-08-15

Claude Code v2.1.233 adds GitLab MR support, per-user identity forwarding, Linux memory limits for Bash tools, and a WebFetch cache TTL knob.

• Adds CLAUDE_CODE_TOOL_MEMORY_LIMIT environment variable (Linux) to cap memory for Bash tool commands via cgroup support, preventing runaway builds from stalling a session.
• Adds CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS environment variable to control the WebFetch session URL cache TTL (default: 15 minutes).
• Adds opt-in forward_user_identity apps gateway setting on Anthropic upstreams, forwarding the signed-in user's identity as headers so a proxy can attribute spend per user.

AI Coding Agents · 2026-08-15

Cline desktop v0.0.13 adds web search for supported models, a font size slider, and Crusoe as a new provider.

• Adds a Web Search toggle in Settings that lets supported models search the web during a task; searches and results are recorded in the session transcript and persist across reopens.
• Adds an app font size slider in Settings that scales the interface and applies the chosen size before the window paints, eliminating the flash-to-old-size on launch.

AI Coding Agents · 2026-08-15

Cline v4.1.10 adds native web search for supported models and expands the model catalog with Crusoe as a new provider.

• Enables web search during agent tasks for models that support it, toggled via Feature Settings; search calls and results appear in the conversation and persist across reloads.
• Adds Crusoe as a new model provider in the catalog, alongside updated model lists and per-provider default models across all existing providers.

Internet Services · 2026-08-15

Cloudflare adds DeepSeek V4 1M-token models, package registry security, Worker-level Access policies, and FIDO2 MFA for infrastructure apps.

• Adds @cf/deepseek-ai/deepseek-v4-pro-0813 and @cf/deepseek-ai/deepseek-v4-flash-0731 to Workers AI, both with a full 1,048,576-token context window, thinking-mode reasoning, and function calling; requires Workers Paid plan or prepaid credits.
• Adds ctx.access and ctx.access.getIdentity() to Worker request context so authenticated requests expose the user's email, name, and groups without manual JWT validation.
• Adds an access block inside the dev section of wrangler.jsonc to simulate Cloudflare Access identities locally — set aud, email, and related fields; remove the block to simulate unauthenticated requests.

Security Data Pipeline · 2026-08-15

Cribl LLM Observability adds Pydantic AI instrumentation via OpenTelemetry, routed to Cribl Stream and Cribl Search.

• Adds support for instrumenting Pydantic AI with OpenTelemetry and sending telemetry to Cribl Stream and Cribl Search.

Security Data Pipeline · 2026-08-15

Cribl Privacy 2.1 delivers 64%–163% throughput gains and 13%–24% lower memory for AI-based telemetry privacy detection in Cribl Guard.

• Cribl Privacy 2.1 model family increases detection throughput by 64%–163% and reduces average memory use by 13%–24% versus Privacy 2.0, with F1 accuracy held steady or improved and CPU utilization unchanged.
• New model pruning and distillation pipeline shrinks feed-forward layers by 75% or more, then trains a smaller student model against the original frozen teacher to recover near-equivalent detection quality at higher throughput.
• Introduces a three-tier model lineup — Fast (maximum throughput), Base (balanced), and Pro (maximum detection accuracy, coming soon) — letting operators choose an operating point on the accuracy/throughput/resource curve per pipeline.

AI Coding Agents · 2026-08-15

Daytona 0.201.0 adds pre-signed file transfer URLs, typed SDK error codes, and a sandbox list date-range filter.

• Introduces pre-signed sandbox file download and upload URLs, allowing direct S3-compatible file transfers without proxying through the API.

Identity & Access Management · 2026-08-15

Didit adds barcode fields to Session API, kyc.marital_status branch support, KYB/phone 502 error codes, and React Native 0.77 TurboModule support.

Public Key Infrastructure (PKI) · 2026-08-15

CertCentral adds CSR-driven CN/SANs repopulation, DCV polling status fields, and Service User name editing.

• Adds dcv_polling_status and dcv_polling_last_checked fields to the Services API responses for certificate requests and DNS name validations, surfacing whether DigiCert's automatic DCV polling is active and when it last ran.
• Adds a Use CN/SANs from CSR option on certificate request forms (DV, OV, EV TLS; QWAC and QWAC PSD2; X9 PKI for TLS; Private TLS) to replace existing Common Name and SANs fields with values from the uploaded CSR, with an Undo option to revert.
• Enables updating a Service User's first and last names in CertCentral, making it easier to distinguish Service Users and assign them to teams or operational roles.

Cloud Security Posture · 2026-08-15

eksctl v0.230.0 adds control plane component config support and BottlerocketFips AMI family for managed nodegroups.

• Adds BottlerocketFips AMI family support in managed nodegroups for FIPS-compliant Bottlerocket nodes.
• Adds control plane component config support, enabling configuration of individual EKS control plane components.
• Makes vpc-cni and kube-proxy optional when creating IPv6 clusters, reducing mandatory addon installation.

Reverse Engineering · 2026-08-15

Finite State adds an in-product What's New drawer and improves license search, Findings filtering, and API reliability.

• Adds an in-product What's New drawer that surfaces release highlights from the documentation feed whenever new customer-facing updates are published.
• Improves license search so prefix matches appear before substring matches in the Add Licenses and Component license pickers.
• Updates the License Policy page to source the live license catalog and display a retryable error state when the catalog cannot load.

Secure Access (VPN / SASE / ZTNA) · 2026-08-15

Firezone macOS/iOS 1.5.19 adds firezone-cli, a command-line interface for unattended and remotely managed Macs.

• Adds firezone-cli, a command-line interface to the macOS Client for Macs that run unattended or are managed remotely.

Secrets Detection & Management · 2026-08-15

GitGuardian adds an API to let customers override the validity status of a detected secret.

• Adds an API endpoint to edit (override) the validity status of a detected secret, giving customers direct control over validity classification.

Secrets Detection & Management · 2026-08-15

GitGuardian adds custom validity reporting via API, Azure DevOps pipeline decorator, and API-driven detector filtering for custom sources.

• New API endpoint lets practitioners set a custom validity status (valid or invalid) on secrets from internal or private systems — requires a personal access token with the secrets:write scope — so GitGuardian can surface that status in filters, severity, and all downstream incident workflows.
• Custom validity status is displayed as Custom validity with the date it was set on every incident for that secret, and setting or removing it is recorded in both the incident activity log and the audit log.
• Adds the Only use detectors with validators option to the public API when creating or updating custom sources, enabling fully automated and consistent source configuration.

Secrets Detection & Management · 2026-08-15

GitGuardian lets you set custom validity status on secrets via API, plus new source configuration options in the public API.

• New API capability to set your own validity status (valid or invalid) on secrets that GitGuardian cannot reach — requires a personal access token with the secrets:write scope.
• Incidents display Custom validity with the date it was set, distinguishing user-provided status from GitGuardian-checked status, recorded in both the incident activity log and the audit log.
• The custom validity status applies to the secret itself, so every incident tied to that secret reflects the status.

SIEM · 2026-08-15

Google SecOps gains Cloud Logging integration for SIEM ingestion pipeline monitoring and feed debugging (public preview, BYOP required).

• Adds Cloud Logging integration (public preview, requires Bring Your Own Project/BYOP Google Cloud project) to monitor, debug, and troubleshoot Google SecOps SIEM ingestion pipelines and feeds via Logs Explorer.

Digital Forensics & Incident Response · 2026-08-15

iLEAPP v2026.3.0 adds Apple Unified Logs, 16+ new artifacts, Telegram/Wickr/Session parsers, and sysdiagnose PowerLog support.

• Adds parsing of *.PLSQL.gz rotated PowerLog archives (decompressed to a session temp directory, reused across all PowerLog artifacts) alongside CurrentPowerlog.PLSQL, with per-archive time-offset correction — extending recoverable history by weeks on most images.
• Adds Apple Unified Logs support with the parser bundled into all builds and 16+ new artifacts surfaced from a predicate survey.
• Adds Telegram artifacts for iOS: Accounts (from accounts-metadata/atomic-state and Postbox t0), Contacts & Peers (full t2 peer dump with avatar images and Spotlight cache), Chats (Postbox chat list), Cached Peer Details (Postbox t18), Device Contacts (Postbox t54), Peer Presence, and Message Tags.

Endpoint Security (EDR/XDR) · 2026-08-15

Iru adds phased OS rollouts for Apple devices, Authenticated Guest Mode for SSO, and upfront framework selection in Compliance Automation.

• Managed OS for Apple devices now supports phased rollouts, enabling staged OS update deployments across a fleet.
• Authenticated Guest Mode is now available on the Single Sign-On Library Item, allowing guest users to authenticate through SSO flows.
• Compliance Automation now lets you select the compliance framework upfront when generating new policies, rather than configuring it after creation.

AI Agent Frameworks · 2026-08-15

NemoClaw adds platform support for DGX Spark, DGX Station, and Windows WSL, with a managed-vLLM preview path for N1x via NEMOCLAW_PROVIDER=install-vllm.

• Adds NEMOCLAW_PROVIDER=install-vllm as the dedicated provider for N1x hardware, enabling a Deferred managed-vLLM preview using nvidia/Qwen3.6-35B-A3B-NVFP4 on a one-host managed vLLM setup.
• Adds NEMOCLAW_PROVIDER=vllm to connect to an existing vLLM server on localhost:8000 for non-N1x platforms.
• Adds confirmed support and Express install instructions for DGX Spark.

Identity & Access Management · 2026-08-15

Nudge Security adds a Risk dashboard (open beta) at Dashboards > Risk, surfacing residual risk scores and business criticality across your SaaS inventory.

• New Risk dashboard at Dashboards > Risk (open beta) displays tiles for apps assessed, business-critical apps, overall residual risk, and apps missing approval — built automatically from Nudge's business criticality tiers and residual risk scores.
• Risk trend chart within the dashboard lets you filter historical risk over time to business-critical apps only.
• Business criticality vs. residual risk matrix lets you click into any cell to see the exact apps behind that risk concentration.

Exploitation & C2 · 2026-08-15

OCInferno gains exploit modules, MFA stripping, delegation auth, container image tokens, IDD self-service, and new enumeration flags.

• Adds --save-domains flag to enum_identity to persist discovered domain URLs to the database.
• Adds --regions flag to enumeration modules to scope scans to specific OCI regions.
• Logs [TIMEOUT] in enum_all output when a module hits a connect or read timeout, making stalled regions visible.

Agentic Infrastructure · 2026-08-15

Ollama v0.32.13 adds Qwen3.8 developer-instruction support, folding leading system/developer prefixes into a single system turn.

• Adds Qwen3.8 support for developer instructions: leading system/developer instruction prefixes sent by OpenAI-compatible coding agents are folded into a single system turn before Qwen3.8 validation, preserving instruction precedence without affecting Qwen3.5 or other renderers.

Agentic Infrastructure · 2026-08-15

Ollama v0.32.12 adds Qwen3.8 27B support with an Apple Silicon MLX-optimized variant.

• Adds qwen3.8:27b model, with performance gains across coding, research, and long-horizon agentic tasks, runnable via ollama run qwen3.8:27b.
• Adds qwen3.8:27b-mlx variant optimized for maximum performance and output quality on Apple Silicon devices, runnable via ollama run qwen3.8:27b-mlx.

AI Coding Agents · 2026-08-15

Codex CLI alpha.18 makes Guardian v2 risk classification configurable and enables unified exec by default on Windows.

• Adds rich configuration for features.guardianv2 — now accepts a boolean toggle or an object specifying classifier instructions, review threshold, reasoning effort, action and instruction token limits, transcript source inclusion, per-entry and total token budgets, and the number of recent non-user entries.
• Enables the unified_exec feature by default on all platforms including Windows, exposing exec_command and write_stdin on Windows instead of shell_command.
• Adds an override to skip project configuration at startup.

AI Coding Agents · 2026-08-15

Codex CLI alpha.16 adds Guardian V2 risk scoring, parallel tool calls, strict MCP auto-review, and smarter plugin app discovery.

• Introduces Guardian V2 risk scoring: records risk scores on threads, initializes per-thread samplers, preserves transcript boundaries, and stores scores as snapshots — high-risk actions now require automatic review.
• Enforces strict auto-review for MCP tool calls even when the approval policy, tool annotations, or a remembered session decision would otherwise skip review.
• Adds agent_name to Responses API turn metadata, falling back to /root when no canonical agent path is set, with the field reserved from client metadata overrides.

AI Coding Agents · 2026-08-15

Codex CLI alpha.11 adds thread usage display in /status, dynamic HTTP headers for MCP servers, and workload identity integration.

• Adds thread-credits and estimated-thread-cost as configurable terminal title items for monitoring per-thread quota consumption.
• Shows estimated thread usage in the /status command and TUI status surfaces.
• Adds dynamic HTTP header helpers for MCP servers, enabling per-request header customization.

Vulnerability Management · 2026-08-15

OpenCVE v3.1.0 ships REST API v2 with OpenAPI docs and scoped tokens, plus project-level access control and extended audit logs.

• Adds REST API v2 with OpenAPI documentation and scoped tokens for integrations.
• Adds access mode and fine-grained scopes to organization API tokens, enabling tighter permission control on existing org-level tokens.
• Adds project-level access control with membership roles and enforced ACLs across CVE views and dashboard widgets.

AI/LLM Security · 2026-08-15

OpenShell v0.0.106 adds a complete Go SDK, a TypeScript SDK (@nvidia/openshell-sdk), and cert-manager external issuer with OpenShift passthrough Route support in Helm.

• Adds a complete Go SDK with domain clients, authentication, and hardening support.
• Adds a TypeScript SDK published as @nvidia/openshell-sdk.
• Adds cert-manager external issuer integration and OpenShift passthrough Route support to the Helm chart deployment.

AI Coding Agents · 2026-08-15

Pi SDK gains configurable model catalog caching with offline mode, custom store paths, and forced refresh support.

• Adds allowModelNetwork and modelRefreshTimeoutMs options to ModelRuntime.create() to opt in to a network refresh of the model catalog at creation time and bound how long it may take.
• Adds modelsStorePath config option to ModelRuntime.create() to specify a custom path for the local model catalog store.
• Adds modelsStore injection point to ModelRuntime.create() to supply a custom persistence implementation for the model catalog.

AI Coding Agents · 2026-08-15

Pi CLI gains --use-theme flag for per-run theme selection and adds optional search-highlight color tokens to theme definitions.

• Adds --use-theme flag to start an interactive run with a specific theme without changing the saved setting (e.g. pi --use-theme light).
• Supports light/dark syntax with --use-theme (e.g. pi --use-theme light/dark) to follow terminal appearance for that run.
• Adds optional searchMatchBg and searchMatchText color tokens to theme definitions for transcript search-match highlight colors, with documented fallback behavior.

AI Coding Agents · 2026-08-15

Pi adds fullscreenExitOutput, defaultTools config key, and new CLI tool-filtering flags.

• Adds fullscreenExitOutput config setting with values "transcript" (prints final transcript and resume hint) and "resume-hint" (restores previous screen and prints only the resume hint); has no effect in regular TUI mode.
• Adds defaultTools config key to select which built-in tools are enabled at startup; extension and SDK custom tools remain enabled regardless. Accepts an array such as ["bash", "edit", "write"]; an empty array starts with no built-in tools while preserving extension and SDK custom tools.
• Adds --tools CLI flag as a strict allowlist for all tools, replacing defaultTools behavior.

AI Coding Agents · 2026-08-15

Pi CLI gains --use-theme flag for per-run theme selection and fullscreen exit output control.

• Adds --use-theme <name[/name]> flag to set the interactive theme for a single run without changing saved settings.
• New fullscreen exit output control determines whether exiting fullscreen prints the final transcript or restores the previous screen and prints only the session resume hint.

AI Coding Agents · 2026-08-15

Pi 0.84.2 adds fullscreen transcript search, configurable default tools, strict JSON-schema sampling, and new extension APIs.

• Adds defaultTools setting for configuring the initial built-in tool selection globally or per project.
• Adds --use-theme <name[/name]> CLI flag to choose an interactive theme per-run without changing saved settings.
• Adds expandPromptTemplates option to the extension pi.sendUserMessage() API for explicitly dispatching commands and expanding skills and prompt templates.

AI Coding Agents · 2026-08-15

Pi v0.84.2 adds fullscreen transcript search, configurable default tools, a per-run theme flag, and new extension/gateway APIs.

• Adds --use-theme <name[/name]> flag to choose an interactive theme for a single run without overwriting saved settings.
• Adds defaultTools setting for configuring the initial built-in tool selection globally or per project.
• Adds expandPromptTemplates option to the extension pi.sendUserMessage() API for explicitly dispatching commands and expanding skills and prompt templates.

Continuous Control Monitoring (CCM) · 2026-08-15

RegScale 6.33.1.0 expands AI Agent coverage to Lines of Inquiry, CAPs, Risk Treatment, Questionnaire Scoring, and more.

• Extends AI Agent capabilities to Lines of Inquiry, Corrective Action Plans, Risk Treatment Mappings, Questionnaire Scoring, Lightning Assessment Tests, and Security Control Test Generation.
• Adds RegML Mapping Recommendations (details not fully disclosed in release notes).

Attack Surface & Exposure Management · 2026-08-15

runZero 5.1 expands IPMI vulnerability detection, improves asset geolocation, and re-evaluates service fingerprints via the Refingerprint action.

• The Refingerprint asset action now also re-evaluates service fingerprints for improved accuracy.
• Asset geolocation now uses location data from additional integration-sourced attributes.
• The scanner detects a broader range of IPMI vulnerabilities.

Firewalls & Network Defense · 2026-08-15

Sublime adds Tailored Phishing Simulations (Beta): environment-prioritized campaigns with staggered delivery and cross-campaign tracking.

• New Tailored Phishing Simulations (Beta) lets you run phishing campaigns prioritized by the attack patterns Sublime is already detecting in your environment.
• Supports sending multiple templates per campaign with staggered delivery schedules.
• Tracks click rates, report rates, and repeat clickers in a cross-campaign dashboard with recipient-level detail per campaign.

Cloud Security Posture · 2026-08-15

Sysdig Secure adds per-layer vulnerability breakdown in the Resource Details drawer, letting teams pinpoint which Dockerfile instruction introduced a CVE.

• Adds a Layers tab in the Resource Details drawer for container images, listing every layer grouped by base image or Application Layers, with the Dockerfile instruction and per-severity vulnerability counts for each layer.
• Adds a Layer filter on the Findings view to slice the CVE list by a specific image layer directly.
• Adds Layer Number and Layer Command fields in the Findings Details drawer to show which layer introduced the affected component for a single vulnerability.

Cloud Security Posture · 2026-08-15

Sysdig Secure findings panel now shows the image layer number and Dockerfile instruction that introduced a vulnerable component.

• Adds Layer Number field to the findings panel, showing the index of the image layer that introduced the affected component (displayed when Sysdig can attribute the finding to a layer).
• Adds Layer Command field to the findings panel, displaying the Dockerfile instruction (e.g. RUN apt-get install -y curl) that created the layer — selecting it opens the Layers tab for deeper inspection.

Cloud Security Posture · 2026-08-15

Sysdig Secure adds image layer analysis, vulnerability policy results in the resource drawer, and base image allow/deny list rules.

• Adds a Vulnerability Policies tab in the Resource Details drawer (opened from Vulnerability Findings) showing how each resource was evaluated against configured Vulnerability Policies, with a details panel per rule surfacing CVEs, affected components, and remediation guidance, plus in-drawer exception creation.
• Adds a Layers tab in the Resource Details drawer for container image resources, displaying the full image layer stack grouped by base image or Application Layers, with per-layer Dockerfile instruction and vulnerability counts by severity — select a layer to filter the Vulnerabilities tab, or use the new Layer filter to slice the CVE list directly.
• Adds Layer Number and Layer Command fields to the Findings Details drawer to identify which layer introduced an affected component.

Network Analysis & Monitoring · 2026-08-15

tcpreplay 4.6.1 adds a continuous OSS-Fuzz pipeline with three libFuzzer targets and removes --xdp-batch-size.

• Adds three libFuzzer targets (fuzz_pcap, fuzz_fragroute, fuzz_services) under test/fuzz/, built against ASan/UBSan and submitted to OSS-Fuzz for continuous fuzzing of the pcap parser, fragroute rules engine, and tcpprep --services parser.
• UBSan now runs alongside ASan in CI, catching misaligned-access bugs; wire-format header structs are now marked packed, hardening packet parsers against a class of defects ASan alone misses.
• Adds a dependency-free unit test suite under test/unit/, runnable via make check or ctest.

Detection Engineering · 2026-08-15

Tenzir v6.11.0 adds merge operator, parallel pipelines, Sigma v2.1 full support, geo_distance, new window modes, and math functions.

• Adds merge operator that attaches an additional source subpipeline and contributes its events into the main event stream — the dual of fork.
• Enables parallel pipeline execution via a // parallelism: <n> leading comment or the --parallelism flag on the tenzir binary, running CPU-bound operators across multiple cores while preserving per-operator semantics.
• Extends window operator with processing-time (omit on), count-based (unsigned size), and trailing windows (trailing=true), exposing the triggering event through $window.event; adds trigger expression to selectively fire subpipelines and tolerance for bounded reordering of late events.

Detection Engineering · 2026-08-15

Tenzir v6.11.0 adds Sigma 2.1 and YARA-X detection support

• Adds support for Sigma 2.1 detection rules.
• Adds support for YARA-X detection engine.

Detection Engineering · 2026-08-15

Tenzir Node v6.11.0 adds Sigma v2.1 support, YARA-X findings, a merge operator, windows, and parallel pipeline execution.

• Adds the merge operator for combining pipeline streams.
• Adds named path and rules arguments to the sigma operator for flexible rule loading.
• Adds full Sigma v2.1 detection support, including Sigma global filter rules and Sigma processing metrics.

Detection Engineering · 2026-08-15

Tenzir v6.11.0 adds Sigma v2.1 support, YARA-X detection findings, a merge operator, parallel pipeline execution, and new windowing and math functions.

• Adds a merge operator for combining pipeline streams.
• Adds named path and rules arguments for the sigma operator, enabling more precise rule targeting.
• Full Sigma v2.1 detection support, including Sigma global filter rules and Sigma processing metrics.

AI/LLM Security · 2026-08-15

ToolHive v0.43.0 adds confidential client support, RFC 8693 delegate clients, lock file plugins, macOS binary signing, and rate-limiting observability.

• Adds plugins key to the lock file schema, enabling plugin entries to be tracked in lock provenance.
• Adds PluginLockService and a managed install flag for plugin lifecycle management.
• Records certificate ref and runner in lock provenance, and enforces them on skill verification.

Secrets Detection & Management · 2026-08-15

TruffleHog Enterprise adds Slack scanning, AWS credential analysis, scan activity API, source archiving, and 16 new detectors

• Adds Slack scanning as a listed app in the Slack Marketplace for Enterprise Edition — scans messages, threads, and attached files for credentials, verifying each finding as live or not.
• Adds continuous Slack message scanning across public channels, private channels (where the app is invited), DMs, and group DMs — edited messages are rescanned and the app joins new public channels automatically.
• Adds historical Slack scanning covering messages, threads, and attached files including archives, base64-encoded data, binaries, and Microsoft Office documents; include/exclude lists scope channel coverage and interrupted scans resume where they left off.

Secrets Detection & Management · 2026-08-15

TruffleHog custom regex detectors gain configurable verification status ranges, entropy filtering, exclude rules, and primary regex designation

• Adds successranges config parameter under verify to specify HTTP status codes (single codes or inclusive ranges like '200-202') that mark a detected secret as live/verified.
• Adds rotatedranges config parameter under verify to specify HTTP status codes (or ranges like '401', '403') that definitively mark a detected secret as rotated/unverified.
• Adds entropy parameter to custom detector config to filter detected strings by randomness score, reducing false positives for API keys and passwords.

Secrets Detection & Management · 2026-08-15

TruffleHog Enterprise gains an Activity Log that records scan lifecycle events across all sources, with a read API and 90-day retention.

• New Activity Log (Enterprise only) records scan lifecycle events — scan started, scan completed, scan failed, scan scheduled, and scan anomaly detected — across every source, with 90-day retention and no configuration required.
• Anomaly detection heuristics flag completed scans that scanned no data or finished suspiciously fast, surfaced as warning-status scan anomaly detected events.
• Scan events carry one of six statuses — success, partial, failure, in progress, scheduled, or warning — each shown as a color chip in the log table.

Secrets Detection & Management · 2026-08-15

TruffleHog v3.97.0 adds SARIF output, five new detectors, S3 custom endpoints, and AWS Secrets Manager metadata.

• Adds --sarif flag for SARIF-format output compatible with GitHub code scanning's github/codeql-action/upload-sarif action, tracking findings as new/fixed across scans.
• Adds custom endpoint support to the S3 source, enabling scans against S3-compatible storage services.
• Adds New Relic License Key detector.

Secure Access (VPN / SASE / ZTNA) · 2026-08-15

Twingate Identity Firewall gains HTTP web app support with JWT and custom header injection for internal app protection.

• Twingate Identity Firewall now supports HTTP web apps, enabling protection of internal web apps, data portals, CI/CD infrastructure, and AI-coded business apps.
• Authenticates users at the Twingate layer — supporting MFA, JIT access, security policies, and access logging — so users reach internal web apps already authenticated.

Web Application Security · 2026-08-14

Acunetix 360 v26.8.0 adds 730-day scan data retention and .NET 10 support.

• Extends scan data retention to 730 days.
• Adds .NET 10 support.

Firewalls & Network Defense · 2026-08-14

Aviatrix VPN Client 3.0.2 adds native Apple Silicon support and extends Ubuntu compatibility to 26.04

• Adds Universal binary macOS installer that runs natively on both Intel and Apple Silicon (ARM64) Macs, eliminating the Rosetta 2 requirement.
• Extends Ubuntu support to Ubuntu 22.04, 24.04, and 26.04 in VPN Client 3.0.2.

Firewalls & Network Defense · 2026-08-14

Aviatrix adds Egress Security Score dashboard tab showing VPC/VNet protection scoring and breakdown (requires Controller 8.0 + DCF)

• Adds Security > Egress > Overview tab (requires Controller 8.0 and DCF feature enabled) showing an Egress Security Score card, a score-calculation explainer dialog, and a Protected VPC/VNets breakdown chart.
• Adds Manage VPC/VNets shortcut on the Egress Security Score card linking directly to the Egress VPC/VNets tab for inline remediation.

Firewalls & Network Defense · 2026-08-14

Aviatrix 10.0 docs add AI agent workload containment, MCP Server integration, CNSF, and Kubernetes Firewall coverage

• Introduces the Aviatrix Cloud Native Security Fabric (CNSF), a new architectural framework for cloud-native security.
• Adds AI Agent Workload Containment via the Distributed Cloud Firewall (DCF) to close network security gaps for AI agent workloads.
• Adds MCP Server Security through a containment architecture addressing egress security for Model Context Protocol servers.

Firewalls & Network Defense · 2026-08-14

Aviatrix CoPilot adds Cloud Routes for centralized multicloud routing visibility and gateway diagnostics

• New Cloud Routes feature accessible at CoPilot > Diagnostics > Cloud Routes provides a central view of all routing information across the Aviatrix transit network, including multicloud and on-prem Site2Cloud connections, without requiring logins to individual cloud provider consoles.
• New Gateway Routes tab shows tunnel information, route state (up/down), and detailed routing tables for all Aviatrix gateways across clouds, with filtering by gateway name, subnet, or specific IP address.
• New VPC/VNet Routes tab displays routing tables for all VPC/VNet/VCNs across any cloud provider, with filtering by route table name, subnet, or IP address.

Firewalls & Network Defense · 2026-08-14

Aviatrix VPN Client 3.0.2 adds a Universal macOS binary with native Apple Silicon support, dropping the Rosetta 2 requirement.

• Aviatrix VPN Client 3.0.2 macOS installer is now a Universal binary running natively on both Intel and Apple Silicon (ARM64), eliminating the Rosetta 2 dependency.
• Adds Ubuntu 26.04 support to the VPN Client alongside existing Ubuntu 22.04 and 24.04 support.
• FIPS 140-3 compliant encryption is now supported in the VPN Client, with SAML-based authentication (Okta, Duo, and other SAML identity providers) available across Windows, macOS, and Ubuntu.

Firewalls & Network Defense · 2026-08-14

Aviatrix CoPilot adds Egress Security Score dashboard with VPC/VNet protection breakdown under Security > Egress > Overview

• Adds Security > Egress > Overview tab (requires Controller 8.0 and DCF feature enabled) showing an Egress Security Score card, a score-calculation explainer dialog, and a Protected VPC/VNets breakdown chart.
• New Egress Security Score card displays a calculated protection score for VPC/VNets and links to the Egress VPC/VNets tab via a Manage VPC/VNets action.
• New Protected VPC/VNets card breaks down cloud-account VPC/VNets into Unprotected, Monitored, Partially Protected, Protected, No Egress, and Unknown states.

Firewalls & Network Defense · 2026-08-14

CoPilot 4.36.0 adds AZ Affinity, Symmetric Routing, VRF-aware Network Segmentation, Kubernetes intra-cluster orchestration status, updated Controller bell notifications, FIPS 140-3 UI compliance, and serverless missing-permissions visibility.

• Adds AZ Affinity, Symmetric Routing, and T-Shirt Instance Sizing controls for Gateway Management.
• Adds VRF support in Network Segmentation, enabling VRF-aware policy across segmented networks.
• New Kubernetes Intra-Cluster Orchestration Status view surfaces the health and state of intra-cluster traffic orchestration.

Identity & Access Management · 2026-08-14

ECM 1.6.2606 adds configuration self-heal, env-variable support for ConfigCLI, and richer plugin-load diagnostics.

• Adds env: prefix support in ConfigCLI arguments so sensitive values can be resolved from environment variables instead of the command line, keeping them out of process creation logs.
• Adds configuration self-heal: the ECM service and Configurator automatically detect and repair a missing or stale configuration file at startup and during installation, preserving appSettings, proxy, and log configuration while refreshing only version-driven sections.
• Improves plugin load diagnostics by logging assembly load failures with full detail, replacing the opaque Found 0 plugins message when tools such as WDAC, AppLocker, or EDR solutions block plugin loading.

Exploitation & C2 · 2026-08-14

Cait expands with Attack Surface Management capabilities and new asset testing features.

• Adds Attack Surface Management to Cait's platform, extending discovery and monitoring beyond previously supported scope.
• Introduces new asset testing capabilities within the Cait service.

AI Coding Agents · 2026-08-14

Claude Code v2.1.232 adds cross-session @-mentions, subagent forking by default, GitLab secret redaction, and GitLab plugin marketplace support.

• Subagent forking is now on by default: a subagent_type: "fork" subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions now run in the background by default.
• Type @ in the prompt to mention another Claude session by name; Claude uses SendMessage to reach that session directly — and SendMessage now delivers to a bare name that exactly matches one live session without a confirmation step.
• Adds /config rows for Dialog expiry and Messages from your other sessions, enabling per-session control over cross-session inbound messaging (accept/hold/refuse).

AI Coding Agents · 2026-08-14

Cline CLI v3.0.55 adds native web search rendering, Crusoe provider, and safer Hub session management

• Refreshed model catalog adds Crusoe as a provider and updates model lists and per-provider default models across all providers.
• Auto-updates no longer install while a CLI is attached to the Hub — the update is recorded at startup and installed on exit, so a background update can no longer kill a live session with Hub connection closed (code=1006); cline update still installs immediately and now reports that the update applies on next start.
• Streaming assistant markdown no longer flashes back to raw text — settled headings, links, and code stay rendered as new chunks arrive instead of the whole message being rebuilt on every chunk.

AI Coding Agents · 2026-08-14

Cline sdk/v0.0.75 adds provider-executed web search, a dedicated Cline gateway provider, and Crusoe to the model catalog.

• Adds web_search model tool (off by default; enable in settings) so models that support it can search the web during a turn, with search calls and results persisted in session history for replay on reload.
• Adds cline doctor fix honest reporting: processes that survived a kill are separated from ones that appeared during the fix, a live parent respawning a daemon is named, and a startup lock held by a running process is reported as held rather than leaked.
• Adds a dedicated Cline provider for the Cline gateway, replacing the generic OpenAI-compatible path, so extended thinking budgets and other gateway options now apply to both cline and cline-pass models.

AI Agent Frameworks · 2026-08-14

CrewAI 1.15.16 adds execution context management with UUID support, flow exception recording, and enhanced AMP deployment telemetry.

• Introduces execution context management with UUID support for tracking individual flow and agent executions.
• Records the type of exception that ended a flow, giving observability pipelines structured failure context.
• Records when a trace batch is shared with AMP, enabling auditable telemetry handoff visibility.

Security Data Pipeline · 2026-08-14

Cribl introduces an Apps platform letting users build and run custom data experiences on top of existing Cribl infrastructure.

• Adds an Apps button in the upper-right corner of every Cribl screen, providing access to pre-built tools and a platform for building custom apps via an AI-driven conversational interface.
• Provides pre-built apps that add new views, processes, workflows, and capabilities built around existing Cribl data — without requiring users to stand up hosting, identity, RBAC, or data access layers from scratch.
• Enables users to build custom apps on the Cribl Apps platform, iterating through an AI-driven conversational flow while Cribl handles the underlying infrastructure, authentication, RBAC, and data governance.

AI Coding Agents · 2026-08-14

Cursor adds deeplinks to share prompts, commands, and rules via cursor://anysphere.cursor-deeplink/ or cursor.com/link/

• Adds prompt deeplinks via cursor://anysphere.cursor-deeplink/prompt?text=... (also cursor.com/link/prompt?text=...) to share pre-filled chat prompts that recipients must confirm before execution.
• Adds command deeplinks via cursor://anysphere.cursor-deeplink/ to share custom commands that are saved into the recipient's .cursor/commands/ directory, requiring user review before execution.
• Adds rule deeplinks to share custom rules that are saved into the recipient's .cursor/rules/ directory, requiring user review before the rule is added.

AI Coding Agents · 2026-08-14

Cursor Bugbot now reviews Azure DevOps pull requests, posting inline comments and build statuses via a Microsoft Entra service principal.

• Adds Bugbot PR review support for Azure DevOps Services repositories, posting review comments, inline comments, and build statuses under the cursor-bugbot/review context on each reviewed pull request.
• Supports on-demand review triggers via cursor review or bugbot run comments on Azure DevOps pull requests, limited to users whose Azure DevOps sign-in address matches a Cursor account in the owning team.
• Enables author filtering in Bugbot repository settings: turn off Run for All Authors and configure 'Only Review PRs by...' or 'Skip PRs by...' using Azure DevOps sign-in addresses (e.g. taylor@contoso.com) found under Organization settings → Users.

AI Coding Agents · 2026-08-14

Cursor Cloud Agents now boot 3x faster with pre-built environments that survive broken commits.

• Introduces Builds for Cloud Agents: pre-baked copies of your development environment (repos cloned, dependencies installed, install script run) that agents boot into instead of setting up from scratch each session.
• Adds a Builds tab in the Cloud Agents dashboard where you can inspect build status, logs, commit SHAs, and which build each agent run used.
• Enables automatic fallback to the last successful build when a bad commit or dependency update breaks the environment, keeping agents operational while you debug.

Web Application Security · 2026-08-14

Dalfox server gains cross-site request blocking, DNS-rebinding protection, and memory-cap controls for finished scans.

• Adds --allowed-hosts <names> flag to dalfox server, listing extra hostnames accepted in the Host header beyond the bind host, localhost, and IP literals — needed when a reverse proxy forwards a public hostname.
• New cross-site request gate on dalfox server rejects browser-originated cross-site requests by checking the Origin header against the allow-list and blocking Sec-Fetch-Site: cross-site or same-site requests with 403, while leaving non-browser clients (curl, CLI, CI) unaffected.
• DNS-rebinding protection added to dalfox server via Host header validation; IP literals and localhost are always accepted, any other hostname must be listed via --allowed-hosts.

Web Application Security · 2026-08-14

Dalfox gains a payload subcommand with named selectors for XSS payload categories including mXSS, DOM clobbering, blind, and remote sources.

• Adds dalfox payload payloadbox to fetch and print remote XSS payloads from PayloadBox.
• Adds dalfox payload all to print every local payload selector in one pass, each grouped under a # name header (remote selectors excluded).
• Adds event-handlers selector to list all DOM event handler attribute names (e.g., onclick, onmouseover).

Web Application Security · 2026-08-14

Dalfox adds --json flag to output selected payloads as a JSON array.

• Adds --json flag to print selected payloads as a JSON array instead of one item per line.

Web Application Security · 2026-08-14

dalfox v3.2.1 adds all payload selector, JSON payload output, closest-selector suggestions, modern JS framework detection, and server-side SSRF guards.

• Adds all selector to dalfox payload to dump every static payload group in one pass.
• Adds JSON output to dalfox payload for machine-readable payload lists.
• Adds per-selector item counts to dalfox payload summary output.

AI Coding Agents · 2026-08-14

API surface changed: +12 endpoints, 63 modified

• New endpoint DELETE /organizations/{organizationId}/identity-providers/{id}
• New endpoint DELETE /users/me/pending-sso-links/{id}
• New endpoint GET /audit/scenarios

AI Coding Agents · 2026-08-14

Daytona 0.200.0 enforces TLS verification and adds a configurable HTTP timeout to the Go SDK.

• Makes the HTTP timeout configurable in the Go SDK to honor long execution timeouts.
• Creates CLI config files with 0600 permissions for tighter access control.

AI Coding Agents · 2026-08-14

DeepWiki gains configurable effort levels (Low/Medium/High) controlling wiki generation cost and depth, configurable per org or per repo.

• Adds three wiki generation effort levels — Low (default, free), Medium (~5–10 ACUs per wiki), and High (~20–40 ACUs per wiki) — configurable per org and overridable per repo from the wiki page.
• Medium and High effort wikis are billed against team ACU usage and require an active subscription or positive credit balance; generation is rejected if neither is present.

AI Coding Agents · 2026-08-14

Devin adds Outposts self-hosted infrastructure, Automations API, Customer Managed Keys, slash commands, plugin marketplace, and app deployments.

• New Automations API endpoints — POST /organizations/automations, GET /organizations/automation/{id}, PATCH /organizations/automation/{id}, DELETE /organizations/automation/{id}, GET /organizations/automations/schemas, GET /organizations/automations/templates — let you programmatically create, read, update, delete, and template-drive automations with trigger/action definitions.
• Adds devin-remote CLI binary and fleet API endpoints via Devin Outposts, enabling sessions to run on self-hosted worker machines with PKCE-based partner integrations and an orchestrator queue/claim/provision contract.
• Adds Customer Managed Keys support for Devin Enterprise Assured deployments, allowing encryption of data at rest using your own AWS KMS key.

Identity & Access Management · 2026-08-14

API surface changed: +1 endpoint, 3 modified

• New endpoint PATCH /v3/session/{sessionId}/kyb/parties/{partyUuid}/
• POST /v3/kyb/search/: response schema changed
• POST /v3/phone/check/: response schema changed

Identity & Access Management · 2026-08-14

Didit workflows gain marital-status branching via kyc.marital_status and copilot-driven Database Validation step setup.

• Adds kyc.marital_status as a usable OCR field in conditional branches and custom status rules within workflow builders; when the document omits marital status the field is empty and the fallback branch applies.
• Workflow copilot can now create and configure Database Validation steps in a single action, resolving the supported service per country from a list you specify and displaying the saved configuration on the canvas.

Identity & Access Management · 2026-08-14

Didit adds a PATCH endpoint to skip or re-require frozen KYB Key People parties, unblocking stalled business verification sessions.

• New PATCH /v3/session/{sessionId}/kyb/parties/{partyUuid}/ endpoint lets operators set is_skipped: true to exempt a frozen Key People party from verification — immediately recomputing KYBKeyPeopleCheck and the parent KYB session status — or is_skipped: false to put the party back in scope; requires the write:businesses permission via API key or console user token.
• The endpoint surfaces new party-level status signals: kyc_session_deleted (linked individual KYC session was deleted and can never settle) and kyb_sub_session_deleted (corporate-party counterpart), giving analysts explicit visibility into why a party is frozen.
• New kyb_registry_provider_unavailable error code (with code, summary, and detail fields) returned when the KYB registry provider is temporarily unavailable; search is not billed and Didit's hosted flow automatically offers manual company entry instead.

Identity & Access Management · 2026-08-14

Didit adds barcode fields to Session API, new 502 error codes for KYB/phone outages, and marital-status branching support.

• Retrieve-session responses now include id_verifications[].barcodes, with fields type, position, data, data_raw, and side per entry; documents without barcode output return an empty array.
• Face-step payloads now always include face_liveness_method; workflows that do not set it explicitly receive PASSIVE as the default value.
• Supports kyc.marital_status as a field in workflow branches and custom status rules.

Identity & Access Management · 2026-08-14

Didit adds barcode data to session responses, new kyc.marital_status branch field, and 502 error codes for KYB/phone outages.

• Retrieve-session responses now include id_verifications[].barcodes, with each entry exposing type, position, data, data_raw, and side; documents without barcode output return an empty array.
• Face-step payloads now always include face_liveness_method; workflows that do not set it explicitly receive PASSIVE from the API.
• Adds kyc.marital_status as a usable field in workflow branch conditions.

Web Application Security · 2026-08-14

dirsearch config.ini now documents defaults and advanced options for recursion, calibration, matchers, output formats, and SQL backends.

• Adds skip-on-status default of 429 in config.ini to automatically skip targets returning rate-limit responses.
• Adds target-max-time key to config.ini to set a per-target maximum scan time (separate from global max-time).
• Adds auto-calibration key to config.ini to force extra wildcard calibration from the start of a scan.

Web Application Security · 2026-08-14

dirsearch native backend gains HTTP proxy support and redirect following

• Adds HTTP proxy support to native scans, allowing native-backend scans to route requests through an HTTP proxy.
• Adds redirect following for native scans, enabling the native backend to honor HTTP redirects during directory enumeration.
• Bounds native response body memory usage, preventing unbounded memory consumption during large native scans.

Web Application Security · 2026-08-14

dirsearch v0.5.0 adds async/Rust-native backends, category wordlists, template placeholders, a Python API, resumable JSON sessions, and multi-format reporting.

• Adds --request-backend native and --wordlist-backend native flags to enable a Rust native backend for GET scans and wordlist generation.
• Adds --sync flag to fall back to the legacy threaded stack when async is not desired.
• Adds --wordlist-categories flag to select category-based wordlists (PHP, Python, Java, .NET, Node, ColdFusion, and infrastructure).

Runtime Security · 2026-08-14

Docker Sandboxes adds network access policies with sbx policy allow network and sbx policy deny network commands for controlling outbound sandbox connections.

• Adds sbx policy allow network and sbx policy deny network commands to manage local outbound network rules for sandboxes, accepting hostnames, CIDR ranges, ports, and wildcard patterns (e.g. *.example.com, **.example.com, example.com:443, 10.0.0.0/8).
• Supports connect:tcp and connect:udp rule actions for network access policies, enabling TCP/UDP-level control over sandbox egress.
• Introduces organization-level network policies that apply centrally across an organization or to selected teams, overriding local allow rules when organization governance is active.

Runtime Security · 2026-08-14

Docker Sandboxes gains org-level governance policies with team scoping, MCP access control, and a Governance API for programmatic management.

• Adds organization-level governance policies (Network access, Filesystem access, MCP access) managed via the AI Platform section in Docker Home, overriding local sbx policy allow rules while preserving local deny rules.
• Adds sbx policy reset CLI command to immediately stop the daemon and force a pull of the latest organization policies, bypassing the normal up-to-5-minute propagation delay — with a confirmation prompt because it deletes all locally configured policy rules.
• Adds MCP access policies using Cedar policy statements, controlling server registration (sbx mcp add), tool calls, resource reads, prompt retrieval, and approval gates — evaluated at registration time and at MCP gateway request time.

Runtime Security · 2026-08-14

Docker Sandboxes gains sbx policy for local network access control with allow/deny rules, presets, and per-sandbox scoping.

• Adds sbx policy allow network and sbx policy deny network commands to manage outbound network access rules for sandboxes globally or per-sandbox via --sandbox <name>.
• Adds sbx policy init <preset> for non-interactive environments (CI/headless); accepts allow-all, balanced, or deny-all as values.
• Adds sbx policy ls to list active rules, with --source (filter by local, org, or kit), --decision (filter by allow or deny), --wide (rule-level detail including rule IDs), and --include-inactive to surface rules disabled by org governance.

Runtime Security · 2026-08-14

Docker Sandboxes adds MCP policy support, letting organizations govern Model Context Protocol activity via Cedar rules in the MCP namespace.

• Adds MCP policies — organization-level Cedar policies written in the MCP namespace — to control Model Context Protocol activity through Docker's MCP gateway, separate from network and filesystem rule formats.
• MCP policy enforces a default-deny posture: all MCP activity is blocked unless a matching permit allows it, and a matching forbid overrides any permit including approval-required ones.
• Registration rules govern future sbx mcp add operations; use-time rules control tool calls, gateway meta-tools, resource reads, and prompt retrieval from already-registered or loaded servers.

Runtime Security · 2026-08-14

Docker Sandboxes gains layered governance with network, filesystem, and MCP access policies plus a programmatic AI Governance API.

• Adds org-level governance configured centrally in Docker Home, applying network and filesystem policies uniformly across every sandbox in the organization — when active, only organization allow rules grant access; local allow rules are no longer evaluated, while local deny rules still apply on top.
• Adds MCP access policies to control MCP server registration, tool calls, resources, prompts, and approval gates within sandboxes.
• Adds network access policies to control outbound network access from sandboxes, configurable per-developer via the CLI or centrally via organization policies.

Runtime Security · 2026-08-14

Docker Sandboxes gains upstream proxy configuration with sbx settings set proxy, PAC, SOCKS5, per-scope exclusions, and Windows integrated auth.

• Adds sbx settings set proxy <value> to configure an upstream proxy for all outbound traffic, supporting http://, https://, socks5://, socks5h://, pac+http://, pac+https://, file:///, system, and direct values.
• Adds sbx settings set proxy.sandbox <value> to override the upstream proxy for sandbox traffic only (network access from inside sandboxes), independently of daemon traffic.
• Adds sbx settings set proxy.daemon <value> to override the upstream proxy for the sbx daemon's own traffic (image pulls, telemetry, sign-in, feature flags) independently of sandbox traffic.

Runtime Security · 2026-08-14

Docker Sandboxes adds upstream proxy support and an MCP gateway for brokering access to registered MCP servers.

• Adds upstream proxy support (experimental) for sandbox and daemon traffic, configurable via proxy URL, PAC file, or SOCKS5 proxy — only HTTP and HTTPS traffic can be forwarded; other TCP traffic cannot be redirected.
• Introduces an MCP gateway endpoint on the host side of the sandbox boundary that brokers access to registered MCP servers, including remote endpoints and local stdio servers (optionally packaged as OCI images or registered with an explicit docker command).
• Enforces MCP policies at the gateway layer — server registration is checked before storage, and governed requests are checked before tool calls, resource reads, prompt retrieval, or gateway meta-tool execution.

Runtime Security · 2026-08-14

Docker Sandboxes gains an MCP gateway with sbx mcp commands for registering, authorizing, and live-loading Model Context Protocol servers into isolated sandboxes.

• Adds sbx mcp add <name> --url <url> to register remote MCP servers (e.g. sbx mcp add notion --url https://mcp.notion.com/mcp) on the host for reuse across sandboxes.
• Adds --local flag to sbx mcp add to resolve OCI-packaged stdio MCP servers from a community registry URL, server.json, or server.yaml manifest and run them on the host with Docker.
• Adds --command and --args flags to sbx mcp add for registering explicit stdio MCP servers (e.g. npx, docker run) on the host, plus --dir to set the working directory (only valid with --command).

Runtime Security · 2026-08-14

Docker Sandboxes agent now supports six additional LLM providers including Anthropic, Google, xAI, Nebius, Mistral, and OpenRouter

• Adds support for anthropic, google, xai, nebius, mistral, and openrouter as LLM providers alongside the existing openai integration.

Runtime Security · 2026-08-14

Docker Sandboxes adds experimental --model flag to route Claude Code API calls to a local model server, Ollama, or Docker Model Runner.

• Adds experimental --model flag to sbx run to route Claude Code's Anthropic API requests to a locally served model (not supported on Windows).
• Enables llmman, a bundled model server that accepts GGUF model references or short names (e.g. gemma4); sbx starts the server on first use, pulls the model, and reuses the running server and model store for subsequent sandboxes.
• Supports routing to an existing Ollama installation via the ollama/ prefix (e.g. --model ollama/gemma4); sbx connects to Ollama but does not manage its lifecycle.

Runtime Security · 2026-08-14

Docker Sandboxes adds scoped secret management with sbx secret set and organization-level policy controls.

• New sbx secret set <service> command stores service secrets for use in sandboxes, defaulting to global scope (all future sandboxes).
• Adds --sandbox <sandbox-name> flag to sbx secret set for per-sandbox secret scoping instead of global.
• Adds --all-sandboxes flag to sbx secret set to explicitly apply a secret across all sandboxes.

Runtime Security · 2026-08-14

Docker Sandboxes adds centralized MCP gateway and upstream proxy policy controls for enterprise teams.

• Adds MCP gateway support to register MCP servers and connect them to sandboxed agents.
• Adds upstream proxy routing so sandbox and daemon traffic can be directed through a corporate proxy, PAC file, or OS system proxy.
• Introduces centralized admin policies to uniformly enforce sandbox network, filesystem, and MCP controls across every developer's machine (separate paid subscription required).

Runtime Security · 2026-08-14

Docker Sandboxes adds centralized MCP gateway and upstream proxy controls for enterprise sandbox policy management.

• Adds MCP gateway support to register MCP servers and connect them to sandboxed agents, enabling controlled tool access for AI workloads.
• Adds upstream proxy configuration to route sandbox and daemon traffic through a corporate proxy, PAC file, or the OS system proxy.
• Introduces centralized policy management for sandbox network, filesystem, and MCP policies, enforced uniformly across every developer's machine (available on a separate paid subscription).

Runtime Security · 2026-08-14

Docker Sandboxes adds centralized MCP gateway and upstream proxy controls for enterprise sandbox policy management.

• Adds MCP gateway support to register MCP servers and connect them to sandboxed agents, enabling centrally managed MCP policies across developer machines.
• Adds upstream proxy configuration to route sandbox and daemon traffic through a corporate proxy, PAC file, or OS system proxy.
• Introduces centralized admin controls for sandbox network, filesystem, and MCP policies, enforced uniformly across every developer's machine (available as a separate paid subscription).

Agentic Infrastructure · 2026-08-14

emisar v0.40.0 adds self-updating runners, paginated MCP responses, and 100-pack catalog coverage including JFrog, Databricks, and Sentry.

• Adds emisar update subcommand so installer-managed runners can update themselves, with automatic release-checksum and GitHub build-attestation verification before executing stop, swap, restart, and rollback.
• Adds --json flag to emisar pack update that now emits its partial report before returning a post-update validation error, preserving machine-readable output for automation pipelines.
• wait_for_run now returns paginated 64 KiB continuation pages when a terminal runbook result exceeds one MCP response, keeping the summary in the first response.

Firewalls & Network Defense · 2026-08-14

Fastly CLI v16.0.0 now offers all available starter kits for each language during compute init.

• The compute/init flow now presents all available starter kits for each language, rather than a limited subset.

AI Agent Frameworks · 2026-08-14

Hermes now routes ~/.ssh/config edits through an approval prompt instead of hard-blocking them.

• Promotes ~/.ssh/config from hard-blocked to approval-gated: edits to the SSH client config (host aliases, ProxyJump, VS Code Remote-SSH targets) now go through the same approve-once/session/always prompt used for other ~/.ssh writes, rather than a flat refusal.
• Non-interactive callers (ACP file bridge, background jobs with no human channel) still fail closed when attempting ~/.ssh/config writes.
• Private keys, authorized_keys, and all other material under ~/.ssh remain hard-blocked regardless of approval state.

AI Agent Frameworks · 2026-08-14

Hermes installer now pre-installs cua-driver for Computer Use toolset; use --skip-computer-use to opt out.

• Adds --skip-computer-use flag to the installer to opt out of pre-installing cua-driver; without it, cua-driver is bundled automatically so the Computer Use toolset is ready the moment it is enabled.

AI Agent Frameworks · 2026-08-14

Hermes gains a plugin CLI with install, search, doctor, and pack commands for managing community plugins.

• Adds install <identifier> [--force] [--ref COMMIT_SHA] command to install plugins from a Git URL or bare community index name, with --ref accepting a full 40-character commit SHA to pin an exact immutable revision.
• Adds search [term] [--json] [--capability CAP] [--refresh] command for fuzzy searching the community plugin index by name, description, or tags, fetched from plugins.index_url and cached under ~/.hermes/cache/ for 24 hours with offline fallback.
• Adds doctor [path-or-id] [--ci] command to validate a native plugin through the real manifest parser, loader, and registration path; --ci flag exits with code 1 on errors for CI pipeline integration.

AI Agent Frameworks · 2026-08-14

Hermes adds a concise messaging verbosity option alongside all, result, error, and off modes.

• Adds concise messaging mode (default): surfaces a one-line status message on completion, with a short output tail appended on failure — alongside the existing all, result, error, and off modes.

AI Agent Frameworks · 2026-08-14

Hermes v2026.8.13 adds profiles.list/profiles.create ws RPCs, setup_mcp consent tool, image.generate RPC, and per-route webhook toolset overrides.

• Adds profiles.list and profiles.create ws JSON-RPC methods (in tui_gateway/methods_profiles.py), giving desktop plugins the ability to enumerate profiles (name, path, model/provider, description, skill_count, optional last_session preview via include_sessions) and create new profiles without going through the dashboard REST router.
• Adds setup_mcp tool that renders an inline MCP consent card in the desktop transcript using a clarify-style blocking bridge, with composer draft suggestions surfaced as brand pills.
• Adds image.generate ws RPC for plugin surfaces.

Agentic Infrastructure · 2026-08-14

API surface changed: +1 endpoint, −1 endpoint, 16 modified

• New endpoint POST /api/organizations/{name}/settings/tokens/{tokenId}/revoke
• DELETE /api/organizations/{name}/resource-groups/{resourceGroupId}/users/{username}: response schema changed
• GET /api/datasets/{namespace}/{repo}/lfs-files: response schema changed

Identity & Access Management · 2026-08-14

iDenfy adds Age Estimation API sessions, KYC blocklist endpoints, PoA check API, KYB stakeholder roles, and AML screening docs.

• New Create a Session endpoint in the iDenfy Partner API to initiate age estimation sessions, with documented request auth, token response, and insufficient-funds error handling.
• New Add identification to blocklist and Remove identification from blocklist API endpoints for managing the KYC blocklist.
• New Create POA check API endpoint for programmatically submitting proof-of-address checks.

Attack Surface & Exposure Management · 2026-08-14

Intruder redesigns its side navigation with one-click access, pinnable Favourites, and activity indicators.

• Adds a pinnable Favourites shortcut bar to the sidebar so users can surface their most-visited pages at the top of the nav.
• Introduces icon and pill indicators on nav items to surface new data or activity at a glance.
• Pages are now grouped into expandable theme sections, replacing the previous nested-tab structure.

Endpoint Security (EDR/XDR) · 2026-08-14

Iru adds a Windows system tray app so end users can install pending Auto App and Custom App updates on demand.

• New Iru system tray app on Windows displays all pending Auto App and Custom App updates, letting end users install one at a time or trigger Update all without IT involvement.
• System tray update list automatically clears completed entries as installs succeed, and handles closing open apps when required to finish an install.

AI Coding Agents · 2026-08-14

Kiro gains nested AGENTS.md support for directory-scoped agent instructions and long-session context improvements.

• Supports nested AGENTS.md files placed throughout the workspace to give Kiro instructions scoped to each directory tree.
• Preserves more context during long sessions, reducing loss of earlier conversation state.
• Reduces idle resource usage for improved background efficiency.

SAST / SCA / Code Security · 2026-08-14

API surface changed: 1 modified

• POST /v2/guard: response schema changed

Endpoint Security (EDR/XDR) · 2026-08-14

Sysinternals drops DemoMirror in ZoomIt, AVD/Dev Box support in RDCMan, and Process Tree PID filtering in Process Monitor.

• Process Monitor adds Process Tree PID filtering to match events based on any ancestor process ID in the process tree — useful for tracing all activity spawned by a parent process.
• RDCMan v3.20 adds Azure Virtual Desktop workspace feed support and Microsoft Dev Box support.
• ZoomIt v12.2 introduces DemoMirror for mirroring the screen, a screen region, or a window onto a second monitor.

Identity & Access Management · 2026-08-14

Nudge Security adds in-browser sensitive data detection and optional redaction enforcement for AI conversations.

• Adds in-browser nudges via the browser extension that detect PII, secrets, or financial info typed into AI conversations and prompt employees to redact in one click or justify sending — configurable at Settings > In-browser nudges.
• Adds optional enforcement mode (configurable at Settings > In-browser nudges) that makes redaction the only way to send, preventing unredacted sensitive data from leaving the browser.

Identity & Access Management · 2026-08-14

Nudge Security adds a Passkey usage dashboard to track org-wide passkey adoption, storage location, and per-user detail.

• Adds the Dashboards > Passkey usage dashboard, showing org-wide passkey adoption rate, top apps used with passkeys, and per-provider storage breakdown with a toggle between number of passkeys and number of users.
• Surfaces device-loss survivability and login-verification status for each passkey detected by the browser extension.
• Adds per-employee passkey usage detail on each user's user details page.

Identity & Access Management · 2026-08-14

Okta adds new IP service categories for dynamic zones and three granular user behavior admin permissions.

• Adds okta.users.behaviors.manage, okta.users.behaviors.read, and okta.users.behaviors.reset custom admin permissions for fine-grained control over user behavior detection.
• Adds new IP service categories for enhanced dynamic zones, expanding the criteria available when building network-based policies.

Identity & Access Management · 2026-08-14

Okta Identity Engine adds multi-resource refresh tokens, new IP service categories, and custom user behavior admin permissions.

• Adds okta.users.behaviors.manage, okta.users.behaviors.read, and okta.users.behaviors.reset custom admin permissions for granular control over user behavior detection.
• /authorize endpoints on custom authorization servers now accept multiple resource parameters, allowing a single refresh token to cover multiple resources; each grant_type=refresh_token exchange mints a precisely scoped, single-aud access token (GA in Preview; requires Okta for AI Agents subscription with agent-to-agent connections enabled).
• Adds new IP service categories for enhanced dynamic zones, expanding the classification options available for zone configuration.

Identity & Access Management · 2026-08-14

Okta Identity Engine 2026.08.1 adds new IP service categories for enhanced dynamic zones.

• Adds new IP service categories for enhanced dynamic zones, expanding the criteria available when defining dynamic network zones.

Agentic Infrastructure · 2026-08-14

Ollama v0.32.11 adds DeepSeek Harness and Muse Code integrations and brings web search to the OpenAI Responses API.

• Adds ollama launch dsh to integrate DeepSeek Harness, DeepSeek's open-source agent harness.
• Adds ollama launch muse to integrate Muse Code, Meta's agentic coding CLI.
• Adds support for the Nemotron 3.5 prompt layout, selecting the correct parser and renderer from its checkpoint template.

AI Coding Agents · 2026-08-14

Codex CLI adds an Amazon Bedrock Runtime provider and skill-level model annotation support in this alpha release.

• Adds the built-in amazon-bedrock-runtime provider for regional bedrock-runtime OpenAI-compatible endpoints, with SigV4 auth, per-provider AWS profile, region, and transport overrides, global and US cross-region GPT-5.6 model variants, and web search disabled (unsupported on Bedrock).
• Adds an optional model field to skill frontmatter metadata (e.g., model: luna), allowing skills to declare a preferred model; unrecognized values are ignored without blocking the rest of the skill from loading.
• Adds SkillModelDelegationInstruction so skills that request Luna while running on Sol or Terra are routed to Luna when it is available in the current provider namespace, with bounded and validated model identifiers and instruction size limits.

AI Coding Agents · 2026-08-14

Codex CLI alpha.14 adds per-server MCP OAuth callback ports, running-task exit choices, and experimental thread queue APIs.

• Adds oauth.callback_port to MCP server configuration so each server can use its own OAuth callback port instead of the global mcp_oauth_callback_port; also accepts oauth.callbackPort from plugin MCP declarations and skill dependency metadata.
• Adds running-task exit choices to local daemon sessions: pressing Ctrl-C while a task is running now shows a menu to cancel the task and stay in Codex, exit Codex while leaving the task running, or stop the task and exit Codex.
• Adds experimental thread queue APIs to the app server.

SAST / SCA / Code Security · 2026-08-14

Codex Security CLI gains deep-scan concurrency controls, OpenRouter/Fireworks provider support, scan prompt files, and enhanced log inspection commands.

• Adds --mode {standard,deep} flag to select between standard and deep scan modes.
• Adds --workers N, --subagents N, --stop-after-no-new N, and --max-discovery-runs N flags to control deep-scan discovery concurrency and runtime; defaults are automatic workers, 3 subagents, stop after 6 consecutive empty runs, and 60 max discovery runs.
• Adds persistent deep-scan defaults via [deep_scan] section in ~/.codex/codex-security/config.toml (or $CODEX_HOME/codex-security/config.toml) with keys workers, subagents, stop_after_no_new, and max_discovery_runs.

SAST / SCA / Code Security · 2026-08-14

Codex Security CLI gains GitLab CI/CD integration with SARIF 2.1.0 upload, diff-scoped MR scanning, and severity-threshold policy support.

• Adds GitLab CI/CD pipeline integration via .gitlab-ci.yml, ingesting SARIF 2.1.0 reports on GitLab Ultimate 19.2 or later through artifacts:reports:sarif.
• Adds CODEX_SECURITY_SCAN_SCOPE CI/CD variable controlling whether the job runs a diff scan (merge-request changes only) or a full scan of the default branch.
• Adds CODEX_SECURITY_FULL_SCAN_DEFAULT_BRANCH variable (default "false") to opt into a complete default-branch scan in addition to merge-request diff scans.

SAST / SCA / Code Security · 2026-08-14

Codex Security CLI bulk scans gain knowledge-base sharing, per-repo prompts, and OpenRouter/Fireworks provider support.

• Adds --knowledge-base flag (repeatable) to inject architecture documents, threat models, or security policies into every scan in a bulk campaign.
• Adds --scan-prompt-file flag to supply shared scan instructions prepended before each repository's CSV prompt field.
• Adds --post-scan-prompt-file flag to run follow-up instructions in the same authenticated session after each successful scan or scan with incomplete coverage.

SAST / SCA / Code Security · 2026-08-14

Codex Security CLI gains headless mode, deep-scan controls, custom prompt files, scan comparison, and log inspection commands.

• Adds --headless flag to output plain progress lines instead of the live scan dashboard, useful for CI or non-interactive terminals.
• Adds --subagents, --stop-after-no-new, and --max-discovery-runs flags to control discovery workers and scan termination in deep mode (repository and path targets only).
• Adds --scan-prompt-file and --post-scan-prompt-file options to inject custom scan instructions and follow-up instructions from Markdown files; both also work with bulk scans via a prompt CSV column.

SAST / SCA / Code Security · 2026-08-14

Codex Security 0.1.18 adds Amazon Bedrock authentication support and raises scan initialization timeout from 30 s to 5 min.

• Supports Amazon Bedrock as a scan backend, accepting bearer tokens, AWS profiles, regional settings, web identity, and container credentials for authentication.
• Passes AWS credentials through to delegated deep-scan workers so Bedrock auth remains available across the full scan pipeline.
• Simplifies the workflow for standard repository and scoped-path scans while preserving nested guidance, exact scan scope, progress updates, and final scan reports.

AI/LLM Security · 2026-08-14

OpenShell v0.0.105 adds stop and start operations for sandboxes.

• Adds stop and start operations to the openshell sandbox subcommand, enabling lifecycle control of running sandboxes.

Identity & Access Management · 2026-08-14

PingOne Forms gains custom image support with configurable sizing, positioning, padding, and dynamic URL binding.

• Adds custom image support to the PingOne Forms drag-and-drop form builder, with configurable sizing, positioning, and padding, plus static or dynamic hyperlink attachment.
• Supports dynamic image URLs resolved at runtime via the node, alongside static public image URLs entered directly in the form.
• Allows HTML attributes — id, class, and referrerpolicy — to be set on form images.

SAST / SCA / Code Security · 2026-08-14

Portkey MCP Gateway gains rate limiting by request count or token consumption, plus content filters and approval workflows.

• Adds rate limiting for MCP tool calls, throttleable by request count or token consumption, scoped to API key, server, or individual tool.
• Adds content filters and approval workflows configurable per MCP server.

SAST / SCA / Code Security · 2026-08-14

Portkey adds MCP Gateway rate limiting, per-model custom host/headers, and an OCR inference endpoint

• Adds target: mcp_tools field to rate limit policies so MCP tool call traffic is governed independently from LLM traffic — scoped to workspace, server, tool, API key, or metadata.*.
• Adds mcp_server and mcp_tool condition/group-by keys for rate limit policies, enabling per-server and per-tool throttling (e.g. cap the send_message tool to 100 rpm or the GitHub server to 500,000 tokens per day with unit: tpd).
• Supports rpm, rph, rpd, and rpw (and token equivalents) as rate limit units for mcp_tools policies, with AND-logic multi-condition matching and an excludes modifier to carve out specific tools.

SAST / SCA / Code Security · 2026-08-14

Portkey adds MCP Gateway rate limiting and a new OCR inference endpoint for document text extraction.

• Adds rate limiting for MCP tool call requests and token consumption via the MCP Gateway, documented under rate-limits.

Continuous Control Monitoring (CCM) · 2026-08-14

RegScale CLI 6.40.0 adds configurable artifact output directory and optional Wiz data-retention reconciliation

• Adds artifactsDir setting to configure the base directory for scanner and integration output files.
• Adds optional Wiz data-retention reconciliation that closes issues whose findings have aged out of Wiz's retention window, enabled via wizRetentionReconciliation and tuned with additional w… settings.

Attack Surface & Exposure Management · 2026-08-14

runZero AWS integration now ingests Inspector findings for EC2 and Lambda; reports page gains pagination, search, and delete

• The AWS integration now supports AWS Inspector findings for EC2 and Lambda assets.
• The reports page now displays a paginated list of all analysis task-based reports and supports searching and deleting reports.

Attack Surface & Exposure Management · 2026-08-14

runZero 5.1 adds AWS Inspector findings for EC2 and Lambda, plus a searchable paginated reports page.

• Adds AWS Inspector findings support for EC2 and Lambda assets via the AWS integration.
• The reports page now displays a paginated list of all analysis task-based reports with search and delete capabilities.
• The AWS integration now skips linked organizational accounts that are closed.

Compliance Automation & Trust Management · 2026-08-14

Scrut replaces the Setup Wizard with Task Center, a unified compliance hub with My Tasks, Audit Prep, and Continuous Compliance tabs.

• Introduces Task Center, a centralized hub replacing the Setup Wizard, surfacing tasks from policies, evidence, risk, vendors, audits, and employee workflows in a single view without requiring module-by-module navigation.
• Adds a My Tasks tab showing every compliance task assigned to the current user across all modules, with next actions and progress counters.
• Adds an Audit Prep tab for tracking audit-related tasks team-wide; supports selecting a framework (SOC 2, ISO 27001, GDPR, etc.) to see exactly what is pending before an internal or external audit — internal audits can be scheduled directly from this tab once compliance reaches 90%.

Compliance Automation & Trust Management · 2026-08-14

Scrut adds FedRAMP Moderate and ISO/IEC 27018:2025 frameworks, approver workflows, and expanded AI evidence checking

• Adds Send for Approval button inside Access Reviews so reviewers can submit each application independently; every send, approve, decline, and comment is logged for traceability.
• Adds entity scoping across Vault files and Questionnaire Automation — assign Vault files to specific entities and select entities when creating or editing a questionnaire so Autofill uses only entity-matched documents and policies; existing content defaults to organization-wide scope; includes an AI Readability toggle to control policy ingestion during Autofill.
• Adds Risk Department multi-select so a single risk can be assigned to multiple departments (mitigation-task Department remains single-select).

SAST / SCA / Code Security · 2026-08-14

StepSecurity Secure Registry adds Go module proxying in Beta, with cooldown periods, block lists, and tag-only enforcement.

• Adds Go module proxy support to Secure Registry (Beta) at https://registry.stepsecurity.io/go, joining npm, PyPI, Maven, and NuGet; every module request is evaluated against your Go policy before a response is returned.
• New Released Tags Only control (Go-specific) rejects module resolutions at commit hashes, branch names, and pseudo-versions such as v0.0.0-20241114170450-2d3c2a9cc518; only published release tags are permitted.
• Cooldown Period holds newly published Go module versions for a configurable window, with per-module exemptions scoped to the full module path.

Firewalls & Network Defense · 2026-08-14

API surface changed: +1 endpoint, 7 modified

• New endpoint POST /v0/message-groups/move-to-spam
• GET /v0/audit-log/events: response schema changed
• GET /v0/audit-log/events/{id}: response schema changed

SIEM · 2026-08-14

API surface changed: 6 modified

• GET /v1/otCollectors/otCollectorsByName: response schema changed
• GET /v1/otCollectors/{id}: response schema changed
• GET /v1/plan/pendingUpdateRequest: response schema changed

SIEM · 2026-08-14

Sumo Logic Mobot gains a new skill to create dashboard panels from plain-language prompts.

• New Mobot skill lets practitioners describe a desired panel in plain language, after which Mobot drafts the query, selects a visualization, and adds the panel to a new or existing dashboard.

SIEM · 2026-08-14

Sumo Logic adds a public API for creating and managing AWS S3 archive destinations for Installed Collectors.

• New public API enables creating and managing AWS S3 archive destinations for Installed Collectors programmatically, complementing the existing UI flow for at-scale automation.

SOAR · 2026-08-14

Tines now publishes an API — 369 endpoints across 71 areas: Actions, Stories > Notes, Stories, …

• Actions (22 endpoints) — create, read, update, delete
• Stories > Notes (12 endpoints) — create, read, update, delete
• Stories (11 endpoints) — create, read, update, delete

SOAR · 2026-08-14

Tines adds per-workflow savings estimation configuration.

• Enables configuring detailed savings estimates on a per-workflow basis to quantify the value of each automated workflow.

SOAR · 2026-08-14

Tines adds AI credit alerts, case template API, LDAP config UI, and AI Agent skills in a busy August rollout.

• Adds Manage case templates via API capability under Cases and API surfaces, enabling programmatic control of case templates.
• Adds Extend AI Agents with skills — new skill extension surface for AI Agents via Actions and Storyboard.
• Adds Self-hosted LDAP configuration UI for self-hosted deployments, providing an admin UI for LDAP setup.

SOAR · 2026-08-14

Tines Cases can now trigger 3B workflows as case actions via a 3B service account connection.

• Enables selection of published Tines 3B workflows as case actions when adding a case action, accessible after configuring a 3B service account connection.

Endpoint Security (EDR/XDR) · 2026-08-14

Trend Vision One lets administrators reset MFA for individual user accounts directly from the User Accounts page.

• Adds admin-level MFA reset for individual user accounts via the Admin-level MFA reset option on the User Accounts page, eliminating the need to open a support case when a user loses their MFA device or recovery code.

Secure Access (VPN / SASE / ZTNA) · 2026-08-14

Twingate adds six distinct admin roles with scoped console access and a visible role badge in the Admin Console.

• Introduces six admin roles — DevOps, Helpdesk, Support, Access Reviewer, Billing, and (implied full) admin — each with scoped access to specific Admin Console pages and actions.
• DevOps admins get access to the Network tab only, covering Resources, Connectors, Remote Networks, Group-to-Resource assignments, and Access Requests.
• Support admins have access to all pages except Internet Security > Secure DNS and Internet Security > Client Configuration.

Secure Access (VPN / SASE / ZTNA) · 2026-08-14

Twingate adds a Helpdesk Admin role giving support staff scoped read-only access and targeted user/device actions.

• New Helpdesk role lets admins delegate support tasks — resetting MFA, verifying/unverifying devices, and managing trusted serial numbers — without granting full administrative access.
• Helpdesk role holders receive read-only access to selected Admin Console areas, scoping their visibility to what is needed for troubleshooting.

Local LLM Runtimes · 2026-08-14

vMLX v1.6.28 adds native Qwen3.6-27B bundle support with automatic multi-token prediction, delivering a measured +33% throughput gain.

• Supports the Qwen3.6-27B bundle line (and the upcoming Qwen 3.8 line): the qwen3_coder tool-parser name now resolves to the XML-function parser, capability-only stamps route through the stock loader instead of the JANG codec, and the bundled multi-token prediction head is automatically constructed, quantized per the stamp's per-module overrides, and engaged at the stamp's trained speculative depth — no flags required.
• Delivers a measured 23.3 → 31 tokens/sec (+33%) on the 4-bit Qwen3.6-27B bundle with greedy output byte-identical whether the MTP head is on or off, and image/video probes answering correctly through both API and app.

SAST / SCA / Code Security · 2026-08-14

Wiz Code now inventories developers' personal public GitHub repos, validates secret exploitability via AI Red Agent, and maps full attack paths on the Security Graph.

• Adds automated inventory and correlation of developer identities to their personal public GitHub repositories outside org boundaries, closing the visibility gap where unmanaged secret exposure lives.
• Enriches secrets found in personal repositories onto the Wiz Security Graph to show the full attack path and blast radius of a compromised credential, including downstream resource access.
• Introduces exploitability validation via the Wiz Red Agent — an AI-powered attacker that actively tests whether an exposed credential is live and what it can reach, going beyond traditional validity checks.

1Password 6 changes

• 1Password SCIM Bridge 2.9.16 (2026-08-18) · Feature · 2026-08-19
• changelog · Aug 19, 2026 · Feature · 2026-08-19
• 1Password for Linux beta 8.12.34-29 (2026-08-17) · Feature · 2026-08-18
• 1Password for Mac beta 8.12.34-29 (2026-08-17) · Feature · 2026-08-18
• 1Password for Windows beta 8.12.34-29 (2026-08-17) · Feature · 2026-08-18
• 1Password in the browser 8.12.34-29 (2026-08-17) · Feature · 2026-08-18

Acunetix 360 2 changes

• changelog · Aug 15, 2026 · Feature · 2026-08-15
• v26.8.0 – 13 August 2026 (2026-08-13) · Feature · 2026-08-14

Adrian 1 changes

• python-sdk-v1.2.0 · Feature · 2026-08-19

AI-Infra-Guard 1 changes

• v4.5.2 · Feature · 2026-08-17

ALEAPP 2 changes

• v2026.3.1 · Feature · 2026-08-19
• v2026.3.0 · Feature · 2026-08-15

Arcjet 1 changes

• docs update · Docs · 2026-08-15

Arctic Wolf 1 changes

• Arctic Wolf Data Explorer (2026-08-18) · Feature · 2026-08-19

Auth0 2 changes

• Custom Rate Limits available in Early Access (2026-08-17) · Feature · 2026-08-18
• changelog · Aug 17, 2026 · Feature · 2026-08-17

authentik 11 changes

• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• docs update · Docs · 2026-08-19
• version/2026.8.0 · Feature · 2026-08-19