The week in full · Aug 21–27

Identity & Access Management · 2026-08-26

1Password for Linux 8.12.34 adds passwordless account linking, KDE Wayland auto-lock, and an Offline Items sidebar view.

• Adds auto-lock support in KDE Plasma on Wayland and other environments implementing the ext_idle_notifier_v1 protocol.
• Moves the 1Password MCP Server from Settings > Labs to Settings > Developer where it is now generally available.
• Enables adding a 1Password account via 1Password.com without re-entering a password, Secret Key, or SSO verification code.

Identity & Access Management · 2026-08-26

• Adds an Offline Items entry in the sidebar to surface items that cannot sync with a 1Password account, including deleted items.
• Enables passwordless account addition via 1Password.com — no re-entry of password, Secret Key, or SSO code required.
• Adds a button next to each item in the 1Password for Claude prompt that reveals why Claude is requesting access to that specific item.

Identity & Access Management · 2026-08-26

1Password for Windows 8.12.34 adds passwordless account onboarding via 1Password.com and improves offline item visibility.

• Moves the 1Password MCP Server from Settings > Labs to Settings > Developer, signaling it has graduated from experimental status.
• Copying an account detail in the Manage Accounts pop-up no longer writes to the device clipboard history.

AI/LLM Security · 2026-08-26

Adrian open-sources its agentic AI security backend with WebSocket ingestion, LLM classifier, and a full configuration surface

• Adds ADRIAN_PII_REDACT env var (default true) to toggle SDK-side PII regex sweep via .env.
• Adds ADRIAN_SLIDING_WINDOW_SIZE (default 16) and ADRIAN_SLIDING_WINDOW_TTL_SECONDS (default 86400) env vars to control the per-agent ring buffer of classified turns prepended to classifier prompts for cross-step context.
• Adds ADRIAN_LLM_CTX_SIZE env var (default 8192) to set the llama.cpp context window, trading VRAM for more history.

AI/LLM Security · 2026-08-26

Adrian Claude Code plugin adds runtime hook-based enforcement with ALERT/BLOCK/HITL modes, WebSocket backend, and ~/.adrian/.env config

• New /plugin marketplace add secureagentics/Adrian and /plugin install adrian-cc@adrian commands install the Adrian runtime security plugin directly from inside Claude Code without any pip install step.
• New /adrian-init command guides setup: selects backend (Adrian Cloud, self-hosted OSS, or custom URL), writes ~/.adrian/.env, and verifies the WebSocket connection.
• New /adrian-status command shows the configured backend URL, whether ADRIAN_API_KEY is set, and current connection health.

AI/LLM Security · 2026-08-26

Adrian TypeScript SDK (@secureagentics/adrian) instruments LLM calls with PII redaction, JSONL logging, WebSocket streaming, and policy verdicts

• New @secureagentics/adrian TypeScript SDK attaches to LLM calls to capture activity events, reasoning traces, and stream them to the Adrian backend over WebSocket, with PII redacted in-process before any data leaves.
• New @secureagentics/adrian-openai provider package wraps the official openai client (Chat Completions, >=4.0.0) via adrian.openai(client) so every call is captured without changing existing call sites.
• Configures via environment variables: ADRIAN_API_KEY (required), ADRIAN_WS_URL (default ws://localhost:8080/ws; use wss://adrian.secureagentics.ai/ws for Adrian Cloud), ADRIAN_LOG_FILE (default events.jsonl), ADRIAN_SESSION_ID, ADRIAN_BLOCK_TIMEOUT (default 30 seconds), and ADRIAN_REPLAY_BUFFER_FRAMES (default 1000).

AI/LLM Security · 2026-08-26

Adrian Python SDK adds direct Anthropic SDK instrumentation with Alert/Block/Human Review enforcement modes

• Adds adrian-sdk[anthropic] pip extra to instrument anthropic.Anthropic and anthropic.AsyncAnthropic directly, capturing every messages.create call as a PairedEvent streamed to the Adrian backend.
• Adds adrian.anthropic_invocation() async context manager and adrian.anthropic_invocation_sync() for synchronous code to group related Anthropic calls under a shared invocation_id.
• Adds auto_instrument=False parameter to adrian.init() plus an explicit adrian.patch_anthropic() call for manual control over when SDK patching occurs.

AI/LLM Security · 2026-08-26

Adrian SDK launches with auto-instrumentation for LangChain/LangGraph and Anthropic SDK, shipping paired LLM/tool events to a hosted or self-hosted backend.

• New adrian-sdk Python package (requires Python 3.12+) installs via pip install adrian-sdk and auto-instruments LangChain/LangGraph and the Anthropic SDK at init time.
• Introduces adrian.init() with parameters api_key, ws_url, log_file, session_id, block_timeout, replay_buffer_frames, auto_instrument, log_level, and handlers, each backed by a corresponding env var (ADRIAN_API_KEY, ADRIAN_WS_URL, ADRIAN_LOG_FILE, ADRIAN_SESSION_ID, ADRIAN_BLOCK_TIMEOUT, ADRIAN_REPLAY_BUFFER_FRAMES).
• Defaults ws_url to ws://localhost:8080/ws for self-hosted deployments; set ws_url or ADRIAN_WS_URL to wss://adrian.secureagentics.ai/ws for the hosted service.

AI/LLM Security · 2026-08-26

Adrian adds SDK integrations for LangChain, Anthropic, OpenAI, and Claude Code, plus Slack and Discord alerting channels.

• Supports LangChain agent wrapping via the Adrian Python SDK — two lines of code capture activity logs and reasoning traces from an existing LangChain agent.
• Supports direct Anthropic SDK usage via the Adrian Python SDK — patches the Anthropic client when calling messages.create without a framework.
• Supports OpenAI client wrapping via the Adrian TypeScript SDK — one line captures every Chat Completions call.

AI/LLM Security · 2026-08-26

Adrian brings runtime oversight, detection, and control to autonomous AI agents via a 2-line Python SDK.

• Initialise monitoring with adrian.init(api_key=..., ws_url=...) — connects to either a self-hosted backend (ws://localhost:8080/ws default) or Adrian Cloud (wss://adrian.secureagentics.ai/ws) with no agent code changes required.
• Set ADRIAN_WS_URL environment variable to point the SDK at the hosted or self-hosted backend without modifying code.
• Supports LangChain and LangGraph agents, and direct Anthropic SDK calls, all captured automatically after adrian.init().

AI/LLM Security · 2026-08-26

• Adds adrian.init(api_key=..., ws_url=...) Python SDK initialisation that wraps LangChain, LangGraph, and Anthropic SDK agents with zero code changes to the agent itself.
• Supports ADRIAN_WS_URL environment variable to configure the backend endpoint, defaulting to ws://localhost:8080/ws (self-hosted) or wss://adrian.secureagentics.ai/ws (hosted cloud).
• Provides Audit mode (notify-only, no intervention) for passive monitoring of agent actions before enabling blocking controls.

SAST / SCA / Code Security · 2026-08-26

• Code Audit surfaces code-based evidence, root cause analysis, and remediation guidance, plus AI-powered AutoFix for creating remediation PRs in a few clicks.
• Pricing shown upfront in credits before an audit starts, with cost calculated from the size and complexity of selected codebases.

SAST / SCA / Code Security · 2026-08-26

• New Data Exposure Audit capability uses LLM agents to trace sensitive data from sources (request bodies, uploads, DB reads, config, app logic) into sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — all from already-connected repos.
• Each Data Exposure Audit consumes credits from the Aikido Wallet.

SAST / SCA / Code Security · 2026-08-26

• Adds Secrets AutoTriage: an LLM agent that runs after entropy detection to assess whether a discovered secret is a real, exposed credential, determine its liveness and scope, and automatically ignore or escalate findings based on defined rules.
• Adds CVE Exploitability Analysis: an LLM agent that evaluates whether a CVE is practically exploitable given how your codebase uses the affected package, then can automatically upgrade, downgrade, snooze, or ignore the finding.
• Each AutoTriage and CVE Exploitability Analysis run is logged with a short rationale so teams can review what was analyzed and what actions the agent took.

SAST / SCA / Code Security · 2026-08-26

• Request-and-approval workflow pauses blocked installs and routes a one-click exception request to the admin Inbox inside Aikido.
• Group-based policies enable different install rules per team.

Post-Exploitation · 2026-08-26

npmHound collector maps npm maintainer compromise blast radius through the full downstream dependency graph in BloodHound

• Adds npmHound, a BloodHound OpenGraph collector that maps npm maintainers, their publish rights, and downstream dependent packages to enable path-finding through a maintainer account compromise's full blast radius.
• Emits optional bridge edges into the GitHub OpenGraph subgraph (documented as unverified) to connect npm and GitHub attack paths.
• Ships with six Cypher starter queries, custom node icons, and node/edge documentation for immediate use after collection.

Password & Credential Cracking · 2026-08-26

brutespray v2.7.2 adds engagement manifests, deterministic dry-run planning, lockout-aware budgets, and authenticated audit chains

• Adds --dry-run flag to resolve targets and credentials into deterministic JSON without performing any authentication attempts.
• Adds --plan-out flag to write the full execution plan to a file for review, approval, or CI evidence.
• Adds --require-plan-ack flag to require that the exact reviewed plan hash matches before execution proceeds; binds credential contents via keyed HMAC so same-sized credential-list substitutions invalidate the plan.

Container & Image Security · 2026-08-26

• Chainguard API v2 is now generally available at /v2/, replacing the v2beta1 path prefix, with a stable contract covering organization and access management, registry metadata, vulnerability and security advisories, event subscriptions, and library artifacts; ships an OpenAPI specification and v2 Go SDK clients.
• API v2 standardizes cursor-based pagination, server-side ordering, resource naming, dedicated resource lookups, partial updates, and typed error details.
• Supports SCIM user provisioning (Early Access) via the /Users resource for Okta and Microsoft Entra ID; assigning a user creates/updates their Chainguard provisioning record, and deactivating or unassigning them blocks the next login or token refresh within approximately one hour.

SAST / SCA / Code Security · 2026-08-26

Checkmarx 3.65 adds Global Inventory API, AI-based SAST findings analysis, manual test result import, and persistent dashboard filter links.

• Adds Global Inventory API — query packages, risks, or licenses aggregated across your account with optional filters (project, application, severity, exploitability) and pagination; authenticated via platform API token.
• Supports uploading manual testing results via CLI or JSON file, unifying manual and automated (ZAP) findings in one view; manual findings appear in UI, reports, and can be deleted individually or in bulk from the UI or overridden via CLI.
• Adds AI-based SAST Findings Analysis that automatically classifies and filters out unlikely-relevant scan results; can be enabled or disabled at the account level or overridden per project.

Identity & Access Management · 2026-08-26

Clerk adds MFA account recovery support, letting you reset lost second factors via the Backend API.

• Adds MFA account recovery via the Backend API, enabling you to reset a user's second factor and build a custom MFA reset flow for users who have lost access to their authenticator.

Identity & Access Management · 2026-08-26

Clerk adds Admin Logs to give teams an audit trail of admin actions across their workspace.

• New Admin Logs dashboard provides an audit trail of admin actions taken across a Clerk workspace.

Internet Services · 2026-08-26

Cloudflare AI adds Wan 3.0 text-to-video, AssemblyAI Universal-3.5 Pro transcription, FLUX Kontext image models, and FLUX Video Upscale

• Adds wan-3.0, Alibaba's text-to-video model, supporting adaptive aspect ratio and 480P, 720P, or 1080P resolution output with configurable duration.
• Adds universal-3.5-pro, AssemblyAI's Universal-3.5 Pro speech recognition model for fast, high-accuracy transcription.
• Adds flux-1-kontext-max, Black Forest Labs' highest-quality Kontext model for text-to-image generation and context-aware image editing.

Internet Services · 2026-08-26

Cloudflare adds app-scoped API tokens, Access token controls, CASB auto-remediation, DLP test scan, ASPA path validation, and WAF updates

• Adds Specified Flagship apps resource scope when creating custom API tokens, with Flagship App permission levels of Evaluate, Read, or Write — limiting token access to selected apps instead of the entire account.
• Cloudflare Access now lets administrators choose a grace period (1 hour to 30 days) when rotating a service token secret, keeping both secrets valid during rotation; the API accepts an RFC 3339 expiration time for custom schedules.
• Cloudflare Access administrators can now temporarily disable service tokens without deleting them, halting authentication (including any active rotation grace period) while preserving configuration for later re-enablement.

Internet Services · 2026-08-26

Cloudflare API adds email security content policies, logpush transformers, AI Security for Apps, leaked credential checks, and content scanning endpoints

• Adds full CRUD API for email security content policies via /accounts/{account_id}/email-security/settings/content_policies (list, get, create, update, delete, and batch operations).
• Adds full CRUD API for account email sending suppressions via /accounts/{account_id}/email/sending/suppressions, including bulk import at /accounts/{account_id}/email/sending/suppressions/bulk.
• Adds full CRUD API for Logpush transformers via /accounts/{account_id}/logpush/transformers, with additional endpoints to preview (/preview), retrieve content (/{transformer_id}/content), and list versions (/{transformer_id}/versions).

Internet Services · 2026-08-26

Cloudflare adds app-scoped API tokens, service token grace periods, RPKI ASPA path validation, and virtual appliance downloads from the dashboard.

• Adds app-scoped API tokens for Flagship, allowing a Cloudflare API token to be scoped to selected Flagship apps instead of every app in the account.
• Adds grace periods for service token rotation, keeping the previous service token secret active while its replacement is deployed.
• Adds the ability to temporarily disable an Access service token to stop it from authenticating without deleting its configuration.

Internet Services · 2026-08-26

Cloudflare adds app-scoped API tokens, service token grace periods/toggles, RPKI ASPA path validation on Radar, and MCP 2026-07-28 spec support.

Internet Services · 2026-08-26

Cloudflare WAF promotes four detections to Block and adds a new Generic Rules - Remote Code Execution rule in Block mode.

• Promotes HTTP/2 Request Smuggling - Request Body Anomaly (rule ...1489d892) from Log to Block in the Cloudflare Managed Ruleset.
• Promotes XSS - JavaScript Event Handler Coercion - Headers (rule ...20646260) from Log to Block in the Cloudflare Managed Ruleset.
• Promotes XSS - JavaScript Event Handler Coercion - Body (rule ...d706d517) from Log to Block in the Cloudflare Managed Ruleset.

Identity & Access Management · 2026-08-26

ConductorOne adds smart revocation chains, Copilot Studio/Gemini MCP integrations, push-rule execution history, and c1i v0.5.0 with new CLI commands.

• Adds --server-url flag on mcp servers register, mcp servers test-connection, and mcp servers update-credentials commands in c1i, replacing the previous --url flag on those subcommands so the global --url can now correctly select the C1 tenant.
• Adds apps create, apps delete, and apps set-owners subcommands to c1i v0.5.0, rounding out app-management API coverage from the CLI.
• Adds auth token subcommand to c1i v0.5.0.

Security Data Pipeline · 2026-08-26

Cribl LLM Observability adds Cohere and CrewAI as supported instrumentation targets via OpenTelemetry.

• Supports instrumenting Cohere with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.
• Supports instrumenting CrewAI with OpenTelemetry to send telemetry to Cribl Stream and Cribl Search.

Secure Access (VPN / SASE / ZTNA) · 2026-08-26

DNSFilter adds Does Not Include category filter in Query Log and improves dashboard usability with shared/private visibility status.

• Adds Does Not Include operator to the Categories filter in the Query Log, letting admins exclude specific categories from view during investigations.
• Dashboard cards in the Manage Dashboards view now display Private or Shared visibility status and can be updated directly from the quick actions menu.
• Dashboards are now clickable directly from the grid view.

Digital Forensics & Incident Response · 2026-08-26

Elcomsoft System Recovery 8.38 adds built-in BitLocker TPM exploit provisioning, imaging checksums, and browser artefact extraction.

• Adds checksum logging for disk images during the imaging workflow.
• Updates the imaging library with new capabilities.

Firewalls & Network Defense · 2026-08-26

Fastly adds API Enforcement for schema-based request validation and Log Explorer & Insights for on-platform log storage and monitoring.

• New API Enforcement product validates incoming API requests against user-defined schemas and logs or blocks non-conforming requests at the Fastly edge.
• New Log Explorer & Insights feature enables proactive storage, inspection, and monitoring of log data directly on the Fastly platform.

Firewalls & Network Defense · 2026-08-26

Fastly Rust SDK 0.13.1 adds cache lookup timeout, bot category detection, dynamic backend healthchecks, and new handle constructors.

• Adds Request::as_handles method to the Rust SDK.
• Adds from_handle functions for ConfigStore, SecretStore, and Log.
• Adds ToBackend implementation for Arc<Backend>.

Threat Intelligence · 2026-08-26

Feedly Threat Intelligence adds a Splunk Hunting Queries AI Model that auto-collects SPL queries from 5,000 vetted CTI sources.

• New Splunk Hunting Queries AI Model continuously collects SPL-based hunting queries from vendor blogs, threat reports, GitHub repos, and researcher write-ups across 5,000 vetted CTI sources.
• CVE Insights Card now surfaces associated Splunk Hunting Queries — download the query and jump to the source article for surrounding context directly from the card.
• API access lets practitioners pull collected hunting queries programmatically into their detection pipeline.

Threat Intelligence · 2026-08-26

Feedly Threat Intelligence now automatically collects Splunk Hunting Queries matching your requirements.

• Automatically collects Splunk Hunting Queries tailored to your configured threat intelligence requirements.

Threat Intelligence · 2026-08-26

Feedly Threat Intelligence auto-collects Splunk Hunting Queries (plus Sigma, YARA, Suricata, Snort, KQL) via a new AI Model and API.

• Adds a Splunk Hunting Queries AI Model that continuously extracts and surfaces SPL queries from articles across 5,000 vetted CTI sources, vendor blogs, threat reports, and GitHub repositories.
• Supports programmatic retrieval of collected hunting queries via the API for direct integration into detection pipelines.
• Extends detection rule recognition to six formats: Splunk SPL, Sigma, YARA, Suricata, Snort, and KQL (Microsoft Defender and Sentinel), covering network traffic inspection, file and malware matching, and log-based detection.

General Utilities & Libraries · 2026-08-26

Ghostty AppleScript gains set_tab_title action to label tabs programmatically from scripts.

• Adds set_tab_title AppleScript action to set tab labels from a script, enabling programmatic tab management workflows.

AI/LLM Security · 2026-08-26

giskard-checks v1.0.3 lets set_default_generator accept model name strings directly.

• Extends set_default_generator to accept model strings (e.g. a provider/model name) in addition to generator objects, simplifying default LLM generator configuration.

AI/LLM Security · 2026-08-26

Giskard v3 rewrites as a modular monorepo with new LLM judge checks, OWASP red-teaming, Suite runner, and a lean LLM provider layer.

• New Scenario API with .interact() and .check() chain lets you define multi-turn eval scenarios; Suite runs batches of scenarios with dynamic binding and supports Suite.append() chaining.
• Adds annotations support on scenario/trace objects, enabling structured metadata to be attached to evaluation runs.
• Adds AllOf, AnyOf, and Not check composition operators in giskard-checks for building compound assertions.

SAST / SCA / Code Security · 2026-08-26

GitHub rule insights dashboard now GA at repo and org levels, with CSV export and cross-repo bypass tracking.

• Adds an organization-level rule insights dashboard at Settings > Repository tab, showing aggregated ruleset evaluation metrics, top repositories by bypass count, and filters by evaluation status, branch, ruleset, and date range across all repositories.
• Adds a repository-level rule insights dashboard at Settings > Rules tab, showing successes, failures, and bypasses over time plus most active bypassers, with each chart linking to the rule insights page with filters prefilled.
• Supports CSV export of rule insights data at both the repository and organization levels for offline reporting and record keeping.

SAST / SCA / Code Security · 2026-08-26

GitHub Copilot app gains a GA Customize tab unifying MCP servers, plugins, skills, and canvases in one place.

• New Customize tab in the GitHub Copilot app consolidates MCP servers, plugins, skills, and canvases into a single discovery surface with featured picks and category browsing.
• Trending MCP server discovery lets users browse by category to find and install MCP servers faster.
• Featured canvases surface contextual views that bridge understanding work and acting on it, including Azure DevOps backlog triage and prioritization delegated to Copilot.

SAST / SCA / Code Security · 2026-08-26

Block abusive users directly from security advisory pages without leaving the page, via the three-dot menu.

• Adds a block-user action to the three-dot menu on security advisory descriptions and comments in public repositories, eliminating the need to navigate to organization or profile settings.
• Shows a confirmation dialog explaining the consequences of blocking before the action is taken.
• Restricts the in-advisory block action to organization moderators or administrators for org-owned repos, and to the account owner for personal repos.

SAST / SCA / Code Security · 2026-08-26

GitHub rulesets now support path-level exceptions for push rules, letting you block file types or sizes everywhere except specific paths.

• Adds path exception patterns to the Restrict file paths push rule, so you can block a file type repository-wide while exempting specific glob patterns (e.g., **/gradle/wrapper/*.jar).
• Adds path exception patterns to the Restrict file size push rule, letting you enforce a size limit without requiring immediate changes to pre-existing oversized files at exempted paths.
• GitHub validates exception path patterns at ruleset save time, surfacing pattern errors immediately.

Digital Forensics & Incident Response · 2026-08-26

Hayabusa logon-summary gains -G/--geo-ip to enrich source IPs with MaxMind ASN, city, and country data.

• Adds -G, --geo-ip <MAXMIND-DB-DIR> flag to logon-summary to enrich source IP addresses with Source ASN, Source Country, and Source City columns in CSV output using MaxMind GeoLite2-ASN.mmdb, GeoLite2-Country.mmdb, and GeoLite2-City.mmdb databases; terminal table displays Source Country (falling back to ASN, with Local/Private placeholders for non-routable addresses).

Digital Forensics & Incident Response · 2026-08-26

Hayabusa adds --geo-ip flag to append ASN, country, and city columns to summarized logon source IPs.

• Adds -G / --geo-ip flag that appends Source ASN, Source Country, and Source City columns for the source IP address of each summarized logon.

Attack Surface & Exposure Management · 2026-08-26

• Adds Bitbucket Cloud as a supported source control integration for AI Pentesting, enabling direct connection and AI-powered penetration tests against Bitbucket-hosted repositories.

Identity & Access Management · 2026-08-26

JumpCloud Agent 2.159.1 adds Self Service App Catalog UI via policy and expands password length support beyond 64 characters on macOS.

• Enables the Self Service App Catalog user interface on Windows via policy, giving managed users direct access to approved applications.
• Supports password changes longer than 64 characters on macOS, with a validation message shown on submission.
• Device Admin controls now display a read-only state for single-selection cases, clarifying available actions.

Threat Intelligence · 2026-08-26

MISP v2.5.45 adds LDAP revamp with nested groups and proxy-header auth, a /gpg.asc endpoint, and CLI worker management.

• Adds ldapNestedGroups setting to resolve nested LDAP group membership for role and org mapping.
• Adds ldapOrgGroupMapping and ldapRoleGroupMapping settings whose precedence follows settings order, supporting role and organisation mapping via directory field or group membership.
• Adds LDAP sync of MISP accounts via the User check_validity task, schedulable as an admin task.

SAST / SCA / Code Security · 2026-08-26

npq v3.27.0 adds --allow-non-interactive-install flag and NPQ_ALLOW_NON_INTERACTIVE_INSTALL env var for safe CI/automated installs

• Adds --allow-non-interactive-install CLI flag to explicitly authorize npq installs in non-interactive (CI/automated) environments, routing them safely instead of blocking.
• Adds NPQ_ALLOW_NON_INTERACTIVE_INSTALL=true environment variable as an alternative to the CLI flag for authorizing non-interactive install routing in pipelines and scripts.

Identity & Access Management · 2026-08-26

Okta for AI Agents gains Cross-App Access for agentic OIDC/SAML apps, real-time import monitoring, and brand email copy-to-default.

• Adds Cross-App Access (XAA) support for AI agents and apps: admins can connect SSO-agentic requesting apps to SSO resource apps over OIDC and SAML without requiring user consent at runtime, with full admin visibility and control over which actions an AI agent can take on behalf of a user.
• Adds User access tab configuration for AI agent access, replacing the previous Delegation tab delegation-link workflow; existing delegation links must be reconfigured using the User access tab.
• Enables binding an AI agent with an OIDC SSO app so they share the same credentials, and allows admins to configure direct user authentication for the AI agent from that binding.

Identity & Access Management · 2026-08-26

Okta GA's Agent SSO, registering Cross App Access AI agents as first-class identities in Universal Directory with short-lived tokens

• Agent SSO (generally available, included in core Okta SSO plans at no additional cost) registers AI agents that support the Cross App Access protocol as first-class identities in Universal Directory alongside human employees, replacing static API keys and one-off OAuth grants with short-lived, identity-governed tokens.
• Administrators manage agent access policy through the same Okta Admin Console and workflows used for human employees — enabling assignment, monitoring, and policy updates for agents such as Anthropic Claude without separate tooling.
• Okta Integration Network now includes out-of-the-box Cross App Access integrations for Anthropic (Claude), Archestra.AI, Asana, Atlassian, Canva, Datadog, Figma, Glean, Granola, Linear, MintMCP, Notion, Slack, and Supabase, removing the need for custom integration work.

Runtime Security · 2026-08-26

OpenSandbox v0.1.16 adds retry transport with RetryPolicy, sandbox lifecycle hooks, background runs in isolated sessions, and pool capacity back-pressure signaling.

• Adds configurable retry transport to async and sync clients with backoff, jitter, Retry-After handling, per-attempt timeouts, and an overall deadline; opt out with RetryPolicy.disabled() to restore previous fast-fail behavior. Retries are on by default for idempotent requests on HTTP 429, 502, and 503; streaming SSE requests bypass replay.
• Adds preStart and periodic lifecycle hook parameters to Sandbox.create and SandboxSync.create, with server-authoritative timeout validation.
• Enables isolated sessions to start detached background runs, poll run status, and retrieve incremental combined output; read-only workspaces reject background execution because they cannot persist run logs.

AI/LLM Security · 2026-08-26

OpenShell v0.0.113 adds OTLP driver trace export for Docker and corporate CA trust for Podman sandbox HTTPS proxies.

• Exports Docker driver traces over OTLP, enabling distributed tracing of sandbox container operations.
• Trusts corporate CA certificates for HTTPS proxies and intercepted TLS within Podman-backed sandboxes.

Endpoint Security (EDR/XDR) · 2026-08-26

OSSEC 4.3.0 adds FIM maintenance mode, TCP/TLS syslog output, and ModSecurity audit log collection

• Adds FIM maintenance mode via agent_control -M with subcommands enable, disable, status, and end (plus -u <id> to target a specific agent), letting syscheck absorb file changes into the baseline without firing integrity alerts; end restarts syscheck/rootcheck and clears maintenance after the scan completes.
• Adds TCP and optional TLS support to ossec-csyslogd syslog_output via new config keys protocol, tls, tls_verify, and tls_ca, in addition to existing UDP; alert payloads in default, CEF, JSON, and Splunk formats now support up to OS_MAXSTR instead of the former 2048-byte limit.
• Adds modsec-audit localfile format to collect libmodsecurity serial audit logs, plus new decoders and rules for nginx ModSecurity error-log events.

Cloud Security Posture · 2026-08-26

Prowler adds Slack integration and multi-cloud organization hierarchy support across AWS, GCP, and Azure

• New Slack integration lets teams connect a Slack workspace to Prowler Cloud or Prowler Private Cloud, select the target channel, and verify the connection for alert delivery.
• New Organizations support provides onboarding and visibility across organization hierarchies for AWS, Google Cloud, and Azure in a unified view.
• New Azure Management Groups support in Prowler enables scoping and onboarding across Azure Management Group hierarchies.

Continuous Control Monitoring (CCM) · 2026-08-26

RegScale CLI 6.42.0 adds JCAM dry-run position mapping, Splunk evidence owner/approver settings, and opt-in Wiz incremental pulls.

• Adds splunkSids setting for offline Splunk evidence backfill runs.
• Adds Splunk evidence owner and approver settings for controlling evidence attribution.
• Adds JCAM position-to-role name mapping override to customize how positions are mapped during imports.

Attack Surface & Exposure Management · 2026-08-26

runZero 5.1.260825.0 adds a toggle for the promiscuous ARP probe on the scan configuration page.

• Adds a configuration option on the scan page to toggle the promiscuous ARP probe on or off.

SAST / SCA / Code Security · 2026-08-26

sbomify v26.8.0 adds malicious-package detection, EPSS/CVSS 4.0 capture, ENISA EUVD flagging, OpenChain Telco conformance, vulnerability risk acceptance, patch SLA/CRA KPIs, and a redesigned Trust Center.

• Captures EPSS scores and CVSS 4.0 from both scanner paths, surfacing richer severity data on findings.
• Surfaces malicious packages as their own distinct vulnerability class, separate from CVE-based findings.
• Flags ENISA EUVD exploited findings alongside existing CISA KEV badges on vulnerability views.

SAST / SCA / Code Security · 2026-08-26

Semgrep adds org-wide nosemgrep controls in public beta and a Workflow issues column on the Projects page.

• Adds a Workflow issues column to the Projects page, letting you select a count to open Agentic Workflows issues for that project.
• Introduces the organization-wide nosemgrep setting in public beta, allowing admins to enable or disable nosemgrep comments org-wide and filter findings by whether they were ignored via a nosemgrep comment.
• Semgrep Multimodal now defaults to GPT-5.6 Luna in more places, with clearer validation when adding OpenAI credentials via bring-your-own-key; alternative models remain available for bring-your-own-key and fallback.

SAST / SCA / Code Security · 2026-08-26

Snyk Evo now scopes repository, asset, and issue visibility to a user's Snyk Organizations via existing role hierarchy.

• The Tenant Viewer role now grants scoped read-only access to assets and issues limited to the Organizations the user belongs to, replacing the previous full-Tenant visibility.
• The Tenant Member role now carries no Evo access, enabling administrators to withhold Evo without removing a user's broader Snyk platform access.
• New users default to Tenant Member on join, requiring an explicit role change to gain any Evo access.

SAST / SCA / Code Security · 2026-08-26

Socket adds Asana integration (beta) for creating and managing tasks from alerts via manual action or ticketing rules.

• Adds Asana integration (beta, Business and Enterprise plans) to create and manage Asana tasks directly from Socket alerts.
• Supports ticketing rules that filter alerts by event, type, priority, repository, and other attributes to automate Asana task creation.
• Allows configuring Asana workspace, project, tags, and assignee per ticketing rule, with bi-directional status sync between linked tasks and alerts.

SAST / SCA / Code Security · 2026-08-26

Socket PHP and Composer support graduates to Beta with reachability analysis now GA for Team plans

• PHP and Composer support is now in Beta and available to all Socket users (previously Experimental).
• PHP reachability analysis is now generally available for Team plan customers and above, with no Experimental access required — includes precomputed reachability and full application reachability.

SAST / SCA / Code Security · 2026-08-26

Socket adds Firefox extension scanning, covering permissions, network activity, malware, and exfiltration behaviors across Mozilla's add-ons directory.

• Scans every Firefox extension listed in Mozilla's official add-ons directory, monitoring new releases for changes in permissions, code, network activity, and behavior.
• Detects malware, credential and clipboard theft, data exfiltration, remote loading, obfuscation, impersonation, and related campaign activity in Firefox extensions.
• Firefox extension coverage is available in Experimental for Enterprise customers — contact your Socket account team to enable it.

Web Application Security · 2026-08-26

SSTImap v1.4 adds save/load of detected vulnerabilities, Pybars3/4 and Mustache GHSA-5hrj-7fc3-cmx9 plugins, and header/cookie-aware crawling.

• Adds ability to save detected vulnerabilities to file and reload them in a later session.
• New plugin detects GHSA-5hrj-7fc3-cmx9 in Mustache template engine.
• New plugin supports Pybars3 and Pybars4 template engines for detection and exploitation.

SOAR · 2026-08-26

Tines 43.0.0 adds Tines primitives support in Apps and introduces Workbench for Cases.

• Adds support for Tines primitives in Apps, enabling use of native Tines building blocks within app configurations.
• Introduces Workbench for Cases, a new environment for working with case data.

Endpoint Security (EDR/XDR) · 2026-08-26

Trend Vision One adds generally available ZDI-powered risk events for zero-day vulnerabilities in Vulnerability Management and Threat and Exposure Management.

• TrendAI™ Zero Day Initiative (ZDI)-powered risk events are now generally available, surfacing zero-day vulnerabilities affecting software in your environment under Cyber Risk Exposure Management → Continuous Risk Management → Vulnerability Management and 'Cyber Risk Exposure Management → Continuous Risk Management → Threat and Exposure Management'.

Endpoint Security (EDR/XDR) · 2026-08-26

Trend Vision One lets you click asset totals in Cyber Risk Overview to drill into subindex contributors in Attack Surface Discovery.

• Clicking an asset type total in Cyber Risk Overview opens Attack Surface Discovery filtered to that asset type and group, enabling direct investigation of assets contributing to Cyber Risk Subindexes.

Data Security & DLP · 2026-08-26

Varonis now supports per-day scan pause schedules with time zone selection for distributed environments.

• Enables configuring different scan pause schedules for each day of the week with a specified time zone, allowing alignment with maintenance windows and business hours across geographically distributed environments.

Data Security & DLP · 2026-08-26

Varonis introduces Data Classes to simplify classification policy building by auto-mapping related criteria and locale-specific patterns.

• Adds Data Classes as a new way to build classification policies, grouping related patterns and dictionaries automatically instead of requiring individual selection, reducing policy complexity and false positives.

Data Security & DLP · 2026-08-26

Varonis lets you scope classification scans by AWS Organization ID, eliminating per-account inclusion/exclusion lists.

• Adds AWS Organization ID support to scan scope rules, letting you include or exclude entire AWS Organizations without maintaining individual account lists.

Data Security & DLP · 2026-08-26

Varonis adds email notifications for automation actions that enter a pending state and require review in Action Center.

• Sends email notifications to customers when automation actions enter a pending state and require review in Action Center, enabling faster response to stalled workflows.

Data Security & DLP · 2026-08-26

Varonis now surfaces Snowflake masking policy and tag changes within 24 hours instead of waiting for the next scheduled sync.

• Snowflake masking policy and tag updates are now visible within 24 hours, replacing the previous scheduled-sync delay, so compliance teams can validate data protection controls more quickly.

Data Security & DLP · 2026-08-26

Varonis now shows originating shares and associated accounts explaining why Snowflake resources are labeled Shared Internally or Shared Externally.

• Displays the originating shares and associated accounts for Snowflake resources labeled Shared Internally or Shared Externally, exposing the full inheritance chain behind each sharing relationship.

Data Security & DLP · 2026-08-26

Varonis adds built-in data coverage reporting with trend analysis across cloud scan scopes and providers.

• New built-in reporting view shows current and historical data coverage across configured scan scopes, broken down by cloud provider and service.
• Trend analysis enables tracking of coverage changes over time and validating scan scope configuration.
• Coverage distribution view surfaces how monitored data is spread across cloud environments.

Data Security & DLP · 2026-08-26

Varonis unifies Jira and Confluence onboarding under a single Atlassian integration with shared identity management.

• Adds a unified Atlassian integration that connects both Jira and Confluence through a single onboarding flow, consolidating identities and eliminating duplicate users across Atlassian services.

Data Security & DLP · 2026-08-26

Varonis adds advanced filtering and CSV export for connected service accounts directly from the Connected Services page.

• Enables export of filtered connected service account results to CSV from the Connected Services page.
• Adds advanced criteria filtering for connected service accounts on the Connected Services page.

Digital Forensics & Incident Response · 2026-08-26

New Linux.Forensics.Journal.Fields artifact reads systemd journal indexes fast, exposing field names, values, counts, and first/last timestamps without parsing entries.

• New Linux.Forensics.Journal.Fields artifact lists every distinct field name and field value from the systemd journal index (equivalent to journalctl -N and an enriched journalctl -F <field>), including entry count and first/last entry timestamps — without reading individual log entries.
• Sources JournalFields and JournalFieldValues are independently controllable: set ListFields to false to suppress field-name enumeration, or set FieldName to an empty string to suppress value enumeration.
• Set FailIfMissing to promote skipped or unreadable journal files (no access, empty, corrupt, or legacy non-compact format) from warnings to errors, making incomplete collections explicitly visible.

SAST / SCA / Code Security · 2026-08-25

Aikido adds Linux device protection (.deb/.rpm), agentless GCP VM scanning, OSCAL FedRAMP DAST reports, and new bulk-configuration APIs.

• New API to bulk update GitHub PR configuration across repositories.
• New API to request a hardened container image.
• Device Protection for Linux (beta): blocks malware at install time on Linux desktops and servers, distributed as .deb and .rpm packages.

SAST / SCA / Code Security · 2026-08-25

Aikido adds Code Audit: agentic, pentest-grade source code reasoning with AutoFix PR generation, no live environment needed.

• New Code Audit feature runs agentic, pentest-grade security reasoning directly on source code to find logic flaws (e.g. cross-tenant data leakage) that pattern-based scanners miss — no staging URL, traffic replay, or agent deployment required.
• AutoFix generates remediation PRs from Code Audit findings with a few clicks, alongside root cause analysis and remediation guidance.
• Code Audit is priced in credits shown upfront before the audit starts, with cost based on codebase size and complexity.

SAST / SCA / Code Security · 2026-08-25

Aikido adds code-based DSPM: Data Exposure Audit maps sensitive data flows through source code without connecting production data stores.

• New Data Exposure Audit feature performs code-based DSPM using LLM agents to trace sensitive fields from sources (request bodies, DB reads, config) to sinks (logs, third-party APIs, LLM prompts, caches, queues, storage) — no production data store access required.
• Detects credentials in URLs — tokens and API keys in query strings, redirects, and clone URLs that may be captured by logs, proxies, or browser history.
• Detects API over-exposure — endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks.

SAST / SCA / Code Security · 2026-08-25

Aikido adds LLM-powered Secrets AutoTriage and CVE Exploitability Analysis to automatically prioritize and act on findings.

• New Secrets AutoTriage agent runs after entropy detection to assess whether a discovered secret is a real, exposed credential — evaluating liveness, scope, and surrounding code context — then applies defined rules or LLM reasoning for ambiguous cases.
• New CVE Exploitability Analysis agent evaluates whether a CVE is actually reachable and exploitable in your codebase using LLM reasoning over how your code uses the affected package.
• Both agents can act autonomously: upgrading, downgrading, snoozing, or ignoring findings automatically based on rules you control.

SAST / SCA / Code Security · 2026-08-25

Aikido Device Protection agent adds real-time malware blocking, extension governance, group policies, and an approval workflow for developer devices.

• New Device Protection agent provides real-time malware blocking across npm, PyPI, Maven, and NuGet package managers, powered by Aikido Intel.
• Adds extension governance covering VS Code, OpenVSX, Chrome, and skills.sh extensions.
• Introduces a request-and-approval workflow: blocked installs trigger a one-click exception request reviewable inside the Aikido admin Inbox.

Container & Image Security · 2026-08-25

Anchore Enterprise adds VM filesystem and disk-image SBOM generation as first-class assets alongside containers

• Adds anchorectl app version asset add filesystem subcommand with --type virtual_machine_disk flag to generate SBOMs from live VM filesystems or mounted disk images and attach them to an application version.
• Supports scanning VM disk images offline (read-only, no agent) via QEMU NBD mount — sudo qemu-nbd --read-only --connect=/dev/nbd0 disk.qcow2 — enabling forensic and golden-image workflows.
• Skips pseudo-filesystems (/proc, /sys) by default when scanning /, making full-root filesystem analysis safe; narrower paths (/usr, /opt, /srv) are also supported for faster targeted scans.

Reconnaissance & OSINT · 2026-08-25

bbot adds js-audit preset to hunt for leaked credentials and vulnerable JavaScript libraries in client-side code.

• Adds js-audit preset (stored at ~/.bbot/presets/web/js-audit.yml) that runs trufflehog, retirejs, badsecrets, http, robots, and wayback modules to detect leaked credentials and vulnerable libraries in client-side JavaScript, with only_verified and include_sitemap options enabled.

Reconnaissance & OSINT · 2026-08-25

BBOT v3.0.2 adds a new js-audit preset and surfaces HTTP decode errors as tagged decode-error events.

• New js-audit preset at bbot/presets/web/js-audit.yml runs trufflehog against HTTP bodies (streamed via stdin), includes the source URL on findings, and sets _module_threads to 2.
• Adds decode-error tag to HTTP_RESPONSE events when a response body cannot be decoded, preventing undecoded content from being treated as valid body data.
• Raises process pool max_tasks_per_child from 25 to 250, enabling more sustained parallel workloads before worker recycling.

Web Application Security · 2026-08-25

Bright adds orchestrated Workflows, OWASP Top 10 dashboard widget, and connectivity-status-based scan filtering

• Adds entryPointFilter to the Scan Configuration API, replacing entrypointsStatuses, supporting filtering by both securityStatus and connectivityStatus (e.g. 'ok', 'unauthorized', 'problem', 'unreachable') for precise scan scoping.
• Introduces Bright Workflows: a visual orchestration layer that chains a trigger, Discovery, and Scan into a reusable, schedulable pipeline that automatically identifies new and changed entry points since the last baseline and passes only those to the Scan.
• Adds an OWASP Top 10:2025 Risk Overview widget to both Organization and Project dashboards, aggregating open issues across selected projects mapped to OWASP categories.

Exploitation & C2 · 2026-08-25

Bugcrowd researchers can now request removal of a response expiration on a submission.

• Adds Request a Response Expiration Removal capability for researchers to request that a response expiration be removed from a submission.

Exploitation & C2 · 2026-08-25

Bugcrowd Request a Response no longer auto-expires, with new inbox filters for active and resolved requests.

• Each RaR now displays the date it was raised so teams can track how long a request has been open.
• New inbox filters let you view RaRs by status: Active requests to Customers to surface outstanding requests and Resolved requests to Customers to review handled ones.

Attack Surface & Exposure Management · 2026-08-25

Censys Platform Audit Log gains 35 new event types covering ASM risk management, SAML, PAT lifecycle, and user authentication.

• Adds ASM-specific audit log events: ASM Exclude Created, ASM Exclude Deleted, ASM Risk Instance Accepted, ASM Risk Instance Unaccepted, ASM Risk Instance Severity Changed, ASM Risk Type Disabled, ASM Risk Type Enabled, ASM Risk Type Severity Changed, ASM Seed Created, and ASM Seed Deleted.
• Adds SAML configuration lifecycle audit events: SAML Config Created, SAML Config Deleted, SAML Config Domain Verified, and SAML Config Updated (Platform and ASM).
• Adds Personal Access Token audit events PAT Created and PAT Deleted (Platform only).

Attack Surface & Exposure Management · 2026-08-25

Censys adds geo_distance CenQL function, 6 KB HTTP body search, 2 new fingerprints, and 16 new protocol/app scanners

• Adds geo_distance function to Censys Query Language (CenQL) for finding assets relative to a geographic location; currently supports host.location.coordinates and host.services.ntrip as target data objects; available to all users.
• Expands searchable HTTP body size for web.endpoints.http.body (name-based web property endpoints) from 2 KB to 6 KB, enabling more targeted Platform queries.
• Adds MPLS_LDP (MPLS Label Distribution Protocol, RFC 5036) scanner; available to all users.

Container & Image Security · 2026-08-25

Chainguard Catalog Starter now manageable via chainctl with new starter subcommands for signup, access, images, and status.

• Adds chainctl starter init to sign up for a new Catalog Starter account interactively from the command line.
• Adds chainctl starter request-access to request access to an existing organization's Catalog Starter plan.
• Adds chainctl starter add-images to add up to four images (by name) to a Catalog Starter subscription from the CLI.

Container & Image Security · 2026-08-25

Chainguard adds SCIM user provisioning (Early Access), promotes API v2 to GA, and launches self-serve Helm chart provisioning.

• Adds SCIM user provisioning (Early Access) for Okta and Microsoft Entra ID via the /Users SCIM resource — creating/updating provisioning records on assignment and blocking login within ~1 hour of deactivation or token expiry.
• Promotes Chainguard API v2 to general availability at /v2/, with a stable contract covering organization and access management, registry metadata, vulnerability and security advisories, event subscriptions, and library artifacts; existing v2beta1 integrations need only update the path prefix.
• Adds cursor-based pagination, server-side ordering, resource naming, dedicated resource lookups, partial updates, and typed error details to the stable API v2, plus an OpenAPI specification and v2 Go SDK clients.

Identity & Access Management · 2026-08-25

Clerk adds custom OAuth scopes for MCP clients and biometric trusted-device sign-in for mobile SDKs

• Adds custom OAuth scope definitions in the Clerk Dashboard (examples: messages:read, tools:execute, resources/files:read, mcp_all) so MCP clients can request only the access each OAuth application needs.
• Adds OAuth metadata advertisement control so MCP clients can discover which scopes your application supports via Clerk's OAuth metadata endpoint.
• Adds useTrustedDevices hook in @clerk/expo with enroll, signIn, and revoke methods to register a device and authenticate returning users with Face ID, Touch ID, or Android biometrics.

SAST / SCA / Code Security · 2026-08-25

Cloudsmith adds Early Access Nix binary cache hosting with ED25519 signing, upstream proxying, and nix copy publish/fetch support.

• Adds Nix binary cache repository support (Early Access), hosting NAR and narinfo files over the standard Nix HTTP binary cache protocol at https://nix.cloudsmith.io/OWNER/REPOSITORY.
• Supports publishing packages via nix copy --to 'https://nix.cloudsmith.io/OWNER/REPOSITORY' --no-check-sigs — no separate upload format required.
• Supports fetching packages via nix copy --from 'https://nix.cloudsmith.io/OWNER/REPOSITORY' STORE_PATH once a repository is configured as a substituter.

SAST / SCA / Code Security · 2026-08-25

Cloudsmith adds Early Access Nix upstream proxying, supporting NixOS release channels via the web app.

• Adds Nix upstream proxy support (Early Access, web app only; API-based management not yet available), pointing at a single NixOS release channel URL such as https://channels.nixos.org/nixos-26.05.
• Adds extra-substituters and extra-trusted-public-keys configuration to Nix client settings, enabling https://nix.cloudsmith.io/OWNER/REPOSITORY as a substituter alongside cache.nixos.org to cover dependency closures that Cloudsmith cannot index.
• Adds upstream proxying for library registries (Chainguard Libraries, RapidFort Curated Libraries), allowing hardened or filtered open-source package replacements to be proxied through a Cloudsmith repository.

SAST / SCA / Code Security · 2026-08-25

Cloudsmith Broadcasts lets you publish repositories to a public, branded URL with aggregated analytics and native tooling support.

• New Broadcasts feature lets you expose a standard Cloudsmith repository to the public through a customizable, branded URL rather than creating a separate public repository.
• Adds a broadcast Overview section in the Cloudsmith dashboard showing aggregated analytics across all broadcasting repositories, including total requests per billing cycle, usage per package, recently downloaded packages, and recently created broadcasts.
• Broadcasts analytics break down package requests by public, private, and open source packages, and show the number of entitlement tokens consumed in the current billing cycle.

SAST / SCA / Code Security · 2026-08-25

Cloudsmith adds Nix binary cache support with Ed25519 signing and upstream NixOS channel proxying.

• Adds Nix format repository support, enabling hosting of public or private Nix binary caches with Ed25519-signed packages.
• Supports upstream proxying and caching against NixOS release channels, so Nix clients can pull from Cloudsmith as a transparent cache in front of official NixOS channels.

Web Application Security · 2026-08-25

DataDome Cloudflare Worker 3.0.0 splits URL exclusion config and enables matrix-param/encoding checks by default

• Adds DATADOME_STATIC_ASSET_EXCLUSION env var to hold static-asset file-extension exclusions separately from custom URL patterns, enabled by default with a standard extension list.
• DATADOME_URL_REGEX_EXCLUSION now holds only custom URL exclusions (e.g. /health|/heartbeat); static-asset extensions must be migrated out of it.
• Adds DATADOME_REMOVE_MATRIX_PARAMS setting to strip matrix params (;) before regex evaluation, mirroring existing query-param (?) handling, enabled by default.

Web Application Security · 2026-08-25

• Narrows DATADOME_URL_REGEX_EXCLUSION to hold only custom URL exclusions — static-asset extensions must now be moved to the new DATADOME_STATIC_ASSET_EXCLUSION variable.
• Enables matrix-parameter stripping via DATADOME_REMOVE_MATRIX_PARAMS by default, ignoring semicolon-delimited params (;) before regex evaluation, matching existing query-param (?) behaviour.
• Enables encoded-character inspection via DATADOME_ENCODED_CHAR_INCLUSION by default, causing DataDome to inspect static-looking paths that contain %23, %25, %2f, %3b, or %3f.

Web Application Security · 2026-08-25

DataDome Cloudflare module 3.0.0 adds three new config settings for static-asset exclusion, matrix-param handling, and encoded-char inspection.

• Adds DATADOME_STATIC_ASSET_EXCLUSION setting (enabled by default) that moves static-asset file-extension exclusions into a dedicated list, so DATADOME_URL_REGEX_EXCLUSION now holds only custom URL exclusions.
• Adds DATADOME_REMOVE_MATRIX_PARAMS setting (enabled by default) to strip RFC 3986 matrix parameters from URLs before matching against exclusion patterns.
• Adds DATADOME_ENCODED_CHAR_INCLUSION setting (enabled by default) to force inspection of static-looking paths that carry an encoded delimiter — defaults to %23, %25, %2f, %3b, %3f, with custom values supported.

Vulnerability Management · 2026-08-25

DefectDojo Pro gains a documented air-gapped install mode driven by --air-gapped true in dojo-compose-cli.

• Enables air-gapped deployment via dojo-compose-cli config set --air-gapped true, which validates the license from /etc/defectdojo/dojopro.lic and blocks registry-dependent commands with an explicit error message instead of silent failures.
• Adds dojo-compose-cli config set --deploy-version and --version flags to pin the exact release version across deployment artifacts and container images.
• Adds dojo-compose-cli deploy download to pull the full deployment directory (compose file, nginx config, issue tracker templates, customizations) into /opt/dojo.

Vulnerability Management · 2026-08-25

DefectDojo Pro adds official OpenShift 4.x deployment support with bootstrap script, SCC guidance, and Route-based TLS.

• Adds dojo.secureCookies config key: must be set to false when deploying behind an edge-terminated OpenShift Route (where TLS ends at the router and the pod receives plain HTTP), or login will fail.
• Adds dojo.skipInitContainer config key: set to true after first install to skip the initializer wait on subsequent upgrades.
• Adds config.logLevel and celery.logLevel config keys, both accepting DEBUG for deeper diagnostic output.

Vulnerability Management · 2026-08-25

DefectDojo Pro adds FIPS 140-3 validated container images for FedRAMP SC-13 and similar compliance deployments.

• Adds -fips image tag suffix to identify FIPS 140-3 validated container variants of DefectDojo Pro, leaving standard images unchanged.
• Adds DD_FIPS_MODE environment variable (set to "1") to activate FIPS enforcement inside containers across Docker Compose, Kubernetes, and ECS deployments.
• Adds fips.enabled Helm value that automatically selects -fips image variants and injects DD_FIPS_MODE for every pod in the chart.

Vulnerability Management · 2026-08-25

DefectDojo Pro adds an interactive Asset Hierarchy diagram with relationship management, node filtering, and incremental hierarchy loading.

• New interactive Asset Hierarchy diagram visualizes parent-child relationships between Assets as labelled arrows, color-coded by selection origin, with a Legend panel identifying node types.
• Adds Hide Asset List button to collapse the Asset selector and give the diagram full-page real estate.
• Node display in the left panel supports toggling Asset ID, Organization ID, Organization Name, and Child Count on or off per node.

Vulnerability Management · 2026-08-25

DefectDojo 3.2.300 adds Regulations support, typed Custom Fields, MFA disable verification, and expanded documentation.

• Scopes endpoint delete and rename operations to the requesting product, restricting cross-product mutations.
• Disabling MFA now requires a verification code, adding a confirmation step to protect account security.
• Documents typed Custom Fields feature, including how custom fields integrate with Rules Engine 2.0.

Container & Image Security · 2026-08-25

Docker Compose watch now supports --prune=false to retain superseded images after rebuilds.

• Adds --prune=false flag to docker compose watch to keep dangling images from previous builds instead of automatically removing them after each rebuild.

AI-Powered Offensive Security · 2026-08-25

Dreadnode adds Kubernetes Gateway API routing, a Caido TypeScript SDK skill, new web-security attacks, bulk session freeze, and media previews.

• Adds WEBHOOK_SITE_API_KEY environment variable to the web-security callback tool, enabling a paid webhook.site account to bypass rate limits while preserving anonymous and interactsh fallback.
• Supports Kubernetes Gateway API (HTTPRoute) routing for on-prem deployments, enabling installations on Istio, Envoy Gateway, and Cilium stacks instead of relying on Ingress.
• Adds a caido-mode skill in the web-security capability, exposing the full Caido TypeScript SDK — including Match & Replace rules, replay sessions, HTTPQL history search, findings management, and curl-through-Caido testing — from within an agent.

SAST / SCA / Code Security · 2026-08-25

Endor Labs AI SAST adds full C language support with buildless scanning in the IDE and on PRs.

• Adds full C language support to Endor Labs AI SAST, enabling buildless scans that run in the IDE and on the PR without requiring a compiler hook or reproducible build.
• Pairs deterministic call-graph and reachability program analysis with LLM reasoning to trace data flow across functions and files, catching buffer overflows, use-after-free, and integer overflows that span multiple functions.
• Each C finding includes a call path, a working exploit, and a suggested fix — consistent with the evidence format for all other supported languages.

Firewalls & Network Defense · 2026-08-25

Fastly Historical Stats and Real-Time Analytics APIs add bot_edge_requests_headless_count metric for headless bot traffic.

• Adds bot_edge_requests_headless_count metric to the Historical Stats API and Real-Time Analytics API to track edge requests originating from headless bots.

Secrets Detection & Management · 2026-08-25

GitGuardian now scans AWS S3 buckets — including objects inside archives — using the same detection engine and incident workflow as repositories.

• Adds AWS S3 bucket scanning via a read-only OIDC-assumed IAM role in your own account — no long-lived AWS keys required — surfacing secrets in CI logs, Terraform state, .env files, support exports, and other objects that code scanners never reach.
• Scans inside archives (e.g. tar.gz) nested within S3 objects, so credentials buried in compressed backups still surface as incidents with severity, validity, playbooks, and notifications.
• Lets you select individual buckets to monitor and assign them to teams like any other source, starting with high-risk buckets such as backup and log archives.

Secrets Detection & Management · 2026-08-25

GitGuardian can now scan AWS S3 buckets for secrets, including inside archives, using OIDC role assumption with no long-lived keys.

• Adds AWS S3 bucket scanning powered by the same detection engine and incident workflow used for repositories, surfacing secrets in objects across CI logs, Terraform state, database dumps, .env files, and support exports.
• Opens and scans inside archives (e.g. tar.gz) found in S3 objects, so secrets buried in compressed backups still surface as incidents.
• Connects via OIDC — GitGuardian assumes a read-only IAM role you create and scope in your own AWS account, with no long-lived AWS keys required.

SAST / SCA / Code Security · 2026-08-25

GitLab Dedicated gains fully managed, single-tenant Hosted Runners with AWS PrivateLink, autoscaling, and GitLab Credits billing.

• Introduces Hosted Runners for GitLab Dedicated: a fully managed, single-tenant CI runner fleet isolated per customer, eliminating the need to provision or maintain your own runners.
• Supports machine sizes linux-small-amd64 (default, 2 vCPU / 8 GB), linux-medium-amd64 (4 vCPU / 16 GB), linux-large-amd64 (8 vCPU / 32 GB), linux-xlarge-amd64 (16 vCPU / 64 GB), and linux-2xlarge-amd64 (32 vCPU / 128 GB) on Linux x86-64 and Linux Arm64.
• Provides consumption-based pricing via GitLab Credits, with usage visible in the GitLab Credits Dashboard.

SIEM · 2026-08-25

Google SecOps adds Operations in Emerging Threats Center, relative time filtering operators, and side-by-side alert inspection view.

• Adds Side-by-side view layout on the Alerts & Detections tab in Cases, letting analysts inspect alert metadata, status, priority, creation date, and Gemini investigation insights in an adjacent side pane without leaving the main list.
• Introduces three precise relative time filter operators — Past, Previous, and Current — in SecOps dashboards and Search to eliminate ambiguity between rolling windows and calendar-aligned periods across all time units (seconds through years); currently in public preview.
• Adds Operations to the Emerging Threats Center feed, surfacing localized threat intelligence from frontline investigations (such as Managed Threat Defense engagements) alongside global Campaigns to map full adversary TTPs.

SIEM · 2026-08-25

Google SecOps data processing pipelines gain an Unroll processor to split log arrays into discrete events before ingestion.

• Adds the Unroll processor (event breaking) to Google SecOps data processing pipelines, which automatically expands log entries containing arrays or slices into multiple individual log events prior to parsing and ingestion.
• Requires structured input: raw string payloads must be converted first using a Transform processor (e.g., set(body, ParseJSON(body))) placed before the Unroll processor in the pipeline execution sequence.

Identity & Access Management · 2026-08-25

iDenfy Sprint 133 adds standalone Bank Card Verification, Persian/Farsi RTL support, new KYB API endpoint, and Risk Assessment PDF export

• New API endpoint to re-run KYB automation, enabling programmatic retrigger of KYB workflows without manual intervention.
• Brazil Digital CNH (Carteira Nacional de Habilitação) document support added to identity verification.
• Primary buttons now support an independent branding color configuration.

Attack Surface & Exposure Management · 2026-08-25

Intruder AI Pentesting now supports Bitbucket Cloud repositories, matching existing GitHub and GitLab coverage.

• Adds Bitbucket Cloud as a supported source-control integration for AI Pentesting, alongside existing GitHub and GitLab support — connect repositories directly to run AI-powered penetration tests against Bitbucket-hosted code.

SAST / SCA / Code Security · 2026-08-25

JFrog Catalog now supports bulk package governance automation via a GraphQL API.

• Adds bulk automation support via the Catalog GraphQL API, enabling package governance at scale.

SAST / SCA / Code Security · 2026-08-25

JFrog Agent Package Resolution (preview) routes AI coding agent package downloads through Artifactory governance automatically.

• Introduces Agent Package Resolution (preview), a feature of the JFrog Agent Plugin that routes AI coding agent dependency downloads through JFrog Artifactory instead of public registries, covering npm, PyPI, Maven, Go, Docker Hub, Helm, and NuGet.
• Adds session steering: at the start of each Claude Code or Cursor agent session, the plugin automatically supplies the Artifactory URL for each governed package type — no per-project configuration required.
• Adds a jf setup command for persistent package-manager configuration that binds the local package manager to an Artifactory repository for a given project, persisting across sessions and tools.

Reconnaissance & OSINT · 2026-08-25

Maigret v0.6.5 expands site coverage by 78+ sites including Chinese and Vietnamese platforms, and fixes SOCKS5h proxy routing across all transports.

• Adds 78+ new sites to the username-search database across multiple batch additions, including VNOJ (Vietnamese competitive programming), Juejin, NetEase Music, Coddy, and Codédex.
• Adds 6 Chinese sites with presence markers, expanding coverage for OSINT investigations targeting Chinese-language platforms.
• Keeps runtime activation tokens out of the sites database, preventing credential leakage in the distributed data.json.

SAST / SCA / Code Security · 2026-08-25

Mend SAST 26.8.1 adds probability risk factor per data flow, new CWE detections for JS/TS and Rust, and opt-in AI rule customization.

• Adds an opt-in option to share additional project data with Mend.io so AI can generate candidates for customizing and tailoring detection rules to your organization.

SAST / SCA / Code Security · 2026-08-25

Mend SAST 26.8.1 adds per-data-flow probability risk factors and expands CWE detection for JS/TS and Rust.

• Adds probability risk factor display next to each data flow in finding details within the Mend Platform, enabling more granular triage.
• Adds detection for CWE-99 (Improper Control of Resource Identifiers / Client Resource Injection) in JavaScript and TypeScript.
• Adds detection for CWE-319 (Cleartext Transmission of Sensitive Information) and CWE-321 (Use of Hard-coded Cryptographic Key) for Rust.

Reconnaissance & OSINT · 2026-08-25

Nettacker 0.4.1 adds SARIF/DefectDojo output, custom wordlists, port exclusions, custom headers, and new scanners for CUPS, SMB, Jenkins, and more.

• Adds SARIF and DefectDojo-compatible JSON as output formats for scan results.
• Adds port exclusions, HTTP scheme selection, custom request headers, and sensitive-header filtering to scan configuration.
• Adds custom wordlists and directory-enumeration base paths for brute-force and discovery modules.

Threat Intelligence · 2026-08-25

OpenCTI adds redis:max_event_length to cap stream event size and offload large events to file storage.

• Adds redis:max_event_length config key (env: REDIS__MAX_EVENT_LENGTH) to set a maximum size in bytes for a Redis stream event, offloading oversized event content to file storage; set to 0 to disable.

Threat Intelligence · 2026-08-25

OpenCTI 7.260824.0 adds One-Pager mode for Fintel reports, score fields on Incidents and Events, S3 offloading for large stream events, and experimental cross-platform Status sync.

• Adds experimental Status sync between OpenCTI platforms via live streams, laying groundwork for cross-platform workflow state propagation.
• Stores large stream event messages to S3 instead of Redis, removing Redis size constraints for high-volume stream deployments.
• Splits STIX bundles in Node.js before pushing to the worker queue, reducing worker-side processing overhead for large bundle imports.

Runtime Security · 2026-08-25

OpenSandbox v1.0.19 adds async pool warmup with OpenTelemetry tracing, lifecycle hooks, detached session runs, and richer runtime metadata.

• Enables OpenTelemetry tracing for pool warmup phases via ConnectionConfig.enableTracing(true), covering queue wait and every warmup stage using the application's global SDK, exporter, sampler, and propagators.
• Exposes Sandbox.allocation summary for confirmed Kubernetes Pool allocations as optional runtime metadata in the SDK.
• Adds preStart and periodic lifecycle hook models accepted at sandbox creation time.

Attack Surface & Exposure Management · 2026-08-25

runZero adds OCSF 1.9.0 asset inventory export as Device Inventory Info and Live Evidence Info events

• Adds OCSF 1.9.0 export for the asset inventory, producing assets.ocsf.jsonl and assets.ocsf.json files from the inventory export menu and the Export API; assets export as Device Inventory Info events, observed services as Live Evidence Info events, with unmapped fields preserved under the event's unmapped object.
• Organization overview report now shows total asset counts in the sites summary, consistent with the sites table in the runZero Console.

Identity & Access Management · 2026-08-25

ISC Workflows HTTP Request action adds Sensitive Request Headers field to mask API keys and tokens in definitions and execution history.

• Adds Sensitive Request Headers field to the HTTP Request action in Identity Security Cloud Workflows — a dedicated masked key-value store for API keys, bearer tokens, and other secrets that are encrypted in workflow definitions and omitted from execution history.

Firewalls & Network Defense · 2026-08-25

Sophos AP6 1.10.3173MR10 adds 6 GHz support in India/Pakistan, Central RADIUS with Entra ID, and per-SSID traffic shaping.

• Adds traffic shaping configuration for AP6 SSIDs under Advanced settings > Quality of service in Sophos Central.
• Adds support for configuring RADIUS servers in Sophos Central for AP6 SSIDs with enterprise authentication, including Microsoft Entra ID as a cloud-based identity provider.
• Adds per-SSID RADIUS server assignment configuration in the local UI.

SIEM · 2026-08-25

Sumo Logic dashboards now support time ranges beyond 32 days when backed by aggregate scheduled views or aggregate scheduled searches.

• Extends dashboard query time ranges beyond the previous 32-day limit when using aggregate scheduled searches, aggregate scheduled views, or a combination of both.

Detection Engineering · 2026-08-25

Tenzir Ship v2.2.0 adds metadata enforcement policies and a new --all-entries flag for changelog validation.

• Adds require_author: true config key to changelog project configuration to require at least one author on unreleased entries.
• Adds omit_pr: true config key to reject pull request numbers in unreleased changelog entries.
• The validate command now applies omit_pr and omit_author policies only to unreleased entries by default; pass --all-entries to audit every release against the current policy.

Detection Engineering · 2026-08-25

Tenzir Ship v2.2.0 adds forward-looking metadata policies to enforce author and PR rules on unreleased changelog entries.

• Changelog projects can now require authors and reject pull request metadata in unreleased entries, with validation applied to unreleased entries by default and an explicit full-history audit mode also available.

Runtime Security · 2026-08-25

Tetragon adds matchCEL selector for CEL-expression-based event filtering in tracing policies

• Adds matchCEL selector to tracing policies, enabling filtering of kernel events using CEL (Common Expression Language) expressions — for example arg1 == int32(-1) && data0 == arg0 + int32(42) — with syscall arguments exposed as zero-based indexed variables (arg0, arg1, …) and data items from the data: list exposed as data0, data1, …

Runtime Security · 2026-08-25

Tetragon v1.7.1 adds int tracepoint args, btfType/btfTypeModule support, and broader policy-filter scoping for uprobes and USDT events.

• Adds btfType and btfTypeModule support in tracing policies, enabling more precise BTF-based type resolution for kernel arguments.
• Adds int argument type support for tracepoints in TracingPolicy, expanding the set of kernel tracepoint arguments that can be traced and filtered.
• Allows hostSelector in TracingPolicy without requiring the enable-policy-filter daemon flag, reducing configuration overhead for host-scoped policies.

SAST / SCA / Code Security · 2026-08-25

Veracode integrations gain GitHub Platform install/scheduling, ADO agent pool config, scan scope selection, and expanded API wrapper capabilities.

• Adds a custom agent pool name parameter in veracode.yml for Azure DevOps Workflow Integration v2.4.3, letting you specify the agent pool used for pipeline execution.
• Adds analysis_branch support in veracode.yml for Azure DevOps Workflow Integration v2.3.10 so scheduled scans run against a specified branch instead of the default branch.
• Adds the debug configuration option in veracode.yml for the Azure DevOps Workflow Integration v2.3.6, GitHub Workflow Integration v1.0.6, and GitLab Workflow Integration v2.1.4 to enable debugging and troubleshooting.

Web Application Security · 2026-08-25

Wallarm adds File Upload Restriction Policy via mitigation controls and WAF rules to cap per-parameter and full-request upload sizes.

• Adds File upload restriction policy mitigation control (Advanced API Security subscription) to set per-parameter or full-request upload size limits with block or monitor modes — requires NGINX Node 6.3.0+ or Native Node 0.16.0+.
• Adds File upload restriction policy WAF rule (Cloud Native WAAP subscription) for rule-based upload size enforcement configurable from Rules WAF, Attacks/Incidents, or API Discovery — requires NGINX Node 6.3.0+ or Native Node 0.16.0+.
• Exposes Size restrictions and Mitigation mode settings within the mitigation control to scope limits to specific request points (POST body, JSON object fields, multipart file parts, or arbitrary headers) using Wallarm point tags such as post, json_doc, hash, file, and multipart.

Web Application Security · 2026-08-25

Wallarm adds GraphQL API Protection with configurable DoS and schema-exposure limits via mitigation controls

• New GraphQL API protection mitigation control in Wallarm Console → Security Controls → Mitigation Controls lets teams set per-endpoint policy limits including Maximum total query size in kilobytes, Maximum value size in kilobytes, Maximum query depth, Maximum number of aliases, Maximum batched queries, and block/register toggles for introspection and debug requests.
• Default GraphQL protection mitigation controls ship pre-configured with 100 KB POST query size, 10 KB value size, depth and batched-query limits of 10, alias limit of 5, and introspection/debug queries denied — active immediately in Monitoring mode for all traffic.
• Supports GraphQL over HTTP POST (application/json, application/graphql, text/plain, multipart/form-data) and HTTP GET (query-parameter form) for policy enforcement.

Web Application Security · 2026-08-25

Wallarm adds automatic MCP session detection and inspection, including SSE stream support for MCP servers.

• Automatically detects and groups MCP (Model Context Protocol) traffic into sessions by recognizing JSON-RPC 2.0 patterns — no manual configuration required.
• Surfaces MCP session details in Wallarm Console: MCP protocol headers, host and path of the MCP server endpoint, MCP methods called (e.g., JSON-RPC method), tool/resource/prompt names accessed, parameters passed to tool calls, and any attacks detected within the session.
• Supports inspection of MCP servers that return responses as Server-Sent Events (Content-type: text/event-stream) SSE streams — requires Wallarm node version 6.13.0 or higher.

Web Application Security · 2026-08-25

Wallarm API Discovery adds MCP server visibility, LLM/AI business flow tracking, and per-endpoint change notifications

• Adds MCP server discovery in the API Discovery tab, listing each server's primitives — tools, resources, and prompts — with a full-screen details page per primitive showing protocol version, request count (last 7 days), and input parameters for prompt templates.
• Adds ACL policies, request verification, and tool input schema enforcement coverage tracking for discovered MCP servers.
• Adds a Business flow — AI/LLM category to surface AI/LLM endpoints and their coverage status, including authentication type, per-parameter coverage percentage, and parameter key and path values.

Web Application Security · 2026-08-25

Wallarm API Discovery adds MCP server support and SSE stream parsing for tool, resource, and prompt schema capture.

• Discovers MCP server surfaces — invocable tool functions, readable resources, and parameterized prompt templates — by analyzing traffic to MCP endpoints.
• Starting from node 6.13.0, parses Server-Sent Events (Content-type: text/event-stream) response streams so that tool, resource, and prompt schemas are captured from streamed MCP responses, not just single JSON bodies.

Identity & Access Management · 2026-08-24

Auth0 adds Custom Rate Limits (Early Access) for per-client Authentication API throttling with block or notify enforcement modes.

• Adds API-based self-service configuration of Custom Rate Limit Policies to cap Authentication API OAuth request consumption per individual client, all third-party apps, or CIMD apps.
• Adds configurable Rate Limit Policy enforcement modes: block requests outright, or trigger non-blocking notifications for safer policy rollout.

Vulnerability Management · 2026-08-24

Brinqa adds Cortex XDR and Cortex Xpanse connectors with coverage across alerts, vulnerabilities, hosts, and more.

• New Cortex XDR connector ingests Alert, Alert Definition, Asset, Host, Incident, Incident Definition, Installed Package, Package, Violation, Violation Definition, Vulnerability, and Vulnerability Definition data objects.
• New Cortex Xpanse connector ingests Alert, Alert Definition, Certificate, Cloud Resource, Host, Incident, Incident Definition, IP Range, Service, and Site data objects.

Vulnerability Management · 2026-08-24

Brinqa Data Lake lets you query Brinqa data through BrinqaDL analytics views in BigQuery.

• Adds a Data Lake integration exposing Brinqa data through BrinqaDL analytics views in Google BigQuery for external querying and analysis.

Web Application Security · 2026-08-24

Burp Suite 2026.8 adds customisable title bar actions, multi-evidence manual issues, and AT evidence highlighting.

• Adds customisable title bar actions, letting practitioners pin frequently used functions directly to the title bar for faster access.
• Supports multiple evidence items when manually creating issues, allowing richer documentation of findings in a single issue entry.
• Adds evidence highlighting for issues raised by Burp AT, making it easier to identify the relevant portions of captured traffic.

Web Application Security · 2026-08-24

DataDome CloudFront integration now supports the nodejs26.x Lambda runtime.

• Adds support for the nodejs26.x runtime in the DataDome CloudFront Lambda@Edge integration.

Web Application Security · 2026-08-24

DataDome Tyk module 1.4.0 adds GraphQL path detection and X-Forwarded-Host support.

• Adds datadome_graphql_endpoint config option to define one or more paths (comma-separated) used to detect GraphQL requests, defaulting to graphql.
• Adds datadome_use_x_forwarded_host config option to support host override via the X-Forwarded-Host header.
• Adds support for 301/302 redirects.

SAST / SCA / Code Security · 2026-08-24

Dependency-Track 5.0.5 uses OSV's modified_id.csv list to speed up full archive downloads.

• Leverages OSV's modified_id.csv list to optimize full vulnerability archive downloads, reducing unnecessary data transfer.

Reverse Engineering · 2026-08-24

Detect-It-Easy adds bundles for Fedora, openSUSE, AppImage, S390X, RISC-V, PPC64, Nix, FreeBSD, Windows ARM64, Parrot OS, Kali Linux, and Termux (CLI)

• Adds pre-built distribution bundles for Fedora, openSUSE, AppImage, S390X, RISC-V, PPC64, Nix, FreeBSD, Windows ARM64, Parrot OS, Kali Linux, and Termux (CLI), expanding platform coverage significantly.

Secure Access (VPN / SASE / ZTNA) · 2026-08-24

DNSFilter adds SecureTransit encrypted VPN-layer privacy policy and a redesigned DNSFilter One Agent with full-window UI

• New SecureTransit feature enforces DNS-layer traffic encryption through a DNSFilter-managed secure gateway, with a choice of WireGuard or IKEv2 protocols.
• SecureTransit policy supports three per-organization or per-device modes: Always On, Manual, or Disabled, configurable from the existing DNS filtering dashboard.
• SecureTransit blocks location trackers, mail trackers, data brokers, and ad networks on-path before data leaves the device, on any network.

SIEM · 2026-08-24

Exabeam Context Management now supports REST API Context Tables.

• Adds support for REST API Context Tables, enabling practitioners to populate and manage context table data programmatically via REST API.

General Utilities & Libraries · 2026-08-24

goshs adds a live team chat with Markdown, emoji reactions, file upload, and optional disk persistence via new CLI flags

• Adds -nc/--no-chat CLI flag and no_chat config key to disable the team chat entirely.
• Adds -pc/--persist-chat CLI flag and persist_chat config key to write the full chat log — messages, edit flags, per-emoji reaction authors — to <webroot>/.goshs-chat/chat.json after every change and restore it on restart.
• New live team chat synchronized over a WebSocket connection across all browser sessions and the --tui dashboard, replacing the old shared clipboard.

General Utilities & Libraries · 2026-08-24

goshs adds --no-chat flag to disable the team chat UI entirely.

• Adds --no-chat flag to hide and deactivate the team chat from the UI.

General Utilities & Libraries · 2026-08-24

goshs adds chat control config keys: no_chat, persist_chat, and persist_chat_images

• Adds no_chat config key to disable the built-in chat feature.
• Adds persist_chat config key to retain chat messages across sessions.
• Adds persist_chat_images config key to persist images shared in chat across sessions.

General Utilities & Libraries · 2026-08-24

goshs v2.1.6 adds upload size limits, team chat toggle, and persistent chat-to-disk options.

• Adds -mu / --max-upload flag to cap file upload size in bytes (default: 0 = unlimited).
• Adds -nc / --no-chat flag to disable the built-in team chat.
• Adds -pc / --persist-chat flag to persist chat history to disk under .goshs-chat/.

General Utilities & Libraries · 2026-08-24

goshs v2.1.6 replaces the shared clipboard with a persistent team chat supporting Markdown, emoji, reactions, image paste, and file upload across the web UI and TUI.

• Adds --persist-chat (-pc) flag to write the full chat log (messages, edit flags, per-emoji reaction authors) to <webroot>/.goshs-chat/chat.json and restore it on restart; in-memory only by default.
• Adds --persist-chat-images (-pci) flag to write base64-pasted images to disk under .goshs-chat/ instead of inlining them.
• Adds --no-chat (-nc) flag to disable the team chat entirely; replaces the old --no-clipboard flag.

Identity & Access Management · 2026-08-24

iDenfy adds standalone Bank Card Verification, Persian/Farsi RTL identity checks, Brazil CNH support, and new KYB automation endpoints

• New API endpoint to re-run KYB automation, enabling programmatic re-triggering of automated checks on existing KYB records.
• Adds dedicated tax identification fields — VAT Number, EIN, and TIN — to KYB workflows.
• Adds External Reference field to KYC verification reports for linking verifications to external systems.

Identity & Access Management · 2026-08-24

iDenfy adds bank card ownership verification as a standalone or KYC add-on flow, plus a full 37-language locale reference.

• Adds bank card ownership verification as either an additional step inside an existing KYC flow or as a fully standalone flow, confirming the card used at onboarding belongs to its holder.
• Standalone bank card verification flow includes consent and capture screens, retry-attempt tracking, dual session clocks, and end-user result screens.
• Publishes a full locale code reference covering all 37 supported languages (Latin and non-Latin scripts) for KYC and KYB verification flows.

Identity & Access Management · 2026-08-24

iDenfy adds standalone Bank Card Verification in a PCI-DSS v4.0.1 environment, Persian/Farsi RTL support, and KYB no-further-shareholders declaration.

• Bank Card Verification can now run as a standalone flow, independently of identity verification, processed in a dedicated PCI-DSS v4.0.1 certified environment.
• Identity verification adds Persian (Farsi) language support with full RTL layout and automatic photo capture on the selfie step.
• KYB ownership chains can now terminate at a company declared to have no further shareholders, closing open-ended UBO chains.

Web Application Security · 2026-08-24

Invicti adds application-level scan schedules, ephemeral API targets, incremental scan-cli scanning, and org SSO identifiers.

• Adds INVICTI_INCREMENTAL_SCAN environment variable to scan-cli to limit a scan to new or changed endpoints, reducing scan time in CI/CD pipelines.
• Adds scheduled scans for entire applications or collections, automatically running DAST scans across all included targets on a chosen recurrence (previously schedules were per-target only).
• Adds ephemeral API targets with a dynamic base URL that resolves at scan time, enabling scanning of temporary or CI/CD-provisioned environments without manual target reconfiguration.

AI/LLM Security · 2026-08-24

• Introduces the AI Bill of Materials (AI-BOM) report, generating a comprehensive inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — available via the Mend Platform reporting interface and API.
• Supports industry-standard CycloneDX 1.7 and SPDX 3.0.1 export formats for AI-BOM reports, enabling interoperability with existing SBOM toolchains.
• Scopes AI-BOM reports at organization, application, and project levels with metadata-only exports to preserve data privacy.

AI/LLM Security · 2026-08-24

Mend AI 26.8.1 adds account-level global workflows with API support and a redesigned Administration sidebar.

• Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally.
• Adds comprehensive API support for managing global workflows.
• Updates the Administration page sidebar with a categorized, collapsible navigation structure, adding a dedicated AI Usage tab under a new AI category and sub-headers for AI, Code, and Dependencies within Engine Settings.

AI/LLM Security · 2026-08-24

Mend Renovate adds overrideDescription config option, devcontainer folder patterns, and scoped Go stdlib OSV remediation.

• Adds overrideDescription option to Renovate config, allowing custom descriptions to be set on dependency updates.
• Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening which files it detects.
• Onboarding summary view now shows What to Expect first, improving the initial setup experience.

AI/LLM Security · 2026-08-24

Mend Container 26.8.1 adds Chainguard support to hardened image detection, including VEX status and branding in the UI.

• Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data, VEX information, and base image/layer detection.
• Surfaces Chainguard VEX status and branding directly in the risk factors columns across the UI for Chainguard-based images and findings.

AI/LLM Security · 2026-08-24

Mend AI adds an AI Bill of Materials (AI-BOM) report in CycloneDX 1.7 and SPDX 3.0.1 formats via UI and API.

• New AI Bill of Materials (AI-BOM) report available through the Mend Platform reporting interface and API, generating a metadata-only inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — at organization, application, and project scopes.
• AI-BOM exports support industry-standard CycloneDX 1.7 and SPDX 3.0.1 formats, enabling downstream tooling and compliance workflows that consume either standard.

Container & Image Security · 2026-08-24

Mend Container adds an AI Bill of Materials (AI-BOM) report in CycloneDX 1.7 and SPDX 3.0.1 formats via platform UI and API.

• Introduces the AI Bill of Materials (AI-BOM) report, generating a comprehensive inventory of detected AI entities — including models, system prompts, agent configurations, tools, and agents — exportable via the Mend Platform reporting interface and API in CycloneDX 1.7 and SPDX 3.0.1 formats across organization, application, and project scopes.

Container & Image Security · 2026-08-24

Mend Platform 26.8.1 adds account-level global workflows with API support and a restructured Administration sidebar.

• Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally.
• Adds comprehensive API support for managing global workflows.
• Updates the Administration page sidebar with a categorized, collapsible navigation structure, including a new dedicated AI Usage tab under an AI category and sub-headers for AI, Code, and Dependencies within Engine Settings.

Container & Image Security · 2026-08-24

Renovate 44.41 adds overrideDescription config option; 44.38 scopes Go stdlib OSV remediation to toolchain and expands devcontainer patterns

• Adds overrideDescription option to Renovate config, allowing custom description overrides per dependency update.
• Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening detection of dev container configuration files.
• Onboarding summary view now surfaces What to Expect section first, improving first-run clarity for new repositories.

Container & Image Security · 2026-08-24

Mend Container 26.8.1 adds Chainguard support with VEX status, layer detection, and branding in risk factor columns.

• Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data and VEX information.
• Detects Chainguard image layers and base images within scanned containers.
• Displays Chainguard VEX status and branding directly in the risk factors columns across the UI for clearer posture insights on Chainguard-based images and findings.

SAST / SCA / Code Security · 2026-08-24

Mend AI adds an AI Bill of Materials (AI-BOM) report in CycloneDX 1.7 and SPDX 3.0.1 formats via platform UI and API.

• New AI Bill of Materials (AI-BOM) report available through the Mend Platform reporting interface and API, generating a comprehensive inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — at organization, application, and project scopes.
• AI-BOM exports use industry-standard CycloneDX 1.7 and SPDX 3.0.1 formats, with metadata-only exports to preserve data privacy.
• AI-BOM data is populated only for scans performed after the feature release date (24-August-2026).

SAST / SCA / Code Security · 2026-08-24

• Updates the Administration page sidebar with a categorized, collapsible navigation structure, adding a dedicated AI Usage tab within a new AI category and sub-headers for AI, Code, and Dependencies under Engine Settings.

SAST / SCA / Code Security · 2026-08-24

Mend Renovate adds overrideDescription config option, devcontainer folder patterns, and scoped Go stdlib OSV remediation.

• Adds overrideDescription option to Renovate config, allowing custom descriptions to be set on dependencies.
• Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening which Dev Container files are detected.
• Onboarding summary view now shows What to Expect section first, improving the onboarding flow for new repositories.

SAST / SCA / Code Security · 2026-08-24

Mend Container 26.8.1 adds Chainguard support to hardened image detection, including VEX status and branding in the UI.

• Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data, VEX information, and detection of Chainguard image layers and base images.
• Surfaces Chainguard VEX status and branding directly within the risk factors columns across the Mend Container UI for Chainguard-based images and findings.

SAST / SCA / Code Security · 2026-08-24

Mend 26.8.1 adds account-level global workflows with API support and a redesigned Administration sidebar with AI settings.

• Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally.
• Adds comprehensive API support for managing global workflows.
• Updates the Administration page sidebar with a categorized, collapsible navigation structure aligning with Application and Project pages.

SAST / SCA / Code Security · 2026-08-24

Mend SAST adds AI Bill of Materials (AI-BOM) report in CycloneDX 1.7 and SPDX 3.0.1 formats via Platform UI and API.

• New AI Bill of Materials (AI-BOM) report available via the Mend Platform reporting interface and API, generating a comprehensive inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — across organization, application, and project scopes.
• AI-BOM exports use industry-standard CycloneDX 1.7 and SPDX 3.0.1 formats, with metadata-only exports to ensure data privacy.
• AI-BOM coverage applies only to scans performed after the feature release date (24-August-2026).

SAST / SCA / Code Security · 2026-08-24

Mend SAST 26.8.1 adds account-level global workflows with API support and a redesigned Administration sidebar.

• Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with controls over whether org-level admins can enable or disable them locally; includes comprehensive API support for managing global workflows.
• Updates the Administration page sidebar with a categorized, collapsible navigation structure; moves AI Usage settings from the General tab to a dedicated AI Usage tab under a new AI category; adds AI, Code, and Dependencies sub-headers within Engine Settings.

SAST / SCA / Code Security · 2026-08-24

Renovate 44.41 adds overrideDescription config option and scopes Go stdlib OSV remediation to the toolchain directive

• Adds overrideDescription option to Renovate configuration, allowing users to customize dependency update PR descriptions.
• Manager devcontainer: adds folder pattern to the list of managerFilePatterns, expanding Dev Container dependency detection.
• Onboarding: shows What to Expect first in the summary view for a clearer onboarding experience.

SAST / SCA / Code Security · 2026-08-24

Mend Container 26.8.1 adds Chainguard support to hardened image detection, including VEX status and layer visibility in the UI.

• Adds Chainguard as a supported source in hardened image detection, incorporating Chainguard-specific vulnerability data, VEX information, and base image/layer detection.
• Surfaces Chainguard VEX status and branding directly in the risk factors columns across the UI for Chainguard-based images and findings.

SAST / SCA / Code Security · 2026-08-24

Mend AI adds an AI Bill of Materials (AI-BOM) report in CycloneDX 1.7 and SPDX 3.0.1 formats via platform UI and API.

• Adds the AI Bill of Materials (AI-BOM) report, available through the Mend Platform reporting interface and API, generating a comprehensive inventory of detected AI entities — models, system prompts, agent configurations, tools, and agents — across organization, application, and project scopes.
• Supports industry-standard CycloneDX 1.7 and SPDX 3.0.1 export formats for AI-BOM data, enabling interoperability with existing SBOM toolchains.
• Enforces metadata-only exports in AI-BOM reports to preserve data privacy while maintaining visibility into AI usage.

SAST / SCA / Code Security · 2026-08-24

Mend SCA adds account-level global workflows with centralized governance and full API support across organizations.

• Introduces Account-Level (Global) Workflows, letting administrators define workflows centrally and propagate them to selected organizations, with API support for managing global workflows.
• Adds controls for whether organization-level admins can enable or disable account-level workflows locally.
• Updates the Administration page sidebar with a categorized, collapsible navigation structure, including a new dedicated AI Usage tab under an AI category (moved from the General tab) and sub-headers for AI, Code, and Dependencies under Engine Settings.

SAST / SCA / Code Security · 2026-08-24

Mend Renovate adds overrideDescription config option, devcontainer folder patterns, and scoped Go stdlib OSV remediation.

• Adds overrideDescription option to Renovate config for customizing dependency update descriptions.
• Adds folder pattern support to managerFilePatterns for the devcontainer manager, broadening file discovery.
• Onboarding summary view now shows What to Expect section first for clearer initial setup guidance.

SAST / SCA / Code Security · 2026-08-24

Mend Container v26.8.1 adds Chainguard support to hardened image detection, including VEX status and branding in the UI.

• Adds Chainguard as a supported vendor in Mend Container's hardened image detection, incorporating Chainguard-specific vulnerability data, VEX information, and Chainguard image layer and base image detection.
• Surfaces Chainguard VEX status and branding directly in the risk factors columns across the UI for Chainguard-based images and findings.

Container & Image Security · 2026-08-24

Minimus AI Integrations teach AI coding agents to build and migrate Dockerfiles using hardened distroless base images.

• New Minimus AI Integrations capability delivers a Dockerfile migration prompt that guides AI agents (Claude Code, Cursor, OpenAI Codex, Windsurf, GitHub Copilot) to use hardened Minimus distroless images instead of bloated general-purpose base images.
• Agents are guided to produce multi-stage Dockerfiles using the dev variant (includes shell and package manager) for the build stage and the fully distroless production variant for the runtime stage, minimizing attack surface.
• Community Edition users can paste the one-off migration prompt directly into an AI chat session to migrate a single Dockerfile or scaffold a new containerized app with no account or setup required.

Identity & Access Management · 2026-08-24

Ping Identity adds ESV support for connector server names, inline script error visibility, and streamlined identity/job editing workflows.

• Enables use of an ESV (Environment Secret/Variable) for the connector server name in the New Connector Server modal.
• Surfaces script errors directly in the script editor when scripts reference environment ESVs incorrectly.
• Allows creating another identity immediately after creating one, without closing the modal.

SAST / SCA / Code Security · 2026-08-24

Snyk rolls out a redesigned UI with unified navigation, Cmd/Ctrl+K command search, and Dark Mode.

• Adds Cmd/Ctrl+K navigation search to jump directly to any page or setting without menu-hunting.
• Introduces Dark Mode (System/Light/Dark) selectable from the user account menu, consistent across all pages.
• Replaces the classic multi-scope sidebar with a single breadcrumb bar supporting one-click scope switching via per-level drop-downs for Tenant, Group, and Organization.

SAST / SCA / Code Security · 2026-08-24

Socket adds --dynamic-sbom-inference flag to Node CLI for per-subproject JVM reachability analysis across Gradle, sbt, and Maven builds.

• Adds --dynamic-sbom-inference flag to socket scan create --reach in the Node CLI, triggering the build tool to generate a Socket facts file so every Gradle, sbt, and Maven build under the scan target is analyzed per-subproject rather than as a single unit — yielding faster scans on large repos and more accurate dependency graphs.
• Adds socket manifest setup --dynamic-sbom-inference to configure per-project defaults one build at a time for repositories containing several JVM builds.
• Adds socket manifest dynamic-sbom-inference as a standalone pre-generation step, enabling Python CLI users (and sbt/Gradle-without-lockfile users) to produce the required facts files before running a scan.

SAST / SCA / Code Security · 2026-08-24

Socket Kotlin scans now support full reachability analysis with dynamic SBOM inference per Gradle subproject.

• Adds --reach --dynamic-sbom-inference flags to socket scan create for full application reachability scans on Kotlin projects, analyzing and reporting reachability per Gradle subproject using the dependency graph Gradle itself resolves.

SAST / SCA / Code Security · 2026-08-24

SonarQube adds a Remediation Agent that autonomously fixes issues in PRs and main-branch backlogs using a configurable LLM provider.

• New SonarQube Remediation Agent fixes backlog issues in your main branch on a schedule or when issues are assigned to it, configurable per repository and project.
• Administrators can enable the Remediation Agent for an organization, supply an LLM provider key, and control which repositories and projects it operates on via SonarQube Cloud administration settings.

SAST / SCA / Code Security · 2026-08-24

ARC Harden Runner v2.19.0 adds deny list egress enforcement and configurable image pull policy via Helm values.

• Adds env.imagePullPolicy and tetragon.imagePullPolicy Helm values to control image pull behavior for ARC Harden Runner and Tetragon images, enabling IfNotPresent for clusters that pre-pull images or operate behind constrained registries.
• Extends deny list egress policy enforcement to ARC Harden Runner — policies attached at Cluster scope in the Policy Store now block specific destinations across every job in that cluster without requiring workflow file changes.

SAST / SCA / Code Security · 2026-08-24

StepSecurity OIDC federation now supports AWS, letting EKS, EC2, and Lambda workloads mint API tokens without stored keys.

• Adds AWS as a second OIDC federation provider for StepSecurity trust policies, alongside GitHub Actions — EKS, EC2, Lambda, and any workload that can call AWS STS can now mint scoped StepSecurity API tokens without a long-lived key.
• AWS trust policies match on the issuer URL of the account's outbound federation, the 12-digit AWS account ID, and an optional role ARN — leave the role ARN blank to trust any role in the account, or specify one to pin to a single workload.
• AWS trust policies carry the same max session duration and permissions allowlist controls already available to GitHub Actions policies, so minted tokens are capped and scoped identically.

SIEM · 2026-08-24

Scheduled searches with Save to Index now save unlimited results per run; the 512-result cap is removed.

• Removes the 512-result-per-run cap for scheduled searches using the Save to Index alert type, so every result returned by a run is now saved to the view.
• The _raw field is now empty for aggregate query results saved to a ScheduledSearchView; all values remain accessible in their individual named fields (e.g. _count, batch, parsedfield).

AI-Powered Offensive Security · 2026-08-24

T3MP3ST adds Novita AI as a native LLM provider and enables Claude Code session resume across kill-chain phases.

• Adds NOVITA_API_KEY environment variable to enable Novita AI as a first-class LLM provider, dispatched through the OpenAI-compatible endpoint at https://api.novita.ai/openai/v1 with a default model and curated model catalog entries.
• Adds T3MP3ST_TRUST_CLAUDE_SESSION environment variable (set to 1) to enable Claude Code session resume across kill-chain phases, persisting session state between agent turns instead of starting fresh each time.
• Adds optional resetSession() method to the LLMProviderAdapter interface, allowing providers that support resumed backend sessions to expose a clean-session escape hatch.

Detection Engineering · 2026-08-24

Tenzir v6.13.0 brings parallel pipeline execution across the node, and v6.12.0 adds RELP transport for Syslog ingestion.

• Supports parallel pipeline execution across the node, enabling concurrent pipeline runs in Tenzir Node v6.13.0.
• Adds Syslog ingestion over RELP (Reliable Event Logging Protocol) in Tenzir Node v6.12.0.

Runtime Security · 2026-08-24

Tetragon TracingPolicy CEL expressions gain bitwise operators: and(), or(), xor(), not()

• Adds bitwise operators and(), or(), xor(), and not() to CelExpr selectors in TracingPolicy, enabling fine-grained flag and bitmask matching in kernel event filters.

Endpoint Security (EDR/XDR) · 2026-08-24

Zero Trust Secure Access On-premises Gateway 1.0.92 adds non-UPN support in X-Authenticated-User header and expands DLP/AI log snippets to 1,000 bytes.

• Supports non-UPN values in the X-Authenticated-User header and records them in traffic logs, enabling identity tracking for users whose identities are not expressed as UPNs.
• Increases the maximum content snippet recorded in DLP and AI detection logs from 100 bytes to 1,000 bytes, providing substantially more context per log entry.

Security Data Fabric & Federated Search · 2026-08-24

Vega launches Detection Skills, an open standard for post-match triage, investigation, and optimization built on Anthropic's Agent Skills format.

• Launches the Detection Skills open standard at detectionskills.io, built on Anthropic's Agent Skills format, for encoding triage, investigation, and detection-optimization logic as versioned, shareable YAML skills.
• Integrates Detection Skills into the Vega Cyber Defense Platform via a detection notebook workflow: compose detection logic, attach skills for triage/investigation/optimization, and receive tuning proposals with attached reasoning for engineer approval.
• Adds an optimization loop that writes approved verdicts back into the detection rule, incrementally sharpening coverage with each alert fire.

Malware Analysis · 2026-08-24

YARA-X v1.20.0 adds --ignore-invalid-rules CLI flag, experimental MSI/VBA/OLECF modules, SIMD-accelerated matching, and new C/Go/Python API surfaces.

• Adds --ignore-invalid-rules CLI option to skip rules that fail to compile without aborting a scan.
• Exposes ignore_invalid_rules in the Python API, matching the new CLI flag.
• Adds yrx_scanner_max_matches_per_pattern to the C API and Scanner.MaxMatchedPerPattern to the Go API to cap per-pattern match counts.

Threat Intelligence · 2026-08-24

Yeti 2.7.0 adds a dynamic object-type discovery endpoint and bucketed, scopeable global search results.

• Adds GET /system/types endpoint returning a dynamic list of every creatable object type in the instance.
• Global search results are now bucketed by type instead of returned as one merged, unranked list.
• Semantic search can now be scoped to a single object type, preventing it from crowding out other type results.

Exploitation & C2 · 2026-08-23

adscan v11.2.0 adds --dns-server for segmented networks and auto-detects a separate DNS host during range discovery.

• Adds --dns-server flag to adscan ci, adscan execute, and adscan doctor to direct all name resolution to a separate DNS host in segmented networks where the AD-zone DNS server is not the domain controller — covering domain and PDC-hostname discovery, SMB and ADCS CA name resolution, Kerberos SPN lookup, cross-forest trust resolution, and the network-preflight DNS check. --dc-ip remains the authentication and enumeration target; omitting --dns-server preserves existing behaviour.

Identity & Access Management · 2026-08-23

Aembit Cloud v1.33 adds an OpenAI WIF credential provider for secretless, keyless ChatGPT API access via federated OIDC tokens.

• Adds the OpenAI WIF credential provider in Aembit Cloud v1.33, enabling workloads to authenticate to the OpenAI ChatGPT API with short-lived, scoped access tokens instead of static sk-proj-... API keys.
• Extends Aembit's WIF credential provider ecosystem to now cover AWS STS, Azure Entra, GCP, Anthropic Claude, and OpenAI ChatGPT under a single secretless access policy model.
• The EdgeController intercepts outbound OpenAI API requests at runtime, exchanges an Aembit-issued federation token at OpenAI's token endpoint, and injects the resulting short-lived access token — requiring no application code changes, SDK modifications, or credential management logic.

Identity & Access Management · 2026-08-23

Aembit extends its WIF Credential Provider ecosystem to the Claude API, replacing static sk-ant-… keys with short-lived, automatically exchanged tokens.

• Adds a new Claude Workload Identity Federation Credential Type option in the Aembit Credential Provider UI, with required fields federation_rule_id, organization_id, and service_account_id, and optional fields audience, scope (defaults to workspace:developer), workspace_id, and lifetime (defaults to 3600 seconds, range 300–43200).
• Adds a claude_wif block to the Aembit Terraform Provider, with required arguments federation_rule_id, organization_id, and service_account_id, and optional arguments audience, scope, workspace_id, and lifetime.
• Aembit's EdgeController now transparently performs the federation token exchange against Claude's POST /v1/oauth/token OAuth endpoint and injects the resulting short-lived bearer token into outbound requests — no application code changes required.

Web Application Security · 2026-08-23

Arcjet bot protection now supports remote rules from the dashboard or MCP server for incident response without code changes.

• Adds remote bot rules configurable from the Arcjet dashboard or MCP server, applying site-wide bot allow/deny policies without code changes or redeployment — useful for blocking a newly spotted bot category during an incident.
• Supports per-rule allow or deny actions on individual bots or entire bot categories, with an empty allow list blocking every detected bot.
• Enables hybrid bot policy: developers manage route-specific bot rules in code while SecOps teams apply site-wide changes via remote rules for incident response.

Web Application Security · 2026-08-23

Arcjet adds an optional on-device Rampart NER model backend for sensitive-info detection, with configurable confidence, accelerator, and custom recognizers

• Adds arcjet[sensitive-info-rampart] pip extra that installs the Rampart on-device NER model (~14.7 MB, ~18.5M parameters, 4-bit quantized, 512-token context) as an alternative detection backend for the sensitive-info rule.
• Adds a rampart() backend option to the sensitive-info rule that detects names, addresses, and government or financial identifiers beyond the built-in WebAssembly engine.
• Adds rampart_entities() helper (Python) to conveniently reference all entity types the Rampart model detects, usable directly in the detect list.

Web Application Security · 2026-08-23

Arcjet adds content moderation as a Guard rule, detecting harmful text in JS/TS, Python, and Go before it's stored or forwarded.

• Adds moderateContent() (JS/TS), ModerateContent() (Python), and arcjet.GuardModerateContent() / GuardModerateContentOptions (Go) as new Guard rules that detect harmful text in untrusted input before it is stored, displayed, or forwarded.
• Exposes decision.conclusion === 'DENY' / decision.reason === 'MODERATE_CONTENT' (JS/TS), decision.conclusion == 'DENY' / decision.reason == 'MODERATE_CONTENT' (Python), and decision.IsDenied() / decision.Reason == arcjet.ReasonModerateContent (Go) to branch on moderation outcomes.
• Returns a result object with result.detected (bool), result.billing.unit (text_units), and result.billing.count so callers can track usage metering per Guard call.

Web Application Security · 2026-08-23

Arcjet adds content moderation as a Guard rule for scanning user messages, tool results, and model outputs before they leave your control.

• New moderateContent() (JavaScript/TypeScript) rule for guard() that evaluates untrusted text and returns ALLOW or DENY with reason MODERATE_CONTENT; mode defaults to LIVE and is optional.
• New ModerateContent() (Python) rule for guard() with the same binary detected verdict and optional text_units billing; mode defaults to LIVE.
• New GuardModerateContent (Go) rule for Guard() where Mode is required (ModeLive or ModeDryRun); omitting Mode returns ErrInvalidMode.

Web Application Security · 2026-08-23

Arcjet adds prompt injection detection for AI pipelines, blocking jailbreaks and instruction overrides before they reach the model.

• New detectPromptInjection function (JavaScript) and detect_prompt_injection function (Python) scan user input and tool results for injection patterns — jailbreaks, role-play escapes, and instruction overrides — at the request boundary before entering model context.
• Binary verdict exposed via decision.reason.isPromptInjection() or decision.reason.injectionDetected in JavaScript, and decision.reason_v2.type == 'PROMPT_INJECTION' in Python.
• Accepts a required mode parameter; in Python, omitting mode or passing threshold= raises TypeError.

Web Application Security · 2026-08-23

Arcjet Guards gains structured Metadata on requests, Capture events for visibility, and an in-process test client for Guard calls.

• Adds a Metadata field to guard() / protect() and every Guard rule accepting string keys mapped to any JSON-serializable value (nested objects, arrays, numbers, booleans, null) for analytics and debugging — excluded from fingerprinting and decision cache keys.
• Server-enforced Metadata limits: max 128 top-level keys, 4 KiB per serialized value, 768 KiB total per request; dropped keys surface as warnings on decision.warnings / decision.Warnings (one per key).
• SDK encoding failures per language collected into a single AJ1017 warning: JavaScript drops undefined, functions, BigInt, and circular references; Python drops datetime, sets, NaN, and circular references; Go drops channels, funcs, cycles, NaN, and invalid UTF-8 strings.

Web Application Security · 2026-08-23

Arcjet adds capture() for non-gating security event tracing across JS/TS, Python, and Go SDKs

• Adds capture() method (JS/TS: arcjet.capture(), Python: aj.capture(), Go: guard.Capture()) to record security-relevant actions — refunds, exports, tool calls — as visibility events without affecting guard() or protect() decisions.
• Accepts action (required, 'resource.verb' past-tense convention), plus optional correlationId/correlation_id, decisionId/decision_id, metadata (nested JSON), occurredAt/occurred_at, and (JS only) waitUntil for serverless invocation lifetime management.
• Adds flush()/Flush to drain the in-memory event queue before shutdown; JS accepts an optional deadline in milliseconds (e.g. arcjet.flush(250)), Go accepts a context.Context; defaults to a one-second deadline.

Web Application Security · 2026-08-23

Arcjet adds agent guard adapters for LangGraph JS, Genkit, OpenAI Agents, Claude Agent SDK, Mastra, and Eve across JavaScript and Python

• Adds @arcjet/guard/langgraph/v1 adapter with guardTool() for authored tool()/StructuredTool handlers and guardToolNode() for unwrapped and MCP tools executing inside ToolNode in LangGraph JS Graph API agents.
• Adds @arcjet/guard/genkit/v1 adapter with guardTool() on returned ToolAction objects and guardMiddleware() as a { name, instantiate } generateMiddleware hook for Genkit JS flows.
• Adds @arcjet/guard/openai-agents/v0 adapter with guardTool() to wrap FunctionTool.invoke after tool({ execute }) for OpenAI Agents text Agent workflows.

AI/LLM Security · 2026-08-23

Aurascape Zero-Bypass MCP Gateway pairs an MCP Gateway with an AI Proxy to block tool calls that skip policy enforcement

• Introduces the Zero-Bypass MCP Gateway, which governs MCP tool access and marks every approved call so the AI Proxy can block any tool invocation that bypassed the Gateway before the model acts.
• Adds automatic MCP server and tool discovery with automatic enrollment, eliminating manual registration of AI agent tool surfaces.
• Supports tool-level sanctioning bound to users and groups, enabling fine-grained access control over which agents can call which MCP tools.

Exploitation & C2 · 2026-08-23

Bugcrowd launches Savant Pathseeker 1.0 in Early Access, introducing autonomous pentesting capability.

• Introduces Savant Pathseeker 1.0 in Early Access, an autonomous pentesting capability on the Bugcrowd platform.

Web Application Security · 2026-08-23

Caido v0.58.2 adds progress logging to the project upgrade window for visibility into large migrations.

• The project upgrade window now displays live progress logs during migration, giving visibility into long-running upgrades.

Malware Analysis · 2026-08-23

CAPEv2 gains an API call trace diff tool, psycopg3 PostgreSQL support with auto-upgrade, and iterative process tree cycle detection.

• Adds automatic in-memory upgrade of postgresql:// connection strings to postgresql+psycopg:// in lib/cuckoo/core/database.py when psycopg v3 is installed, preventing startup ImportError without any config change.
• Adds psycopg (v3) support as the PostgreSQL database driver, enabling modern async capability and significant performance gains over the previous psycopg2 driver.
• Introduces an API call trace diff comparison tool in the web compare view (web/compare/views.py) with basic sequence alignment, replacing the earlier PR #3093 approach.

Secure Access (VPN / SASE / ZTNA) · 2026-08-23

Cato AI Security adds Claude inference hook integration, MCP/skill posture visibility, and scoped agent policy rollout via Cato Scout

• Adds scout-debug command to verify hook registration inside supported agents, enabling in-workflow deployment troubleshooting.
• Extends Cato AI Security coverage to Claude Chat, Claude Code, and Claude Cowork via Anthropic Inference Hooks — no endpoint agent or network inline access required.
• Adds MCP and tool visibility so security teams can enumerate the MCP servers and tools available to agents and assess their combined risk surface.

Secure Access (VPN / SASE / ZTNA) · 2026-08-23

Cato Networks introduces Agentic Threat Prevention, combining inline conditional enforcement and an agentic decision-making layer to stop multi-stage AI-driven attacks in real time.

• New Agentic Threat Prevention capability surfaces findings, supporting evidence, activated controls, and mitigation status inside the Cato Management Application.
• Inline conditional enforcement dynamically tags hosts based on recent activity and denies specific behaviors mapped to MITRE ATT&CK tactics — for example, blocking executable downloads from cloud services on hosts that have contacted known C2 servers.
• Agentic decision-making layer continuously aggregates telemetry, reasons about host patterns, and automatically applies prevention policies in real time without manual intervention — for example, denying lateral movement vectors on hosts exhibiting both internal discovery and suspicious external communications.

SAST / SCA / Code Security · 2026-08-23

Chalk v1.2.0 adds a DNS telemetry sink, sink fallback chains, per-chalk reporting, new runtime timing keys, and metadata headers on HTTP sinks.

• New dns sink type encodes chalk key values into DNS lookup hostnames via a domain_template with {KEY} placeholders, providing a telemetry channel for environments where HTTPS egress is restricted; supports dns_server, require_chalk_mark, and per-key normalize.<KEY>.callback fields in sink_config.
• New fallback_sink_config field on all sink_config sections names a backup sink to use when the primary is unavailable or disabled; chalk walks the full fallback chain on each delivery failure, with each sink tracking its own disable_after_errors counter independently.
• outconf sections now support per_chalk_reports: true and custom_report sections support per_chalk: true to emit one report per chalk mark instead of bundling all marks into a single report.

Internet Services · 2026-08-23

Cloudflare adds CASB auto-remediation policies, enriched API 403 responses, optional OAuth scopes, and higher Browser Rendering limits.

• Cloudflare API 403 Forbidden responses now include a documentation_url field pointing directly to the denied endpoint's API documentation, surfacing required roles for faster self-service troubleshooting and enabling agents to drive approval workflows from error context.
• Adds CASB remediation policies in Cloudflare One to automatically remediate file-sharing findings in Microsoft 365 and Google Workspace — or send webhooks to Slack, ServiceNow, or any destination — the moment CASB detects a finding, with no manual triage.
• OAuth clients can now classify configured scopes as required or optional in the Cloudflare dashboard; users see Read Only and Full Access templates and a scope search on the consent screen, and can decline optional scopes to enforce least-privilege access.

SAST / SCA / Code Security · 2026-08-23

cve-lite-cli v1.30.0 adds a Root column across all report formats and auto-applies safe transitive fixes with --fix

• Adds --fix auto-application of safe within-range transitive refreshes when the fix is available inside the parent's declared range, without requiring a parent-level upgrade.
• Adds a Root column showing the top-level direct dependency behind each transitive finding, across terminal, JSON, and HTML report outputs (including multi-folder scans).
• pnpm lockfile parsing now runs once per scan instead of up to three times, delivering approximately 14% faster warm scans on large monorepos.

Public Key Infrastructure (PKI) · 2026-08-23

CertCentral adds Persistent DNS TXT record bulk revalidation, X9 PKI multi-year TLS certs, and in-place ACME ICA updates

• Adds support for the Persistent DNS TXT record DCV method in CertCentral bulk domain revalidation — a one-time DNS TXT record containing a DigiCert-provided persistent URI that is reused on every subsequent revalidation without creating new records or values.
• Extends X9 PKI for TLS certificate validity options from 397-day maximum to selectable 1-, 2-, or 3-year terms (custom validity capped at 1,095 days), available on the Dashboard under Request a Certificate > Request X9 PKI for TLS Certificate > Certificate Settings > Validity period.
• Enables updating the issuing intermediate CA (ICA) certificate on an existing ACME Directory URL without creating a new URL — accessible via the ACME Directory URL Restrictions panel using the 'Intermediate chains [Intermediate CA] > [Root CA]' menu.

Data Security & DLP · 2026-08-23

fhEVM v0.14.0 adds KMS epoch lifecycle, unified EIP-712 decryption, confidential bridging, and new Solidity FHE APIs

• Adds destroyKmsEpoch to the KMS connector for epoch destruction as part of the KMS context/epoch lifecycle, alongside single-in-flight enforcement, signature-checked epoch activation confirmations, and getters for context-switch monitoring.
• Adds deployProtocolConfigFromMigration, deployKMSGenerationFromMigration, upgradeKMSGeneration, and verify Hardhat tasks as the new required deployment and rollout path replacing the removed KMSGeneration Gateway migration path.
• Adds --seed-start-block flag to the host-listener poller for controlling coprocessor block replay start point.

Secure Access (VPN / SASE / ZTNA) · 2026-08-23

API surface changed: +6 endpoints, −1 endpoint, 2 modified

• New endpoint GET /intune_posture_providers
• New endpoint GET /intune_posture_providers/{id}
• New endpoint GET /iru_devices

Endpoint Security (EDR/XDR) · 2026-08-23

Fleet adds DELETE /api/v1/fleet/android_enterprise to disconnect Android Enterprise and un-enroll affected hosts.

• Adds DELETE /api/v1/fleet/android_enterprise endpoint to remove a connected Android Enterprise integration, which un-enrolls all associated hosts and turns off Android MDM features.
• Exposes user_id, user_email, fleet_initiated, and streamed fields in activity/audit log entries.
• New endpoint documented: DELETE /api/v1/fleet/android_enterprise

Secrets Detection & Management · 2026-08-23

GitGuardian adds Cloudsmith container registry support for Secret Scanning

• Adds Cloudsmith as a supported container registry source for Secret Scanning, enabling teams to monitor Docker images hosted on Cloudsmith for hardcoded secrets alongside other connected registries.

Exploitation & C2 · 2026-08-23

Metasploit adds RCE modules for Flowise and Langflow, a Forgejo file-read gather module, and new Linux MIPS64 payload stagers.

• Adds exploit/multi/http/flowise_mcp_rce exploit module targeting remote code execution in Flowise via HTTP.
• Adds exploit/multi/http/langflow_unauth_rce_cve_2026_9198 exploit module for unauthenticated RCE in Langflow.
• Adds auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774 gather module for arbitrary file read in Forgejo.

Data Security & DLP · 2026-08-23

MIND launches three new AI DLP agents plus a Model Context Protocol interface for plain-language agent control.

• New Model Context Protocol (MCP) interface lets teams direct MIND agents in plain language from any MCP-compatible AI client, with no console switching or query syntax to learn.
• New Policy Producer Agent autonomously creates and continuously refines DLP policies based on observed environment activity and direct instructions, eliminating manual policy engineering.
• New Rapid Response Agent executes approved remediation actions immediately and escalates to human approval when required, removing queue delays.

Digital Forensics & Incident Response · 2026-08-23

Mitiga launches Helios AIDR with AI Insights, automating contextual triage, risk scoring, and evidence assembly for cloud SecOps.

• Introduces Helios AIDR, an AI-driven cloud detection and response platform that performs real-time triage across multi-cloud and SaaS environments.
• Launches AI Insights as the first Helios AIDR capability, automatically executing contextual triage tests against every potential threat lead and significant cloud activity.
• AI Insights dynamically adjusts risk scores and separates routine activity from genuine security concerns without manual analyst intervention.

Digital Forensics & Incident Response · 2026-08-23

Mitiga launches HeliosAI Investigation, natural-language log search, and AI Summary for Workbench Events in the HeliosAI Agent.

• Adds HeliosAI Investigation to the HeliosAI Agent, providing guided cross-cloud and SaaS incident investigation across AWS, GCP, Azure, Microsoft 365, Okta, and SaaS applications — surfacing leads, connecting identity activity, and showing the forensic evidence and confidence reasoning behind every verdict.
• Adds natural-language log search to the HeliosAI Agent, letting analysts query the Cloud Security Data Lake in plain English with no query syntax or schema knowledge required.
• Adds AI Summary for Workbench Events, which reads a selected group of forensic events and generates a narrative covering what happened, in what order, and why it matters — with one-click access to the underlying raw log entries and detectors.

Digital Forensics & Incident Response · 2026-08-23

Mitiga launches Investigation Workbench for unified multi-cloud and SaaS incident investigation across a single pane of glass.

• Adds Investigation Workbench to the IR2 Platform, providing a single-pane view of activity chains across multi-cloud and SaaS environments without requiring deep cloud investigation expertise.
• Provides automated timelines of cloud and SaaS user activity to help SOC teams assess incident scope — such as tracking post-phishing actions like file downloads or email access.
• Enables internal IR and SOC teams to quickly determine incident materiality and decide between in-house containment versus external expert escalation, supporting SEC 4-day disclosure requirements.

Reconnaissance & OSINT · 2026-08-23

Nmap's rsync-list-modules NSE script gains structured XML output

• The rsync-list-modules NSE script now emits structured XML output, making its results parseable in -oX / -oA Nmap XML reports.

Identity & Access Management · 2026-08-23

Nudge Security now discovers AI agents built on Datadog and HubSpot via browser-based agent discovery.

• Discovers AI agents built on Datadog and HubSpot as part of the AI agent discovery research preview, surfaced through the browser extension.
• Access to the research preview can be requested from the AI Agents tab under Identities.

Security Data Pipeline · 2026-08-23

Realm now streams parsed, OCSF-normalized, enriched security logs directly into Databricks Delta Lake via the Zerobus Ingest push API, governed by Unity Catalog.

• New Databricks integration delivers security telemetry directly into Unity Catalog Delta tables via Zerobus Ingest, Databricks' serverless push-based ingestion API, with no customer-managed staging bucket or message bus.
• Realm streams both raw logs and parsed, OCSF-normalized versions simultaneously, letting teams route raw events to Bronze and structured data to Silver within their medallion architecture.
• Real-time enrichment with GeoIP, threat intel, and customer-supplied CMDB or HRIS context is applied as events flow through, before they land in the lakehouse.

Security Data Pipeline · 2026-08-23

Realm Security adds Detection Integrity and Data Haven Search to cut SIEM volume without breaking coverage.

• New Detection Integrity capability reads every SIEM detection, maps each rule to its dependent log sources and fields, and auto-generates pipeline protection rules to preserve coverage as volume is reduced — supporting Sigma, KQL, and SPL.
• Detection Integrity produces a shareable report showing what was reduced, what was protected, projected savings, and MITRE ATT&CK coverage before and after each reduction; when a cut cannot be applied safely, it flags the finding instead of cutting.
• New search inside Realm Data Haven lets analysts query their full immutable security history directly against OCSF-normalized observables and resupply exact events to any destination — no restore step, no schema setup, no data-lake infrastructure required.

Exploitation & C2 · 2026-08-23

Rekono 2.0 adds finding triage, multi-format reports, VirusTotal/EPSS/CVE enrichment, alerting, and a rebuilt Nuxt UI.

• Replaces the /api/system/ endpoint with /api/settings/ and one dedicated endpoint per integration for granular control.
• Removes scheduled_in from scans; scheduled_at is the only scheduling field going forward.
• Removes the /newauth, /newtechnology, and /newvulnerability Telegram bot commands; these values are now requested inline when a scan is created.

Web Application Security · 2026-08-23

Salt launches the first AWS WAF Partner Managed Ruleset purpose-built for API and AI agent protection, available now in AWS Marketplace.

• Introduces Salt Managed Rules for AWS WAF, the first AWS WAF Partner Managed Ruleset built specifically to protect APIs and AI agents — subscribable from AWS Marketplace and attachable to existing web ACLs with no new infrastructure.
• Adds industry-first MCP endpoint awareness: identifies and labels MCP traffic, blocks unauthenticated MCP access, and provides observability into MCP interactions inside AWS WAF environments.
• Detects API-layer attack vectors missed by standard WAF rules — including credential brute force, excessive GraphQL queries, SSRF, prototype pollution, and JWT-based anomalies.

SAST / SCA / Code Security · 2026-08-23

StackHawk 6.4.0 adds multi-profile scan mode control, a new auth-bypass scan rule, and team ownership management for applications.

• Adds PUT /api/v1/org/{orgId}/team/{teamId}/application endpoint behavior correction — Team assignments made through the API now persist correctly; previously the endpoint returned success without saving.
• Applications table now shows Team ownership for each application and supports inline reassignment; applications without a Team are labeled Unassigned.
• Team ownership field is also available in Application Settings > General, with Unassigned at the top of the list.

Reconnaissance & OSINT · 2026-08-23

subfinder v2.16.0 adds scanmalware passive source and enforces -max-results across paginating sources

• Adds -mr / -max-results flag enforcement across all paginating sources, so result caps are now reliably honored when sources page through results.
• Adds scanmalware as a new passive subdomain discovery source, available via -s scanmalware.

SIEM · 2026-08-23

API surface changed: 1 modified

• POST /v2/search/jobs: request body changed

Detection Engineering · 2026-08-23

Tenzir Test v2.1.0 adds format-aware sorting that keeps multiline record blocks intact during test output comparison.

• Applies pre-compare transforms consistently across the shell, Python fixture, and diff runners before baseline comparison.
• Keeps multiline record blocks intact when sorting test output, stabilizing nondeterministic event ordering.

Identity & Access Management · 2026-08-23

Token Security integrates with Claude's Compliance API to discover, map, and govern Anthropic API keys and AI agent identities.

• Integrates with Claude's Compliance API to pull Anthropic identity and activity signals — API keys, workspaces, projects, users, service accounts, model activity, tool usage, administrative events, and key lifecycle events — into Token's identity control plane.
• Enables discovery and ownership mapping of Anthropic API keys across the full access chain: from creation in Claude through storage in repository secrets, invocation by CI/CD pipelines, and execution inside cloud workloads.
• Surfaces Claude-specific identity posture risks including stale Anthropic keys, keys without clear owners, abandoned workspaces, over-privileged access, and unrotated credentials.

Identity & Access Management · 2026-08-23

Token Security adds MCP Server Discovery to automatically find, inventory, and analyze hidden AI/MCP servers and embedded secrets across enterprise endpoints.

• Automatically retrieves MCP configuration files (e.g., claude_desktop_config.json, .mcp.json configs) from endpoints via CrowdStrike Real Time Response (RTR) without user disruption.
• New MCP Server Discovery capability continuously scans and inventories MCP servers and AI agent processes across enterprise environments, integrating with CrowdStrike and other endpoint ecosystems without requiring additional agents.
• Analyzes CrowdStrike logs for IDE and Claude Code instances to pinpoint which MCP servers they are communicating with, surfacing discoveries in near real time.

Secrets Detection & Management · 2026-08-23

TruffleHog Enterprise gains AWS Analyze: enriches discovered AWS keys with IAM identity, permissions, and revocation metadata.

• New cloud analyze integration for AWS (AWS Analyze) in TruffleHog Enterprise shows the IAM identity behind a discovered AWS key, its identity-based permissions, and related revocation metadata to accelerate triage.
• Supports two authentication methods for the privileged analysis identity: IAM user access keys (access key ID + secret access key), or short-lived client certificates via IAM Roles Anywhere.
• Optional role ARN field on the access-key integration lets TruffleHog assume a role for analysis; the IAM user must also have sts:AssumeRole on arn:aws:iam::*:role/* when this is set.

Security Data Fabric & Federated Search · 2026-08-23

Vega introduces Detection Skills: an open standard for attaching triage, investigation, and tuning logic directly to detections.

• Launches Detection Skills, an open standard built on Anthropic's Agent Skills format, enabling triage, investigation, and optimization reasoning to be written as versioned skills that attach to detections and execute as a continuous agentic loop.
• Ships the Detection Skills Library with 50+ skills from Vega Research and partners — the same skills running inside the Vega platform — available openly at detectionskills.io.
• Provides a sandbox at detectionskills.io to build a detection, attach a skill, preview the verdict, and export spec-compliant YAML.

Secure Access (VPN / SASE / ZTNA) · 2026-08-23

vopono 0.10.22 adds vopono check for daemon connectivity and health checks covering IPv4, IPv6, and DNS.

• Adds vopono check subcommand to run daemon connectivity and health checks covering IPv4, IPv6, and DNS lookups.

Secure Access (VPN / SASE / ZTNA) · 2026-08-23

vopono 0.10.21 adds AirVPN WireGuard sync, --json output for programmatic use, and IPv6 improvements.

• Adds --json flag to most commands for programmatic/scriptable output.
• Adds AirVPN WireGuard config syncing support via API key through vopono sync.
• Improves IPv6 handling in network namespaces (carried over from unpublished 0.10.20).

SAST / SCA / Code Security · 2026-08-23

Waratek adds Reflection Protection rule to RASP for Java, blocking unsafe reflection and dynamic class-loading attacks at the JVM layer with zero configuration.

• New Reflection Protection rule for Waratek RASP for Java blocks exploitation of unsafe Java reflection and dynamic class-loading vulnerabilities — including zero-days — by hooking into the Reflection API and tracking untrusted data at the JVM layer.
• Enables protection against the full class of unsafe reflection attacks (e.g. Class.forName() and .newInstance() abuse patterns) without requiring source code changes, redeployment, or application downtime.
• Rule can be enabled directly from the Waratek Portal's rule wizard with no configuration required, taking effect immediately across all protected applications.

Identity & Access Management · 2026-08-23

Yubico and Devolutions add Copy to YubiKey to RDM, letting admins inject vaulted passwords via YubiKey hardware slots in air-gapped environments.

• New Copy to YubiKey action in Devolutions Remote Desktop Manager (RDM) programs a vaulted credential directly into a YubiKey hardware slot (Slot 1 or Slot 2) as a static password, enabling clipboard-free credential injection via the YubiKey acting as a USB HID keyboard.
• Supports credential injection into environments where clipboard redirection is disabled — including air-gapped server consoles and BIOS prompts — without requiring software, network access, or clipboard use.
• Credentials remain vaulted in Devolutions RDM; YubiKey slots are only written deliberately, preserving audit trails and governance over privileged credential access.

Vulnerability Management · 2026-08-22

Brinqa Data Lake now exposes analytics views queryable via BigQuery under the BrinqaDL namespace.

• New Brinqa Data Lake integration exposes BrinqaDL analytics views in BigQuery, enabling direct SQL queries against Brinqa data.

Web Application Security · 2026-08-22

BunkerWeb 1.6.14 adds mTLS CA bundle and CRL distribution via scheduler, plus Permissions-Policy Client Hints controls

• Adds MTLS_CA_CERTIFICATE_DATA config key to supply trusted client CA bundle inline as base64 or PEM (e.g. via Web UI), eliminating per-instance file mounts.
• Adds MTLS_CA_CERTIFICATE_PRIORITY config key to control priority of the client CA bundle source.
• Adds MTLS_CRL_DATA config key to supply a PEM-encoded certificate revocation list inline as base64 or PEM, enabling revoked-certificate rejection without file mounts.

Web Application Security · 2026-08-22

BunkerWeb adds TOTP-based 2FA for admin accounts with encrypted key storage and rotation support via TOTP_ENCRYPTION_KEYS.

• Adds TOTP-based two-factor authentication for admin and user accounts, with secrets stored encrypted in the database using keys persisted in /var/lib/bunkerweb/.totp_encryption_keys.json.
• Introduces the TOTP_ENCRYPTION_KEYS environment variable (space-separated keys or JSON map, each key exactly 43 characters) to supply or rotate TOTP encryption keys without relying on auto-generated ones.
• Supports TOTP encryption key rotation via a JSON map value in TOTP_ENCRYPTION_KEYS: old keys remain alongside the new one so existing 2FA enrollments stay valid.

Web Application Security · 2026-08-22

BunkerWeb 1.6.14 adds mTLS CA bundle and CRL distribution via Scheduler, client-hint blocking controls, and hardened X-SSL-* header stripping.

• Adds MTLS_CA_CERTIFICATE_DATA to supply the mTLS client CA bundle directly as base64 or PEM inline (e.g. via the web UI), without mounting files into BunkerWeb containers.
• Adds MTLS_CA_CERTIFICATE_PRIORITY to control the source priority of the client CA bundle (file path vs. inline data).
• Adds MTLS_CRL_DATA to supply a PEM-encoded certificate revocation list inline as base64 or PEM, enabling BunkerWeb to reject revoked client certificates.

Web Application Security · 2026-08-22

BunkerWeb 1.6.14 adds TOTP-based 2FA with encrypted secrets, Biscuit keys, and server-side sessions pinned to IP and User-Agent.

• Adds TOTP-based two-factor authentication for admin accounts; secrets are stored encrypted in the database with keys kept in /var/lib/bunkerweb/.totp_encryption_keys.json.
• Introduces TOTP_ENCRYPTION_KEYS environment variable (space-separated keys or a JSON map, each key exactly 43 characters) to supply or rotate your own TOTP encryption keys instead of relying on auto-generated ones.
• Persists Flask secret, Biscuit keys, and TOTP encryption keys by mounting a volume on /data in the bunkerweb-ui container (symlinked to /data/lib), surviving container recreation.

Web Application Security · 2026-08-22

BunkerWeb 1.6.14 adds mTLS client certificate support with centralized CA/CRL distribution and Redis-backed metrics sync.

• Adds MTLS_CA_CERTIFICATE_PRIORITY config key to control the source of the client CA bundle (file path vs. inline data), with MTLS_CA_CERTIFICATE_DATA for supplying the trusted CA bundle directly as base64 or plaintext PEM (e.g. via the web UI).
• Adds MTLS_CRL_PRIORITY and MTLS_CRL_DATA config keys to supply a PEM-encoded certificate revocation list (CRL) either as a file path or inline base64/PEM data, enabling BunkerWeb to deny revoked client certificates.
• Scheduler validates, caches, and distributes CA bundles and CRLs to every BunkerWeb instance automatically — no per-instance file mounting required; updates are picked up on the next job run.

Web Application Security · 2026-08-22

BunkerWeb 1.6.14 adds per-service CrowdSec multisite settings, a certificate validator in the UI, and new metrics/policy controls.

• Makes every CROWDSEC_* setting multisite, so individual services can point at different Local API or AppSec endpoints; set CROWDSEC_API to an empty string on a service to retain AppSec inspection without the decision lookup.
• Adds METRICS_REDIS_TTL setting to control TTL for metrics stored in Redis, alongside atomic list and facet updates and buffering during Redis OOM events.
• Adds DISABLE_ONLINE_API environment variable to the all-in-one image (matching the official CrowdSec image name) to run CrowdSec without registering to the Central API.

Identity & Access Management · 2026-08-22

Clerk CLI adds npx clerk@latest init for zero-config auth setup with auto-generated dev keys and npx clerk@latest doctor verification

• Adds npx clerk@latest init CLI command that auto-detects framework and package manager, installs the SDK, and wires up provider, middleware, auth routes, and env file — supporting Next.js, React, React Router, Nuxt, TanStack Start, Astro, Vue, JavaScript/Vite, Expo, Express, Fastify, iOS, and Android.
• Adds temporary development keys support: when the framework supports it, npx clerk@latest init writes dev keys to the project env file so no Clerk account is required upfront; the app is claimed later via npx clerk@latest auth login.
• Adds --framework <framework> and --pm <package-manager> flags to npx clerk@latest init for overriding auto-detected framework and package manager in empty directories.

Identity & Access Management · 2026-08-22

Clerk adds custom OAuth scopes for precise, discoverable MCP client access control.

• Supports custom OAuth scopes, enabling precise and discoverable access control for MCP clients connecting to your API.

Identity & Access Management · 2026-08-22

ConductorOne adds a native MCP gateway integration for Google Gemini Enterprise with per-user OAuth attribution and policy enforcement.

• New ConductorOne MCP gateway integration for Google Gemini Enterprise routes tool calls through https://<your-tenant>-mcp.conductor.one/v1, attributing each call to the individual user's identity rather than a shared service account.
• Publishes a pre-registered OAuth 2.0 client metadata document at https://<your-tenant>.conductor.one/auth/v1/client-metadata/gemini-enterprise, eliminating secret rotation — the client_id is the document URL itself and uses PKCE with no client secret.
• Exposes authorization_endpoint (https://<tenant>.conductor.one/auth/v1/authorize) and token_endpoint (https://<tenant>.conductor.one/auth/v1/token) discoverable via https://<tenant>-mcp.conductor.one/.well-known/oauth-authorization-server.

Identity & Access Management · 2026-08-22

ConductorOne adds smart revocation, policy reuse, Copilot Studio/Gemini MCP integrations, push-rule execution history, and c1i v0.5.0 new commands.

• Adds Grant source setting (Direct) on automation revoke steps to scope automated revocations to only direct grants, preventing collateral removal of group-inherited access.
• Adds apps create, apps delete, apps set-owners, auth token, mcp gateway list-tools, mcp gateway call, and a policies command family to the c1i CLI (v0.5.0).
• Public API can now list connector-discovered applications, inspect their managed state, and promote an unmanaged application to managed — returning HTTP 409 on a repeat promotion and exposing the managed application ID in the binding response.

Identity & Access Management · 2026-08-22

ConductorOne adds smart revocation chain tracing, automation grant-source scoping, policy reuse, MCP gateway integrations, and a major c1i CLI expansion.

• Adds apps create, apps delete, apps set-owners, auth token, mcp gateway list-tools, mcp gateway call, and a policies command family to the c1i CLI, rounding out API coverage for agent-focused automation.
• Adds --server-url flag to the c1i mcp gateway command, replacing the former --url flag, so the global --url flag consistently selects the C1 tenant across all commands.
• New Grant source setting (All or Direct) on automation revoke steps lets automations scope revocations to only direct grants, avoiding collateral removal of group-inherited access.

Web Application Security · 2026-08-22

Dalfox gains completion subcommand for shell autocomplete across bash, zsh, fish, powershell, and elvish

• Adds dalfox completion <SHELL> subcommand to generate shell autocomplete scripts for bash, zsh, fish, powershell, and elvish, written cleanly to stdout for safe redirection to a file.

Web Application Security · 2026-08-22

Dalfox v3 (Rust rewrite) consolidates scan subcommands, renames flags, and adds MCP server, WAF evasion, dry-run, and more.

• Adds dalfox mcp subcommand to expose Dalfox to AI coding assistants over JSON-RPC via an MCP server.
• Adds --sxss flag to dalfox scan for stored-XSS scanning (replaces the retired dalfox sxss subcommand).
• Adds --input-type raw-http to accept captured raw HTTP requests as scan input.

Web Application Security · 2026-08-22

Dalfox adds shell completion generation via dalfox completion for bash, zsh, fish, PowerShell, and Elvish.

• Adds dalfox completion subcommand to generate shell completions for bash, zsh, fish, PowerShell, and Elvish for installs not handled by a package manager (Cargo, release archive, source build).

Web Application Security · 2026-08-22

Dalfox adds dalfox completion subcommand for generating shell completion scripts in bash, zsh, fish, powershell, and elvish.

• New dalfox completion <SHELL> subcommand generates and prints shell completion scripts to stdout for bash, zsh, fish, powershell, and elvish — output is safe to redirect directly to the appropriate completion file.
• Deprecated compat commands and the man packaging helper are hidden from generated completion scripts, keeping autocomplete output clean.

Web Application Security · 2026-08-22

DataDome Envoy module 2.8.0 adds GraphQL support with configurable endpoint extraction.

• Adds ENABLE_GRAPHQL_SUPPORT setting (set to true) to enable GraphQL request handling in the Envoy module starting with v2.8.0.
• Adds GRAPHQL_ENDPOINT setting (default: /graphql) to specify one or more comma-separated endpoints from which the GraphQL operation name and type are extracted.

Web Application Security · 2026-08-22

DataDome Envoy module 2.8.0 adds GraphQL support.

• Adds GraphQL support to the Envoy module.

Identity & Access Management · 2026-08-22

Didit White Label gains a Texts tab for per-locale string overrides, completion screen mode control, and dynamic placeholders.

• Adds Console → White Label → Texts tab to override the wording of specific verification-flow screens (welcome, document selection, document capture, selfie intro, questionnaire navigation, completion screen, and common buttons like Continue and Retry) on a per-locale basis, without forking translations.
• Introduces Completion screen mode setting: choose Decision (default) to show the real outcome, or Submitted for review to always show a neutral 'we received your data and are reviewing it' message regardless of Didit's internal decision — useful when the product communicates approval separately.
• Supports dynamic placeholders in override text — {appName}, {stepIndex}, and {stepTotal} — resolved per user at render time from the actual running workflow, with a 500-character limit per overridden string.

Identity & Access Management · 2026-08-22

Didit adds per-user full history PDF export, bundling up to 20 sessions into one chronological report.

• New Actions → Download PDF option on a user's detail page exports a single PDF bundling a cover page (profile summary, feature status, session index) with the full standard report of every completed session sharing that user's vendor_data, merged in chronological order — capped at the 20 most recent sessions in a reportable status (Approved, Declined, In Review, Kyc Expired).

Identity & Access Management · 2026-08-22

Didit adds POST /v3/document-ai/ for custom field extraction, name matching, and tamper detection on payslips, invoices, and other supporting documents.

• New POST /v3/document-ai/ endpoint accepts a document (multipart/form-data) plus a fields JSON-encoded array (1–30 items, max 16 KB) and returns typed extracted values (text, number, date as YYYY-MM-DD), a status of Approved/Declined/In Review, and a warnings list — supporting payslips, proof-of-funds letters, tax statements, contracts, invoices, and more.
• Each field definition in the fields array carries key (^[a-z0-9_]{1,64}$), name, instruction, type (text | number | date), required (boolean), and is_full_name (boolean, at most one per request); marking required: true raises DOCUMENT_AI_MISSING_REQUIRED_FIELDS when the value cannot be read.
• Fuzzy name-match scoring via expected_first_name + expected_last_name (person) or expected_company_name + optional expected_company_country (ISO 3166-1 alpha-2) returns name_match_score (0–100) and name_on_document; scores below document_ai_name_match_score_threshold (default 80) trigger DOCUMENT_AI_NAME_MISMATCH.

Identity & Access Management · 2026-08-22

Didit adds Document AI field extraction and KYB company registry search/profile endpoints to its API.

• New Document AI capability extracts user-defined fields from any PDF or image document, with name matching and tampering checks.
• New KYB Registry Search endpoint lets practitioners search official company registries by name, registration number, and country at no cost.
• New KYB Registry Select endpoint retrieves the full registry profile for a selected company, including officers, beneficial owners, and addresses.

Web Application Security · 2026-08-22

dirsearch v0.5.0 adds async/Rust backends, category wordlists, MySQL/PostgreSQL reporting, a Python API, and resumable JSON sessions.

• Adds --request-backend native and --wordlist-backend native flags to enable a Rust native backend for GET scans and native wordlist generation.
• Adds --wordlist-categories flag with built-in categories (PHP, Python, Java, .NET, Node, ColdFusion, infrastructure) for targeted discovery.
• Adds --wordlist-status and --wordlist-max-size flags, plus selectable wordlist backends (auto, python, native).

Web Application Security · 2026-08-22

dirsearch exposes a public Python API and adds a --wordlist-status inspection mode requiring Python 3.11+

• Exports a public Python API via dirsearch.py — DirsearchFuzzer, FuzzerConfig, FuzzerResult, Wordlist, WordlistState, and WordlistTemplate are now importable from lib.core.api and listed in __all__.
• Adds a wordlist_status mode (driven by options['wordlist_status']) that prints the loaded wordlist files, total generated entries, and the wordlist_max_size generation limit, then exits — useful for auditing dictionary configuration before a scan.
• Raises minimum supported Python version to 3.11; dirsearch now exits with an error message if run on Python 3.10 or lower.

Web Application Security · 2026-08-22

dirsearch config.ini now documents full default configuration including ffuf/wfuzz-style matchers, SQL output backends, and wordlist controls

• Adds matcher-mode and filter-mode keys (values: or) to config.ini, enabling ffuf/wfuzz-inspired match/filter logic for responses.
• Adds match-status, filter-status, match-size, filter-size, match-words, filter-words, match-lines, filter-lines, match-regex, filter-regex, match-time, and filter-time keys to config.ini for granular response filtering and matching.
• Adds mysql-url and postgres-url keys to config.ini (e.g. mysql://user:password@localhost/database) enabling SQL database output alongside the existing SQLite backend.

Web Application Security · 2026-08-22

dirsearch exposes a public Python API with DirsearchFuzzer, FuzzerConfig, FuzzerResult, Wordlist, and related classes.

• Adds a public Python library API exporting DirsearchFuzzer, FuzzerConfig, FuzzerResult, Wordlist, WordlistLimitError, WordlistState, and WordlistTemplate from dirsearch.lib.core.api, enabling programmatic use of dirsearch's fuzzing engine in Python tooling.

Reverse Engineering · 2026-08-22

GEF adds has_fastbins() to detect whether the current glibc version supports fastbins.

• Adds GlibcArena.has_fastbins() method returning bool to programmatically detect whether the target glibc supports fastbins (removed in glibc 2.43).

SAST / SCA / Code Security · 2026-08-22

GitHub's blocked-user management gains search, filtering, sorting, private notes, and block metadata for personal and org accounts.

• Adds search across blocked-user lists by username, full name, or email in Settings → Moderation → Blocked users.
• Adds filtering by block reason (Spam, Misconduct, or Harassment) on blocked-user lists.
• Adds sort and pagination support for long blocked-user lists.

SAST / SCA / Code Security · 2026-08-22

GitHub Copilot's agentic coding capabilities come to Slack in public preview, enabling async PR creation and team-shared agent sessions.

• Mention @GitHub in any Slack direct message, channel, or thread to start a GitHub Copilot agent session that can triage issues, implement code changes in a secure cloud sandbox, and open pull requests.
• Copilot can create a dedicated Slack Code channel per task, where teammates can follow the plan, inspect diffs, review HTML artifact previews, and iterate without noising up the original conversation.
• Agent sessions are multiplayer — any team member can join from the original thread, add context, redirect the approach, or stop the session, making agent workflows visible and learnable across the team.

SAST / SCA / Code Security · 2026-08-22

GitHub Copilot cloud agent sessions now run collaboratively inside Microsoft Teams channels, threads, and DMs.

• Adds @GitHub mention support in Microsoft Teams channels, threads, and direct messages to start a GitHub Copilot cloud agent session that all conversation participants can view and direct.
• Participants with write access to the target repository can trigger Copilot to make code changes directly from the Teams conversation.
• Agent work runs asynchronously in a secure cloud sandbox; progress is visible in the channel thread and artifacts can be picked up in a terminal, the GitHub Copilot app, or an IDE.

Data Security & DLP · 2026-08-22

Immuta adds at-a-glance access request queue metrics for governors and refines Databricks Unity Catalog ingestion logic.

• Adds three summary tiles to the Access Requests page showing pending request count, average age of pending requests, and stewards with at least one pending request assigned — with a hover-over breakdown of top individuals or groups by request volume.
• Updates Databricks Unity Catalog crawl logic to skip ingestion of catalogs where the Immuta workspace has read-only access and isolated catalogs where the Immuta service principal lacks MANAGE permission, filtering them out at ingestion time rather than failing during policy enforcement.

Secrets Detection & Management · 2026-08-22

Infisical v0.162.23 adds PKCS#12 keystore import to certificate manager and raises the PKI post-sync command limit to 8192 characters.

• Raises the PKI post-sync command character limit to 8192 characters, enabling longer post-sync scripts.
• Adds PKCS#12 keystore import support to the certificate manager.

Endpoint Security (EDR/XDR) · 2026-08-22

Iru adds AI-guided Windows Update Library, System Tray visibility for employees, and new Auto Apps for Windows and Mac.

• Adds native Iru AI integration to the Windows Update Library Item for a guided update experience.
• New Windows System Tray app gives employees visibility into pending updates with deadlines.
• New Auto Apps added for Windows and Mac platforms.

SAST / SCA / Code Security · 2026-08-22

JFrog Artifactory gains On-Behalf-Of (OBO) OAuth 2.0 token exchange with Amazon Bedrock AgentCore Gateway for per-user AI agent identity propagation.

• Supports On-Behalf-Of (OBO) token exchange (RFC 8693) between Amazon Bedrock AgentCore Gateway and JFrog Artifactory Access, so AI agent requests reach Artifactory authenticated as the originating user rather than a shared service account — preserving audit fidelity, least privilege, and containment.
• Enables AgentCore Gateway to use JFrog Artifactory's MCP server as a registered target, with onBehalfOfTokenExchangeConfig configured on the gateway target so each inbound user JWT is exchanged for a short-lived, per-user JFrog token.
• Supports listingMode field on AgentCore Gateway targets (requires a recent AWS CLI) to enable dynamic tool listing, allowing tool discovery to run under the user's token instead of a shared credential.

Container & Image Security · 2026-08-22

Kata Containers 4.1.0 adds OpenVMM and Cloud Hypervisor VM template support, L3 forwarding network model, NVSwitch passthrough, and EROFS backing mode in kata-deploy.

• Adds shared_fs=none configuration to kata-deploy so virtiofsd is not shipped when it is not needed.
• Adds EROFS backing mode configuration support in kata-deploy.
• Adds values overlay support when publishing the Helm chart in kata-deploy.

Digital Forensics & Incident Response · 2026-08-22

MVT gains a plugin system: Python packages can register modules via mvt.modules entry points, with --list-modules auditing by source.

• Adds an installed-module plugin system: Python packages register MVT modules automatically by declaring an entry point in the mvt.modules group inside pyproject.toml, using the format [project.entry-points."mvt.modules"].
• External module packages log under the mvt.ext.<package> namespace (with the mvt_plugin_ prefix stripped), keeping plugin log output visually distinct from built-in modules in the mvt.* logger tree; file-loaded modules log as mvt.ext.<file name>.
• Extends --list-modules to group available modules by source — MVT itself (with version), each installed package (with version and commit when installed from a repository), and each externally loaded file (with its SHA-256 hash).

Digital Forensics & Incident Response · 2026-08-22

MVT WhatsApp module gains LID-to-phone-number resolution, contact records extraction, and new timeline events for chat sessions and disappearing messages.

• Adds lid_phone_number_pair record type and lid_pair_recorded timeline event: the WhatsApp module now resolves opaque LID identifiers to phone numbers using the ZWAPHONENUMBERLIDPAIR table from LID.sqlite (or ChatStorage.sqlite), populating partner_resolved_phone_number on 1:1 chat session records.
• Adds chat_session record type with chat_first_message and chat_last_message timeline events per conversation, plus a group_created event for group chats; notes that a session's last-message date can postdate its newest stored message when recent messages were deleted.
• New WhatsappContacts module extracts contact records from private/var/mobile/Containers/Shared/AppGroup/*/ContactsV2.sqlite into whatsapp_contacts.json, including phone number, WhatsApp and LID identifiers, and the per-contact disappearing messages timer (absent from ChatStorage.sqlite).

Network Analysis & Monitoring · 2026-08-22

FlowCarp gains detection for CNCMachineRMS RAT C2 protocol, with a free demo endpoint for PCAP submission

• Adds detection model for the CNCMachineRMS RAT binary C2 protocol to FlowCarp, enabling identification of sessions on TCP port 443 that mimic HTTPS but are unencrypted.
• Exposes https://demo.flowcarp.com as a free public endpoint: submit a PCAP via curl --data-binary and receive a JSON alert if CNCMachineRMS traffic is present.
• Documents CNCMachineRMS's use of DNS-over-HTTPS (DoH) to bypass local DNS logging, with lookups sent to dns.google, cloudflare-dns.com, and dns.quad9.net before C2 connection.

Network Analysis & Monitoring · 2026-08-22

NETRESEC adds CNCMachineRMS C2 protocol detection to FlowCarp, with a free PCAP submission API for instant triage.

• Adds a statistical detection model for the CNCMachineRMS binary C2 protocol to FlowCarp, enabling identification of this RAT's traffic on TCP port 443 without TLS decryption.
• Exposes the FlowCarp demo server at https://demo.flowcarp.com accepting raw PCAP uploads via curl --data-binary and returning JSON alerts when CNCMachineRMS traffic is detected.
• Documents four confirmed CNCMachineRMS C2 server IPs — 89.110.110.119:443, 85.158.110.78:443, 89.124.79.98:443, 144.124.242.171:443 — and two associated domains (notepadreleased[.]com, triotmelon[.]com) as actionable network IOCs.

Identity & Access Management · 2026-08-22

Okta adds unified AI agent identity across registration paths and Cross App Access (XAA) for AI agents and apps.

• Adds unified identity for AI agents (GA in Production): Okta now resolves AI agent identities across every registration path into a single authoritative record per org, with each agent carrying an externalId and platform value for uniqueness.
• New endpoints for listing, reviewing, resolving staged identity conflicts, and managing provider priority for AI agents — see AI Agent Providers documentation.
• Adds Cross App Access (XAA) support for AI agents and apps: enables connections between custom SSO-agentic requesting apps and SSO resource apps across OIDC and SAML SSO protocols, removing the need for user consent at runtime.

Identity & Access Management · 2026-08-22

Okta Identity Engine 2026.08.2 makes unified identity for AI agents generally available in Production.

• Unified identity for AI agents is now generally available (GA) in Production, enabling identity lifecycle management for non-human AI agent principals.

SAST / SCA / Code Security · 2026-08-22

Codex Security deep scans gain configurable --max-time-hours deadline and persistent max_time_hours config key

• Adds --max-time-hours flag to --mode deep scans to set a worker deadline (default 96 hours, accepts any positive value up to 96 including fractions); at the deadline, finished worker results are aggregated into the final report and unfinished workers are stopped.
• Adds max_time_hours key under [deep_scan] in the deep-scan configuration file for persistent deadline settings or bulk campaigns.

SAST / SCA / Code Security · 2026-08-22

Codex Security CLI gains Linear issue publishing, automated patching with PR creation, and deep-scan concurrency controls

• New codex-security publish scan subcommand publishes completed scan findings to Linear, with flags --to linear, --linear-team TEAM_ID, --project PROJECT_ID, --linear-api-key KEY, --linear-assignee EMAIL_OR_USER_ID, --dry-run, and --json.
• Supports env vars CODEX_SECURITY_LINEAR_TEAM, CODEX_SECURITY_LINEAR_PROJECT, and CODEX_SECURITY_LINEAR_API_KEY as alternatives to the matching CLI flags for Linear publishing.
• New --patch flag on scan triggers automated fix-and-verify of findings after a complete scan (requires CLI 0.1.15 or later); --patch-severity {critical,high,medium,low} sets the minimum severity threshold (default: high).

SAST / SCA / Code Security · 2026-08-22

Codex Security CLI gains --patch, --patch-severity, --create-pr, and --max-time-hours flags for automated patching and scan time control.

• Adds --patch flag to automatically patch high and critical findings without the interactive finding browser.
• Adds --patch-severity flag to control which severity levels are patched non-interactively.
• Adds --create-pr flag to commit verified patches and open a GitHub pull request directly from the CLI.

SAST / SCA / Code Security · 2026-08-22

Codex Security plugin 0.1.20 adds full end-to-end deep scan audits, Trusted Access checks, and broader environment support; 0.1.19 adds [deep_scan].max_time_hours.

• Adds [deep_scan].max_time_hours config key (0.1.19) to cap deep scan duration at up to 96 hours (fractional hours supported); completed discovery results are preserved when the deadline expires, and the report is marked partial if no source review finishes in time.
• Run npx @openai/codex-security info --json to inspect both the package and bundled plugin versions together.
• Deep scan workers now run through the same end-to-end audit pipeline as standard scans — threat modeling, validation, attack-path analysis, and coverage reporting — with results combined into a single scan.

SAST / SCA / Code Security · 2026-08-22

Codex Security deep scans gain max_time_hours config key (up to 96 h) and new worker-control settings in plugin v0.1.19

• Adds max_time_hours config key (plugin v0.1.19+) to cap deep-scan worker execution at a positive number of hours up to 96, with fractional values supported; expired workers are stopped and completed results are aggregated into the final report.
• Exposes configurable limits for the number of independent standard-scan runs allowed before aggregation, the number of parallel standard-scan workers (default 4), and the number of subagents each worker may start (default 4).
• Adds a 'stop after consecutive completed worker scans produce no new findings' threshold to avoid redundant deep-scan work.

Runtime Security · 2026-08-22

Egress sidecar now auto-allows its own OTLP metric export endpoint via OTEL_EXPORTER_OTLP_METRICS_ENDPOINT or OTEL_EXPORTER_OTLP_ENDPOINT.

• Adds automatic always-allow egress rule for the sidecar's own OTLP metric export: reads OTEL_EXPORTER_OTLP_METRICS_ENDPOINT (preferred) or OTEL_EXPORTER_OTLP_ENDPOINT at startup and injects the destination into the deny-all policy — domains via the DNS proxy, IPs into the static nft allow sets — surviving policy updates and reloads, with deny.always still taking precedence.

AI/LLM Security · 2026-08-22

OpenShell v0.0.111 adds transparent TCP egress, DNS correlation, OTLP driver traces, and standalone first-party compute drivers.

• Adds policy DNS correlation store for network policy decisions in Docker and Podman sandboxes.
• Enables transparent TCP egress and policy DNS enforcement for Docker and Podman runtimes.
• Exports Podman driver traces over OTLP for observability into sandbox compute activity.

Secure Access (VPN / SASE / ZTNA) · 2026-08-22

Pomerium Enterprise Console adds -directory-provider and -url startup flags, plus a restored cluster health view.

• Adds -directory-provider and related startup flags so directory sync can be fully configured at launch without using the web UI.
• Adds -url startup flag that lets the console automatically create its own Pomerium route on first boot, eliminating a manual setup step for new installs.

Secure Access (VPN / SASE / ZTNA) · 2026-08-22

Pomerium adds MCP OAuth server-side hardening: CIMD support, configurable inbound DCR, RFC 8252 loopback matching, and prefixed tokens.

• Adds OAuth Client ID Metadata Document (CIMD) support for inbound MCP routes, letting downstream clients (Claude Code, ChatGPT, MCP Inspector) identify themselves via the lighter-weight CIMD registration path instead of full DCR.
• Adds a runtime toggle in Pomerium Zero cluster settings to enable inbound Dynamic Client Registration (DCR) per cluster; the feature ships off by default instead of relying on a single global default.
• MCP access and refresh tokens are now issued with prefixes pom_mat_… and pom_mrt_…, making Pomerium-issued credentials identifiable in logs and catchable by secret-scanning tools.

Secure Access (VPN / SASE / ZTNA) · 2026-08-22

Pomerium ships distroless images and stable GitHub user keying via node_id to harden deployments.

• Pomerium container images now use the base-nossl-debian12 distroless variant instead of base-debian12, structurally removing libssl3 from every deployment.
• The GitHub directory provider can now use GitHub's stable node_id as the primary key for directory users instead of the GitHub login (username), so policies survive account renames or username reuse.

SAST / SCA / Code Security · 2026-08-22

Portkey adds a Registry API for approved MCP servers, configurable semantic cache embedding providers, and OAuth metadata controls for MCP integrations.

• Adds GET https://mcp.portkey.ai/v0.1/servers Registry API (beta) serving approved MCP servers as a standards-compliant server.json catalog in MCP Registry v0.1 format, authenticated via x-portkey-api-key header with mcp_servers.list scope.
• Adds query parameters limit (1–100), cursor, search, updated_after (ISO 8601), and workspace_id (UUID or slug) to the GET /v0.1/servers endpoint for pagination, filtering, and incremental syncs.
• Adds SEMANTIC_CACHE_EMBEDDING_PROVIDER environment variable supporting openai, azure-openai, google (Gemini embeddings), and vertex-ai to configure which provider generates embeddings for semantic caching.

SAST / SCA / Code Security · 2026-08-22

Portkey Prometheus metrics gain PROMETHEUS_EXTRA_LABELS to expose API key and config name as metric labels.

• Adds PROMETHEUS_EXTRA_LABELS environment variable (comma-separated string, default empty) to attach apiKeyName and/or configName as labels on every custom Prometheus metric, enabling per-key and per-config filtering in dashboards.

SAST / SCA / Code Security · 2026-08-22

Portkey adds MCP Gateway, Agent Gateway, Coding Agent governance, gRPC transport, OpenTelemetry observability, and Nitro Mode across its AI gateway platform.

• New MCP Gateway provides centralized authentication, access control, and governance for MCP servers, with a Registry API (Beta) to serve approved servers as a standard endpoint.
• Adds OAuth 2.1 built-in authentication (OAuth), external identity-provider support (Bring Your Own Auth), JWT Validation, Identity Forwarding, Forwarding Headers, Custom Auth, and Authorization controls for MCP Gateway.
• Adds Tool Provisioning to control which tools, resources, and prompts are exposed to which workspaces and users through the MCP Gateway.

SAST / SCA / Code Security · 2026-08-22

Retire.js 5.7.0 adds CycloneDX 1.7 output with full SPDX license reporting and richer BOM metadata across 1.6 and 1.7 formats.

• Adds --outputformat cyclonedxJSON1_7 and --outputformat cyclonedxJSON1_7_VEX flags for CycloneDX 1.7 SBOM output.
• CycloneDX 1.6 and 1.7 reports now include $schema, metadata.tools (object form from spec 1.5), metadata.component (scanned path as BOM subject), dependencies (scan target linked to all detected components), evidence.identity (version-detection technique and confidence, e.g. filecontent, filename, hash, ast), and vulnerabilities[].detail (VEX variants only, when the repository supplies details).

SAST / SCA / Code Security · 2026-08-22

Retire.js 5.6.0 surfaces --insecure usage in JSON and CycloneDX reports so auditors can detect certificate-check bypasses.

• Adds ignoreRepositoryCertificateErrors field to JSON reports when --insecure is set, making repository certificate-check bypasses machine-readable.
• Adds a retirejs:ignore-repository-certificate-errors entry under metadata.properties in all CycloneDX reports when --insecure is set, surfacing the bypass in SBOM output.

SAST / SCA / Code Security · 2026-08-22

Retire.js 5.5.0 adds vulnerability repository metadata to JSON and CycloneDX reports, plus source attribution in CycloneDX 1.6 VEX output.

• Adds vulnerabilityRepositories field to JSON report output, listing the vulnerability repositories used during the scan.
• Adds retirejs:vulnerability-repository entries under metadata.properties in all CycloneDX report formats, surfacing which repositories backed the scan.
• CycloneDX 1.6 VEX output now identifies Retire.js as the source of each vulnerability and rating, including the repository URL when a single repository is used.

Compliance Automation & Trust Management · 2026-08-22

Scrut MCP exposes 13 tools for AI-driven compliance queries, evidence upload, and document management via natural-language prompts.

• Adds scrut_list_frameworks MCP tool to list enabled compliance frameworks (SOC 2, ISO 27001, GDPR, etc.) along with each one's next audit date.
• Adds scrut_list_controls MCP tool to list framework controls — including code, domain, owner, and status — filterable by framework or product.
• Adds scrut_get_control MCP tool to retrieve full details for a single control by control code.

Compliance Automation & Trust Management · 2026-08-22

Scrut MCP Skills package multi-step GRC jobs into single-prompt tasks for Claude, Cursor, and other MCP-compatible AI tools.

• Introduces Scrut MCP Skills — self-contained SKILL.md folders that sequence Scrut MCP tool calls for a full GRC job, triggerable with a single prompt from any MCP-compatible AI agent (Claude Code, Claude Desktop, Cursor, Codex, ChatGPT, Microsoft Copilot).
• New scrut-upload-evidence skill uploads a file or attaches a link to the correct evidence item, with a note — prompt: 'File this access review as evidence.'
• New scrut-compliance-digest skill summarizes framework, control, policy, evidence, and test state in a format suited for leadership — prompt: 'Give me a compliance digest for the board.'

Compliance Automation & Trust Management · 2026-08-22

Scrut July 2026 adds MCP integration for AI apps, Shadow IT governance, audit snapshots, Tenable import, and SoA enhancements.

• Adds Shadow IT application governance under People → Access Reviews → Applications, with Managed, Discovered, and Restricted views; supports bulk actions (ignore, restrict) and owner assignment for both SaaS and desktop apps.
• Adds Compliance → Frameworks implementation details field to SoA exports, alongside a new Document Reference column auto-fetched from linked policies, for ISO framework Statement of Applicability downloads.
• Supports importing Tenable (formerly Nessus) vulnerability scan findings into the Scrut vulnerability workflow via a new Tenable integration, enabling triage alongside existing vulnerability work.

Compliance Automation & Trust Management · 2026-08-22

Scrut Automation launches MCP server integration, connecting compliance data to Claude, Cursor, ChatGPT, and Codex via OAuth.

• Adds Scrut MCP server with region-specific endpoints — https://mcp.scrut.io/mcp (India), https://mcp.us.scrut.io/mcp (US), https://mcp.eu.scrut.io/mcp (EU), https://mcp.au.scrut.io/mcp (Australia) — exposing Scrut compliance data to any MCP-compatible AI tool.
• Supports connecting Scrut MCP to Claude Code CLI via claude mcp add --transport http scrut <region-url> --client-id vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U --callback-port 8787.
• Supports connecting Scrut MCP to Codex CLI via codex mcp add scrut --url <region-url> --oauth-client-id vpubmKiuV6hrcQLBwMLyo4aVWgheoH8U --oauth-resource <region-url>, with mcp_oauth_callback_port = 8788 and experimental_use_rmcp_client = true set in ~/.codex/config.toml.

Compliance Automation & Trust Management · 2026-08-22

Scrut Automation adds a Supabase integration

• Adds a Supabase integration to Scrut Automation's integrations catalog.

Identity & Access Management · 2026-08-22

SPIRE v1.15.3 adds a Slurm workload attestor, Azure Blob bundle publisher, and several new agent configuration options.

• Adds trust_bundle_spiffe_workload_api agent configuration option to fetch the initial trust bundle from a Workload API endpoint, simplifying nested agent deployments.
• Adds disable_workload_api and disable_sds_api agent options to disable the Workload API and SDS APIs on the public endpoint.
• Adds disable_kubelet_client option for the k8s workload attestor.

Detection Engineering · 2026-08-22

tree-sitter-tql v1.2.0 adds support for multiple pipeline arguments in operators like fork_merge.

• Operators can now accept multiple pipeline arguments separated by commas, enabling operators such as fork_merge to take more than one { … } pipeline block without a syntax error.

Detection Engineering · 2026-08-22

Tenzir v6.13.0 adds native OTLP ingestion, node-wide parallelism config, parallel file-reading, and flat operator names

• Adds accept_otlp operator to receive OpenTelemetry logs, metrics, and traces over OTLP/HTTP or OTLP/gRPC, with support for JSON and binary Protobuf, gzip compression, TLS and mTLS, signal filtering, and bounded request sizes; set schema="record" for direct attribute-key access.
• Adds tenzir.parallelism configuration option (also settable via TENZIR_PARALLELISM environment variable) to configure parallelism node-wide for all pipelines that do not specify their own degree; a // parallelism: directive in a pipeline takes precedence over --parallelism, which takes precedence over tenzir.parallelism; use // parallelism: disabled to opt a single pipeline out.
• Adds decimal_format="float" option to the read_parquet operator to read Arrow Decimal128 values as potentially lossy real values; default behavior reads them as strings.

Detection Engineering · 2026-08-22

Tenzir v6.13.0 adds native OpenTelemetry ingestion, node-wide pipeline parallelism, and parallel summarize with periodic emission.

• Adds native OTLP (OpenTelemetry Protocol) ingestion for direct telemetry data intake into Tenzir nodes.
• Parallelizes file-reading operators to scale pipeline execution across the node.
• Introduces node-wide parallelism, enabling concurrent execution of pipelines including file ingestion and periodic aggregation.

Detection Engineering · 2026-08-22

Tenzir v6.13.0 adds native OTLP ingestion, node-wide pipeline parallelism, and parallel file-reading operators.

• Adds native OpenTelemetry Protocol (OTLP) ingestion, enabling direct ingest of traces, metrics, and logs from OTLP sources.
• Introduces node-wide parallelism so pipeline execution scales across the full node, covering file ingestion and periodic aggregation.
• Parallelizes file-reading operators, allowing multiple files to be read concurrently within a pipeline.

Identity & Access Management · 2026-08-21

1Password SaaS Manager adds Claude Console consumption imports, custom-field workflow triggers, and Lark Frozen status field.

• Adds Claude Console as a new import source, pulling message and Claude Code usage consumption data into SaaS Manager.
• Enables custom person fields as workflow triggers, expanding automation options based on people data.
• Adds the Lark Frozen status as a dedicated person field, distinguishing temporary leave from suspension and making it usable in workflows.

Malware Analysis · 2026-08-21

CAPEv2 cleaners gain --banned-clean flag and --db-batch-size control for database deletions.

• Adds --banned-clean argument to utils/cleaners.py to remove all tasks marked with TASK_BANNED status.
• Adds --db-batch-size argument to utils/cleaners.py to control the batch size for MongoDB and SQL database deletions (default: 1000, constant DB_BATCH_SIZE).

Integrated & IT Risk Management · 2026-08-21

CISO Assistant v3.21.2 adds ISO 27701-2025 support, manual score overrides, and per-template email toggles.

• Adds per-template toggle to disable individual outgoing emails in the mailing system, giving administrators fine-grained control over which notifications are sent.
• Adds the ISO 27701-2025 framework outline to the library, enabling privacy information management assessments against the updated standard.
• Enables manual override of question-driven scores, allowing assessors to adjust computed scores without being locked to automated answers.

SAST / SCA / Code Security · 2026-08-21

GitHub adds pinned saved views to the repository issues sidebar, reaction avatars, dashboard density controls, and scoped issue dependency APIs.

• Enables pinning saved views to the repository issues sidebar for one-click access, even when the sidebar is collapsed.
• Adds profile avatars for reactions on issues.
• Adds an Issues Dashboard density setting to control how many issues are visible at once.

SAST / SCA / Code Security · 2026-08-21

GitHub-hosted runners gain a Windows 11 arm64 image with Visual Studio 2026, available via runs-on: windows-11-vs2026-arm.

• Adds windows-11-vs2026-arm as a runs-on target for GitHub Actions workflows, providing a Windows 11 arm64 image with Visual Studio 2026 on standard and larger GitHub-hosted runners.

General Utilities & Libraries · 2026-08-21

gh v2.98.0 adds worktree checkout for PRs, semantic/hybrid issue search, and sets GH_EXTENSION for extensions.

• Adds --worktree PATH flag to gh pr checkout to check out a pull request directly into a git worktree.
• Adds --search-type flag to gh search issues supporting semantic and hybrid search modes.
• Sets GH_EXTENSION=1 environment variable when gh invokes an extension, allowing extensions to detect they were launched by gh.

SAST / SCA / Code Security · 2026-08-21

GitLab 19.3 introduces the Flow Creator agent, letting anyone describe automation in plain language to generate runnable Custom Flow definitions.

• Adds the Flow Creator agent to GitLab Duo Agent Platform (accessible via Agentic Chat), which converts plain-language descriptions into complete, runnable Flow Registry definitions — no YAML schema knowledge required.
• Flow Creator reads current Flow Registry documentation before every response, applies rules encoding known failure patterns, and runs a pre-output checklist before generating any YAML to catch issues like missing project_id, broken human-in-the-loop gates, wrong sends_response_to targets, and missing stopping instructions.
• Generated flow definitions can be pasted directly into the configuration editor when creating a flow from a project or from the AI Catalog, with visibility options of private, restricted, or public.

SAST / SCA / Code Security · 2026-08-21

GitLab Dedicated now hosts the AI Gateway for the Duo Agent Platform inside each customer's single-tenant AWS environment.

• Deploys the AI Gateway for the GitLab Duo Agent Platform inside the GitLab Dedicated single-tenant environment, keeping AI inference within the customer's AWS region and data residency boundary.
• Supports Amazon Bedrock as a model backend for the AI Gateway on GitLab Dedicated, so inference stays in the customer's chosen AWS region.
• Enables bring-your-own-model configuration, letting customers connect preferred model providers under their own data classification rules and existing commitments.

SAST / SCA / Code Security · 2026-08-21

GitLab 19.3 adds bulk SAST False Positive Detection and Agentic SAST Vulnerability Resolution against existing vulnerability backlogs.

• Adds bulk-select UI in the vulnerability report to run SAST False Positive Detection and Agentic SAST Vulnerability Resolution against multiple existing vulnerabilities at once, replacing one-at-a-time manual triage.
• SAST False Positive Detection analyzes surrounding code and returns a confidence score and explanation indicating whether a finding is a real risk or a false positive.
• Supports importing third-party scanner findings in SARIF format into the unified vulnerability report, making bulk agentic flows available to findings from any external scanner.

Endpoint Security (EDR/XDR) · 2026-08-21

Huntress Portal now exposes all IPv4 addresses per agent via UI hover, exports, and the ipv4_addresses REST API field.

• Adds ipv4_addresses REST API field on agent records, returning the full list of IPv4 addresses collected by the Base Agent survey — not just the first.

Endpoint Security (EDR/XDR) · 2026-08-21

Huntress Managed EDR now surfaces Windows Subsystem for Linux (WSL) status on Windows endpoints to expose shadow IT blind spots.

• Adds WSL visibility to the EDR agent page in the Huntress portal, showing WSL status (Installed or Uninstalled) per Windows endpoint across your fleet.

Secrets Detection & Management · 2026-08-21

Infisical v0.162.22 adds Kubernetes auth for gateway enrollment, code-signing approval scoping, and a secret manager insights view.

• Adds Kubernetes auth for gateway enrollment, enabling Kubernetes-native authentication when enrolling gateways.
• Scopes code-signing approvals to a specific signing situation, allowing more granular control over approval workflows.
• Adds a Secret Manager product insights view for visibility into secret manager usage and activity.

SAST / SCA / Code Security · 2026-08-21

Legit VibeGuard 2.0 adds discovery and runtime governance of AI agent skills, models, and MCP servers on developer endpoints.

• Legit VibeGuard 2.0 extends developer endpoint security to discover and inventory AI agents, models, MCP servers, and skills running in the agentic environment on developer endpoints.
• Surfaces sensitive or destructive agent actions — such as deleting code, altering database data, or touching production resources — to the developer at runtime for human-in-the-loop review before execution.
• Enables security teams to enforce organizational policy over which AI agents, skills, and models are permitted in the development environment.

AI/LLM Security · 2026-08-21

OpenShell v0.0.110 adds OIDC device authorization for headless login, non-root sandbox identities, and persistent credential refresh in providers.

• Supports OIDC device authorization grant flow for headless (browserless) login, enabling use in CI/CD and other non-interactive environments.
• Allows non-root identities inside sandbox environments, expanding the range of workloads and privilege models that sandboxes can support.
• Stores refresh credentials in credential drivers so providers can maintain long-lived credential sessions without re-authentication.

Identity & Access Management · 2026-08-21

Passbolt 5.15 adds autofill improvements and enhanced permissions confirmation dialog UI.

• Improves autofill behavior in the browser extension.
• Enhances the UI on permissions confirmation dialogs.

CNAPP · 2026-08-21

Plerion adds external access inventory and in-product access reviews across 97 AWS resource types and four sharing mechanisms.

• Builds an external access grant inventory for every tenant, analyzing 97 AWS resource types across four sharing mechanisms: resource policies, role trust policies, Resource Access Manager (RAM) shares, and cross-account permissions set directly as an attribute.
• Supports exporting access grants to a spreadsheet for offline access reviews.
• Enables end-to-end access reviews inside Plerion: assign a team accountable for a grant, record a Keep, Remove, Review later, or Trust until review decision, add notes, and set a future review date.

Identity & Access Management · 2026-08-21

MySailPoint gains admin-controlled Home defaults, dashboard templates (including Admin Overview), and multi-size widgets.

• Adds Managed Defaults: admins can draft and publish a global default Home layout (action tiles and widgets) that applies tenant-wide, overriding previous individual customizations; found under Dashboard Manager > Templates > Home Page Templates.
• Adds a Default Home Pages section under Managed Dashboards > Default Home Pages where published managed defaults can be further edited or deleted (deleting reverts to the SailPoint baseline).
• Adds Dashboard Templates: ready-made copyable dashboards covering persona, industry, or information type so admins can start with a pre-built layout instead of a blank canvas.

SAST / SCA / Code Security · 2026-08-21

Snyk Code gains template-file analysis, 9 new Java libraries, Java 25 support, and .gitignore-committed file scanning.

• Committed files matched by .gitignore rules are now analyzed by Snyk Code and Snyk Secrets — requires Snyk CLI 1.1307.0 or later for CLI scans; SCM and web scans need no action.
• .snyk exclude patterns remain the supported way to deliberately exclude a path from analysis.
• Analyzes template files and traces data flow from application code into the template, reporting XSS vulnerabilities that only become exploitable at render time; supported engines: Jinja2, Razor, FreeMarker, EJS, Handlebars, Pug, Thymeleaf, Twig, Mustache, and Velocity.

SAST / SCA / Code Security · 2026-08-21

StackHawk 6.4.0 adds multi-profile scan mode control, an HTTP header auth-bypass scan rule, and fixes hawk validate exit codes.

• Adds --profile-scan-mode flag (env: PROFILE_SCAN_MODE) to control plugin coverage across authentication profiles: business-logic (default, BOLA/BFLA only), primary-full (full policy on one profile, BOLA/BFLA on the rest), or all-full (full policy on every profile).
• Adds --full-scan-profile flag (env: FULL_SCAN_PROFILE) to designate which profile receives the full scan policy when using --profile-scan-mode primary-full; defaults to the first profile declared in configuration.
• Multi-profile scan findings now carry a [profile=<name>] prefix on their evidence to identify which identity a vulnerability was discovered under.

SAST / SCA / Code Security · 2026-08-21

HawkScan 6.4.0 adds multi-profile scan mode control, a new auth-bypass scan rule, and improved CI validation exit codes.

• Adds --profile-scan-mode flag (env: PROFILE_SCAN_MODE) with three modes — business-logic (default), primary-full, and all-full — giving explicit control over whether full scan policy runs against one or all authentication profiles in multi-profile scans.
• Adds --full-scan-profile flag (env: FULL_SCAN_PROFILE) to designate which profile receives the full policy when using primary-full mode; defaults to the first profile declared in configuration.
• New active scan rule (plugin 40059) tests HTTP Header Authentication Bypass by injecting headers such as X-Forwarded-For, X-Original-URL, and X-Rewrite-URL; off by default, enabled via policy management.

SAST / SCA / Code Security · 2026-08-21

Dev Machine Guard v1.16.0 adds credential-location and browser-extension inventories, plus expanded AI agent and MCP detection.

• New credential location inventory scans thirteen sources — AWS credentials, AWS config, GCP application default credentials, SSH private keys, git credential store, .netrc, GitHub CLI hosts, .npmrc, .pypirc, Docker config, kubeconfig, Terraform credentials, and Vault token — reporting exact file path, credential count, usable-or-wrapped status, file mode (macOS/Linux), and whether the file is tracked inside a git repository; no credential value, substring, digest, or fingerprint ever leaves the device.
• New browser extension inventory covers Google Chrome, Microsoft Edge, and Mozilla Firefox (including Firefox under snap/flatpak and Edge under flatpak) on macOS, Windows, and Linux, recording per-extension identity (id, name, version, manifest version), enabled state and who disabled it, install method (store, sideloaded, registry installed, unpacked, or policy installed), store attribution and listing/flag status, Firefox signature state, and the host and API permissions the browser is currently honouring.
• Pi, Factory Droid, and Amp are now detected in the AI agent and tool inventory, proven from on-disk artifacts (npm or Bun manifests, installer anchor directories, Homebrew cask roots, WinGet publisher directories, or pacman file manifests) rather than by binary name, with version read from disk or reported as unknown.

Endpoint Security (EDR/XDR) · 2026-08-21

Private Access Connector 2.42.0.2105 adds PAM support, unique SSH host keys, clone-safe identity, and auto-recovery of the registration file.

• Enables Pluggable Authentication Modules (PAM) support via an updated OpenSSH build, expanding authentication integration options for Private Access Connectors.
• Ensures each Connector generates a unique SSH host key, eliminating host-key collisions in cloned or templated deployments.
• Adds automatic recovery of the Connector registration file from backup when the file is missing or corrupted, reducing manual intervention after storage failures.

Endpoint Security (EDR/XDR) · 2026-08-21

Private Access Connector 3.7.0.2100 adds log rotation for log streaming logs on Rocky Linux 9.

• Adds log rotation for log streaming logs on Rocky Linux 9 Connectors.
• Token revocation command now runs synchronously, ensuring deterministic completion before returning.

SAST / SCA / Code Security · 2026-08-21

Veracode integrations gain GitHub/Azure DevOps platform-managed installs, scan scheduling, new veracode.yml keys, and expanded Java API Wrapper support.

• Adds analysis_branch key support in veracode.yml for Azure DevOps Workflow Integration v2.3.10 so scheduled scans run against a specified branch instead of the default branch.
• Adds debug configuration option in veracode.yml for Azure DevOps Workflow Integration v2.3.6, GitHub Workflow Integration v1.0.6, and GitLab Workflow Integration v2.1.4 to enable debugging and troubleshooting.
• Adds custom agent pool name parameter in veracode.yml for Azure DevOps Workflow Integration v2.4.3 to specify the agent pool used for pipeline execution.

SAST / SCA / Code Security · 2026-08-21

Veracode CLI gains batch fix processing, --exclude and --skip-packagers flags, target UUID support, and new exit codes across v2.38–v2.51.

• Adds --exclude flag to veracode package to prevent specified Java packages or JAR files from being scanned (v2.51.0).
• Adds --skip-packagers flag to veracode package to exclude specific artifacts (e.g. unsupported SQL) from packaging results without affecting other languages (v2.48.0).
• Adds --java-source flag and VERACODE_PACKAGE_JAVA_SOURCE=true environment variable to veracode package for Java source code packaging (v2.46.0).

1Password 4 changes

• 1Password for Linux 8.12.34 (2026-08-25) · Feature · 2026-08-26
• 1Password for Mac 8.12.34 (2026-08-25) · Feature · 2026-08-26
• 1Password for Windows 8.12.34 (2026-08-25) · Feature · 2026-08-26
• 1Password SaaS Manager #1358 (2026-08-20) · Feature · 2026-08-21

Adrian 8 changes

• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26

adscan 1 changes

• v11.2.0 · Feature · 2026-08-23

Aembit 2 changes

• OpenAI Workload Identity Federation: Aembit Brings Secretless Access to the OpenAI API (2026-08-17) · Feature · 2026-08-23
• Aembit Adds Workload Identity Federation Support for the Claude API (2026-08-05) · Feature · 2026-08-23

Aikido Security 9 changes

• 🚀Code Audit: Pentest-grade reasoning on your source code, no environment required. · Feature · 2026-08-26
• 🚀DSPM: Find data exposure risks without connecting your data stores · Feature · 2026-08-26
• 🚀Extreme Noise Reduction for Secrets and CVEs · Feature · 2026-08-26
• 🚀Protect Company Devices From Supply Chain Attacks · Feature · 2026-08-26
• #54 - Device Protection for Linux and VM Scanning for Google Cloud · Feature · 2026-08-25
• 🚀 Code Audit: Pentest-grade reasoning on your source code, no environment required. · Feature · 2026-08-25
• 🚀 DSPM: Find data exposure risks without connecting your data stores · Feature · 2026-08-25
• 🚀 Extreme Noise Reduction for Secrets and CVEs · Feature · 2026-08-25
• 🚀 Protect Company Devices From Supply Chain Attacks · Feature · 2026-08-25

Anchore 1 changes

• What your SBOM inventory misses if it only covers containers (2026-08-18) · Feature · 2026-08-25

Arcjet 8 changes

• docs update · Docs · 2026-08-23
• docs update · Docs · 2026-08-23
• docs update · Docs · 2026-08-23
• docs update · Docs · 2026-08-23
• docs update · Docs · 2026-08-23
• docs update · Docs · 2026-08-23
• docs update · Docs · 2026-08-23
• docs update · Docs · 2026-08-23

Aurascape 1 changes

• Zero-Bypass MCP Gateway Data Sheet (2026-08-20) · Feature · 2026-08-23

Auth0 1 changes

• changelog · Aug 24, 2026 · Feature · 2026-08-24

bbot 2 changes

• docs update · Docs · 2026-08-25
• v3.0.2 · Feature · 2026-08-25

bloodhound 1 changes

• docs update · Docs · 2026-08-26

Bright Security 1 changes

• Release of August 25, 2026 · Feature · 2026-08-25

Brinqa 3 changes

• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-22

brutespray 1 changes

• v2.7.2 · Feature · 2026-08-26

Bugcrowd 3 changes

• docs update · Docs · 2026-08-25
• Request a Response Expiration Removal (2026-08-25) · Feature · 2026-08-25
• changelog · Aug 23, 2026 · Feature · 2026-08-23

BunkerWeb 6 changes

• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• v1.6.14 · Feature · 2026-08-22

Burp Suite 1 changes

• Professional / Community 2026.8 (2026-08-24) · Feature · 2026-08-24

caido 1 changes

• v0.58.2 · Feature · 2026-08-23

CAPEv2 2 changes

• commits-2026-08-21 · Code activity · 2026-08-23
• commits-2026-08-19 · Code activity · 2026-08-21

Cato Networks 2 changes

• Inside Cato’s Latest AI Security Innovations for Claude (2026-08-13) · Feature · 2026-08-23
• Defeating the Agentic Attacker: Agentic Threat Prevention in Action (2026-08-10) · Feature · 2026-08-23

Censys 2 changes

• docs update · Docs · 2026-08-25
• August 24, 2026 (2026-08-24) · Feature · 2026-08-25

Chainguard 3 changes

• changelog · Aug 26, 2026 · Feature · 2026-08-26
• docs update · Docs · 2026-08-25
• Week of 2026-08-24 · Feature · 2026-08-25

Chalk 1 changes

• v1.2.0 · Feature · 2026-08-23

Checkmarx 1 changes

• docs update · Docs · 2026-08-26

CISO Assistant 1 changes

• v3.21.2 · Feature · 2026-08-21

Clerk 5 changes

• docs update · Docs · 2026-08-26
• Audit Dashboard activity with Admin Logs (2026-08-25) · Feature · 2026-08-26
• changelog · Aug 25, 2026 · Feature · 2026-08-25
• docs update · Docs · 2026-08-22
• Custom OAuth scopes (2026-08-21) · Feature · 2026-08-22

Cloudflare 7 changes

• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• WAF - WAF Release - 2026-08-25 (2026-08-25) · Feature · 2026-08-26
• changelog · Aug 23, 2026 · Feature · 2026-08-23

Cloudsmith 4 changes

• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• New format: Nix, with upstream support for NixOS (2026-08-24) · Feature · 2026-08-25

ConductorOne 4 changes

• changelog · Aug 26, 2026 · Feature · 2026-08-26
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• August 21, 2026 (2026-08-21) · Feature · 2026-08-22

Cribl 1 changes

• docs update · Docs · 2026-08-26

cve-lite-cli 1 changes

• v1.30.0 · Feature · 2026-08-23

Dalfox 4 changes

• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22

DataDome 7 changes

• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-24
• Tyk module 1.4.0 (2026-08-24) · Feature · 2026-08-24
• docs update · Docs · 2026-08-22
• Envoy module 2.8.0 (2026-08-21) · Feature · 2026-08-22

defectdojo 5 changes

• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• 3.2.300 · Feature · 2026-08-25

dependency-track 1 changes

• 5.0.5 · Feature · 2026-08-24

detect-it-easy 1 changes

• docs update · Docs · 2026-08-24

Didit 4 changes

• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22

DigiCert CertCentral 1 changes

• changelog · Aug 23, 2026 · Feature · 2026-08-23

dirsearch 4 changes

• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22

DNSFilter 2 changes

• 08/25 August 25 – Web Application and API Update (2026-08-25) · Feature · 2026-08-26
• changelog · Aug 24, 2026 · Feature · 2026-08-24

Docker Compose 1 changes

• docs update · Docs · 2026-08-25

Dreadnode 1 changes

• Kubernetes Gateway API support for on-prem installs · Feature · 2026-08-25

ElcomSoft 1 changes

• Elcomsoft System Recovery 8.38: Built-In BitLocker TPM Exploit Library, Browser Artefact Extraction, and Imaging Checksums (2026-08-26) · Feature · 2026-08-26

Endor Labs 1 changes

• Why Endor Labs AI SAST for C finds what other tools miss | Blog | Endor Labs (2026-08-24) · Feature · 2026-08-25

Exabeam 1 changes

• docs update · Docs · 2026-08-24

Fastly 3 changes

• docs update · Docs · 2026-08-26
• Rust SDK 0.13.1 (2026-08-24) · Feature · 2026-08-26
• Add headless bot metric to Historical Stats and Real-Time Analytics APIs (2026-08-24) · Feature · 2026-08-25

Feedly Threat Intelligence 3 changes

• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26
• Automatically collect Splunk Hunting Queries that match your requirements (2026-08-25) · Feature · 2026-08-26

fhEVM 1 changes

• v0.14.0 · Feature · 2026-08-23

Firezone 1 changes

• 1.0.0 · API · 2026-08-23

Fleet 1 changes

• api-docs-91b019e489ab · API · 2026-08-23

gef 1 changes

• docs update · Docs · 2026-08-22

Ghostty 1 changes

• docs update · Docs · 2026-08-26

Giskard 2 changes

• giskard-checks/v1.0.3 · Feature · 2026-08-26
• v3.0.0 · Feature · 2026-08-26

GitGuardian SaaS 3 changes

• docs update · Docs · 2026-08-25
• Scan your AWS S3 buckets for secrets (2026-08-25) · Feature · 2026-08-25
• docs update · Docs · 2026-08-23

GitHub 9 changes

• Rule insights dashboard generally available (2026-08-25) · Feature · 2026-08-26
• GitHub Copilot app Customize tab is generally available (2026-08-25) · Feature · 2026-08-26
• Block users directly from security advisories (2026-08-25) · Feature · 2026-08-26
• Push rules in rulesets now support path exceptions (2026-08-25) · Feature · 2026-08-26
• Better tools for managing blocked users (2026-08-21) · Feature · 2026-08-22
• The new GitHub Copilot experience in Slack (2026-08-21) · Feature · 2026-08-22
• Shared agentic work with GitHub Copilot in Microsoft Teams (2026-08-21) · Feature · 2026-08-22
• Pinning saved views to the repository issues sidebar is generally available and more (2026-08-20) · Feature · 2026-08-21
• Windows 11 arm64 VS2026 image generally available (2026-08-20) · Feature · 2026-08-21

GitHub CLI 1 changes

• v2.98.0 · Feature · 2026-08-21

GitLab 4 changes

• Scale software delivery pipelines in isolation without owning the runner fleet (2026-08-25) · Feature · 2026-08-25
• Build custom flows in minutes with the Flow Creator agent (2026-08-20) · Feature · 2026-08-21
• Run agentic software delivery inside the boundaries you already trust (2026-08-20) · Feature · 2026-08-21
• When your backlog outgrows your team, GitLab scales remediation (2026-08-20) · Feature · 2026-08-21

Google SecOps 2 changes

• docs update · Docs · 2026-08-25
• August 24, 2026 (2026-08-24) · Feature · 2026-08-25

goshs 5 changes

• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• v2.1.6 · Feature · 2026-08-24

Hayabusa 2 changes

• docs update · Docs · 2026-08-26
• docs update · Docs · 2026-08-26

Huntress 2 changes

• All IPv4 Addresses associated with an Agent are now displayed in Portal · Feature · 2026-08-21
• Windows Subsystem for Linux Visibility in Huntress Managed EDR · Feature · 2026-08-21

iDenfy 4 changes

• changelog · Aug 25, 2026 · Feature · 2026-08-25
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• updated · Aug 24, 2026 · Feature · 2026-08-24

Immuta 1 changes

• updated · Aug 22, 2026 · Feature · 2026-08-22

infisical 2 changes

• v0.162.23 · Feature · 2026-08-22
• v0.162.22 · Feature · 2026-08-21

Intruder 2 changes

• changelog · Aug 26, 2026 · Feature · 2026-08-26
• Integrate with Bitbucket Cloud for AI Pentesting (2026-08-25) · Feature · 2026-08-25

Invicti 1 changes

• changelog · Aug 24, 2026 · Feature · 2026-08-24

Iru 1 changes

• What's New in Iru | August 21st · Feature · 2026-08-22

JFrog 3 changes

• docs update · Docs · 2026-08-25
• Coding Agents Just Reopened Your Software Supply Chain Blind Spot (2026-08-25) · Feature · 2026-08-25
• Propagating User Identity From AI Agents to Your Tools: Amazon Bedrock AgentCore Gateway and JFrog Artifactory (2026-08-21) · Feature · 2026-08-22

JumpCloud 1 changes

• JumpCloud Agent Release Notes for August 25, 2026 (2026-08-25) · Feature · 2026-08-26

kata-containers 1 changes

• 4.1.0 · Feature · 2026-08-22

Legit Security 1 changes

• Your AI Agent Has New Skills. Can You Trust Them? (2026-08-20) · Feature · 2026-08-21

Maigret 1 changes

• v0.6.5 · Feature · 2026-08-25

Mend AI 5 changes

• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• (24-August-2026) · Feature · 2026-08-24

Mend Container 4 changes

• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• Version 26.8.1 (23-August-2026) · Feature · 2026-08-24

Mend Platform 5 changes

• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• Version 26.8.1 (23-August-2026) · Feature · 2026-08-24

Mend SAST 6 changes

• docs update · Docs · 2026-08-25
• Version 26.8.1 (24-August-2026) · Feature · 2026-08-25
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24

Mend SCA 4 changes

• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24

Metasploit Framework 1 changes

• docs update · Docs · 2026-08-23

MIND 1 changes

• MIND AI DLP agents: Your team. One mission. Stress Free DLP. (2026-07-29) · Feature · 2026-08-23

Minimus 1 changes

• docs update · Docs · 2026-08-24

MISP 1 changes

• v2.5.45 · Feature · 2026-08-26

Mitiga 3 changes

• Helios AIDR: Why Cloud Security Needs Intelligent Automation Now (2026-08-19) · Feature · 2026-08-23
• HeliosAI Agent: Finally, a Tier 2/3 Analyst You Can Trust (2026-08-18) · Feature · 2026-08-23
• Introducing Investigation Workbench (2026-07-24) · Feature · 2026-08-23

Mobile Verification Toolkit 2 changes

• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22

NETRESEC 2 changes

• docs update · Docs · 2026-08-22
• CNCMachineRMS C2 Protocol (2026-08-21) · Feature · 2026-08-22

Nettacker 1 changes

• 0.4.1 · Feature · 2026-08-25

Nmap 1 changes

• commits-2026-08-18 · Code activity · 2026-08-23

npq 1 changes

• v3.27.0 · Feature · 2026-08-26

Nudge Security 1 changes

• changelog · Aug 23, 2026 · Feature · 2026-08-23

Okta for AI Agents 1 changes

• changelog · Aug 26, 2026 · Feature · 2026-08-26

Okta Identity Engine 3 changes

• announced · Aug 24, 2026 · Feature · 2026-08-26
• docs update · Docs · 2026-08-22
• Weekly release 2026.08.2 (2026-08-19) · Feature · 2026-08-22

OpenAI Codex Security 5 changes

• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22

OpenCTI 2 changes

• docs update · Docs · 2026-08-25
• 7.260824.0 · Feature · 2026-08-25

OpenSandbox 3 changes

• python/sandbox/v0.1.16 · Feature · 2026-08-26
• java/sandbox/v1.0.19 · Feature · 2026-08-25
• docker/egress/v1.1.7 · Feature · 2026-08-22

OpenShell 3 changes

• v0.0.113 · Feature · 2026-08-26
• v0.0.111 · Feature · 2026-08-22
• v0.0.110 · Feature · 2026-08-21

OSSEC HIDS 1 changes

• 4.3.0 · Feature · 2026-08-26

Passbolt 1 changes

• Who Is He | Browser Extension & API · Feature · 2026-08-21

Ping Identity 1 changes

• changelog · Aug 24, 2026 · Feature · 2026-08-24

Plerion 1 changes

• Review external access to AWS with resource access grants: · Feature · 2026-08-21

Pomerium 3 changes

• Enterprise Console Updates · Feature · 2026-08-22
• MCP OAuth Compatibility & Hardening · Feature · 2026-08-22
• Platform & Image Hardening · Feature · 2026-08-22

Portkey 3 changes

• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22

Prowler 1 changes

• docs update · Docs · 2026-08-26

Realm Security 2 changes

• Realm + Databricks Zerobus Ingest: Clean, Structured Security Data, Delivered Direct (2026-08-04) · Feature · 2026-08-23
• Realm Security Debuts Detection Integrity to Prove that Reducing SIEM Log Volume Never Breaks a Threat Detection (2026-07-28) · Feature · 2026-08-23

RegScale 1 changes

• CLI 6.42.0 (2026-08-26) · Feature · 2026-08-26

rekono-kbx 1 changes

• 2.0.0-1 · Feature · 2026-08-23

Retire.js 3 changes

• 5.7.0 · Feature · 2026-08-22
• 5.6.0 · Feature · 2026-08-22
• 5.5.0 · Feature · 2026-08-22

runZero 2 changes

• runZero 5.1.260825.0 (2026-08-25) · Feature · 2026-08-26
• changelog · Aug 25, 2026 · Feature · 2026-08-25

SailPoint 2 changes

• Enhancement: HTTP Request Action - Sensitive Request Headers (2026-08-24) · Feature · 2026-08-25
• Enhancement: MySailPoint Managed Defaults, Dashboard Templates & Widget Sizing (2026-08-19) · Feature · 2026-08-21

Salt Security 1 changes

• Salt Debuts First AWS WAF Managed Ruleset for AI Agent and API Protection (2026-08-04) · Feature · 2026-08-23

sbomify 1 changes

• v26.8.0 · Feature · 2026-08-26

Scrut Automation 5 changes

• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22

Semgrep 1 changes

• updated · Aug 26, 2026 · Feature · 2026-08-26

Snyk 2 changes

• changelog · Aug 26, 2026 · Feature · 2026-08-26
• changelog · Aug 24, 2026 · Feature · 2026-08-24

Snyk Code 1 changes

• changelog · Aug 21, 2026 · Feature · 2026-08-21

Socket 5 changes

• New: Asana integration for alert ticketing (2026-08-25) · Feature · 2026-08-26
• PHP and Composer support is now in beta (2026-08-21) · Feature · 2026-08-26
• New: Firefox extension protection (2026-08-20) · Feature · 2026-08-26
• docs update · Docs · 2026-08-24
• docs update · Docs · 2026-08-24

SonarQube 1 changes

• docs update · Docs · 2026-08-24

Sophos Access Points 1 changes

• 1.10.3173MR10NewReleased on August 24, 2026 · Feature · 2026-08-25

spire 1 changes

• v1.15.3 · Feature · 2026-08-22

sstimap 1 changes

• v1.4 · Feature · 2026-08-26

StackHawk 3 changes

• changelog · Aug 23, 2026 · Feature · 2026-08-23
• docs update · Docs · 2026-08-21
• updated · Aug 21, 2026 · Feature · 2026-08-21

StepSecurity 3 changes

• ARC Harden Runner v2.19.0 (2026-08-24) · Feature · 2026-08-24
• Mint StepSecurity API Tokens from AWS Workloads (2026-08-20) · Feature · 2026-08-24
• Dev Machine Guard v1.16.0 (2026-08-21) · Feature · 2026-08-21

subfinder 1 changes

• v2.16.0 · Feature · 2026-08-23

Sumo Logic 3 changes

• Support for Longer Dashboard Time Ranges (Dashboards) (2026-08-25) · Feature · 2026-08-25
• Changes to the Save to Index Alert Type for Scheduled Searches (Alerts) (2026-08-24) · Feature · 2026-08-24
• 1.0.0 · API · 2026-08-23

T3MP3ST 1 changes

• commits-2026-08-12 · Code activity · 2026-08-24

Tenzir 8 changes

• docs update · Docs · 2026-08-25
• Tenzir Ship v2.2.0: Forward-looking changelog metadata policies (2026-08-24) · Feature · 2026-08-25
• changelog · Aug 24, 2026 · Feature · 2026-08-24
• Tenzir Test v2.1.0: Format-aware test output sorting (2026-08-23) · Feature · 2026-08-23
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• docs update · Docs · 2026-08-22
• Tenzir Node v6.13.0: Parallel pipelines across the node (2026-08-22) · Feature · 2026-08-22

tetragon 3 changes

• docs update · Docs · 2026-08-25
• v1.7.1 · Feature · 2026-08-25
• docs update · Docs · 2026-08-24

Tines 1 changes

• changelog · Aug 26, 2026 · Feature · 2026-08-26

Token Security 2 changes

• Token Security Brings Claude Compliance API Into Its Identity Control Plane | Token Security (2026-08-06) · Feature · 2026-08-23
• Token Security’s MCP Server Discovery Capability Uncovers Hidden AI Servers and Secrets | Token Security (2026-08-06) · Feature · 2026-08-23

Trend Vision One 5 changes

• TrendAI™ Zero Day Initiative risk events now generally available (2026-08-25) · Feature · 2026-08-26
• Clickable asset totals allow you to view assets that contribute to Cyber Risk Subindexes (2026-08-24) · Feature · 2026-08-26
• Zero Trust Secure Access On-premises Gateway version 1.0.92 (2026-08-24) · Feature · 2026-08-24
• Zero Trust Secure Access Private Access Connector version 2.42.0.2105 (2026-08-20) · Feature · 2026-08-21
• Zero Trust Secure Access Private Access Connector version 3.7.0.2100 (2026-08-20) · Feature · 2026-08-21

trufflehog 1 changes

• docs update · Docs · 2026-08-23

Varonis 9 changes

• Schedule scan pauses by day and time zone · Feature · 2026-08-26
• Simplify classification policies with Data Classes · Feature · 2026-08-26
• Scope classification scans by AWS Organization · Feature · 2026-08-26
• Get notified when automation actions require attention · Feature · 2026-08-26
• Monitor Snowflake masking policy and tag changes faster · Feature · 2026-08-26
• See how and why Snowflake resources are being shared · Feature · 2026-08-26
• Understand data coverage across scan scopes · Feature · 2026-08-26
• Unify Jira and Confluence onboarding with a single Atlassian integration · Feature · 2026-08-26
• Filter and export connected service accounts more efficiently · Feature · 2026-08-26

Vega 2 changes

• updated · Aug 24, 2026 · Feature · 2026-08-24
• updated · Aug 23, 2026 · Feature · 2026-08-23

Velociraptor 1 changes

• docs update · Docs · 2026-08-26

Veracode 3 changes

• Integration updates (2026-08-24) · Feature · 2026-08-25
• Integration updates (2026-08-19) · Feature · 2026-08-21
• CLI updates (2026-07-31) · Feature · 2026-08-21

vopono 2 changes

• 0.10.22 · Feature · 2026-08-23
• 0.10.21 · Feature · 2026-08-23

Wallarm 5 changes

• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25
• docs update · Docs · 2026-08-25

Waratek 1 changes

• Waratek Launches Reflection Protection, a Zero-Configuration Defense Against Known and Zero-Day Unsafe Java Reflection and Class-Loading Attacks (2026-08-18) · Feature · 2026-08-23

YARA-X 1 changes

• v1.20.0 · Feature · 2026-08-24

Yeti 1 changes

• 2.7.0 · Feature · 2026-08-24

Yubico 1 changes

• The ‘Air-Gap Conundrum’: When Password Managers Meet the Data Center Floor (2026-08-03) · Feature · 2026-08-23

1Password 1Password for Windows 8.12.34 (2026-08-25) · 2026-08-26

The 1Password MCP Server setting has been removed from Settings > Labs and is now located under Settings > Developer.

brutespray v2.7.2 · 2026-08-26

--require-plan-ack requires an engagement manifest with evidence.hmac_key set; executions using plan acknowledgment without this key will fail closed.

brutespray v2.7.2 · 2026-08-26

brutespray audit verify requires the BRUTESPRAY_AUDIT_HMAC_KEY environment variable; missing or incorrect keys cause verification to fail.

brutespray v2.7.2 · 2026-08-26

-P is now a strict print-and-exit operation in the shared Execute path; any setup that relied on -P continuing into credential attempts will no longer do so.

Chainguard changelog · Aug 26, 2026 · 2026-08-26

Existing v2beta1 integrations must update their path prefix from /v2beta1/ to /v2/; request and response shapes are preserved.

Cloudflare WAF - WAF Release - 2026-08-25 (2026-08-25) · 2026-08-26

Rules ...1489d892, ...20646260, ...d706d517, and ...660886c8 change from Log to Block — traffic previously only logged for HTTP/2 Request Smuggling and XSS JavaScript Event Handler Coercion will now be blocked.

Cloudflare WAF - WAF Release - 2026-08-25 (2026-08-25) · 2026-08-26

Rule ...c293b926 (XSS, HTML Injection - Script Tag - Beta) is merged into ...7b58420b; any overrides or exceptions referencing the Beta rule ID will no longer apply.

ConductorOne changelog · Aug 26, 2026 · 2026-08-26

c1i now requires a full https:// tenant URL; the bare short-name shortcut is retired and a non-HTTPS URL is rejected instead of silently upgraded.

ConductorOne changelog · Aug 26, 2026 · 2026-08-26

On mcp servers register, mcp servers test-connection, and mcp servers update-credentials, the external MCP server URL flag is renamed from --url to --server-url; scripts or configs passing --url to select the MCP server on these commands will break.

Giskard v3.0.0 · 2026-08-26

Scenario.from_sequence is removed; step-based scenario construction via the .interact() chain is now required.

Giskard v3.0.0 · 2026-08-26

Jinja2 template parsing in Workflow.chat is now opt-in rather than the default, breaking any workflow that relied on automatic Jinja rendering of chat messages.

Giskard v3.0.0 · 2026-08-26

Templating support in conformity rules is dropped entirely.

Giskard v3.0.0 · 2026-08-26

The Interact injection is now name-based, changing how check dependencies are resolved inside scenarios.

Giskard v3.0.0 · 2026-08-26

The Interact API is replaced with a new API (refactor: new 'Interact' API); code using the previous Interact interface will break.

Giskard v3.0.0 · 2026-08-26

Giskard v2 is no longer actively maintained; the automatic tabular scan (giskard.Model + giskard.Dataset), giskard.testing ML test suite, and Giskard Hub are not present in v3.

Okta for AI Agents changelog · Aug 26, 2026 · 2026-08-26

Orgs that previously used the Delegation tab to configure AI agent access through delegation links must reconfigure them using the User access tab.

Semgrep updated · Aug 26, 2026 · 2026-08-26

For organizations migrated to Unified Policies, the Policies V1 and Ruleboard endpoints now return 410 Gone with a DEPLOYMENT_MIGRATED code instead of a normal response.

Semgrep updated · Aug 26, 2026 · 2026-08-26

Organizations without Semgrep Multimodal enabled now receive a 403 response from every trigger path, including scheduled and API-initiated runs.

Bright Security Release of August 25, 2026 · 2026-08-25

The entrypointsStatuses property in the Scan Configuration API is scheduled for deprecation on 22 September 2026; migrate integrations to entryPointFilter (with securityStatus and connectivityStatus sub-fields) before that date.

Bright Security Release of August 25, 2026 · 2026-08-25

Removes the X-XSS-Protection misconfiguration check from Header Security tests; scanners that previously relied on this finding will no longer receive it.

DataDome docs update · 2026-08-25

In v3.0.0, static-asset file extensions must be moved out of DATADOME_URL_REGEX_EXCLUSION into the new DATADOME_STATIC_ASSET_EXCLUSION variable; any extensions left in DATADOME_URL_REGEX_EXCLUSION will be treated as custom URL exclusions rather than static-asset exclusions.

DataDome docs update · 2026-08-25

DATADOME_REMOVE_MATRIX_PARAMS and DATADOME_ENCODED_CHAR_INCLUSION are enabled by default in v3.0.0; applications that require the old behaviour must explicitly disable them.

DataDome docs update · 2026-08-25

Any static-asset extensions previously listed in DATADOME_URL_REGEX_EXCLUSION (e.g. .css, .js, .png, etc.) must be moved to the new DATADOME_STATIC_ASSET_EXCLUSION variable; leaving them in DATADOME_URL_REGEX_EXCLUSION will cause them to be evaluated as bot-detection candidates rather than excluded.

DataDome docs update · 2026-08-25

DATADOME_REMOVE_MATRIX_PARAMS is now on by default — deployments that rely on matrix params being passed through unchanged must explicitly disable this setting.

DataDome docs update · 2026-08-25

DATADOME_ENCODED_CHAR_INCLUSION is now on by default — paths containing %23, %25, %2f, %3b, or %3f that were previously excluded as static assets will now be inspected; disable the setting only if it causes compatibility issues.

DataDome docs update · 2026-08-25

The DATADOME_URL_REGEX_EXCLUSION setting no longer includes static-asset extension patterns — those are now managed by the new DATADOME_STATIC_ASSET_EXCLUSION setting. Any custom regexes that were duplicating built-in static-asset exclusions should be reviewed to avoid redundancy or gaps.

Nettacker 0.4.1 · 2026-08-25

Runtime data (SQLite database and results) has moved from .data to .nettacker/data; any scripts or tooling that reference the old .data path must be updated.

OpenSandbox java/sandbox/v1.0.19 · 2026-08-25

SandboxPool.Builder.reconcileInterval(...) and the corresponding PoolConfig setting have been removed; pool reconciliation now runs on a fixed one-second cadence. Callers must delete all uses of reconcileInterval with no replacement.

Tenzir docs update · 2026-08-25

The validate command no longer applies omit_pr and omit_author policies to released (published) entries by default; existing workflows that relied on full-history omission checks must now pass --all-entries to restore that behaviour.

tetragon docs update · 2026-08-25

The MatchArgs operator is deprecated in favour of the MatchCEL selector.

tetragon v1.7.1 · 2026-08-25

returnArgAction no longer accepts Post as a value in TracingPolicy. Use returnArg to include return values in events and omit returnArgAction for default behavior; only TrackSock and UntrackSock remain supported. Existing policies with returnArgAction: "Post" must remove that field.

Veracode Integration updates (2026-08-24) · 2026-08-25

The Veracode Flaw Importer task (with spaces in the task name) in the Veracode Azure DevOps extension is deprecated and scheduled for removal in a future release; replace it with VeracodeFlawImporter.

Veracode Integration updates (2026-08-24) · 2026-08-25

Support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x ends November 30, 2026; upgrade to Jira 10 or later to continue using a supported version.

DNSFilter changelog · Aug 24, 2026 · 2026-08-24

The Reset to Default option has been removed from the Dashboard Actions menu — any workflow relying on it to reset dashboard layout will no longer find this control.

goshs v2.1.6 · 2026-08-24

The --no-clipboard flag is replaced by --no-chat (-nc); any scripts or configs using --no-clipboard will break on upgrade.

Mend AI docs update · 2026-08-24

AI Usage settings have been moved from the General tab to a dedicated AI Usage tab under the new AI category in the Administration sidebar — any documentation or runbooks pointing to the General tab for AI Usage settings will need to be updated.

Sumo Logic Changes to the Save to Index Alert Type for Scheduled Searches (Alerts) (2026-08-24) · 2026-08-24

For scheduled searches using the Save to Index alert type with aggregate queries, the _raw (Message) field is now empty — any downstream query that uses parse against _raw, searches plain-text keywords from the message body, or reads the Message column to get field values will break and must be updated to reference named fields directly.

Sumo Logic Changes to the Save to Index Alert Type for Scheduled Searches (Alerts) (2026-08-24) · 2026-08-24

The 512-result-per-run limit for Save to Index scheduled searches is removed; searches that run frequently (e.g. every 15 minutes) without a limit operator may now save significantly more data per run than before.

Arcjet docs update · 2026-08-23

Unversioned import aliases such as @arcjet/guard/vercel-ai do not resolve; only versioned paths (e.g. @arcjet/guard/langgraph/v1) are valid.

Chalk v1.2.0 · 2026-08-23

report_default, report_large, and insertion_default templates have had FAILED_KEYS removed and _FAILED_KEYS added; consumers reading FAILED_KEYS from these report templates must switch to _FAILED_KEYS.

Cloudflare changelog · Aug 23, 2026 · 2026-08-23

Web Analytics may report a different volume of pageviews after the soft navigation measurement update — the extent depends on front-end architecture and visitor traffic patterns.

fhEVM v0.14.0 · 2026-08-23

The signDecryptionPermit() API is now the required SDK decryption permit path; durationDays is replaced by durationSeconds, permit objects carry a protocol version, and several low-level SDK exports were removed in favor of high-level encrypt/decrypt/sign actions.

fhEVM v0.14.0 · 2026-08-23

User-decryption authorization moves to the unified v2 flow; legacy on-chain request shapes remain only for the deprecation window.

fhEVM v0.14.0 · 2026-08-23

The KMSGeneration Gateway migration path was removed; deployment and rollout flows must use deployProtocolConfigFromMigration, deployKMSGenerationFromMigration, upgradeKMSGeneration, verify tasks, and the KMS/wave1 migration verification scripts.

fhEVM v0.14.0 · 2026-08-23

The coprocessor's Ethereum chain-ID flag was renamed to the canonical protocol-config chain ID; host_chains seeding is now declarative — coprocessor configuration must be updated accordingly.

Firezone 1.0.0 · 2026-08-23

Removed endpoint GET /intune_integration

rekono-kbx 2.0.0-1 · 2026-08-23

The /api/system/ endpoint is replaced by /api/settings/ and per-integration endpoints — any client calling /api/system/ will break.

rekono-kbx 2.0.0-1 · 2026-08-23

The address field on host objects is renamed to ip — any code or integration referencing address will break.

rekono-kbx 2.0.0-1 · 2026-08-23

The scheduled_in field is removed from scans; use scheduled_at instead.

rekono-kbx 2.0.0-1 · 2026-08-23

Finding fields first_seen, last_seen, detected_by, and is_active are removed from the API.

rekono-kbx 2.0.0-1 · 2026-08-23

The enable and disable operations on findings are removed.

rekono-kbx 2.0.0-1 · 2026-08-23

The Telegram bot commands /newauth, /newtechnology, and /newvulnerability are removed.

rekono-kbx 2.0.0-1 · 2026-08-23

SMTP configuration is removed from the configuration file and from RKN_EMAIL_* environment variables; it must now be set via the database/UI.

rekono-kbx 2.0.0-1 · 2026-08-23

The queues tasks-queue, executions-queue, and findings-queue are renamed to tasks, executions, and findings — any external tooling targeting the old queue names will break.

rekono-kbx 2.0.0-1 · 2026-08-23

Redis is replaced by Valkey — existing Redis-only deployments must migrate to Valkey.

rekono-kbx 2.0.0-1 · 2026-08-23

Required Python version is raised to 3.11.

rekono-kbx 2.0.0-1 · 2026-08-23

Required Dirsearch version is raised to 0.5.0.

rekono-kbx 2.0.0-1 · 2026-08-23

TLS certificates are now stored in a Docker volume instead of the docker/nginx/tls directory.

rekono-kbx 2.0.0-1 · 2026-08-23

Rekono Desktop (Electron apps and Debian package) is removed; the only supported deployment methods are Docker and from source.

rekono-kbx 2.0.0-1 · 2026-08-23

The rootpath sub-path deployment option is removed.

StackHawk changelog · Aug 23, 2026 · 2026-08-23

hawk validate config previously exited 0 even on hard validation errors and missing configuration files; it now exits non-zero on those conditions. CI pipelines relying on the always-zero exit behavior (e.g., hawk validate config stackhawk.yml && ./deploy.sh) will now correctly fail when the configuration is invalid.

BunkerWeb docs update · 2026-08-22

The default Permissions-Policy now blocks all ch-* (Client Hints) directives; services relying on Accept-CH or Sec-CH-Prefers-Color-Scheme will lose Client Hints support until the policy is adjusted to re-allow the required ch-* features.

BunkerWeb docs update · 2026-08-22

Incoming X-SSL-* headers are stripped before reaching the application on every site; setups behind an upstream proxy that sets these headers must capture the value in a server-http Nginx set directive (e.g. set $trusted_ssl_verify $http_x_ssl_client_verify) and re-inject it via REVERSE_PROXY_HEADERS — using proxy_set_header alone is insufficient because the header is already empty by the time it is evaluated.

BunkerWeb docs update · 2026-08-22

When mTLS is enabled and the scheduler cache at /var/cache/bunkerweb is not persistent, mTLS remains disabled after a scheduler restart until the first job run completes and redistributes the CA bundle; a persistent cache volume is required for strict enforcement across restarts.

BunkerWeb docs update · 2026-08-22

Recreating the bunkerweb-ui container without a persistent volume on /data wipes TOTP encryption keys; every user loses their 2FA enrollment and must re-enroll.

BunkerWeb docs update · 2026-08-22

Setting TOTP_ENCRYPTION_KEYS to an invalid value (e.g. fewer than 43 characters, such as the placeholder changeme) causes the key to be discarded and replaced by a random one, leaving 2FA unusable until the variable is cleared manually — unlike leaving the variable unset, this also prevents the admin enrollment from being reset automatically.

BunkerWeb v1.6.14 · 2026-08-22

KEEP_CONFIG_ON_RESTART is no longer listed as a configurable setting in the web UI or database — it must be set in the environment or in /etc/bunkerweb/variables.env on Linux, as it is read by the entrypoint before the database is reachable.

BunkerWeb v1.6.14 · 2026-08-22

Existing remember me long-lived tokens are rejected and deleted on the next request; users relying on year-long browser persistence will be logged out and must re-authenticate. Extend SESSION_LIFETIME_HOURS and SESSION_ABSOLUTE_HOURS to replicate long-lived sessions.

BunkerWeb v1.6.14 · 2026-08-22

Biscuit tokens carrying more than a single block are now rejected by the API; any client that appended extra blocks to its tokens will have its requests refused.

ConductorOne docs update · 2026-08-22

c1i v0.5.0 now requires a full https:// tenant URL — bare short-name shortcuts are rejected, and a non-HTTPS URL is rejected instead of silently upgraded.

ConductorOne docs update · 2026-08-22

The mcp gateway command's --url flag has been renamed to --server-url; any scripts or aliases using --url with mcp gateway will break.

ConductorOne August 21, 2026 (2026-08-21) · 2026-08-22

c1i now requires a full https:// tenant URL — bare short-name shortcuts are rejected, and a non-HTTPS URL is rejected instead of silently upgraded.

ConductorOne August 21, 2026 (2026-08-21) · 2026-08-22

The mcp gateway command's --url flag is renamed to --server-url; any script passing --url to mcp gateway must be updated.

Dalfox docs update · 2026-08-22

The dalfox url subcommand is retired as a first-class command (survives only as a hidden alias); replace with dalfox scan [url].

Dalfox docs update · 2026-08-22

The dalfox file subcommand is retired as a first-class command (survives only as a hidden alias); replace with dalfox scan [file].

Dalfox docs update · 2026-08-22

The dalfox pipe subcommand is retired as a first-class command (survives only as a hidden alias); replace with dalfox scan - or cat targets | dalfox scan.

Dalfox docs update · 2026-08-22

The dalfox sxss subcommand is removed with no hidden alias; replace with dalfox scan [url] --sxss.

Dalfox docs update · 2026-08-22

--concurrence <int> is renamed to --workers <int>.

Dalfox docs update · 2026-08-22

-C, --cookie <string> is renamed to --cookies <string>.

Dalfox docs update · 2026-08-22

--use-bav and --skip-bav are removed with no replacement; BAV checks are gone entirely from v3.

Dalfox docs update · 2026-08-22

--found-action <cmd> and --found-action-shell are removed; use REST API webhooks or pipe stdout instead.

Dalfox docs update · 2026-08-22

--skip-headless and --force-headless-verification are removed; headless Chrome is gone and static analysis is always on.

Dalfox docs update · 2026-08-22

--grep <file> and --skip-grep are removed; regex response matching replaced by AST analysis.

Dalfox docs update · 2026-08-22

--report and --report-format are removed; use -f markdown -o <file> or -f sarif -o <file> instead.

Dalfox docs update · 2026-08-22

--max-cpu is removed; CPU allocation is handled automatically by the async scheduler.

Dalfox docs update · 2026-08-22

--no-spinner is removed; spinner suppression is now automatic.

dirsearch docs update · 2026-08-22

Legacy pickle session files are no longer loaded directly; existing pickle sessions will produce a warning and cannot be resumed without recreation.

dirsearch docs update · 2026-08-22

Optional DB dependencies (MySQL, PostgreSQL) are now explicit extras (dirsearch[mysql], dirsearch[postgresql], dirsearch[db]) rather than mandatory runtime dependencies.

dirsearch docs update · 2026-08-22

The old dependency installer path was removed.

dirsearch docs update · 2026-08-22

dirsearch now requires Python 3.11 or higher; installations running Python 3.10 or below will receive 'Sorry, dirsearch requires Python 3.11 or higher' and exit immediately.

Okta Identity Engine docs update · 2026-08-22

Okta for AI Agent orgs that previously used the Delegation tab to configure AI agent access through delegation links must reconfigure them using the User access tab.

GitHub Windows 11 arm64 VS2026 image generally available (2026-08-20) · 2026-08-21

Starting September 21, 2026, the windows-11-arm image will be gradually updated to use Visual Studio 2026 by default (rollout completes September 30, 2026), which may break workflows that depend on Visual Studio 2022.

Snyk Code changelog · Aug 21, 2026 · 2026-08-21

Committed files matched by a .gitignore rule are now included in analysis across all interfaces and this cannot be disabled. CLI scans require an upgrade to Snyk CLI 1.1307.0 or later; earlier versions retain the previous behavior, causing CLI results to differ from SCM and web results.

StackHawk docs update · 2026-08-21

hawk validate previously exited 0 even on hard validation errors and missing configuration files; it now exits non-zero in those cases, which will cause pipelines relying on the old always-zero behavior to correctly fail on a broken configuration.

StackHawk updated · Aug 21, 2026 · 2026-08-21

hawk validate config previously exited 0 even on hard validation errors; it now exits non-zero for hard errors and missing configuration files. Pipelines relying on the always-zero exit code will now correctly fail on a broken configuration.

Veracode Integration updates (2026-08-19) · 2026-08-21

The Veracode Flaw Importer task (with spaces in the task name) in the Veracode Azure DevOps extension v3.35.0 is deprecated and replaced by VeracodeFlawImporter; the old task is scheduled for removal in a future release.

Veracode Integration updates (2026-08-19) · 2026-08-21

Veracode will end support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x on November 30, 2026; upgrade to Jira 10 or later to maintain a supported configuration.

Veracode CLI updates (2026-07-31) · 2026-08-21

The veracode static scan command no longer includes the --verbose flag by default (v2.38.2).

Veracode CLI updates (2026-07-31) · 2026-08-21

The --debug flag on veracode package is deprecated in favor of --verbose (v2.38.0).

Veracode CLI updates (2026-07-31) · 2026-08-21

The previous SRCCLR_DOWNLOAD_URL default of https://download.sourceclear.com is now deprecated; the new default is https://sca-downloads.veracode.com — update all instances in your environment (v2.39.0).

Veracode CLI updates (2026-07-31) · 2026-08-21

Using old CLI versions (pre-v2.48.0) with the Veracode Platform will result in incomplete data displayed in the platform (v2.48.0).