New on the Toolchain — issue 005, October 26, 2026

Commands you copy from an issue or a tool page are now checked for characters that look like ordinary ones but aren't, such as a Cyrillic letter inside a web address or a hidden mark that reorders what you see. A command that fails the check is left out with a note, so the line you paste always does what it shows.

The releases in your monthly and quarterly Grep reports now read in your language, the same way they do in the daily issue. If a few haven't been translated yet, the report says how many stayed in English. The download links don't change, so the files you share match what everyone else gets.

Head now shows each new detection, integration or supported platform as its own labeled badge with a link to the release notes, the same way Tail does. Before, the Head email only gave a count like Integrations: 2 changes, so you had to click through to see what actually changed. Now you can tell at a glance what a tool added or retired.

The watchlist header is simpler now. We took out its own detect my toolchain button, which did the same thing as the paste box in My Toolchain. To find the tools you run from a brew list, a Brewfile or a requirements.txt, open My Toolchain and paste it there, so building your toolchain all happens in one place.

If you read in another language, your emails now arrive fully in it: Diff's weekly documentation changes are translated too, subject lines are written in your language instead of an English template, and fewer passages fall back to English.

The home-page chart pairs monthly bars with a line showing the rise in software creation over five years. Source dates and missing-data gaps stay visible, without a headline total.

The Tail email now opens with a few releases we picked that looked interesting, each with a line on why it matters. Before, it was the whole day's firehose in one long email. Now you can read the picks in a minute and open the issue on the web when you want every release, which is all still there.

We now track five more tools, including Nebulock's Agentic Threat Hunting Framework, an AI DFIR toolkit and Datadog's pathrunner. Their release notes show up in the newsletter from the next issue, and each has a tool page with its history.

The Features and Command line sections on each tool page now open with two or three plain sentences instead of a long paragraph, so you get to the list faster.

The panel at the top of every tool page is now titled How [tool] helps, so you can tell at a glance it's about what the tool does for you.

The stack-to-toolchain diagram on What is a cyber toolchain? now labels the pile of tools on the left Stack, so it reads as the move from the tools you have to the tools connected into a chain.

More of the back catalog now reads fully in Japanese, German, Chinese, Spanish, Portuguese, Korean and Hindi. We retranslated the passages that came back mangled the first time, about half of them, so fewer past issues fall back to English mid-page.

The box that asks before we delete your account now looks and works like every other box on the site. It has the same title bar with a close button in the corner and the same row of buttons at the bottom, so it's clear how to back out. Closing it always keeps your account.

Buttons now look and respond the same on every page, including tips, the scorecard, vendors, website history and the API reference. Before, some pages drew their own, so the same action could look different from one page to the next and you had to work out what was clickable.

A small one: tool pages now use the same rounded corners as the rest of the site. Badges, bars, dots and code snippets on a tool page each had a slightly different edge, so the page looked a little off next to the others. Now they match from page to page.

A small one: the tool preview you open from the tools table now uses the site's usual spacing, corners and shadow. The install command has a bit more room, the embedded video has the same rounded edge as videos elsewhere, and the hint on a greyed-out button looks like every other pop-up on the site.

What is a cyber toolchain? now walks through three toolchains at work: taking a server with a known-exploited (CISA KEV) flaw off the internet, patching a critical flaw tonight instead of in next week's window, and turning an alert into a contained incident. Each one explains the work without naming products, draws the chain with its branches, shows the real tools for any step when you hover or tap it, and saves the ones we follow to My Toolchain in one click. Clicking a tool opens its details in place. The diagram at the top shows fourteen licensed tools, the eleven in use, and three jobs they do together; a new section explains why to plan by toolchain instead of by stack. Both diagrams download as a PNG, ready for a slide. The page is now the featured piece on Articles.

In the daily email, each highlight's number now sits beside the tool name instead of on top of it, so you can read which tool it is on your phone.

The Tail email now always opens with a few picks. Before, an issue whose picks weren't ready mailed a short note and a link instead. Now we write the picks when the email goes out, so you get them every time.

A security advisory on a tool's timeline is now labelled as one, and it no longer counts as a release. Trivy's CVE-2026-55092 used to sit in the release history like a version, with a clone command for a tag that doesn't exist. Now it reads advisory, it offers no clone command, and release counts only count what the tool actually shipped.

The activity chart on this page shows our commits for every week again, not just the latest one, so you can see how steadily the site is being built alongside the updates we ship.

A small one: the headline on the tools table is now the same size as the headline on every other page. It was a touch smaller, so the title jumped a little as you moved between pages.

Uniq can now include rebrand observations from a vendor's linked pages, with the same paired screenshots and dated evidence as its home and pricing pages. Those observations previously stopped the issue from rendering.

When an update adds to what a tool covers, like a new integration or detection, you now see it as a badge on the bullet it came from. It used to sit in a separate box under the entry.

Briefed on Head now shows only the features each tool was picked for, so the short read matches the reason it made the list. Everything still shows every feature.

Features, Command line and Releases on a tool page now work the same way. Each one is a list on the left with the item you picked open on the right, the same Show and Search controls above it, and j and k to move down the list. Once you've learned one, you know all three, and you don't lose your place in a long list to read one entry.

Release notes now name each product the same way throughout. When a vendor shortens its own product name partway through (Cloud SIEM under Datadog Cloud SIEM), we spell it out in full, so one product never reads like two.

Tool feature lists now go back years, through older release notes, not just recent ones. We now track about 31,700 features across 1,230 tools, roughly twice as many as before, so a Capability Search finds a tool that shipped a feature long ago, not only one that mentioned it lately.

Additional filters on an issue now starts closed every time, so each issue opens on the entries rather than a row of controls. It still opens on its own when a filter is on, so you can always see why the list is shorter.

The Add to Grep buttons in the New Tools email now stay on one line in Gmail on iPhone, so the list reads cleanly instead of breaking each button into a stack of words.

Type a newsletter's name into search, like Head or Tail, and the top result opens its newest issue. Before, typing Head showed you tools named Headscale and old issues, and you had to go to the newsletter page to find this week's.

You can subscribe without the mouse. Press ] until you reach the subscribe box, use j and k to move between the plans, and press Enter to pick one. You land in the email box, and Enter again signs you up.

Tool pages now keep up with the product. When a vendor adds to its docs, changes the words on its website, rewrites its README or description, or ships a new API, we rewrite that tool's summary and highlights the same week, so the page describes the product as it is now rather than as it was when we first added it.

The tools list opens faster. You see the first screen of tools right away and the rest arrive a moment later, so you can start reading without waiting for the whole list. Search engines can now read the page too, which makes it easier to find us when you search for a tool.

Uniq's rebrand reports now support before-and-after evidence from captured product and linked pages, so you can see where those changes appeared.

Uniq now says what it covers: how vendors reposition, reprice, rebrand, and change hands. The old line only mentioned how vendors describe themselves, so it undersold the pricing, rebrand, and deal coverage every issue already carries.

There's a new Webhooks page under Developers. It shows how you'll get a signed request at your own HTTPS address when a tool you follow ships, so you can wire releases into your own systems without polling. Webhooks are included with Researcher and Business, and they're coming soon.