The Cyber Toolchain — issue -010, September 30, 2025
THE CYBER TOOLCHAIN
NO. -010
Tail
THE DAILY RELEASE FIREHOSE
PUBLISHED SEPTEMBER 30, 2025 · EVERY DAY
EDITIONStail|grep|head|ls|diff|uniq
The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
ldeep 1.0.88 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. Signing & LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. Channel Binding verification and binary SID format support.
└──▷ GET THIS VERSION
$ git clone --branch 1.0.88 https://github.com/franc-pentest/ldeep.git
# already have the repo? check out this version:$ git checkout 1.0.88
New LDAP Signing and LDAPS Channel Binding verification capability to detect misconfigured AD signing/binding policies.
Supports binary SID format, enabling correct resolution of SIDs stored in binary encoding.
Hunter adds multi-domain people finding with new filters in Discover and Domain Search, including job title, verification status, and saved leads.
└──▷ HOW TO FIND IT
Find decision makers in specific departments across multiple companies, filtering out saved contacts.
📍In Discover, select target companies -> Use the Find People sidebar -> Filter by Job title, Department, and Verification status. Enable Saved leads to hide already saved prospects.
Filter emails for a specific domain by verification status and location to find valid contacts in a target region.
📍In Domain Search, enter the company domain -> Filter by Verification status (e.g., Valid) -> Filter by Location (e.g., United States).
Adds a Find People sidebar in the Discover section to search for contacts across multiple companies, replacing the old bulk email-finding workflow.
Adds seven new filtering options for people discovery: Job title, Verification status (Valid, Accept All, Unknown), Saved leads, Department, Contact details, People per company, and Location.
Extends the multi-domain people finding filters to the Leads section for saved company lists.
Adds new filtering options to Domain Search: Verification status, Location, Saved leads, Department, Type (personal/generic), and Show only results with phone/position/full name.
New -rl/--rate-limit flag sets a maximum requests-per-second cap to respect bug bounty scope rate limits.
When respParamInputField is enabled in config.yml, parameter names are now extracted from <select> and <button> HTML fields in addition to <input> and <textarea>.
2 details in Everything
1 more release in this issue
· 2025-09-29 → 2025-09-30
Dradis Pro v4.18 adds YoY BI trends, custom mappings copy, and Azure DevOps Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. support
└──▷ HOW TO FIND IT
View year-over-year activity trends and common issues in the BI Dashboard
📍In the Dradis Pro web console, navigate to Business Intelligence › Dashboard to view YoY insights.
Copy existing template mappings when uploading an updated kit
📍In the Mappings Manager, upload a new or updated kit/template and select Copy existing mappings to apply them.
Configure Azure DevOps integration with Microsoft Entra ID
📍In the Integration settings for Azure DevOps, switch the authentication method from OAuth to Microsoft Entra ID and save.
Adds Business Intelligence Dashboard views showing year-over-year activity trends and common issue lists
Adds Mappings Manager option to copy existing template mappings when uploading new or updated kits/templates
BloodHound v8.2.0 adds ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise. pathfinding, saved query sharing, audit logging, job filtering, and new asset group tag capabilities.
└──▷ GET THIS VERSION
$ git clone --branch v8.2.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v8.2.0
Adds History Search API endpoint for querying past search activity.
Adds accordion detail panels for ADCS nodes in the graph explorer.
Updates built-in ADCS saved searches with improved coverage.
Adds DCFor edge type to the pathfinding relationship filter.
Makes ManageCA and ManageCertificate edges traversable in pathfinding.
+24 moreshow less
Adds a kinds array to graph node API responses for richer type information.
Adds environment filter support to the /selectors/:selectorId/members API endpoint.
Adds member filtering per environment in the Priority Zone details page.
Adds filter dialog to the Finished Jobs log for narrowing ingestion history.
Adds Status and DataCollected filters to the Finished Jobs table.
Adds date range picker inputs to the Finished Jobs table for time-scoped filtering.
Adds tag glyph indicators on asset group tag items in the UI.
Adds new config option to enable or disable user analytics collection.
Adds Certify/Revoke Certification API for objects.
Adds List Certifications API endpoint.
Adds client type field to the Client API.
Adds a new Get Users Minimal API endpoint for lightweight user lookups.
Introduces a dynamic Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. (CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.) via API configuration.
Introduces force_download_embedded_collectors configuration option to force collector downloads.
Adds sort_by and environment filtering support to the /asset-group-tags/:assetGroupTagId/selectors endpoint and selectors list UI.
Adds saved query sharing: queries can be set to public and shared with specific users.
Persists saved query filters across sessions.
Adds delete confirmation modal for saved queries.
Adds a stale clients parameter for client management.
Bumps SharpHound bundled collector to v2.7.2.
Hides the manual upload button for users who lack upload permissions.
Refreshes BloodHound application icon and logos.
Adds Release Audit proof-of-concept feature for tracking release events.
Adds comma-separated number formatting to large numeric displays in the UI.
29 details in Everything
1 more release in this issue
· 2025-09-02 → 2025-09-23
evil-winrm-py v1.5.0 adds runps for local PowerShell script execution and tab completion for remote executables.
└──▷ GET THIS VERSION
$ git clone --branch v1.5.0 https://github.com/adityatelange/evil-winrm-py.git
# already have the repo? check out this version:$ git checkout v1.5.0
└──▷ TRY IT
Run a local PowerShell script on the remote host mid-session without manually uploading it first.
$ runps /path/to/local/script.ps1
New runps command executes local PowerShell scripts directly from the interactive shell without pre-uploading.
Adds tab completion for executable files in the current remote directory, speeding up lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. workflows.
Improves KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. credential handling for compatibility with updated gssapi library.
Enhances load_ps to provide feedback and update command suggestions when new scripts are loaded.
Hydra v9.6 adds SSH legacy cipher support, PostgreSQL custom port, SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. expired-account handling, and HTTP 403 support.
└──▷ GET THIS VERSION
$ git clone --branch v9.6 https://github.com/vanhauser-thc/thc-hydra.git
# already have the repo? check out this version:$ git checkout v9.6
└──▷ TRY IT
Attack an older SSH server that requires legacy ciphers (e.g., arcfour, diffie-hellman-group1-sha1) that modern clients reject by default.
Supports SSH legacy ciphers, enabling brute-force against older SSH servers that require deprecated algorithms.
Supports custom ports for PostgreSQL targets.
Improves SMB module handling of expired-credential responses.
Supports HTTP 403 responses, expanding coverage for web form attacks where targets return 403 on failure.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!freerdp dependency upgraded from v2 to v3; systems without freerdp v3 installed will fail to build or use the RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. module.
A collection of small utilities for advanced password cracking
hashcat-utils v1.10 adds ngramX, ntlmv1.py, export_potfile.py, stdin support for combinators, and a 512-char combinator length limit.
└──▷ GET THIS VERSION
$ git clone --branch v1.10 https://github.com/hashcat/hashcat-utils.git
# already have the repo? check out this version:$ git checkout v1.10
└──▷ TRY IT
Pipe a wordlist directly into combinatorX as the first file, combining it with a second wordlist without writing a temp file.
$ cat wordlist1.txt | combinatorX - wordlist2.txt
Adds ngramX utility for n-gram generation from wordlists.
Adds ntlmv1.py script for NTLMv1NTLMv1A Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. hash handling.
Adds export_potfile.py script to export potfile contents.
Raises maximum length (LEN_MAX) to 512 characters for all combinators, enabling longer password candidate generation.
Adds stdin support for combinatorX to read the first file from standard input, enabling pipeline-based workflows.
+5 moreshow less
Updates combinatorX to version 1.2.
Adds tmesis.pl support for \x rule syntax and escaping of non-7-bit-ASCII bytes in output.
Improves performance of permute by using an output buffer.
Adds CI/CD pipeline via GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. with downloadable build artifacts.
Adds Makefile support for building individual binaries.
SecLists 2025.3 adds Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server discovery, and YYYY-MM-DD date wordlists plus expanded default-password and LFI coverage.
└──▷ GET THIS VERSION
$ git clone --branch 2025.3 https://github.com/danielmiessler/SecLists.git
# already have the repo? check out this version:$ git checkout 2025.3
New Active Directory wordlist for AD-specific enumeration and password attacks.
New Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) server discovery dictionary for enumerating AI/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. tool endpoints.
New YYYY-MM-DD date-format wordlists for fuzzing date-based parameters and paths.
Adds /etc/apache2/.htpasswd to LFI fuzzing lists for broader local file inclusion coverage.
Expands web-all-content-types.txt with all IANA MIME types for content-type fuzzing.
+9 moreshow less
Adds MCP server entries to common.txt for broad discovery sweeps.
Adds IBM Power Systems default credential padmin:padmin and Quectel entries to default-passwords.csv / default-passwords.txt.
Adds common Spanish names and words for language-aware password and username enumeration.
Expands Swagger/OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. endpoint wordlist for API surface discovery.
Adds Spring Cloud Gateway prefix permutations to Java-Spring-Boot.txt for behind-gateway service discovery.
Adds new SAP payload to the SAP fuzzing wordlist.
Adds encryptionkeys directory to common_directories.txt for key-store discovery.
Expands OBEX common filenames wordlist for Bluetooth object-exchange enumeration.
Adds more permutations to common_directories.txt for broader directory brute-forcing.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!All DirBuster wordlists are renamed with the DirBuster-2007 prefix (e.g., dirbuster/directory-list-2.3-medium.txt is now DirBuster-2007/...); any tooling or scripts referencing the old paths will break.
Predatory ESP32 firmware for M5Stack, Cardputer and LilyGo devices.
Bruce 1.11.1 adds unified binary for Cardputer variants and exposes new I2C/UARTUARTA hardware protocol for serial communication between devices, transmitting data one bit at a time over two wires. Cyber tools use it to access embedded device consoles and debug interfaces without a network stack./GPS pin configuration options in Dev mode.
└──▷ GET THIS VERSION
$ git clone --branch 1.11.1 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.11.1
Cardputer and Cardputer ADV now share the same binary file
Added GPS>Config>GPS pins configuration to change rx/tx GPS pins
Added Config>Dev mode section with options to change I2C device pins, UART pins, and GPS pins
3 details in Everything
1 more release in this issue
· 2025-09-05 → 2025-09-29
Bruce 1.11 adds Karma WiFi attack, Ethernet card support, MAC spoofing, and BLEBLEBluetooth Low Energy, a wireless protocol maintained by the Bluetooth SIG for short-range communication at minimal power draw, making it useful for cyber tools that interact with IoT devices or proximity-based systems. reader support for PN532.
└──▷ GET THIS VERSION
$ git clone --branch 1.11 https://github.com/BruceDevices/firmware.git
# already have the repo? check out this version:$ git checkout 1.11
Adds Karma attack capability to WiFi module
Adds support for Ethernet Card and refactors WiFi attacks to work with any esp-netif interface
Adds MAC Management and MAC Spoofing implementation
Adds BLE Reader support for PN532/PN532Killer and Standalone Control of Emulator
The open-source wireless research platform for ESP32.
GhostESP v1.7.2 adds Lolin S3 Pro support and direct UARTUARTA hardware protocol for serial communication between devices, transmitting data one bit at a time over two wires. Cyber tools use it to access embedded device consoles and debug interfaces without a network stack./JTAGJTAGA hardware debugging standard (IEEE 1149.1) that exposes a chip's internal state through a small set of pins, letting cyber tools read memory, set breakpoints, and flash firmware without touching the running OS. character echo.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.2 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:$ git checkout v1.7.2
Add support for Lolin S3 pro to the hardware target list
Echo backspace, newline, and characters directly to UART and JTAG when supported
Proxmark3 v4.20728 adds MQTT client, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. Simplex 36-bit, FeliCaFeliCaA contactless smart card standard developed by Sony, widely used in Japanese transit and payment systems, operating at 13.56 MHz with its own proprietary protocol distinct from ISO 14443. auth/dump, saflok commands, and shell execution from the client.
└──▷ GET THIS VERSION
$ git clone --branch v4.20728 https://github.com/RfidResearchGroup/proxmark3.git
# already have the repo? check out this version:$ git checkout v4.20728
Adds hf saflok command suite for Saflok hotel lock interactions.
Adds MQTT support: the pm3 client can now send and receive MQTT messages or JSON files, with preferences stored via prefs.
Adds ! shell escape — run system commands from inside the pm3 client (note: dangerous when running as root/sudo).
Adds lf t55xx view — view T55XX dump files directly without a connected card.
Adds hf felica liteauth for FeliCa Lite-S authentication.
+13 moreshow less
Adds hf felica scsvcode to dump all service and area codes from a FeliCa tag.
Adds partial hf felica dump support for dumping all blocks from unauthenticated readable services.
Adds HID Simplex Grinnell 36-bit detection with improved Simplex decoder.
Adds detection of PCF 7961 chipset.
Adds ntag_clean.lua script for easy NTAG memory wipe.
Adds --override parameter to NDEF read to bypass MAD CRC check.
Extends data crypto to handle AES-256 in addition to existing ciphers.
Extends mem load to handle UL-C and UL-AES dictionary files.
Extends hf mfu sim to support UL-C simulation.
Extends lf search to test for chipset even when only signal noise is detected.
Adds Swissbit iShield Key Mifare recognition to hf mfdes info.
Extends hf mf info to detect unknown backdoor keys and additional backdoor variants.
Extends reveng -g to correctly accept 1024-character hex strings as input.
18 details in Everything
└──▷ BREAKING ON UPGRADE
!lf t55xx restore now skips writing block 0 if its value is all zeros — cards where a zero block 0 was intentional will no longer have that block written on restore.
Proxmark3 adds MQTT messaging, hf saflok, FeliCaFeliCaA contactless smart card standard developed by Sony, widely used in Japanese transit and payment systems, operating at 13.56 MHz with its own proprietary protocol distinct from ISO 14443. Lite-S auth, and shell command execution.
Adds mqtt commands to send and receive MQTT messages or JSON files
Adds --override parameter to NDEF read for overriding MAD CRC check
Adds hf saflok commands for SAFLOK card support
Adds ! shell command to execute system commands from inside the client
Adds hf felica liteauth for FeliCa Lite-S authentication
+2 moreshow less
Adds ntag_clean.lua script for easier NTAG memory wipe
A fast, intuitive USB 2.0 protocol analysis application for use with Cynthion.
v0.5.0 adds PcapNG support, HIDHIDHuman Interface Device — a USB (and Bluetooth) device class standardized by the USB Implementers Forum covering keyboards, mice, and gamepads; cyber tools use it to make a rogue device enumerate as a trusted input peripheral. report descriptor decoding, and Cynthion VBUS control
└──▷ GET THIS VERSION
$ git clone --branch v0.5.0 https://github.com/greatscottgadgets/packetry.git
# already have the repo? check out this version:$ git checkout v0.5.0
Add facility to dump the capture database for debugging.
Add decoding of HID report descriptors.
Add support for non-packet events from Cynthion analyzer.
Add support for VBUS power control with Cynthion analyzer.
Add support for the PcapNG file format with custom non-packet blocks.
airgeddon v11.52 adds WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. attacks menu, 802.11be Evil Twin support, and enhanced enterprise certificate analysis.
└──▷ GET THIS VERSION
$ git clone --branch v11.52 https://github.com/v1s1t0r1sh3r3/airgeddon.git
# already have the repo? check out this version:$ git checkout v11.52
Adds a WPA3 attacks menu exposed as a hookable function to enable WPA3 support in existing plugins.
Improves 802.11be (Wi-Fi 7) standard detection for adapters and enables Evil Twin fake APs to advertise 802.11be when the adapter supports it.
New option to disable ESSID stripping during Evil Twin attacks, preserving the full network name.
Enhances enterprise certificate analysis and identity capture capabilities.
Codacy Cloud adds OpenSSF Scorecard integration and trims deprecated patterns
Adds OpenSSF Scorecard report view directly from dependency details to assess open-source component security posture.
Removes the Trivy_vulnerability pattern, replacing it with Trivy_vulnerability_critical and Trivy_vulnerability_high for precise vulnerability tracking.
Enhances issue uniqueness detection to ensure all unique issues reported on the same line by tools like Trivy and Prospector are visible.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The Trivy_vulnerability pattern is removed; users must update queries or filters referencing it to use Trivy_vulnerability_critical or Trivy_vulnerability_high.
Veracode Scan for VS Code gains OAuth SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.; Jira Server integration adds failed-import email notifications.
Adds OAuth-based authentication support to Veracode Scan for VS Code v1.15.0 for IDE single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO)
Adds email notification on import failure in Veracode Integration for Jira Server v4.14.0 using Jira SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. server configuration
2 details in Everything
12 more releases in this issue
· 2025-09-02 → 2025-09-25
Adds email notifications for failed imports in Veracode Integration for Jira Server v4.14.0
Adds support for sending email notifications when an import fails, using your Jira SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. server configuration.
Veracode Scan for VS Code v1.15.0 adds OAuth-based authentication and single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.)
Veracode EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds Business Units management, new Dashboard widgets, and Deep Discovery work queue enhancements.
Adds Business units capability to create, assign, and manage business units with domain associations.
Adds Heatmap, World map, and Things widgets to the EASM dashboard with filterable data views.
Adds shortcut to create reports from the new Dashboard widgets.
Enhances Deep discovery with a work queue, selection toggles, and clearer result indicators.
EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds heatmap/world map/things dashboard widgets, business unit management with domain associations, and deep discovery work queue enhancements.
Dashboard now supports Heatmap, World map, and Things widgets with filterable data views and report generation shortcuts
Users can create, assign, and manage Business units linked to specific domains
Deep discovery features an enhanced work queue with selection toggles and clearer result indicators
Veracode Scan for Eclipse v1.4.0 adds OAuth/SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication support.
Snyk API & Web adds Mark as sensitive masking and an Account Owner policy for non-retrievable secrets in target settings.
Account Owners gain a new module on the Settings > Authentication page to enforce that all designated sensitive information becomes permanently non-retrievable after being saved
Users configuring targets can select the Mark as sensitive checkbox for fields like API authentication payload, login forms, basic auth credentials, custom headers/cookies, API parameter values, and Postman environment values to have them automatically masked
2 details in Everything
6 more releases in this issue
· 2025-09-04 → 2025-09-30
Adds fail-fast option for broken DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. navigation sequences in Target Settings.
Adds a 'When a navigation sequence fails, fail the scan immediately and notify me' checkbox in the Navigation Sequences module of Target Settings to stop scans on failure.
Mend SCA v25.9.1 adds import/export support for CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and new SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. sources (Syft, Dependency-Track).
Adds support for importing Syft-generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
Adds support for importing Dependency-Track-generated SBOMs
Adds support for importing self-generated SBOMs
Enables CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 format for both import and export
4 details in Everything
2 more releases in this issue
· 2025-09-07 → 2025-09-28
Mend SCA 25.8.2 adds new workflow conditions for direct dependencies, multi-license detection, and exploit prioritization plus grouped findings UI.
Adds three new SCA conditions to enhance workflows: trigger actions for direct dependencies, detect components with multiple licenses, and prioritize vulnerabilities with publicly available exploits.
Enables grouping of findings in the Findings tab within the Direct Library side-panel via collapsible/expandable Library Rows.
Mend SAST 25.8.2 adds Windsurf AI code scanning and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide.-based deep links for findings.
Adds the capability to scan AI-generated code within Windsurf
uuid-based deep links replace older finding identifiers in Mend CLI report outputs
Skylos v0.1.0 introduces VS Code integration with inline diagnostics, configurable settings, and a workspace scan command.
└──▷ GET THIS VERSION
$ git clone --branch v0.1.0-skylos-vsce https://github.com/duriantaco/skylos.git
# already have the repo? check out this version:$ git checkout v0.1.0-skylos-vsce
└──▷ HOW TO FIND IT
Run a scan on the entire current workspace using the Command Palette.
📍Skylos: Scan Workspace
Adds skylos.path, skylos.confidence, skylos.excludeFolders, skylos.runOnSave, skylos.enableSecrets, skylos.enableDanger, and skylos.showPopup settings to control extension behavior
Adds inline diagnostics popup and status bar notifications after each scan
Adds Skylos: Scan Workspace workspace command for initiating scans from the Command Palette
3 details in Everything
3 more releases in this issue
· 2025-09-17 → 2025-09-22
Skylos v2.2.2 adds --secrets CLI flag for secrets scanning PoC with SKY-S101 detections
└──▷ GET THIS VERSION
$ git clone --branch v2.2.2 https://github.com/duriantaco/skylos.git
# already have the repo? check out this version:$ git checkout v2.2.2
--secrets CLI flag to trigger secrets scanning PoC (SKY-S101) with provider patterns and high entropy checks, outputting results in JSON.
GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. CI workflow added for Skylos Deadcode Scan (.github/workflows/skylos.yml).
GitLab 18.4 adds CI/CD job token push auth, OCS severity thresholds, OpenTofu OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. templates, and agentic Duo controls.
[ci_push_repository_for_job_token_allowed] API parameter enables CI/CD job tokens to authenticate Git push requests
severity_threshold config key in Operational Container Scanning filters vulnerability reports by severity level
provider-release and module-release CI/CD templates with type: oci support for publishing OpenTofu modules/providers to the container registry
Group/Application settings allow automatic Duo Code Review for multiple projects simultaneously
GitLab Knowledge Graph beta CLI parses local repositories into an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.-connected embeddable graph database
Adds --passive-scan-severity, GitHub Action support, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation, and new framework detectors in Noir v0.24.0
└──▷ GET THIS VERSION
$ git clone --branch v0.24.0 https://github.com/owasp-noir/noir.git
# already have the repo? check out this version:$ git checkout v0.24.0
└──▷ USE IT
Run a passive scan targeting only high and critical severity issues, skipping the automatic rule update check for offline environments.
shell
noir passive-scan --passive-scan-severity high --passive-scan-no-update-check <target>
Configure CI/CD to use the new official GitHub Action for automated scanning.
Adds --passive-scan-severity CLI flag to set minimum severity level for passive scans
Adds --passive-scan-auto-update and --passive-scan-no-update-check flags to control automatic passive scan rule updates
Adds official OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Noir GitHub Action integration
Adds SBOM (Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.) generation support
Adds support for 17 new detectors/analyzers including Marten, Grip, Amber, Plug, Go-Zero, FastHTTP, Mix, Vert.x, Next.js, Ktor, Symfony, Laravel, Tornado, Sanic, Gotham, Tide, and Warp
+1 moreshow less
Adds --cache-disable and --cache-clear flags to control LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. cache behavior
Openlayer introduces test bundles, new LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. evaluation tests, and Python runtime support in CLI.
Introduces test bundles to group tests for use cases like the EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe., OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against., agentic workflows, and data quality.
Adds new test types to the library: groundedness for LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code., toxicity score, prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. checks, and competitor recommendation checks.
Adds support for new Python runtimes in the CLI development mode.
KICS v2.1.14 adds over 15 new detection queries for AWS, Azure, and Kubernetes
└──▷ GET THIS VERSION
$ git clone --branch v2.1.14 https://github.com/Checkmarx/kics.git
# already have the repo? check out this version:$ git checkout v2.1.14
└──▷ TRY IT
Scan infrastructure code to find AWS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. clusters missing encryption configuration.
Detect IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies in Terraform code that may allow data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. risks.
Find ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. services assigned with public IP addresses in Terraform, Ansible, or CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. projects.
Adds --response-size-limit flag to cap response body reads (default 4 MB), preventing memory exhaustion against targets that return very large responses
Adds --unique flag to filter duplicate responses using SimHash with Hamming distance analysis, reducing noise from similar pages across large applications
Adds --data-json flag that auto-sets Content-Type: application/json, switches method to POST, and accepts payloads or @filename references
Adds --data-urlencoded flag that auto-sets Content-Type: application/x-www-form-urlencoded, URL-encodes the payload, switches method to POST, and accepts @filename references
Enhances the interactive scan management menu with real-time view and modification of scan limits, plus a new Waiting status for queued scans
Juice Shop v19 adds Node.js 24 support, Angular 20 upgrade, and a new multi-hint system on the Score Board.
└──▷ GET THIS VERSION
$ git clone --branch v19.0.0 https://github.com/juice-shop/juice-shop.git
# already have the repo? check out this version:$ git checkout v19.0.0
Adds support for Node.js 24.x runtime.
Updates frontend to Angular 20.x and Angular Material 20.x.
New Score Board feature: gradually unlockable hints per challenge, revealed progressively as players need help.
Adds backend and challenge solution webhook support for multiple text hints per challenge.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The hint and hintUrl fields are removed from challenges.yml definition and the corresponding entity model — any customization files or integrations that reference these fields must be updated.
!Significant changes to existing challenges may break canned CTFCTFCapture The Flag — a competitive hacking challenge format where participants exploit intentionally vulnerable systems or puzzles to retrieve hidden strings, used by cyber tools to practice and demonstrate offensive and defensive techniques. setups and solution guides made for previous versions of OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Juice Shop.
Adds Trend Matrix for Applications with CSV export, filtering, and vulnerability widgets; enables automatic DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. scans in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure..
Introduces the Trend Matrix for Applications as a new view displaying Mean Time to Remediate grouped by severity and indicating vulnerabilities exceeding MTTR
Adds the ability to export the Trend Matrix to CSV format
Implements automatic DAST scans in the GitHub Actions CI/CD pipeline
Makes Scan Profiles required for all CI/CD integrations
Displays the custom User Agent option in Scan Configuration for Targets
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Scan Profiles are now required for CI/CD integrations; prior configurations without explicit profiles may fail or require migration.
humble 1.53 adds CI/CD JSON output mode and a new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. session header security check
└──▷ GET THIS VERSION
$ git clone --branch 1.53 https://github.com/rfc-st/humble.git
# already have the repo? check out this version:$ git checkout 1.53
└──▷ TRY IT
Fail a CI/CD pipeline based on machine-readable analysis totals instead of human-formatted output
$ python3 humble.py -u https://example.com -cicd
New -cicd parameter outputs analysis totals in JSON format, suitable for CI/CD pipeline integration
New insecure header detection: Mcp-Session-Id — Potentially Unsafe Value
Updated OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Secure Headers project best practices coverage
Updated Permissions-PolicyPermissions-PolicyAn HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. directive definitions
Apiiro maps an application's architecture and risk graph and runs AI-SAST, SCA, secrets, API and threat-modeling checks on AI- and human-written code.
New npm supply chain worm detection insights and remediation tools
Adds Malicious package insight filter in SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. > Risks for detecting compromised dependencies.
Updates Risk Graph Explorer to support tracing dependency trees for affected services or repos.
Provides Malicious Code Ruleset for securing CI/CD stages against malicious payloads.
Introduces PRevent app to block malicious commits from being added to repositories.
4 details in Everything
1 more release in this issue
· 2025-09-02 → 2025-09-17
Socket CLI --sub-path flag allows specifying multiple directories for a single monorepo workspace scan.
Adds --sub-path CLI argument to socket scan commands, allowing the flag to be passed multiple times to include several directories in a single workspace scan
Integrates --sub-path with the base_paths parameter in the fullscans API endpoint
Socket moves Rust scanning from Experimental to Beta with full SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation
Enables full Rust project analysis including Cargo workspaces and Cargo.toml-only crates
Unlocks full SBOM generation for Rust dependencies
Activates Rust-aware supply chain checks in the general beta tier
Socket Python SDK adds apitokens.list() and base_path param
Adds apitokens.list() method to list API tokens programmatically.
Adds base_path parameter support in file upload methods to override default URL paths.
Updates multiple API endpoints to align with the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. specification, correcting URL paths and HTTP methods.
Socket API /v0/purl now returns 400 with actionable error details for malformed PURLs
GET /v0/purl returns a 400 Bad Request with specific guidance when a submitted PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. is malformed (e.g. missing pkg: prefix) or unknown.
Socket.dev Python SDK v3.0.3 expands API coverage with new client modules for analytics, threats, and auditing.
Analytics, ThreatFeed, ApiTokens, AuditLog, and AlertTypes client classes now available in the Python SDK
Enhanced DiffScans and Triage client functionality for scanning and workflow management
New OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. client support for API schema interaction
Sonatype Nexus Repository 3.84.0 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. manifest and RPM support in Container Scanning, plus HA concurrency improvements.
Sonatype Repository Firewall now supports container images using the OCI Image Manifest Specification and Linux distributions with RPM package formats for scanning.
High availability deployments handle concurrent requests for the same asset more reliably by reducing transient read failures on blob attributes.
Adds BUILD_ATTEMPT env var and updates BUILD_URI format for GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. job-level tracking.
└──▷ GET THIS VERSION
$ git clone --branch v0.6.1 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:$ git checkout v0.6.1
BUILD_ATTEMPT environment variable is now exposed in custom report context to capture the build attempt number previously embedded in BUILD_URI.
BUILD_URI environment variable value format changed to include both workflow ID and job ID (.../actions/runs/<workflow>/job/<job>) instead of referencing only the build attempt.
BUILD_ID environment variable now references the GitHub Actions job ID instead of the workflow ID.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The format of the BUILD_URI environment variable has changed from a build-attempt reference to a URI containing both workflow and job IDs (.../actions/runs/<workflow>/job/<job>), which may break parsers expecting the previous short-form ID.
!BUILD_ID now resolves to the GitHub Actions job ID instead of the workflow ID, potentially changing logic that relied on the previous workflow-level identifier.
1 more release in this issue
· 2025-09-09 → 2025-09-23
Chalk v0.6.0 adds X509X509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. codec, postexec async collection, ZIP injection, env var scanning, and JSON logging
└──▷ GET THIS VERSION
$ git clone --branch v0.6.0 https://github.com/crashappsec/chalk.git
# already have the repo? check out this version:$ git checkout v0.6.0
└──▷ USE IT
Inject the chalk binary into a ZIP archive for AWS Lambda deployment with size threshold.
Disable environment variable scanning for artifacts if they contain sensitive data not relevant to the scan.
shell
chalk exec --no-env-vars <command>
Adds symlink_behavior_chalking, --chalk-symlink-behavior, symlink_behavior_non_chalking, and --scan-symlink-behavior to control symlink handling for chalked vs non-chalked paths.
Adds X509 codec that parses PEM/DER files and outputs metadata keys like _X509_SUBJECT, _X509_KEY_TYPE, _X509_NOT_BEFORE, _X509_NOT_AFTER. Configured via certs.filter_method, certs.always_scan_paths, certs.scan_no_extension, certs.scan_extensions, certs.ignore_filenames, certs.ignore_prefixes, and certs.ignore_extensions.
Adds asynchronous metadata collection after chalk exec via the postexec report, using configs docker.prep_postexec, exec.postexec.run, exec.postexec.fork, exec.postexec.nice, exec.postexec.access_watch.prep_tmp_path, exec.postexec.access_watch.initial_poll_time, exec.postexec.access_watch.initial_poll_interval, exec.postexec.access_watch.scan_codecs, and exec.postexec.access_watch.scan_paths.
Adds _OP_ARTIFACT_ACCESSED key to indicate if an artifact was accessed during operation.
Adds _OP_ARTIFACT_MOUNTED key to indicate if an artifact file is externally mounted.
+8 moreshow less
Adds _OP_ARTIFACT_PATH_WITHIN_VCTL key to report the path of the file in the git repo.
Adds environment variable scanning for artifacts (default on) with configurable env_vars setting or --[no-]env-vars flag, and adds _OP_ARTIFACT_ENV_VAR_NAME key.
Reports all IMDSv2 errors in FAILED_KEYS or _OP_FAILED_KEYS.
Adds ZIP archive injection support for AWS Lambda via config zip.inject_binary, zip.inject_binary_allowed_extensions (default .zip), and zip.inject_zip_size_threshold (default 50Mb), plus CLI flag --inject-binary-into-zip.
Enables setting rlimit for heartbeat processes via configuration.
Outputs logs in json format for non-interactive sessions, including fields chalk_version, chalk_commit, chalk_magic, timestamp, and msg.
Adds BUILD_UNIQUE_ID environment variable for GitHub jobs and caches external tool outputs within the same workflow job context.
Enables chalk.env to extract chalkmark from chalk.json in AWS Lambda environments where LAMBDA_TASK_ROOT is defined, and adds run-time keys mirroring _BUILD_* keys for non-chalking operations.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!symlink_behavior config renamed to symlink_behavior_chalking.
!--symlink-behavior CLI flag renamed to --chalk-symlink-behavior.
!exec.heartbeat.* configs moved to singleton exec.heartbeat.* (e.g., exec.heartbeat.run, exec.heartbeat.rate).
!Configuration ignore_patterns now applies to all chalk operations, not just chalking ones.
safe-chain adds setup-ci subcommand to wrap npm commands in CI/CD pipelines
└──▷ GET THIS VERSION
$ git clone --branch 1.0.24 https://github.com/AikidoSec/safe-chain.git
# already have the repo? check out this version:$ git checkout 1.0.24
Adds the safe-chain setup-ci command to configure GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. and Azure Pipelines for wrapping npm commands.
Changes default behavior to block package installation and exit with code 1 when scanning fails (previously it ran the command).
2 details in Everything
└──▷ BREAKING ON UPGRADE
!safe-chain now exits with code 1 and blocks package installation when scanning fails, instead of continuing execution.
1 more release in this issue
· 2025-09-11 → 2025-09-24
Malware detection now blocks installation by default instead of prompting, enforcing security by default.
Adds --safe-chain-malware-action=prompt flag to override the new blocking default behavior.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The default action when malware is detected has changed from prompt (allowing bypass by typing Y) to block, which will cause safe-chain to exit with an error on malicious packages.
cosign v2.6.0 adds in-toto statement signing, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. 1.1 bundle artifacts, SigningConfig support, and alternative hash algorithms.
└──▷ GET THIS VERSION
$ git clone --branch v2.6.0 https://github.com/sigstore/cosign.git
# already have the repo? check out this version:$ git checkout v2.6.0
└──▷ TRY IT
Sign and verify a container image, storing the bundle as an OCI 1.1 referring artifact for registries that support it.
Supports signing a complete in-toto statement directly via attest-blob --statement instead of requiring cosign to construct one from a predicate.
Adds verify-blob-attestation support for verifying a statement's subject using --digest and --digestAlg instead of a file reference.
Uploads signatures and verification material as OCI Image 1.1 referring artifacts via --new-bundle-format=true on cosign sign and cosign verify.
Adds --use-signing-config flag to sign-blob, attest-blob, sign, and attest for providing service URLs via a SigningConfig, enabling use with Rekor v2 instances.
Supports self-managed keys when signing with the sigstore-go backend.
+4 moreshow less
Removes SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. assumption in sign-blob/verify-blob, enabling alternative hash algorithms with keys.
Adds a terminal spinner during signing operations with the sigstore-go backend.
Skips TUF content loading when a trusted root path is explicitly specified.
No longer requires timestamps when verifying with a key (--use-signed-timestamps is optional in key-based verification).
9 details in Everything
└──▷ BREAKING ON UPGRADE
!sign.SignerFromKeyOpts no longer generates a key; it now returns whether the client needs to generate a key, and callers must invoke sign.KeylessSigner themselves if so.
LavaMoat webpack plugin officially releases scuttling support and adds tree-shake-safe policy enforcement.
└──▷ GET THIS VERSION
$ git clone --branch webpack-v1.4.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v1.4.0
└──▷ USE IT
Enable scuttling in your webpack build to lock down global object access at runtime, preventing supply-chain attacks from abusing globals.
LavaMoat webpack plugin now officially supports scuttling with documentation.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-core-v16.7.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v16.7.0
allow-scripts now recommends global installation for simpler, project-wide lifecycle script control.
└──▷ GET THIS VERSION
$ git clone --branch allow-scripts-v3.4.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout allow-scripts-v3.4.0
Supports global installation of allow-scripts as the recommended usage pattern, enabling consistent lifecycle script enforcement across projects without per-project setup.
$ git clone --branch webpack-v1.3.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v1.3.0
└──▷ USE IT
Generate a LavaMoat policy file during CI without applying sandbox protections — lets you audit or commit the policy separately from the production build.
Adds generatePolicyOnly option to run the plugin in policy-generation mode without applying protections, useful for CI policy auditing without a full build.
Adds null runtime support, enabling LavaMoat to work in webpack configurations that use no runtime chunk.
Adds runtimeConfigurationPerChunk_experimental option to embed and control LavaMoat runtime options on a per-chunk basis.
Adds static shims for the webpack runtime, reducing reliance on dynamic runtime injection.
Emits explicit error messages when a webpack compilation completes with no modules protected, surfacing misconfiguration early.
LavaMoat Core 16.6.0 adds Firefox content-script support for cross-realm window prototypes.
└──▷ GET THIS VERSION
$ git clone --branch lavamoat-core-v16.6.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout lavamoat-core-v16.6.0
Version 5.28 adds Azure DevOps SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. remediation, AI Auto-Fix for custom models, and new Guardrails flow.
Adds full SAST/SCA remediation capabilities in Azure
Introduces a new Guardrails flow supporting local and server-side rule evaluation
Enables AI Auto-Fix to use customer-provided models for custom model strategy
Infisical v0.148.1 adds HashiCorp Vault Gateway support, Redis cluster/replica configuration, and a custom migration UI for vaults
└──▷ GET THIS VERSION
$ git clone --branch v0.148.1 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.148.1
Adds HashiCorp Vault Gateway support to app connection and secret sync workflows, enabling new credential forwarding paths.
Introduces Redis cluster support via explicit environment variables for Infisical's internal caching layer, unlocking distributed deployments without single-point failure.
Adds REDIS_READ_REPLICA_HOST and related read replica configuration keys to direct cache reads away from the primary instance.
Provides a custom migration UI interface within the server admin console for executing vault-to-vault migrations without manual intervention.
Enables primary forwarding mode as a new operational surface for managing upstream service dependencies.
+1 moreshow less
Reworks Audit Log Stream architecture, likely altering ingestion paths and storage formats for audit data.
Infisical v0.148 adds Microsoft ADCSADCSActive Directory Certificate Services, Microsoft's PKI role for issuing and managing X.509 certificates inside a Windows domain; cyber tools target it because misconfigurations frequently allow privilege escalation or domain compromise.PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. connector, GitHub Bulk Team Sync, Google SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. enforcement, and k8s InstantUpdates support.
└──▷ GET THIS VERSION
$ git clone --branch v0.148.0 https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout v0.148.0
Adds the Microsoft ADCS external certificate authority connector to allow managing secrets signed by an Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services PKI
Adds Github Bulk Team Sync integration to synchronize GitHub team memberships with project roles in bulk
Enforces Google SSO at the organization level via the enforce_google_sso org setting, preventing non-SSO logins for the organization
Adds InstantUpdates support in the k8s operator to propagate secret changes to pods without restarts
Adds Universal Auth Login Lockout capability to prevent brute-force attacks on machine identities by blocking repeated failed login attempts
Detection Engine 2.148 expands secret detection across AI services, cloud platforms, and DevOps tools.
Adds detector for VirusTotal API keys
Adds detector for Cloudflare Turnstile secret keys
Adds detector for Stability AI API Key
Adds detector for Azure Cognito OAuth credentials
Adds detector with host-specific checks for Azure Cognito OAuth credentials with Host
+15 moreshow less
Extends Artifactory support to include dashes in hostnames for Access Token, Basic Auth Credentials, Reference Token with Host, and Token with Host
Adds detector for GitLab Feature Flags Client Token with Project ID
Adds new detector for Kubernetes JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. with Host
Adds detector for GitLab Trigger Token
Adds detector for Brave Search API keys
Adds detector for GitLab deploy tokens
Adds detector for Firecrawl API keys
Adds detector for Dify API keys
Adds detector for GitLab Runner Authentication Token
Adds detector for Ubidots API keys
Adds detector for Vapi API keys
Adds detector for Llama Cloud API keys
Extends Azure Cosmos DB credentials host pattern to improve recall
Restricts GitLab Token detector pattern to reduce false positives
Improves ODBCODBCA standard API, maintained by Microsoft, for connecting applications to relational databases regardless of vendor. Cyber tools use it to query databases without writing engine-specific code. connection string precision
20 details in Everything
1 more release in this issue
· 2025-09-15 → 2025-09-22
GitGuardian SaaS adds in-platform Secret Revocation for GitHub, GitLab, and OpenAI via a new Revocable by GitGuardian tag.
Adds the Revocable by GitGuardian tag to incidents containing secrets that can be immediately revoked from the platform, accelerating incident response workflows
Enables in-platform secret revocation for supported providers (GitHub, GitLab, OpenAI) via a call-to-action in the incident detail view, which automatically resolves valid revocations and logs them in the incident timeline
Adds Container Registries endpoints to the public API documentation.
GitGuardian Self-Hosted 2025.9 adds BYO source scanning, AI filters, and SharePoint/OneDrive support
└──▷ HOW TO FIND IT
Quickly search across all incidents and logs using the new unified interface
📍Press Ctrl+K (or Cmd+K) in the UI to open Quick Access, then type natural language queries.
Filter audit logs using natural language instead of static fields
📍In the Audit Logs view, use the AI Filters input box to type 'Show me failed authentication attempts from last week'.
Bring Your Own Sources capability extends secret detection to CI logs, legacy systems, and SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel.
SOPS v3.11.0 adds new CLI flags for sops set, shell completions, env-var keyservice config, and Azure KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. latest-key support.
└──▷ GET THIS VERSION
$ git clone --branch v3.11.0 https://github.com/mozilla/sops.git
# already have the repo? check out this version:$ git checkout v3.11.0
└──▷ TRY IT
Pipe a secret value into sops set from another command, avoiding shell history exposure.
$ vault kv get -field=password secret/db | sops set secrets.yaml '["database"]["password"]' --value-stdin
Configure the SOPS keyservice via environment variables instead of repeating flags on every invocation — handy for container or CI environments.
New period config key for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. logging endpoints controls log finalization frequency.
Adds period field to HTTPS logging endpoint schema to control how frequently log files are finalized and sent (default 5 seconds, 0 resets to default).
Adds /rest/workspace-alerts/{id}/test endpoint to verify notification integrations.
Adds POST /rest/workspace-alerts/{id}/test endpoint to send a test notification for Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. workspace alerts
Verifies Slack, PagerDuty, email, and webhook integration reachability before production use
Wallarm adds generally available Schema-Based Testing with Docker agent for CI/CD API DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces.
Introduces Schema-Based Testing as a generally available capability within the Wallarm Security Testing suite.
Adds support for running tests via a lightweight Docker-based agent for isolated execution.
Enables sync of test results to the Wallarm Console for tracking and prioritization.
Allows users to define a configurable risk-level threshold to automatically fail test runs.
Quark Engine v25.9.1 adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-359 detection APIs and 4 new GoldDream malware rules.
└──▷ GET THIS VERSION
$ git clone --branch v25.9.1 https://github.com/ev-flow/quark-engine.git
# already have the repo? check out this version:$ git checkout v25.9.1
Adds Quark Script APIs and showcase for detecting CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor).
Adds 4 new detection rules for the GoldDream Android malware family.
EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Score Policy for vulnerability prioritization and enhanced license management with declared/concluded licenses
Introduces EPSS Score Policy component for advanced vulnerability prioritization using exploit prediction scores
Supports configured EPSS score thresholds for automated decision-making in risk assessment
2 details in Everything
3 more releases in this issue
· 2025-09-02 → 2025-09-11
Finite State adds API endpoints for component filtering and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. upload alongside UI capability to clear finding statuses
Adds component API filtering by name and version via new API endpoints to search across all projects
Adds SBOM API endpoint for uploading SBOM files to support automated integration workflows
Adds UI capability to clear and reset single or multiple finding statuses simultaneously
New global component permission and enhanced SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. audit trails in Finite State Platform
Adds a new global add component permission allowing global admins to add components to any project
Improves SBOM audit trail tracking for uploads and processing activities with detailed logging of all SBOM-related operations
jadx v1.5.3 adds text/binary resource search, smali file editing, and enhanced AAB parsing in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
└──▷ GET THIS VERSION
$ git clone --branch v1.5.3 https://github.com/skylot/jadx.git
# already have the repo? check out this version:$ git checkout v1.5.3
Adds GUI search options to search within text or binary resources.
Enables viewing and editing input smali files directly in the GUI.
Frida 17.3.0 adds XNU injection support and exposes CModule symbols.
Adds basic XNU injection support in the Barebone backend, tested on iOS 14.0 in QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware..
Exposes underscore-prefixed CModule symbols so they are usable from Frida scripts.
Radare2 6.0.4 adds sBPF analysis, VAX/SNES/MSP430 pseudo-disasm, MobiCore/XNU IOKit support, r2agent session listing, and dozens of new assembler instructions.
└──▷ GET THIS VERSION
$ git clone --branch 6.0.4 https://github.com/radareorg/radare2.git
# already have the repo? check out this version:$ git checkout 6.0.4
└──▷ TRY IT
List active r2agent remote sessions to audit what connections are currently registered.
$ r2agent -L
Control the numeric base used when displaying immediate values in disassembly.
$ r2 -e asm.imm.base=16 binary
New sBPF (Solana BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module.) analysis plugin with Rust string resolution, ESIL modelling, and ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. binary detection
Adds a:path analysis plugin (initial import)
New snes.pseudoASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. plugin for Super Nintendo disassembly
New pseudocode plugin for VAX architecture
New MSP430 pseudo-disassembler plugin (initial implementation)
+31 moreshow less
Adds process_vm IO plugin for process memory access
Implements XNU IOKit class carving and adds core IOKit types
Initial support for MobiCore MCLF binary format (fixes #14879)
Supports assembling extended BPF64 instructions and integrates BPF assembler into the Capstone plugin
Implements ST/LD classic BPF instruction assembly
Adds ldm/stm support for ARM32 assembler
Adds pld prefetch load for ARM32 assembler
Adds umlal and extended msr constructions for ARM32 assembler
Adds mrs instruction support in the ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. assembler
Implements crc32, rdrand, and rdseed for x86 assembler
Adds lzcnt, tzcnt, and popcnt for x86-64 assembler
Expands M68K assembler support with more instructions (fixes #21211)
Adds r2agent -L to list current remote sessions
Registers remote sessions when using r2agent
Implements R_IO_SEEK_HOLE for IO layer
New asm.imm.base config variable for controlling immediate base display
Implements r_flag_closest_with_prefix API and API for nearest flag inside a flagspace
Initial implementation of autoflagspaces
Adds R2_DEBUG_NOLANG environment variable to suppress RLang plugin loading
Adds r2 -H R2_MANDIR to print the man directory path
Adds new math operators and sub-expression support for negation operators in the shell
Indexes __objc_msgrefs xrefs and parses _selrefs for Objective-C metadata
Stores rawname in RFlagItem and exposes it from RBinName
Adds RBinClass instance size and type name fields
Adds support for HTTP POST on /cmd and r2pipe client APIs over HTTP
Implements tfc command without arguments to list all type function callbacks
Supports mangled/demangled names in zignatures
Implements vmatrix visual mode (initial import)
Initial real threaded Core tasks support; aliases fg/bg/jobs for task management
Hayabusa v3.6.0 improves Results Summary with first/last detection timestamps and cleaner empty-field handling for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion.
└──▷ GET THIS VERSION
$ git clone --branch v3.6.0 https://github.com/Yamato-Security/hayabusa.git
# already have the repo? check out this version:$ git checkout v3.6.0
Outputs first and last detection timestamps (in addition to first/last event timestamps) in the Results Summary of csv-timeline and json-timeline commands.
Event and record IDs with multiple possibilities from correlation rules now output as empty strings instead of - for easier parsing.
Rule modified date outputs an empty string instead of - when not defined, easing SIEM import.
Empty rule metadata fields (e.g., RuleModifiedDate) are omitted from JSON output entirely, reducing file size and simplifying parsing.
Volatility 3 v2.26.2 adds windows.etwpatch plugin, volshell breakpoints, and reorganizes malware plugins under a dedicated category.
└──▷ GET THIS VERSION
$ git clone --branch v2.26.2 https://github.com/volatilityfoundation/volatility3.git
# already have the repo? check out this version:$ git checkout v2.26.2
└──▷ TRY IT
Detect ETWETWEvent Tracing for Windows, a Microsoft kernel-level logging framework that lets applications and drivers emit structured events; cyber tools use it to observe process, network, and file activity without installing additional sensors. patching on a Windows memory image to uncover malware that blinds event tracing.
$ vol -f <memory.img> windows.etwpatch
New windows.etwpatch plugin for detecting ETW (Event Tracing for Windows) patching.
Adds breakpoint/watchpoint support in volshell — set a breakpoint on a specific layer and offset to drop into Python when that memory location is read.
Reorganizes malware-focused plugins under a malware subcategory (e.g., linux.malware.check_afinfo, windows.malware.hollowprocesses) for cleaner namespacing.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Plugin names such as linux.check_afinfo and windows.hollowprocesses are deprecated and moved to linux.malware.check_afinfo and windows.malware.hollowprocesses; old names will continue to work for approximately one year but will print deprecation warnings, and will be removed after that period.
Timesketch 20250929 adds Sec-Gemini log analysis, sketch deletion, OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. custom CA certs, and new tsctl db/archive commands.
└──▷ GET THIS VERSION
$ git clone --branch 20250929 https://github.com/google/timesketch.git
# already have the repo? check out this version:$ git checkout 20250929
└──▷ TRY IT
Export the Timesketch database for backup or migration before upgrading.
$ tsctl export-db
Identify archive records in Timesketch that are inconsistent with OpenSearch index state.
$ tsctl find-inconsistent-archives
Tracks used time filters across searches so analysts can revisit previous temporal scopes.
Supports custom CA certificates for OpenSearch connections, enabling mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with./private-CA deployments.
Integrates Sec-Gemini as a log analysis agent provider via a refactored log_analyzer feature.
Adds sketch deletion capability through the UI and API.
New tsctl commands: export-db, import-db, check-opensearch-links, and find-inconsistent-archives for database and index maintenance.
+5 moreshow less
Introduces an all scope to the sketchlist API endpoint, allowing retrieval of all sketches beyond personal/shared views.
Enhances Scenario and Question API client functionality for richer programmatic investigation workflows.
Adds SQLAlchemy engine options support for fine-grained database connection tuning.
Refactored DFIQv2 and Yeti analyzer for improved threat-indicator correlation.
Improves tsctl archive operations with additional archive management capabilities.
Extends RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to PeopleBase, AppBase, TenantBase, ThreatBase for granular access control
Abnormal AI adds a Micro-Learning Video Library for AI Phishing Coach training
└──▷ HOW TO FIND IT
Access the new micro-learning modules in the AI Phishing Coach interface to engage users with shorter, focused content.
📍In the Abnormal AI console, navigate to the AI Phishing Coach section to find the Micro-Learning Video Library.
Adds the Micro-Learning Video Library to replace long videos with five focused micro-training topics: Introduction, Threat Awareness, Emerging Threats, Ethical & Social Responsibility, and Best Practices.
Rspamd 3.13.0 adds multiclass Bayes, a provider-based neural/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. fusion engine, and SA-style multimap selector rules.
└──▷ GET THIS VERSION
$ git clone --branch 3.13.0 https://github.com/rspamd/rspamd.git
# already have the repo? check out this version:$ git checkout 3.13.0
└──▷ TRY IT
Train a message into a named Bayes class (e.g., transactional) instead of the binary spam/ham model.
$ rspamc learn_class:transactional receipt.eml
Filter messages using an SA-style selector rule in multimap to match sender domain with a regex.
Adds multiclass Bayesian classification supporting 2–20 named labels (spam, ham, transactional, newsletters, phishing, etc.) with single-Redis-call efficiency, autolearn, and Lua API support via task:get_multiclass_result().
Overhauls the neural module into a pluggable provider-based architecture combining symbol features, LLM embeddingsembeddingsLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. (OpenAI, etc.), trained normalization (unit/zscore/none), and Redis-backed embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. caching.
Adds SA-style selector rules in the multimap module for regex filtering on message fields, integrated with Hyperscan and the regex cache.
Adds automatic MIME part-type detection and expanded HTML feature extraction for downstream classification modules.
Adds flexible HTTP timeout configuration and upstream probe mode to reduce forced revive operations.
+2 moreshow less
Adds Bayes class management to the WebUI alongside end-to-end scan test flows.
Adds initial support for OpenAI GPT-5 and improved handling of GPT model parameters and prompts in the GPT/LLM integration.
Cortex Analytics adds detection for Mshta.exe spawning from browsers and rare domain access.
Adds 4 new Low severity Analytics BIOCs to detect suspicious executable behavior
Adds 14 new Informational Analytics BIOCs covering cloud identity and infrastructure activities
Decreases severity of the 'Modification of NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. restrictions in the Registry' BIOC from Medium to Informational
Cortex Analytics adds detection coverage for Right-to-Left Override in email attachments and BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data.data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
Added a new Low Analytics BIOC to detect email attachments with Right-to-Left Override Unicode characters
Added a new Informational Analytics BIOC for BigQuery table or query results exfiltrated to a foreign project
Added a new Informational Analytics BIOC for an unusual cloud identity granted permissions to a BigQuery resource
PAN-OS 11.2 adds dynamic IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addressing and dual-stack support on the PA-415-5G cellular interface.
Supports dynamic IPv6 addressing on the cellular interface of the PA-415-5G firewall, allowing the device to obtain a dynamic IPv6 prefix from the provider.
Enables dual-stack configuration on the cellular interface for the PA-415-5G, supporting both IPv4 and IPv6 traffic over the same interface.
Wireshark adds CAN-XL packet support, GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. toggle for capture filter optimization, and Falco IP geolocation.
Adds LINKTYPE_CANXL dissector for decoding CAN-XL messages in captured traffic
Adds IP geolocation data to exported Falco event logs
Security Onion 2.4.180 adds hardware virtualization support, NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. channel customization, configurable per-agent realert thresholds, and Zeek DNS resolved IP logging.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.180-20250916 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.180-20250916
Adds hardware virtualization support for manager/search and standalone nodes, including hypervisor firewall rules.
Adds NIC channel customization for network interface tuning.
Adds configurable realert threshold per elastic agent.
Adds so-elastic-agent-monitor for monitoring elastic agent health.
Adds support for a custom FQDN on receiver nodes.
+5 moreshow less
Adds Zeek dns.resolved_ip field logging.
Adds additional Fleet Node state visibility in the UI.
Adds Ruleset Name UI element for improved rule management display.
Upgrades Elasticsearch to 8.18.6.
Changes Suricata metadata index rollover from 1 day to 30 days, reducing index churn.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Fleet Nodes will need to be reinstalled after upgrading to this release.
Malcolm v25.09.0 adds Google Threat Intelligence feed support, new Modbus detailed logging, VADR dashboards, and configurable upload/time-frame env vars.
└──▷ GET THIS VERSION
$ git clone --branch v25.09.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.09.0
└──▷ USE IT
Raise the PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. upload limit to 20 GB to accommodate large capture files ingested via the Malcolm upload interface.
env
PCAP_UPLOAD_MAX_FILE_GB=20
Set the default OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Dashboards time window to the last 24 hours so analysts open to a relevant view without manual adjustment.
Adds PCAP_UPLOAD_MAX_FILE_GB to upload-common.env to configure the maximum PCAP upload file size.
Adds DASHBOARDS_TIMEPICKER_FROM and DASHBOARDS_TIMEPICKER_TO to dashboards-helper.env to configure the default search time frame for OpenSearch Dashboards.
Adds modbus_detailed.log for improved Modbus register tracking via the updated icsnpp-modbus plugin.
Includes tx-rx-secure.sh in files packaged by malcolm_appliance_packager.sh for easier certificate distribution.
Supports the Google Threat Intelligence feed as a Zeek intel source for threat intelligence enrichment.
+6 moreshow less
Integrates Validated Architecture Design Review (VADR) dashboards from CISA.
Adds non-LVM storage option(s) for Malcolm/Hedgehog Linux ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. installers.
Adds Arkime capture statistics to the Packet Capture Statistics dashboard.
Adds icons with links to the ready and ingest statistics APIs on the Malcolm landing page.
Renames the Zeek Intelligence dashboard to Threat Intelligence with an improved layout.
External navigation links from context menus in Arkime and Dashboards now prompt the user before opening external sites.
Inspektor Gadget v0.44.0 adds ttysnoop gadget, human-readable open-mode/flag formatters, and custom OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. gadget parameters.
└──▷ GET THIS VERSION
$ git clone --branch v0.44.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.44.0
New ttysnoop gadget for snooping on TTY/terminal activity.
Adds built-in formatters for mode and flags fields in trace_open, surfacing human-readable permission and flag strings instead of raw integers.
Enables gadget authors to define custom parameters directly in gadget.yaml for OCI-packaged gadgets.
Adds count annotation/parameter to top_process gadget for controlling the number of displayed processes.
Trivy is a comprehensive security scanner that finds vulnerabilities, misconfigurations, secrets, and SBOM in containers, Kubernetes, code repositories, and clouds
Trivy 0.67.0 adds seal support, OS-level vulnerability updates via OS release detection, and CoreOS SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. support
└──▷ GET THIS VERSION
$ git clone --branch 0.67.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.67.0
Adds seal support for cryptographically verifying the integrity of Trivy scan results
Adds os-release detection for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence.-based images in the vulnerability scanner to improve package identification accuracy
Adds CoreOS platform support in the SBOM generator via sbom subsystem
Changes default value of --list-all-pkgs CLI flag to true in cloudformation scanning mode
Preserves CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOM structure during vulnerability updates when scanning existing SBOM files
5 details in Everything
1 more release in this issue
· 2025-09-02 → 2025-09-30
Trivy 0.66.0 adds streaming secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., .terraform remote module caching, misconf audit configs, and cache timeouts.
└──▷ GET THIS VERSION
$ git clone --branch 0.66.0 https://github.com/aquasecurity/trivy.git
# already have the repo? check out this version:$ git checkout 0.66.0
misconf: added audit config attribute
use .terraform cache for remote modules in plan scanning
secret: implement streaming secret scanner with byte offset tracking
add timeout handling for cache database operations
kube-bench v0.13.0 adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. 1.11, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. 1.8.0, RH 1.4 and RH 1.8 benchmark support
└──▷ GET THIS VERSION
$ git clone --branch v0.13.0 https://github.com/aquasecurity/kube-bench.git
# already have the repo? check out this version:$ git checkout v0.13.0
Adds CIS KubernetesCIS KubernetesHardening benchmarks published by the Center for Internet Security for Kubernetes clusters, giving cyber tools a concrete, versioned checklist of configuration checks to run and report against. benchmark v1.11 checks.
Adds CIS benchmark profile for GKE v1.8.0.
Adds Red Hat OpenShift benchmark v1.4 checks.
Adds CIS benchmark checks for Red Hat OpenShift v1.8.
Adds support for a default value on the EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. 1.7 eventRecordQPS rule, reducing false positives in default cluster configurations.
cilium-cli v0.18.7 expands clustermesh CLI with multi-IP support, dict Helm values, and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. peer data in sysdumps.
└──▷ GET THIS VERSION
$ git clone --branch v0.18.7 https://github.com/cilium/cilium-cli.git
# already have the repo? check out this version:$ git checkout v0.18.7
Supports more than one service IP when connecting to remote clustermesh-apiserver (excluding NodePort Services).
Adds dict format support for Helm value clustermesh.config.clusters when connecting clusters.
Outputs clustermesh.config.clusters in the new dict format automatically for clusters running Cilium >= 1.20.
Includes BGP remote peer capabilities in sysdump output.
Docker Compose v2.39.4 adds develop.watch.initial_sync support for fine-grained file-watch control.
└──▷ GET THIS VERSION
$ git clone --branch v2.39.4 https://github.com/docker/compose.git
# already have the repo? check out this version:$ git checkout v2.39.4
└──▷ USE IT
Suppress the initial bulk sync when starting a watch session, so only live file changes are propagated — useful when the container already has the correct files baked in.
Grype v0.100.0 adds unaffected package/CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. stores to suppress false-positive vulnerability matches
└──▷ GET THIS VERSION
$ git clone --branch v0.100.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.100.0
Adds unaffected package and CPE stores to the vulnerability database, enabling Grype to track which packages are explicitly marked as not affected.
Uses the unaffected match table to automatically remove vulnerability matches for packages confirmed unaffected, reducing false positives.
KubeHound v1.6.5 flags Secret volumes during ingestion, opens khaudit as OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees., and imports all Kubernetes authn providers.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.5 https://github.com/datadog/kubehound.git
# already have the repo? check out this version:$ git checkout v1.6.5
Flags Secret volumes during ingestion so they appear as a distinct surface in the attack graph.
Moves khaudit to open source, making the audit subcomponent available outside Datadog.
Imports all Kubernetes authentication providers during cluster ingestion for broader authn coverage.
Kata Containers v3.21.0 adds initdata support for IBM SEL and Confidential Guests, new IO limits, and zstd packaging.
└──▷ GET THIS VERSION
$ git clone --branch 3.21.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.21.0
Adds initdata annotation support for remote configs in the Go runtime (runtime)
Adds initdata annotation support for NonProtection scenarios in the Rust runtime (runtime-rs)
Adds CoCo annotations support for ConfidentialGuests in qemu runtime
Adds zst suffix handling to kata-manager for tarball unpacking
Adds xz and zst suffix support for the kata tarball in kata-deploy local-build
Prowler 5.12.0 adds MongoDB Atlas provider (10 checks), JIRA integration, API status filtering, and token throttling.
└──▷ GET THIS VERSION
$ git clone --branch 5.12.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.12.0
└──▷ TRY IT
List all available MongoDB Atlas security checks to understand what Prowler can assess before running a scan.
$ prowler mongodb-atlas --list-checks
New MongoDB Atlas provider (Beta) with 10 security checks covering clusters, projects, and organizations — including TLS, encryption-at-rest, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., auditing, and internet-exposure checks.
Sends Prowler findings directly to JIRA projects as Task issues, with labels, finding URLs, tenant info, and color-coded severity for MANUAL findings.
New --excluded-checks-file CLI flag lets you supply a file of checks to exclude from a scan.
The GET /overviews/findings_severity endpoint now supports filter[status] and filter[status__in] query parameters to aggregate findings by FAIL or PASS status.
Token endpoint (/api/v1/tokens) now supports rate throttling via the DJANGO_THROTTLE_TOKEN_OBTAIN environment variable to prevent abuse.
+3 moreshow less
UI: Overview chart Findings by Severity now defaults to showing only FAIL findings and links to the Findings page pre-filtered by severity.
UI: Markdown rendering added to the finding details page.
Adds AdditionalURLs field to CheckMetadata for surfacing additional reference URLs on checks.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!FTP and MongoDB EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. security group checks are renamed to follow the pattern ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_* — any scripts, suppressions, or dashboards referencing the old check names will break.
Cloud Custodian 0.9.47 adds QuickSight, EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. Pipes, CloudWatch Synthetics, Azure Backup Vault support, and broad org-resource tagging actions.
└──▷ GET THIS VERSION
$ git clone --branch 0.9.47.0 https://github.com/cloud-custodian/cloud-custodian.git
# already have the repo? check out this version:$ git checkout 0.9.47.0
└──▷ TRY IT
Find S3 Multi-Region Access Points exposed to external accounts and flag them for review.
$ custodian run -s out policy-s3-mrap-xaccount.yml
# policy-s3-mrap-xaccount.yml
policies:
- name: s3-mrap-cross-account
resource: aws.s3-access-point-multi
filters:
- type: cross-account
Enforce tagging standards on all AWS Organization accounts by auto-tagging with the acting user.
Adds aws.quicksight-dashboard and aws.quicksight-datasource resource types for managing QuickSight assets.
Adds aws.eventbridge-pipes resource type for governing EventBridge Pipes.
Enables aws.cloudwatch-synthetics as a new manageable resource type.
Adds cross-account filter to aws.s3-access-point-multi (S3 Multi-Region Access Points).
Adds region-copy action to aws.rds-cluster-snapshot for copying RDS cluster snapshots across regions.
+6 moreshow less
Adds metrics filter to aws.fsx covering all FSx file system types.
Adds tagging actions (tag, remove-tag, rename-tag, auto-tag-user, copy-related-tag, mark-for-op) and marked-for-op filter to aws.org-account, aws.org-policy, and aws.org-unit.
Adds azure.backup-vault resource type for Azure Backup Vault governance.
Expands azure.machine-learning-workspace with full ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. resource actions (tag, delete, lock, etc.) and filters (cost, diagnostic-settings, metric, policy-compliant, etc.).
Updates AWS Lambda runtime support to include Python 3.10–3.13.
cloud-nuke v0.43.0 adds AWS Cloud Map, CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stacks, JSON output, and tag filtering for Launch Templates, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. clusters, Lambda, and Secrets Manager.
└──▷ GET THIS VERSION
$ git clone --branch v0.43.0 https://github.com/gruntwork-io/cloud-nuke.git
# already have the repo? check out this version:$ git checkout v0.43.0
Adds support for nuking AWS Cloud Map resources.
Adds support for nuking AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. stacks.
Adds JSON output format support (--output json) for machine-readable results.
Adds tag-based filtering for EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. Launch Templates.
Adds tag-based filtering for ECS clusters.
+3 moreshow less
Adds tag-based filtering for Lambda Functions.
Adds tag-based filtering for Secrets Manager secrets.
Adds deletion-protection handling for RDS clusters, automatically disabling it before deletion.
Cloudsplaining 0.8.1 adds assume role support for scanning cross-account or role-based AWS environments.
└──▷ GET THIS VERSION
$ git clone --branch 0.8.1 https://github.com/salesforce/cloudsplaining.git
# already have the repo? check out this version:$ git checkout 0.8.1
Adds assume role support, enabling Cloudsplaining to scan IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies by assuming a specified AWS role.
Mosaic AI Model Serving now supports Anthropic Claude Opus 4.1 via Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves.
Mosaic AI Vector Search standard endpoints now support FedRAMP ModerateFedRAMP ModerateA US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. and IRAP in compliant workspaces.
Delta Sharing on Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access. enters Beta for sharing foreign schemas and tables
Serverless GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. compute adds H100 accelerator support for single-node workflows.
Serverless GPU compute now supports on-demand H100 accelerators
Databricks Online Feature Stores public preview adds Lakebase-backed low-latency feature access with Unity Catalog and MLflow integrations
Adds Databricks Online Feature Stores (powered by Lakebase) for highly-scalable, low-latency feature data access consistent with offline feature tables.
Provides native integration with Unity Catalog, MLflow, and Mosaic AI Model Serving to allow productionized endpoints, agents, and rule engines to automatically access features.
Databricks Assistant Agent mode (Data Science Agent) enters Beta, enabling multi-step workflow orchestration from a single prompt.
Adds Agent mode to Databricks Assistant for orchestrating multi-step workflows from a single prompt
Introduces the Data Science Agent, a custom agent capable of planning solutions, retrieving assets, running code, and fixing errors automatically for tasks like EDA, forecasting, and machine learning
Adds Early Access Cylance Protect (now Arctic Wolf) Cloud Collector for Memory Protection and Threats.
Adds Early Access Salesforce EventLog Cloud Collector for various Salesforce event types.
+11 moreshow less
Adds Early Access Snowflake Cloud Collector for Login History, Others, and Query History.
Enables creation of standalone cases from correlation detections via detection grouping rule using the correlation rule group by field.
Adds Analytics Rules Severity setting to manually tune case/alert risk scores with weights for None, Low, Medium, High, and Critical.
Adds Custom Analytics Rule Builder in Threat Detection Management with a point-and-click interface.
Adds Peer Comparison feature in Outcomes Navigator under MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&ACK Coverage and Use Case Coverage tabs.
Allows sorting search exports chronologically via the sort order selector in exported results.
Enables viewing associated detection events in Timeline view via the Show Associated Events option.
Adds capability to open cases or alerts in a new browser tab by right-clicking the list item.
Increases case note character limit to 10,000 characters and custom closed reason limit to 10,000 characters.
Increases attachment size limit to 15 MB per file.
Adds Silent Monitoring Threshold feature allowing configuration of the Warn After Silent For duration from 30 minutes to 72 hours.
Microsoft Sentinel Sept 2026 updates include integrated data lake onboarding, Fabric mirroring, and UEBA new data sources.
└──▷ HOW TO FIND IT
Enable data lake retention for existing Sentinel tables via the Defender portal.
📍In the Defender portal, navigate to Table Management › select a table › Retention, then enable Mirror to Data Lake and configure retention settings.
Integrated Microsoft Sentinel SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and data lake onboarding removes the need for a separate data lake setup by using Defender portal Table management to enable the lake tier.
Adds Multi-Layer Graphs for investigations with drag-and-drop visibility controls.
Adds support for organizing investigation graphs into customizable layers to separate IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. or ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. techniques.
Enables auto-collection of new data into default and active layers within graphs.
Adds visibility controls to hide or show individual layers instantly to reduce visual noise.
Supports drag-and-drop movement of observables and objects between graph layers.
Provides real-time collaboration where layer changes are saved instantly and visible to the team.
5 details in Everything
2 more releases in this issue
· 2025-09-01 → 2025-09-11
Sekoia.io adds detection rules for WIZ Critical Alerts, CrowdStrike Falcon EppDetections, and new MacOS/Windows threat patterns.
Adds a new rule to detect WIZ Issues Critical Alert from the WIZ integration
Adds support for detecting Informational Severity EppDetection from CrowdStrike Falcon
Adds support for detecting Intrusion Detection severity events from CrowdStrike Falcon
Adds support for detecting Low Severity EppDetection from CrowdStrike Falcon
Adds support for detecting Medium Severity EppDetection from CrowdStrike Falcon
+5 moreshow less
Adds support for detecting High Severity EppDetection from CrowdStrike Falcon
Adds support for detecting Critical Severity EppDetection from CrowdStrike Falcon
Adds a new rule to detect Entra ID Sign-In Via Known AiTM Phishing Kit (Rockstar 2FA) from Microsoft Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.
Adds 8 new detection rules for MacOS threats including Chflags Hidden and Tmutil operations
Adds 5 new correlation detection rules for Windows threats including PowerShell infection chains
Google SecOps adds join support to YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. statistical Search queries for multi-source correlation
Adds join capability to YARA-L statistical Search queries that include a match section
Enables linking related data sources directly within a single statistical search query
2 details in Everything
3 more releases in this issue
· 2025-09-03 → 2025-09-27
Google SecOps adds parsers for Akamai, AWS, Bitwarden, Box, Duo, Harness, Jamf, PingOne, Snyk, Venafi, Veritas, VMware, and Zoom logs
Adds support for ingesting Akamai Cloud Monitor logs via a new parser
Adds support for ingesting Akamai DataStream 2 logs via a new parser
Adds support for collecting Aware audit logs via a new parser
Adds support for collecting AWS API Gateway access logs via a new parser
Adds support for collecting AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware.Transit GatewayTransit GatewayAn AWS-managed network hub that connects VPCs and on-premises networks through a single gateway, replacing complex peering meshes and giving cyber tools a central point to route or inspect cross-network traffic. flow logs via a new parser
+26 moreshow less
Adds support for collecting Bitwarden Enterprise event logs via a new parser
Adds support for collecting Box Collaboration JSON logs via a new parser
Adds support for collecting Censys logs via a new parser
Adds support for collecting Code42 Incydr core datasets via a new parser
Adds support for collecting CSV Custom IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. files via a new parser
Adds support for collecting Deep Instinct EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. logs via a new parser
Adds support for collecting DigiCert audit logs via a new parser
Adds support for collecting DomainTools Iris Investigate results via a new parser
Adds support for collecting Duo administrator logs via a new parser
Adds support for collecting Duo authentication logs via a new parser
Adds support for collecting Duo entity context logs via a new parser
Adds support for collecting Google Cloud Abuse Events logs via a new parser
Adds support for collecting Harness IO audit logs via a new parser
Adds support for collecting HPE Aruba Networking Central logs via a new parser
Adds support for collecting Jamf Pro context logs via a new parser
Adds support for collecting PingOne Advanced Identity Cloud logs via a new parser
Adds support for collecting Slack audit logs via a new parser
Adds support for collecting Snyk group-level audit logs via a new parser
Adds support for collecting Snyk group-level audit and issues logs via a new parser
Adds support for collecting Venafi Zero Touch PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. logs via a new parser
Adds support for collecting Veritas NetBackup logs via a new parser
Adds support for collecting VMware AirWatch logs via a new parser
Adds support for collecting VMware Avi Load Balancer WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. logs via a new parser
Adds support for collecting VMware Horizon logs via a new parser
Adds support for collecting VMware VeloCloud SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. logs via a new parser
Adds support for collecting Zoom operation logs via a new parser
Splunk ES 8.2.1 adds AI Assistant finding summaries and Hybrid pairing with Splunk SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions..
└──▷ HOW TO FIND IT
Summarize a specific finding in the analyst queue to speed up triage.
📍Select a finding in the analyst queue and click Summarize with AI › Select model (Frontier or Splunk-hosted)
Pair your cloud ES deployment with an on-premises SOAR instance.
📍Navigate to Setup › Integration Settings › Pair with Splunk SOAR and configure the hybrid connection.
Adds ability to summarize individual findings in the analyst queue using the AI Assistant
Adds choice between Frontier or Splunk-hosted models for the AI Assistant based on compliance requirements
Enables hybrid pairing of Enterprise Security (Cloud) with a single Splunk SOAR (On-premises) instance
3 details in Everything
1 more release in this issue
· 2025-09-09 → 2025-09-17
Splunk ES 8.2 introduces AI Assistant, TAXIITAXIIA protocol for sharing threat intelligence over HTTPS, commonly carrying STIX data. It lets tools retrieve and exchange intelligence from compatible services. 2 feed support, detection versioning/auditing, and expanded APIs
Adds AI Assistant for investigations to summarize findings, generate SPL searches, and create investigation reports.
Adds ability to view version activity for detections and a detection audit trail that logs who made changes and when.
Adds ability to test detections in the detection editor to evaluate performance and review search results without deploying.
Adds Validation of SPL conditions for custom finding-based detections directly within the detection editor.
Adds support for TAXII version 2.0 and TAXII version 2.1 threat intelligence feeds.
+10 moreshow less
Expands API capabilities to include creating findings, adding findings to investigations, and CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations on notes.
Adds ability to configure whether finding groups reopen when additional intermediate findings are added.
Adds lookback finding groups to group historical findings based on the first detection run time.
Adds overlap finding groups to prevent overlooking edge cases that might represent risk.
Allows filtering the analyst queue by type using buttons for Findings, Investigations, Finding groups, or All types.
Makes notes and note titles either required or optional when analysts update a finding or investigation.
Adds option to hide duplicate findings in the analyst queue so they only appear nested under an investigation (ESSI-I-426).
Allows syncing changes made in an investigation or finding group to all included findings (ESSI-I-425, ESSI-I-457.
Adds KV Store retention policy to automatically remove old records from KV StoreKV StoreA key-value store is a database that maps arbitrary keys to values with no fixed schema, offering fast lookups that cyber tools use for caching, state sharing, or configuration at scale. collections based on time or size.
Makes new Splunk Enterprise Security APIs searchable using the SPL REST command.
15 details in Everything
└──▷ BREAKING ON UPGRADE
!SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. user tokens support is no longer required for native SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. functionality.
Wazuh v4.13.0 adds hot ruleset reload, global FIMFIMFile Integrity Monitoring — a technique that tracks cryptographic hashes or metadata of files on disk and alerts when they change unexpectedly, giving cyber tools a way to detect tampering or unauthorized modification./inventory queries, and new API endpoints for managers and agent summaries.
└──▷ GET THIS VERSION
$ git clone --branch v4.13.0 https://github.com/wazuh/wazuh.git
# already have the repo? check out this version:$ git checkout v4.13.0
└──▷ TRY IT
Trigger a hot ruleset reload for Analysisd using the new management endpoint.
$ curl -u wazuh:password -X POST https://localhost:55000/ruleset/reload
Analysisd now supports hot ruleset reloads without restarting the service.
Adds global queries capability for FIM and system inventory data across all agents.
Adds a new /agents/summary RESTful API endpoint to retrieve aggregated agent status.
Adds server uuid field to the /manager/info RESTful API response.
Adds hot ruleset reload management via new RESTful API endpoints.
RunReveal introduces Dashboards, Scheduled Prompts, pipeline metrics, MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. mapping, detection silencing, and BYO LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. support.
Adds Dashboarding feature to create visual security graphs integrated with the AI chat agent
Adds AI Settings on the Settings page and brain emoticon in RunReveal AI Chat to specify specific large language modellarge language modelA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. versions via Bring your own LLM
Adds Scheduled prompts to automate AI-powered reports delivered as markdown on custom intervals
Adds pipeline metrics tracking event throughput and drop rates for data processing visibility
Adds MITRE techniques mapping on detections to tag coverage with tactics and techniques
+1 moreshow less
Adds Silence Detection button to mute noisy detections for a specific time period
tenzir v5.15.0 adds lambda field capture, grouped enumerate, read_syslog octet counting, --no-autostart flag, and improved to_splunk parameters
map and where functions now support lambda expressions that capture surrounding fields.
enumerate operator supports a new group option for separate event counting.
read_syslog operator gains an octet_counting option to follow RFC6587 message boundaries.
New --no-autostart flag prevents automatic pipeline starts on node launch.
to_splunk operator accepts string-expressions for host and source parameters and adds a new event parameter.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!read_zeek_tsv no longer casts parsed events to the shipped Zeek schema, keeping TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. logs as-is.
Tenzir Platform v1.18.0 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. param customization via CLI and UI reorganization.
Adds custom scope and audience parameters to the CLI for OIDC authentication configuration
tenzir v5.13.2 adds the from_s3 operator for ingesting data from Amazon S3 with glob and auth support
Adds from_s3 operator supporting glob patterns, automatic format detection, file monitoring, and multiple auth methods (default AWS credentials, explicit access keys, IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role assumption, anonymous access)
Allows S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. services via endpoint_override and scheme URL parameters in the from_s3 operator
dev-v1.4.0 adds multi-dataset sequence validation support and negate DOES NOT MATCH to IM rules.
└──▷ GET THIS VERSION
$ git clone --branch dev-v1.4.0 https://github.com/elastic/detection-rules.git
# already have the repo? check out this version:$ git checkout dev-v1.4.0
Support for multi-dataset sequence validation in schema validation logic.
Adds negate DOES NOT MATCH capability to the IM rule type (requires version >=9.2).
Adds support for up to 5 group_by fields in threshold rules (requires version >=9.2).
Beelzebub v3.4.2 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Trust Score scoring to honeypot interactions.
└──▷ GET THIS VERSION
$ git clone --branch v3.4.2 https://github.com/mariocandela/beelzebub.git
# already have the repo? check out this version:$ git checkout v3.4.2
Splunk Security Content v5.15.0 adds the ArcaneDoor analytic story with two new Cisco ASA detections for state-sponsored zero-dayzero-dayA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. activity.
└──▷ GET THIS VERSION
$ git clone --branch v5.15.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.15.0
New ArcaneDoor analytic story covering state-sponsored exploitation of Cisco ASA/Firewall zero-dayszero-daysA vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. (CVE-2025-20333 & CVE-2025-20362).
New detection: Cisco ASA - Core Syslog Message Volume Drop to identify abnormal reductions in syslog output that may indicate log suppression.
New detection: Cisco ASA - Logging Disabled via CLI to catch attempts to disable logging on Cisco ASA devices.
Updated Cisco Secure Firewall - Intrusion Events by Threat Activity lookup with the latest Snort IDs for improved ArcaneDoor threat coverage.
Splunk Security Content v5.14.0 adds 19 new analytics and 5 analytic stories covering LAMEHUG, NotDoor, Secret Blizzard, ObjectivyStealer, and PathWiper.
└──▷ GET THIS VERSION
$ git clone --branch v5.14.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.14.0
New analytic story and detections for LAMEHUG malware, covering AI-driven command chain generation via Hugging Face API calls, systeminfo/net start/tasklist/dsquery execution, and recursive file copy into %ProgramData%\info\.
New analytic story for NotDoor malware (APT28/Fancy Bear Outlook macro backdoor), with detections for suspicious Outlook macro creation, LoadMacroProviderOnBoot persistence, and disabling of security dialogs.
New detections for Secret Blizzard TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind.: certutil.exe root certificate installation from temp directories using -addstore root, -f (force), and -Enterprise flags.
New analytic story for 0bj3ctivity Stealer, tagging existing content to detect credential theft, session hijacking, and encrypted exfiltration targeting browsers, messaging apps, and cryptocurrency wallets.
New analytic story for PathWiper.
+10 moreshow less
New detection: Linux Magic SysRq Key Abuse (community contribution).
New detection: Windows AI Platform DNS Query for identifying AI platform–related DNS activity.
New detection: Windows DLL Module Loaded in Temp Dir to catch DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. side-loading from temporary directories.
New detection: Windows Excel ActiveMicrosoftApp Child Process for suspicious Excel child process spawning.
New detection: Windows File Collection Via Copy Utilities targeting staged data collection behavior.
New detection: Windows Net System Service Discovery covering net start enumeration.
New detection: Windows Set Private Network Profile via Registry for network profile manipulation.
New detections for Windows SpeechRuntime COM Hijacking DLL Load and Windows SpeechRuntime Suspicious Child Process.
New WMIC-based discovery detections: CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., DiskDrive, Memory Chip, Network, and Systeminfo enumeration via wmic.
New Outlook-specific detections: macro security modification (Windows Outlook Macro Security Modified) and dialogs disabled from unusual processes (Windows Outlook Dialogs Disabled from Unusual Process).
15 details in Everything
└──▷ BREAKING ON UPGRADE
!Several detections previously deprecated in ESCU v5.12.0 have been removed in v5.14.0; users must transition to recommended replacements as listed in the official deprecated analytics documentation.
Shuffle nightly adds local AI model auto-detection and Kubernetes resource/env var controls for workers and apps.
└──▷ GET THIS VERSION
$ git clone --branch nightly-23092025-v1 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout nightly-23092025-v1
└──▷ HOW TO FIND IT
Propagate log-disabling setting through the full Kubernetes execution chain without manual per-container config.
📍Set SHUFFLE_LOGS_DISABLED=true on the Orborus deployment; it will now automatically flow to worker and app containers.
Cap resource consumption of Shuffle worker and app pods in a Helm-managed Kubernetes deployment.
Detects local/self-hosted AI model availability automatically during backend startup.
Propagates the SHUFFLE_LOGS_DISABLED environment variable from Orborus through to worker and app containers in Kubernetes deployments.
Supports setting CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory resource limits and requests for worker and app pods via Helm values.
Shuffle 2.1.0 adds local/self-hosted AI model support, Datastore Categories, Protected Keys, and custom dashboards via new stats API.
└──▷ GET THIS VERSION
$ git clone --branch v2.1.0 https://github.com/Shuffle/Shuffle.git
# already have the repo? check out this version:$ git checkout v2.1.0
└──▷ HOW TO FIND IT
Point Shuffle AI Agents at a private, self-hosted LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. instead of a cloud provider — keeping all data on-prem.
📍In the console, go to Settings › AI and enter your self-hosted model URL, model name, and API key, then save to make Shuffle use your private OpenAI-compatible endpoint.
Supports local and self-hosted AI models: connect any OpenAI-compatible LLM by supplying a URL, model name, and API key so AI Agents run fully on-premises.
Generates workflows from plain-text descriptions or flowcharts using AI.
Adds AI-assisted workflow editing with keyboard shortcuts.
Introduces Datastore Categories for structured key organization across alerts, tickets, users, and IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., with category-based search and deduplication.
Adds Protected Keys so secrets can be used safely in workflows via best-effort fuzzy hashing.
+6 moreshow less
Adds bulk datastore APIs with pagination, supporting up to 500 key lookups per request.
Adds Custom Dashboards with user-defined metrics via POST /api/v1/stats.
New Statistics & Observability features: workflow execution views, top run/failure tracking, historical debug search, notifications, and multi-tenant org views.
Admin view for child organization activity tracking in multi-tenant deployments.
App container auto-scaling based on request rate, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage, and queue depth.
Detects local/self-hosted AI model availability automatically during backend startup.
ThreatStream adds JSON export for MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. profile security coverage.
Adds JSON format support to the Exporting MITRE ATT&CK Profiles feature.
Adds Timeline and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. Heatmap/Flow visualizations to Anomali dashboards; enables column selection for bar charts.
Adds Timeline visualization type to visualize user and entity behavior in a timeline view
Adds MITRE ATT&CK Heatmap visualization type to add MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. heatmaps to your dashboards
Adds MITRE ATT&CK Flow visualization type to add panels with attack flows to your dashboards
Allows selecting or hiding specific columns for plotting bar charts
Anomali ThreatStream Integrator v8.5.6 adds wildcard indicator types and UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. field support for custom CSV outputs
Adds mal_wildcard_domain, mal_wildcard_url, sus_wildcard_domain, and sus_wildcard_url to the list of supported wildcard indicator types for Palo Alto Networks ThreatStream Integrator integration destinations.
Adds UUID to the selectable output fields for custom CSV destination files.
Export IoCs and TTPsTTPsTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. from Team Boards in CSV, STIX 2.1STIX 2.1A JSON-based open standard maintained by OASIS for representing threat intelligence objects and relationships, letting cyber tools exchange indicators, actors, and TTPs in a common machine-readable format., or MISP
Enables export of TTPs to ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. Navigator directly from selected articles or the entire board (max 200 articles)
Improves STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. export format for IP with port as separate network traffic objects
Adds description field to threat TTPTTPTactics, techniques and procedures, the goals, methods and specific behaviors used by an attacker. They describe how an attack works, rather than only the files or addresses it leaves behind. STIX objects in exports
OpenCTI 6.8.0 adds PIRs, Ariane AI chatbot, Connector Manager, Service Accounts, bulk user ops, and new connectors.
└──▷ GET THIS VERSION
$ git clone --branch 6.8.0 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.8.0
Priority Intelligence Requirements (PIR) allows defining criteria to flag relevant threats with a relevance score.
Connector Catalog and Manager enables deploying and configuring verified connectors directly from the UI, requiring the xtm-composer component.
Ariane Agentic AI assistant provides natural language interaction via an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server (xtm-mcp).
Import AI document now recognizes Organization, Sector, Channel, Tool, Individual, Region entities and specific relationships (Uses, Targets, etc.).
New Service Accounts user type restricted to API-based integrations with no UI login access.
+19 moreshow less
Bulk operations on user accounts allow mass activating, deactivating, or updating multiple users.
Create email templates for your users with dynamic variables for EE administrators.
Activity logs now include Source IP and User-Agent information (EE).
Audit logs can now be streamed to console or files via a new capability.
Manage Taxonomies is removed; replaced by Manage Tags, Manage Vocabularies, Manage Case Models, Manage Status Models, Manage Kill Chain Phases.
Vulnerability model adds first seen active attribute; Software model adds product attribute.
UI shows nested objects in the overview of observables and allows expanding fields within observables.
Create draft from an entity directly within the entity view.
Export, Import, and Duplicate Playbooks capability is now available (EE).
XTM Hub enables one-click deploy for Dashboard & CSV feeds.
New GLIMPS Enrichment connector added.
New Splunk SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. App connector added.
New Elastic Security Incidents connector added.
New Elastic Security Intel Stream connector added.
New Sumo Logic Intel Stream connector added.
New Doppel connector added.
New Microsoft Sentinel Intel connector added.
New Cognyte LUMINAR connector added.
New CrowdSec connector added.
24 details in Everything
└──▷ BREAKING ON UPGRADE
!The Manage Taxonomies capability is removed; use Manage Tags, Manage Vocabularies, Manage Case Models, Manage Status Models, Manage Kill Chain Phases instead.
OpenCTI 6.7.20 introduces configurable SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. payload size and CSV import performance fixes.
└──▷ GET THIS VERSION
$ git clone --branch 6.7.20 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.7.20
Adds SAML_MAX_BODY_LENGTH environment variable to configure the maximum SSO/SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. payload body size for handling large enterprise envelopes.
$ git clone --branch v1.33.0 https://github.com/Lookyloo/lookyloo.git
# already have the repo? check out this version:$ git checkout v1.33.0
Adds support for RFC3161 Trusted Timestamps to validate HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session., HTML, screenshot, URL, and download content hashes via a Time Stamping Authority (TSA)
Enables capturing .i2p domains through the Lacus instance
Adds website/web/templates/custom_header.html, website/web/templates/custom_footer.html, website/web/static/css/overrides.css, website/web/static/js/overrides.js, and website/web/custom_csp.py for custom theming
MSTICPy v2.17.0 adds RRCF outlier detection, expanded Prisma Cloud AWS coverage, and OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. for Defender providers.
└──▷ GET THIS VERSION
$ git clone --branch v2.17.0 https://github.com/microsoft/msticpy.git
# already have the repo? check out this version:$ git checkout v2.17.0
Adds RRCF (Random Cut Forest) outlier detection for ensemble-based anomaly scoring on telemetry data.
!Defender provider auth will fail until msticpyconfig.yaml scopes are updated to OAuth2 .default values — legacy non-OAuth2 or incorrect scope names are no longer accepted.
Huntress Managed SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. now supports SentinelOne as a log source with GA configuration guide.
10 more releases in this issue
· 2025-09-03 → 2025-09-24
Incident Reports now show full SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. activity history with View Changes button
Incident Reports now display the complete history of all SOC updates, with latest details at the top and previous updates shown below.
A new View Changes button highlights modifications in each update within Incident Reports.
Huntress extends endpoint defense capabilities to macOS by introducing Tamper Protection for its Managed EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. agents. This feature safeguards the agent process and associated system files from active tampering or removal by threat actors, ensuring continuous visibility. Administrators can temporarily pause this protection for maintenance tasks via the web portal.
Zero Trust Secure Access module for Windows v2.27.1051 enhances Private Access reliability by allowing connections via the last known-good connector during backend outages.
27 more releases in this issue
· 2025-09-05 → 2025-09-30
Zero Trust Secure Access module for macOS v2.24.177 introduces an offline mode allowing Private Access to utilize the last known good configuration during backend outages.
Helm Chart 3.1.8 adds node-level compliance checks for master nodes and enhanced deployment log visibility.
Adds node-level compliance checks for master nodes to ensure alignment with Kubernetes and OpenShift standards
Enhances deployment log visibility by including signature verification rule evaluation events and detailed evaluation reasons for frontend and public API deployments
Private GenAI protection now supports multiple LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integrations via the new AI proxy mode.
Enables the AI proxy mode in Zero Trust Secure Access to support multiple Large Language Model (LLM) integrations.
Adds a new configuration path for managing these settings: Zero Trust Secure Access > Secure Access Configuration > Internet Access and AI Secure Access Configuration.
Zero Trust Secure Access On-premises Gateway 1.0.71 adds AI proxy support for private AI services with multiple LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration.
Zero Trust Secure Access Internet Access extends its network footprint by adding a new Point of Presence in Azure Sweden, allowing regional users to configure their service FQDNs accordingly.
Trend Vision One enhances the Workbench Execution Profiles feature with improved lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. visualization capabilities.
Improved visualization of lateral movement within the network in Execution Profiles to identify potential threats with a more focused scope
Trend Vision One auto-bypasses teams.microsoft.com URLs in Time-of-Click Protection to prevent false positives from Microsoft Teams URL validation changes.
Adds automatic bypass for teams.microsoft.com URLs in Time-of-Click Protection to prevent false positives when Microsoft validates meeting join URLs.
Trend Vision One extends DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. approved sender lists to Gmail in API and inline modes.
Allows configuring the approved sender list for Data Loss Prevention policies to exclude specific senders from scanning for Gmail
TrendAI Vision One Endpoint agent for macOS adds quarantine file path and SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. to Data Explorer detections
Agentless Vulnerability & Threat Detection now scans AWS disks encrypted with customer-managed KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. keys.
Adds AWS KMSAWS KMSAWS Key Management Service, Amazon's hosted service for creating and controlling cryptographic keys, giving cyber tools a durable, audited place to encrypt data without managing raw key material themselves. decryption IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies to the CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. stack template, enabling scanning of disks encrypted with customer managed keys
P/A Connector v2.37.0.2062 adds IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. resiliency automation and ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections.RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. time sync
Automates recovery of IoT connections on the connector by detecting service issues and auto-reconnecting
Enables time synchronization for RDP applications via ZTNA browser access
Cloud Risk Management Template Scanner now supports Google Cloud (GCP) for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. risk detection.
Fleet 4.73.0 adds batch script scheduling, secret variable APIs, CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. filtering, and TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. PIN enforcement detection.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.73.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.73.0
└──▷ HOW TO FIND IT
Filter the software inventory to high-severity vulnerabilities before a patch cycle.
📍In the Fleet UI, go to Software › (Host or Team) › filter by Min CVSS score and Max CVSS score to narrow the list to the severity range you care about.
Schedule a batch script run in advance and monitor progress without cluttering the global activity feed.
📍In the Fleet UI, go to Controls › Scripts › Batch progress, then open Run scripts, select a script and a future run time to schedule it. Monitor started, scheduled, and finished runs under the Batch progress tab.
New detail query detects whether a BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints. PIN protector is set, executed only when TPM PIN enforcement is required.
Automatic host identity certificate renewal for TPM-backed certificates on Linux: orbit renews certificates within 180 days of expiration using proof-of-possession.
New global activity event logged when a disk encryption key is escrowed.
Adds issuer and issued cells to the host details and My Device page certificates table.
Enables filtering host and team software by minimum and maximum CVSS score in the Fleet UI.
+16 moreshow less
Displays kernel vulnerabilities on the operating system details page for Linux systems.
Updates macOS CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. policies: macOS 13 to CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. v3.1.0, macOS 14 to v2.1.0, macOS 15 to v1.1.0.
Fleet certificate ingestion now accepts non-standard country codes longer than 2 characters and truncates other oversized fields instead of failing.
New API endpoints to add, delete, and list secret variables; custom variables can also be managed in the UI.
New API endpoints to get and list batch scripts, with a cron job to launch scheduled batch script runs.
New API endpoint to cancel a scheduled batch script run; cancellation also available directly from the UI summary modal.
Ability to schedule batch script runs in advance from the Run scripts modal.
Hosts list can now be filtered to those incompatible with a script in a batch run.
New side navigation on Controls > Scripts page with a Library tab and a new Batch progress tab showing started, scheduled, and finished scripts.
Batch execution IDs added to script run activities.
IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems.SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. authentication added to BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on. mobile device enrollment when enabled for the team.
GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. now supports overriding install/uninstall scripts and specifying pre-install queries and post-install scripts for Fleet-maintained apps.
Adds support for $FLEET_VAR_HOST_UUID variable in Windows MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. configuration profiles.
Adds last-opened time tracking for Linux software (DEB & RPM packages), plus an indication when software was never opened vs. unsupported type.
Automatic install policies are now included in host software responses.
Updates fleetctl api to support sending data in the body of non-GET requests using the -F flag.
21 details in Everything
└──▷ BREAKING ON UPGRADE
!PUT /api/v1/fleet/spec/secret_variables now only accepts secret variable names containing uppercase letters, numbers, and underscores.
!DEB and RPM fleetd packages previously uploaded to the Fleet Software page for in-band upgrades must be re-generated with fleetctl v4.73.0 and re-uploaded before use, because pre-removal scripts in older packages stop Orbit unconditionally on upgrade.
NodeZero September 2025 adds a hosted MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server with OAuth 2.1OAuth 2.1A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly., EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. for all account types, and enhanced AD Tripwire diagnostics.
Adds the NodeZero MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) Server hosted by Horizon3.ai, enabling AI agents to integrate pentesting capabilities into agentic workflows with OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..1 authentication and multiple user support
Provisions EDR feature for all account types, including Flex and C+
Adds Remediation Hub in Response & Remediation to prioritize high-impact fixes using Active Risk Score
Introduces Vector Command Advanced managed service for validating internal segmentation controls and compliance evidence
Simplifies GCP SCC Alert triage with Triage-as-Code (TRaC) translation to plain language
Enriches GCP SCC alerts with asset context from Cloud Security (InsightCloudSec)
Adds SSL_NO_VERIFY environment variable to CVA Local Scanner to skip TLS verification
+9 moreshow less
Adds SCAN_SCHEDULE environment variable to CVA Local Scanner to customize scan interval in seconds
Deprecates CRON_SCHEDULE environment variable for CVA Local Scanner scan frequency configuration
Renames DIVVY_SOURCE_DOCUMENT_FORCE_WRITE to DIVVY_SOURCE_DOCUMENT_FORCE_WRITE_ENABLED environment variable in Cloud Security
Adds SOURCE_DOCUMENT_BLOCKED_JOBS environment variable to Cloud Security to block source document storage for specific harvesters
Adds new Query Filters for Azure Service Bus Namespace Topics including Message Topic Minimum TLS Version, Message Topic Type, and others
Adds Workspace Directory With Enabled Web Access Insight and Query Filter in Cloud Security
Adds AppStream Private Image resource support with AppStreamImageHarvester in Cloud Security AWS
Adds protected registry path visibility to NGAV/Ransomware Prevention alert payloads via the protectedRegistry field
Updates SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. API documentation paths to include /api/3/yaml format in Console v3
14 details in Everything
└──▷ BREAKING ON UPGRADE
!CRON_SCHEDULE environment variable is deprecated and no longer used for CVA Local Scanner scan schedule intervals; use SCAN_SCHEDULE instead.
!Environment variable DIVVY_SOURCE_DOCUMENT_FORCE_WRITE must be renamed to DIVVY_SOURCE_DOCUMENT_FORCE_WRITE_ENABLED in Cloud Security configurations.
DefectDojo 2.50.2 adds fix-availability data for JFrog, WPScan, and Mend parsers, a customizable OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. login button, and OXAS-ADV vulnerability ID support.
└──▷ GET THIS VERSION
$ git clone --branch 2.50.2 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.50.2
└──▷ USE IT
Customize the OIDC SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login button text shown to users on the DefectDojo login page.
yaml
SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT: "Login with Corporate SSO"
Enable the Django Debug Toolbar for troubleshooting without modifying settings files directly.
yaml
DD_DEBUG_TOOLBAR=True
Adds fix_available field population to the JFrog On-Demand parser so practitioners can see remediation availability directly in findings.
Adds fix_available field population to the WPScan parser for WordPress vulnerability findings.
Adds fix_available field population to the Mend (WhiteSource) parser for SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. findings.
Adds SOCIAL_AUTH_OIDC_LOGIN_BUTTON_TEXT setting to customize the OIDC SSO login button label in the UI.
Adds support for OXAS-ADV- vulnerability ID prefix in vulnerability tracking.
+2 moreshow less
Enables Django Debug Toolbar via an environment variable for operator-level diagnostics.
DefectDojo 2.50.1 adds fix_available tracking across JFrog Xray, Aqua, and KrakenD parsers plus a new Semgrep Pro parser and Wazuh v4.8 support.
└──▷ GET THIS VERSION
$ git clone --branch 2.50.1 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.50.1
Adds fix_available field population to the JFrog Xray unified parser so remediation status surfaces automatically on import.
Adds fix_available field population to the Aqua parser for richer vulnerability triage data.
Adds fix_available field population to the KrakenD Audit parser.
New Semgrep Pro parser supports ingesting Semgrep Pro scan results.
Adds Wazuh v4.8 support in the Wazuh parser.
+4 moreshow less
Updates the Qualys Hacker Guardian parser to handle larger CSV files.
New VAR vulnid variable added to settings.dist.py / local_settings.py.
Disables password reset for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. users via the API, preventing credential confusion.
uWSGI now defaults to 4 processes × 4 threads, improving out-of-the-box throughput.
DefectDojo 2.50.0 adds fix_available signals across major scanners, a global Finding Groups page, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. nginx support, and broader file import options.
└──▷ GET THIS VERSION
$ git clone --branch 2.50.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.50.0
Adds fix_available field support to Harbor, AnchoreCTL, AnchoreEngine, Trivy, TrivyOperator, and RedHatSatellite parsers, surfacing patch availability data from these scanners in findings.
Adds fix_available information to engagement views in the UI.
New global Finding Groups page for cross-product finding group management.
Adds Product Life Cycle filter to finding filters.
New Snyk Issue API parser for code (file-based) issues.
+5 moreshow less
Enables IPv6 support in nginx.
Allows more file extensions for importers, including .fpr extension for Fortify scans.
BlackDuck importer now supports import in plaintext or bytes format.
Webhook notifications now support the owner field.
Adds wid-sec-w vulnerability ID support.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Helm chart drops support for networking.k8s.io/v1beta1 Ingress API version; clusters must use networking.k8s.io/v1.
!Helm chart drops support for the kubernetes.io/ingress.class annotation in GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.; use ingressClassName instead.
!feat(settings): Drop time_zone — the time_zone setting is removed from settings.dist.py; existing configurations referencing this key will need to be updated.
Tenable One Web App Scanning now supports scanning SOAP APIs in addition to REST and GraphQL
Adds SOAP API assessment capability to extend existing REST and GraphQL support for broader API attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. coverage
1 detail in Everything
4 more releases in this issue
· 2025-09-04 → 2025-09-30
Adds Information Order Configuration for asset data prioritization, Findings Global Search with custom queries, and ServiceNow Asset Enrichment options
Adds Information Order Configuration to customize default information order per asset class and control connector data prioritization across the Tenable One platform
Adds direct navigation to configuration settings via the Information Order section on the Asset Details page
Enables filtering of the entire Findings inventory with advanced custom queries using blocks of property filters, findings criteria, operators, selectors, properties, and workflow in Findings Global Search
Adds Asset Enrichment options to the ServiceNow third party connector to enrich asset details with ServiceNow attributes
Tenable One OT Exposure 4.4.39 adds PLC project file import, asset merging, auto subnet discovery, and a Policy Violations dashboard
Supports importing PLC project files (Rockwell Automation) to enrich asset inventory without active queries.
Adds the ability to merge duplicate assets directly from the inventory UI.
Introduces Auto Subnet Discovery using a new active query and a Subnet column in Inventory.
Replaces the legacy Network Segments column and configuration page with a CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network.-based Asset Groups model.
Adds a Policy Violations dashboard and workflow for managing findings like PLC Start/Stop and Intrusion Detection.
+5 moreshow less
Transmits dynamic OT asset tags to Tenable One and Tenable Security Center for cross-platform alignment.
Enables passive fingerprinting of Foxboro DCS components for asset discovery and monitoring.
Adds support for VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments. traffic analysis within virtual and cloud network segments.
Simplifies ICP sensor management by supporting multi-port sniffing via a simplified configuration option.
Enhances Yokogawa support with online code download operations and fixes offline code download issues.
10 details in Everything
└──▷ BREAKING ON UPGRADE
!The Network Segments column and its configuration page are removed; existing groups are automatically converted to Asset Groups.
!The GraphQL field Mutation.resolveEvent is deprecated and replaced with resolveFindings.
!The GraphQL field Mutation.resolveEvents is deprecated and replaced with resolveFindings.
!The enum value FindingStatus.Fixed has been removed.
Adds ACSC Five Eyes dashboard template and signed listener launcher for Identity Exposure on-prem
New dashboard template adds a pre-built view for monitoring compliance with ACSC cybersecurity standards based on the Five EyesActive DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. compromise report.
Vuls v0.35.0 adds Fedora detection via vuls2, snmp2cpe timeout/retry options, and vuls2 DB digest tracking.
└──▷ GET THIS VERSION
$ git clone --branch v0.35.0 https://github.com/future-architect/vuls.git
# already have the repo? check out this version:$ git checkout v0.35.0
Adds Fedora vulnerability detection powered by the vuls2 detector engine.
Adds --timeout and --retry options to the contrib/snmp2cpe command for more resilient SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale.-to-CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. conversion.
Updates the snmp2cpe convert command with new conversion logic.
Saves and tracks the digest of the vuls2 vulnerability database for integrity verification.
Updates Windows scanner release info fetching.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Fedora detection now uses the vuls2 detector (feat! commit a6bee18); setups relying on the previous Fedora detection path may behave differently on upgrade.
1 more release in this issue
· 2025-09-06 → 2025-09-25
Edgescan adds flexible date formats in UI, last edited metadata for credentials, staged asset notification controls, and improved scope config stability.
Adds support for flexible date formats across the entire UI to ensure unambiguous display
Displays the last edited date and editor name on the credentials modal within the asset details page
Allows configuration of credential-added event notifications to skip alerts when staging assets
Improves the initiate scanning/assessment start schedule flows for staged asset onboarding
Renames the permission label from Risk Accept Vulnerabilities to Discard Vulnerability
+1 moreshow less
Enables scan result parsers to handle non-ASCII strings without export issues
6 details in Everything
1 more release in this issue
· 2025-09-09 → 2025-09-24
Tenable Nessus 10.8.6 adds macOS 26 support and FedRAMPFedRAMPA US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one./China connectivity updates
Adds macOS 26 (Tahoe) platform support for scanners
New policy history API endpoint and updated PowerShell execution worklets; old endpoints deprecated.
Integrations must switch from https://policyreport.automox.com to the new GET /api/policy-history endpoint under the main console subdomain
Policy creation now supports updated worklets for PowerShell Execution Policy (AllSigned and RemoteSigned) using the new signing API
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The endpoint https://policyreport.automox.com is being decommissioned on November 24th, breaking integrations that rely on it without migration to console.automox.com/api/policy-history
!Worklets referencing the decommissioned endpoint worklet-signing.prod.automox.com will fail unless policies are recreated with updated worklets pointing to console.automox.com/api/signing
2 more releases in this issue
· 2025-09-05 → 2025-09-29
v1.11.510 adds experimental font listing via config flag and DSC v3 integration support
└──▷ GET THIS VERSION
$ git clone --branch v1.11.510 https://github.com/microsoft/winget-cli.git
# already have the repo? check out this version:$ git checkout v1.11.510
└──▷ TRY IT
List installed fonts after enabling the experimental feature
$ winget font list
Adds winget font list command to display installed font families and face counts when the experimental feature is enabled
Enables export of the current device configuration including Windows Settings, WinGet source packages, and DSC v3 package settings
Adds support for Microsoft Desired State Configuration (DSC) v3 in winget-cli
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Dropped support for running on 32-bit ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., requiring Windows 10 (1809+) or Windows 11 on non-32-bit ARM architectures
An asset discovery and inventory platform that identifies and maps all devices on networks without requiring agents.
runZero 4.0 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools (list_sites, query_directory_group, query_wireless) and cert search in vulnerability inventory.
list_sites, query_directory_group, and query_wireless tools added to the MCP server
Vulnerability inventory now supports searching by certificate attributes (ID, type, serial, public key, signature, fingerprint, subject, issuer, key usage)
2 details in Everything
6 more releases in this issue
· 2025-09-08 → 2025-09-30
runZero 4.0.250910.0 adds subnet filtering for Dragos, offline MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support, and granular import controls for major integrations.
Adds exclude_assets_by_subnets filter to the Dragos integration task configuration
Replaces the Fingerprint Only toggle with separate import_software and import_vulnerabilities boolean options for CrowdStrike, MS365Defender, SentinelOne, Wiz, Tenable, Rapid7 InsightVM, and Qualys integrations
Increases the Organization overview report limit for top metrics from 10 to unlimited entries
Decode JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. in concealed fields, restore old Dev Env vars, and fix UI bugs
1Password for Linux 8.11.10 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. field decoding and Developer Environment version history.
Adds JWT item field support to decode and view JSON Web Token contents directly in the editor
Adds version history for Developer Environment variables, allowing previous values to be viewed and restored
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager Sept 2025 adds AI app recommendations, contract inventory auto-sync, and EPM status visibility
Adds AI-powered similar app recommendations to the app library for discovering alternative applications
Automatically adds newly identified apps to inventory via AI contract processing
Triggers automatic contract AI reprocessing for contracts in Review status when extraction depth is increased
Makes Role-Based Access ControlRole-Based Access ControlRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.) optionally applicable to individual applications
Prioritizes access policies automatically by least approval, specific person types, and access rights
+7 moreshow less
Displays EPM connection status directly in Product Connections with active/inactive indicators
Adds Lattice HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. integration for Users and Teams
Adds Anaplan Usage integration for Groups, Users, User Activity, and Provisioning
Adds LinkedIn Talent Insights integration for Users, Provisioning, and Deprovisioning
Adds Cursor integration for Groups, Users, User roles, User activity, Provisioning, and Deprovisioning
Adds Keycloak Identity integration for Apps, Groups, Users, User activity, Provisioning, and Deprovisioning
Beta release improves Windows HelloWindows HelloA Microsoft authentication framework built into Windows 10 and later that lets users sign in via biometrics or PIN instead of passwords, giving cyber tools a phishing-resistant credential layer to build on. UX and adds Enter key submission for Developer Environment forms.
Adds Enter key support to submit creating, renaming, and deleting Developer Environment forms.
Enables drag-and-drop selection of the variable import area on the Developer Environments page.
1Password for Mac 8.11.10-32 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. decoding in concealed fields, Developer Environment breadcrumbs and history restoration
JSON Web Tokens stored in concealed item fields can now be decoded and viewed
JumpCloud introduces General Availability for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. License Management with connector-based import and automated assignment.
SaaS License Management is now GA! Automate license tracking for supported SaaS applications with connectors
JumpCloud adds an All option to monitor software addition/removal across all applications.
Adds the All rule condition option to configure software addition and removal alerting for all installed software without manual per-application specification.
Adds Windows MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies.CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. policies for Schedule Restart, MS Edge Extensions, and Storage Sense
Adds Schedule Restart policy to automate and enforce device restarts for Windows devices
Adds MS Edge Extensions policy to control installation, usage, and permissions of Microsoft Edge extensions
Adds Storage Sense Configuration policy to automatically remove unnecessary files on Windows devices
MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. admins can view all policies and import templates across tenant organizations from the Multi-Tenant Portal.
Adds View All Policies in the Multi-Tenant Portal to see every policy managed across all tenant organizations
Enables importing policy and policy group templates from different organizations directly in the Multi-Tenant Portal
Stytch Connected Apps now supports integration with existing external authentication systems via OAuth
Adds support for Connected Apps that function as identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for any existing authentication system, not just Stytch core auth
1 detail in Everything
3 more releases in this issue
· 2025-09-05 → 2025-09-09
Stytch Connected Apps now supports existing auth systems for OAuth and agent workflows
Adds support for using any existing authentication system as the core identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for Stytch Connected Apps
Enables issuing OAuth tokens for cross-app and AI agent + MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. interactions without migrating auth stacks
Provides consent UI with full lifecycle management and org-level policy controls for non-Stytch auth backends
Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.
Commvault Cloud September 2025 adds network tag modification during restore, Google Cloud onboarding automation, SUSE Linux support in Azure Cleanroom, and new credential vau
Automated Google Cloud onboarding: Streamlined integration that creates custom roles, manages credentials, and deploys access nodes.
Driver Inject for GCP VMs: Automated disaster recovery injector node that attaches disks and injects drivers when no local access node is present.
Cloud Rewind rebuilds AWS cloud configurations across regions and accounts.
Auto Recovery replication support for FS, DB, and Object Storage workloads in Commvault Cloud SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally..
Auto recovery support for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. VMs with warm/hot site options and orchestrated replication.
+9 moreshow less
Agent injection and SAN policy automation for Azure Cleanroom.
Express configuration for automated creation of Azure Cleanrooms via single sign-onsingle sign-onSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management..
Azure infrastructure automation: resource groups, storage accounts, VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules., and security groups for Cleanroom recovery.
Automated recovery of SUSE Linux VMs into Azure Cleanroom with driver injection and IP conversion.
Credential vault support for Sybase database credentials.
Credential vault support for Informix database credentials.
Auto-Scale configuration simplification for Access Nodes.
Workflow-based Threat Scan support for AWS VMs during restores.
Linux Access Node Support for Windows Dynamic Disk Browse & Recovery.
14 details in Everything
└──▷ BREAKING ON UPGRADE
!End of Support for IBM i 6.1; Commvault version 11.36 is the last supported version.
Druva AWS Workloads enhances RDS Airgap Restores with cross-account KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. key support
Adds enhanced security and encryption for RDS Airgap Restores with better access control and cross-account key usage
MSC console now supports creating Druva Provisioned Customers, requesting licenses, and viewing Tenant Consumption Report V2 directly.
Adds ability to create Druva Provisioned Customers within the MSC console
Enables MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. Admins to request product licenses for Salesforce, Microsoft Dynamics 365, Archive Storage, and Threat Hunt from the MSC console
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Compliance features Workloads, Backup Frequency Limit, Retention Limit, Alerts, and Compliance Reports are deprecated from the Service Plan configuration and will no longer be generated.
Veeam Backup & Replication is backup, recovery, and replication software for virtual, physical, cloud, and SaaS workloads.
Veeam v13 adds Veeam Software Appliance (VSA), Infrastructure Appliance (VIA), web UI preview, and infrastructure lockdown mode.
└──▷ HOW TO FIND IT
Deploy a hardened backup server in a ROBO site using the new software appliance ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. for rapid, secure setup with minimal OS expertise required.
📍boot from VSA ISO / deploy OVA on VMware vSphere
Use the new web console for accessible backup management from any browser without local client software.
📍Open Web UI URL in browser
Adds the Veeam Software Appliance (VSA) as a new deployment option with pre-built JeOS, DISA STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. hardening, and an immutable-by-default built-in repository supporting up to 20,000 workloads on 2PB of storage.
Introduces the Veeam Infrastructure Appliance (VIA) for scalable backup infrastructure components, offering dedicated installation profiles including a Veeam Hardened Repository appliance and passwordless certificate-based authentication for management connections.
Enables new "backup infrastructure lockdown mode" in V13 VSA to prevent unauthorized addition of backup infrastructure components that could impact performance or allow data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels..
Provides a preview of the next-gen web-based user interface with localization support and WCAG-ready design compliant with EAA and ADA regulations.
Adds global.resourceLabels Helm flag to specify labels on all Kasten PVCs, Network Policies, Services, and Pods.
Adds global.ephemeralResourceLabels Helm flag to specify labels only on ephemeral Kasten PVCs, Network Policies, Services, and Pods.
Adds kastenDisasterRecovery.restoreTimeoutMinutes Helm value to configure the Veeam Kasten Disaster Recovery restore timeout and avoid timeout failures.
Makes prometheus.server.resources and prometheus.configmapReload.prometheus.resources respect global.resources settings when defined, with Prometheus-specific overrides still taking precedence.
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The Helm flags kanisterPodCustomLabels and kanisterPodCustomAnnotations have been removed; any Helm values referencing them will break on upgrade.
!Support for Kubernetes 1.29 has been removed; clusters running 1.29 are no longer supported.
!Upgrading to 8.0.8 is not recommended for clusters running Kubernetes 1.27 or OpenShift 4.14 or earlier due to lack of SelfSubjectReview API support, which may cause dashboard authentication issues.
Velero is an open-source tool that backs up, restores, and migrates Kubernetes cluster resources and persistent volumes.
Velero v1.17 brings micro-service fs-backup, Windows cluster support, volume group snapshots, priority classes, and include/exclude resource policies.
└──▷ GET THIS VERSION
$ git clone --branch v1.17.0 https://github.com/velero-io/velero.git
# already have the repo? check out this version:$ git checkout v1.17.0
└──▷ USE IT
Define reusable include/exclude filters in a resource policy configMap so multiple backups can reference the same policy without repeating filter flags.
Adds PrepareQueueLength to the node-agent configuration to cap the number of data mover pods and volumes created while data path quota is unavailable, preventing resource exhaustion in large-scale environments.
Adds includeExcludePolicy to resource policy configmaps alongside the existing volumePolicy, making include/exclude filters reusable across multiple backups.
Enables parameterized kubelet mount path during node-agent installation.
Adds a Gauge metric for BSL (Backup Storage Location) availability.
Adds BSL status check for backup and restore operations.
+11 moreshow less
Adds support for distributed snapshotting.
Adds support for configuring a VGS (volume group snapshot) label key.
Supports volume group snapshots (Kubernetes beta) for both CSICSIAn ambiguous acronym spanning Container Storage Interface, Crime Scene Investigation, and other expansions — without more context about which domain this tool operates in, a reliable definition cannot be given. snapshot backup and CSI snapshot data movement, enabling point-in-time consistent snapshots across correlated volumes.
Adds Kubernetes priority class support for Velero server, node-agent, data mover pods, and backup repository maintenance jobs.
Modernizes fs-backup to a micro-service architecture, adding load concurrency control, cancel, and resume-on-node-agent-restart capabilities.
Adds Windows cluster support for fs-backup, enabling backup and restore of Windows workloads and volumes via data mover pods running on Windows nodes.
Adds imagePullSecrets inheritance for VGDP pods and maintenance jobs.
Adds support for third-party tolerations for data mover pods.
Allows users to disable pod volume host path mount for node-agent.
Copies security context from the origin pod to data mover pods.
Allows proper tracking of multiple hooks per container.
16 details in Everything
└──▷ BREAKING ON UPGRADE
!--uploader-type=restic is no longer a valid installation configuration — fs-backup under the Restic path is removed; new backups cannot be created via Restic, though restoring from previous Restic-path backups remains supported until v1.19.
!The following Velero server parameters are removed (configuration must now be provided via the repository maintenance job configMap): --keep-latest-maintenance-jobs, --maintenance-job-cpu-request, --maintenance-job-mem-request, --maintenance-job-cpu-limit, --maintenance-job-mem-limit.
!The selected-node annotation on PVCs is now always removed during restore when no node mapping exists; previously the annotation was preserved if the node existed.
AC-130.0.0 adds activity detection for new domains and AI/DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. features in Google Gemini, Microsoft 365 Copilot, and Yammer.
Adds translate.google.ca domain support for Google Translate application detection
Adds hubspotlinks.com domain support for HubSpot application detection
Adds ccmdls.adobe.com domain support for Adobe Creative Cloud detection
Adds svc.webex.com domain support for Cisco Spark Message and Meet detection
Adds app.smartsheet.eu domain support for Smartsheet detection
+10 moreshow less
Adds file Upload and Download activity coverage in the WhatsApp channel
Adds new activity support for Google Gemini AI Assistant integrated with other Google apps
Enables AI Response with DLP support
Enables AI Post with DLP support
Improves DeepL instance_id logic to identify non-logged-in user setup file downloads as public
Adds image file upload support with DLP protection in Microsoft 365 Copilot
Adds Download Installer activity detection for Microsoft Office 365 Suite to detect Microsoft Edge installer file downloads
Supports new navigation options in Yammer: scheduling live events, exporting group data, and posting messages directly from Teams
Enables upload/conversion actions without logging in to be treated as Upload activity in Adobe Document Cloud
Detects to_user as Everyone except external users for Microsoft Office 365 OneDrive for Business files shared with the entire organization
Netskope R130.1 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server catalog, EEEU policy exposure for OneDrive/SharePoint, Android EnterpriseAndroid EnterpriseA Google program that gives organizations APIs and management modes to enroll, configure, and enforce policy on Android devices through an EMM platform. Browser, and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. file classification
Adds public MCP servers catalog in the App Catalog for discovery and confidence-based risk assessment of generative AI tools
Introduces Everyone Except External Users (EEEU) policy exposure and remediation actions for Microsoft 365 OneDrive and SharePoint via Next Generation API Data Protection
Enables Enterprise Browser support for Android and Chrome OS devices with centralized policy management
Adds AI File Classification using LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to DLP for enhanced file type detection with reduced false positives
Expands Fingerprint 2.0 to support multimodalmultimodalAble to work with more than one type of input or output, such as text, images and audio. A multimodal model can combine information across those formats. images and bulk training data upload via a standalone microservice
+3 moreshow less
DLP On Demand now supports structured columnar database classification on customer-managed public cloud (AWS, Azure, GCP) and on-premises (ESX)
Adds Extension Management Phase 1 allowing tenant-level policies to default block/allow or force-install Chrome Web Store extensions by ID
Adds Created Date, Entity Created, and Last Modified timestamp fields to Skope IT Alerts and Incidents for supported SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. apps
Adds Application Category Dashboard to Netskope Library for visibility into app category usage, risk, and policy triggers
Application Category Dashboard added to the Netskope Library (available via Reports > New Experience portal) providing top used applications (managed/unmanaged), risky applications/traffic/data movement, and policies/alerts per application category.
Ability to save a copy of the new dashboard to personal or Group folder for customization.
Netskope Cloud R130 adds Enterprise Browser notifications, Copilot GA, SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. custom app onboarding, and NPA DNS record support.
Adds enhanced user notifications in the Enterprise Browser feature to improve visibility into browser-based activities
General Availability (GA) of Microsoft Copilot integration within Netskope Cloud for policy enforcement and data protection
New General API Data Protection capability for securing data accessed via APIs across SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. applications
Supports DNS Record Type configuration for additional records in Netskope Private Access (NPA)
Enables onboarding of custom SaaS applications into the SaaS Security Posture Management (SSPM) module
Adapter 214.253.15.1 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./Dynamic Group subsets, pagination, manageability aborts, and Win Server 2025 support for AD V2
Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. V2 mode supports importing a subset of users/groups via LDAP Query filters.
Active Directory V2 mode supports importing subsets using Dynamic Groups.
Active Directory V2 Manageability option in Advanced Settings allows sync abort and admin email notification when thresholds are exceeded.
Active Directory V2 Page Size option enables pagination for LDAP requests (default: 1000).
Netskope R130 adds FTP TSS, steganography DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., API copilot GA, deferred actions, PCCv2, and egress IP detection
Cloud Firewall (CFW) now applies Threat Security Policies to FTP traffic with incident generation.
Endpoint DLP introduces Printer Content Control v2 (PCCv2) for Windows, improving matching without OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. and preserving original file formats.
DLP service adds Steganography detection for BMP and PNG images in the ML Classification service.
Next Generation API Data Protection adds support for Microsoft Copilot with policy creation, DLP, and threat protection.
Next Generation API Data Protection introduces Deferred Policy Action to transition from alert-only to enforcement with a configurable grace period.
+20 moreshow less
Endpoint DLP supports Application Control for browser processes on Windows to evaluate files before they are opened.
Endpoint DLP adds Large File Sampling (default 80MB segment, max 2GB) for Windows and macOS.
Endpoint DLP adds Network File Share Content Control for files written via SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments./CIFS on Windows.
Cloud TAP Stitcher CLI adds the --origin-filter-regex option for regex-based POP selection.
Cloud TAP Stitcher adds Multi-NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. Traffic Exporting to distribute traffic to multiple NDR endpoints.
NG SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. Real-time Protection policies now support File Profiles and Negation for Custom Attributes.
NG SWG Real-time Protection adds the ability to suppress alerts for block actions via checkbox.
NG SWG inline policy constraints add file name, extension, type, and size for browse activity.
Netskope Private Access (NPA) adds support for PTR, MX, TXT, NS, SOA, and CERT DNS record types on Windows and macOS clients version 130.0.0+.
SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. adds Onboard Custom SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Apps via Bring Your Own App (BYOA), enhanced Predefined Rules including GitHub coverage, and ServiceNow onboarding in Next-Gen SSPM.
Threat Protection Deepscan adds an On Demand REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. supporting files up to 16 MB and a large scan option for 128 MB.
Traffic Steering adds Embedded Mini-browser (WebView2) support for Captive Portal Authentication on Windows clients version 130.0.0+.
Traffic Steering allows blocking RFC-1918 IP addresses/subnets in Fail-Close mode by removing the Local IP address range steering exception in Destination Location.
Traffic Steering adds On-Premises Detection using Egress IP address via a new option in Tunnel Settings > On-premises Detection in Client Configuration UI.
Netskope Client for MacOS adds One-Time Password-Based Client Disable support, configurable in Settings > Security Cloud Platform > Client Configuration > Tamperproof > Allow disabling of Internet Security.
Support for Debian 12 (Bookworm) extends Netskope Client for Linux compatibility.
Netskope Client UI for Windows now respects the system's Windows display language setting under Settings > Time & Language > Language.
Device Classification feature is generally available for all tenants (previously Controlled GA in v129).
Netskope Client for iOS adds the TerminateOnSleepThresholdVPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. profile option (integer seconds) to terminate the client after sleep exceeds the threshold.
Netskope Client for Android adds App Persistence to automatically restart the app within 15 minutes if killed by battery optimization or crash.
25 details in Everything
└──▷ BREAKING ON UPGRADE
!The GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. error message NS_ALERT_UNKNOWN_IDENTITY is renamed to NS_ALERT_INFO_NOT_AVAILABLE.
Netskope DEM adds real-user transaction monitoring for steered/bypassed browsers and NPA root cause analysis with path visualization.
Adds native performance telemetry collection from end users' browsers for both steered and bypassed applications
Adds app dependencies automated discovery including CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. providers and third-party infrastructure
Adds page load and API calls performance telemetry capture
Adds local connectivity and network path impact metrics
Adds app server performance monitoring data
+5 moreshow less
Adds data transfer and transactional error tracking
Adds Network Path Visualization in DEM NPA to map paths between users and private applications
Adds Root Cause Analysis with NPA Metrics integration for identifying network and application degradations
Adds Other Impacted Users metric to highlight systemic degradations across the network
Enhances Tunnel Status Alert webhook payload to include detailed information previously available only in Slack and email
fHEVM v0.8.0 adds a new KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. connector, compressed ciphertext support for SnS/KMS, and protocolId() to SepoliaConfig.
└──▷ GET THIS VERSION
$ git clone --branch v0.8.0 https://github.com/zama-ai/fhevm.git
# already have the repo? check out this version:$ git checkout v0.8.0
New KMS connector integration
Compressed ciphertext support for the Secret Number Service (SnS) worker and Key Management System (KMS)
Added protocolId() function in SepoliaConfig to follow ERC standards
Added extraData generic field to gateway functions, events, and signed structs
4 details in Everything
└──▷ BREAKING ON UPGRADE
!Changed callback function expected by Oracle following ERC standards
!Changed storage layout for the library following ERC standards
Bytebase 3.10 adds Cassandra data masking, a TLS verification toggle for instance setup, and GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. job summaries
└──▷ GET THIS VERSION
$ git clone --branch 3.10.0 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.10.0
Add support for data masking in Cassandra databases.
Add a new option to toggle TLS certificate verification when adding a database instance.
Enable the rollout command in the Bytebase GitHub Action (bytebase-action) to output a job summary.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The SQL_RESULT_SIZE_LIMIT setting and DATA_EXPORT policy are deprecated; use DATA_QUERY policy instead, where sql_query_restriction and data_export settings have been consolidated.
!In Terraform, the sql_query_restriction block is deprecated; replace it with a query_data_policy block supporting disable_export, maximum_result_rows, maximum_result_size, and timeout_in_seconds.
EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. API adds programmatic access via OneAPI with new endpoints for assets and certificates
Adds programmatic access to External Attack Surface Management features via the Zscaler OneAPI using OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authorization.
Adds GET /organizations, GET /organizations/:orgId/findings, GET /organizations/:orgId/findings/:findingId/details, GET /organizations/:orgId/findings/:findingId/evidence, GET /organizations/:orgId/findings/:findingId/scan-output, GET /organizations/:orgId/lookalike-domains, and GET /organizations/:orgId/lookalike-domains/:lookalikeRaw/details endpoints for retrieving EASM organizations, findings, lookalike domains, and associated evidence.
Adds new API endpoints GET /{orgId}/assets, GET /{orgId}/assets/{assetId}/services, GET /{orgId}/assets/{assetId}/technologies, and GET /{orgId}/assets/{assetId}/certificates to retrieve discovered assets, their running services, technologies, and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS certificates.
3 details in Everything
50 more releases in this issue
· 2025-09-01 → 2025-09-30
ZIA adds custom file types for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and File Type Control policies with new API endpoints and NSS log filters
Adds GET /fileTypeCategories, GET/POST/PUT/DELETE /customFileTypes and GET /customFileTypes/count API endpoints to manage custom file types programmatically
Replaces fileTypes attribute with fileTypeCategories in /webDlpRules and /fileTypeRules endpoints to support both predefined and custom file types by ID, name, and category
Adds customDownloadFiletype and customUploadFiletype attributes to the ZmanageNssFeed model in /nssFeeds for filtering NSS logs by custom file types
Adds Download User-Defined File Type and Upload User-Defined File Type filters and columns to Web Insights Logs
Enables creation of custom file types for use in Data Loss Prevention (DLP) and File Type Control policies
Adds scheduled update windows for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Service Edges to avoid unplanned reboot interruptions.
Enables scheduling software updates for new VPN Service Edges during the initial creation flow.
Allows editing the update day and time for existing VPN Service Edges via the Edit VPN Service Edge drawer.
Displays a login banner in ZPA Admin Portal prompting administrators to schedule updates, with Sunday 2:00 AM UTC as the fallback default.
Applies scheduled update logic to both private.zscaler.com and zpatwo.net cloud platforms.
Adds REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints to retrieve and delete Cloud & Branch Connector VMs by instance ID.
Adds GET /ecVm/uuid/{vmInstanceId} endpoint to retrieve detailed information about a Cloud & Branch Connector VM using its public cloud instance ID
Adds DELETE /ecVm/uuid/{vmInstanceId} endpoint to delete a Cloud & Branch Connector VM using its public cloud instance ID
Zscaler Client Connector Portal 4.5 adds named app profile options, new API endpoints, and telemetry controls
└──▷ HOW TO FIND IT
Use new API endpoints to programmatically manage app and forwarding profiles
📍API & Developer Reference Guide
Enable telemetry control globally and per-app in App Supportability settings
📍Enabling Zscaler Client Connector Telemetry
Adds notification template settings consolidated into end user notification configuration for per-app profile assignment
Adds manual system proxy identification option on Windows to bypass default Microsoft APIs
Enforces HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. prefix for Default PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. URLs with no HTTP fallback in forwarding profiles
Adds OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. machine tunnel authentication requiring external device verification before startup
Adds Policy Based Access (All Ports) option for ZIA Disaster Recovery using Z-Tunnel 2.0
+19 moreshow less
Adds automatic packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. start on Windows for tunnel failures and health checks in App Profiles
Removes Imprivata integration requirement for Additional IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Domains option
Adds monitoring and re-caching of system proxy settings when changes are detected
Enables traffic steering and endpoint firewall rule management based on network type (On-Trusted/Off-Trusted)
Adds customizable blocked notification for ZPA app failures due to device posture per app profile
Adds location service option to find nearest data center via user device services
Adds default language selection for the Zscaler Client Connector app in App Profiles
Adds local packet capture enablement to App Profiles alongside global settings
Adds device posture check for specific Zscaler Client Connector versions
Adds option to disable iCloud Private Relay in App Profiles
Adds automatic ZPA reauthentication settings in app profile overriding global settings based on network environment
Adds password requirement and generation options when disabling ZIA and ZDX remotely via CLI
Updates Registered Devices tab to include devices for Authentication Service tenants
Adds Business Continuity mode testing option for user groups
Adds TLS connection auto-switch if Z-Tunnel 2.0 DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. becomes unstable in forwarding profiles
Updates Browser-Based Authentication field on macOS to Authentication Browser Type drop-down with WebAuthnWebAuthnA web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. Popup Browser option
Adds global App Supportability setting to enable or disable Zscaler Client Connector Telemetry
Supports changing Registered Devices column calculation basis from Unique-ID to Hardware Fingerprint
Adds control for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass inclusion of FQDN subdomains for Z-Tunnel 1.0 and Tunnel with Local Proxy
ZIA adds Adaptive Access Engine, custom file types with API, NSS doc subtype fields, SafeSearch app control, and new Docusign/Copilot SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. support.
Adds Adaptive Access Profile filter and column to Web Insights Logs for tracking adaptive access decisions.
New REST endpoints (GET /customFileTypes, POST /customFileTypes, PUT /customFileTypes, DELETE /customFileTypes/{id}, GET /customFileTypes/count) for managing custom file types via API.
Supports UTF-8 BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly., UTF-16 LE, and UTF-16 BE in File Type Control and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies.
Adds safeSearchApps field to AdvancedUrlFilteringCloudAppOptions model on the /advancedUrlFilterAndCloudAppSettings endpoint for granular SafeSearch control.
Adds %s{upload_doc_sub_type} (web logs) and %s{upload_doc_subtype} (SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. feeds) fields to NSS Feed Output Format for document subtype logging.
+3 moreshow less
Supports Microsoft Copilot and Docusign as new SaaS application tenants for Advanced SSPM scans.
Adds No. of Transactions column to Cloud Applications table in the Shadow IT Report.
Supports specifying quarantine locations for Google Drive, OneDrive, and SharePoint via Admin Quarantine action in Data at Rest Scanning policies.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!The fileTypes attribute in /webDlpRules and /fileTypeRules endpoints is replaced with the fileTypeCategories attribute; API configurations must be updated to use the new attribute.
Workflow Automation adds SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security incident attributes, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.-to-GCP integration, and sort-ordered CSV export.
Adds a Channel column to the Incidents table and a corresponding filter for Source DLP type Endpoint incidents
Adds File Shared By, File Shared At, File Modified By, and File Link Expiry attributes to Violation Details for Source DLP type SaaS Security incidents
Enables sorting the Incidents table before exporting to CSV so the file respects the on-screen order
Adds support for Data Loss Prevention (DLP) application integration with Google Cloud Platform (GCP)
New OS End of Life dashboard provides visibility into assets with EOL/EOS operating systems.
Adds the OS End of Life dashboard to view summary tiles, charts, and tables for assets running operating systems that have reached or are approaching End-of-Life (EOL) or End-of-Support (EOS) status.
ZIA adds Subdocument Type filters/columns to Insights Logs and %s{upload_doc_sub_type} field to NSS feed outputs for Snowflake SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls.
Adds the Subdocument Type filter and column to Web Insights Logs and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights Logs pages in the ZIA Admin Portal to capture document subtypes
Adds the %s{upload_doc_sub_type} field to NSS Feed Output Format for web logs to log uploaded document subtypes
Adds the %s{upload_doc_subtype} field to NSS Feed Output Format for SaaS Security feeds configured for file applications to log downloaded document subtypes
Increases Advanced SSPM coverage with 46 new Snowflake controls
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AI Inventory, new Data Posture Policies for AWS/Azure/Snowflake/On-Prem, scan rules, saved views, and on-prem file server scanning.
Adds the AI Inventory dedicated to inventorying and managing AI/ML resources in the cloud.
Adds new Data Posture Policies for AWS (including Bedrock models), Azure (including AI Foundry Hubs), On-Premises MySQL, and Snowflake.
Adds automatic exclusion of log data stores (Network Flow, RDS Audit, ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy., NLB) from scanning to improve efficiency.
Adds Scan Rules for configuring data scan schedule granularity for data stores.
Adds Notification Emails feature to send configuration/permission issue alerts during tenant onboarding.
+6 moreshow less
Adds Saved Views capability on Resource Inventory, AI Inventory, and Compliance pages.
Adds support for scanning on-premises file servers via the On-Premises Scanner.
Adds resource names (instead of instance IDs) for AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. VMs in the Resource Inventory.
Adds new posture labels for Azure File Share, Azure Storage Account Table, Snowflake, and Azure Databricks.
Adds support for scanning sensitive data in Azure Databricks workspaces.
Adds Is Dormant and Stale Access Keys predicates for querying Snowflake resources in Investigation & Policy Query.
New ZTW CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. API endpoints for DNS control, gateways, forwarding rules, and resource management
Adds GET /ecRules/self, POST /ecRules/self, PUT /ecRules/self/{ruleId}, and DELETE /ecRules/self/{ruleId} endpoints to manage log and control forwarding rules programmatically.
Adds GET /ecRules/ecDns, POST /ecRules/ecDns, PUT /ecRules/ecDns/{ruleId}, and DELETE /ecRules/ecDns/{ruleId} endpoints to manage DNS Control Forwarding Rules.
Adds GET /dnsGateways, GET /dnsGateways/lite, POST /dnsGateways, PUT /dnsGateways/{gatewayId}, and DELETE /dnsGateways/{gatewayId} endpoints for full lifecycle management of DNS Gateways.
Adds GET /gateways/{gatewayId} and PUT /gateways/{gatewayId} endpoints to update or retrieve Forwarding Gateway configurations.
Adds GET /ecRules/ecRdr/{ruleId} and DELETE /ecRules/ecRdr/{ruleId} endpoints to retrieve or delete forwarding rule configurations.
+3 moreshow less
Adds GET /ipSourceGroups/{ipGroupId}, PUT /ipSourceGroups/{ipGroupId}, GET /ipDestinationGroups/{ipGroupId}, PUT /ipDestinationGroups/{ipGroupId}, GET /ipGroups/{ipGroupId}, and PUT /ipGroups/{ipGroupId} endpoints for source, destination, and general IP group management.
Adds GET /networkServices/{serviceId}, POST /networkServiceGroups, GET /networkServiceGroups/{groupId}, PUT /networkServiceGroups/{groupId}, and DELETE /networkServiceGroups/{groupId} endpoints to manage network services and service groups.
Adds GET /workloadGroups and GET /workloadGroups/lite endpoints to retrieve Workload Group details.
ZIA adds Post-Quantum CryptographyPost-Quantum CryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. visibility logs and customizable quarantine locations for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. file sharing apps
Adds Post-Quantum Cryptography Visibility Report in Analytics > Interactive Reports > Web Activity to track PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. key algorithms and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS versions
Adds new Web Insights data types: PQC vs. Classical Key Exchange, Top PQC Key Exchange Algorithms, and Top Users with PQC Key Exchange
Adds client and server-side TLS algorithm filters and columns to Web Insights Logs (e.g., Client Digital Signature Proposal, Server-Side Key Exchange Algorithm)
Adds new NSS feed output fields for web logs including %d{client_tls_keyex_pqc_offers}, %s{client_tls_keyex_alg}, and others
Enables specifying a custom quarantine location for Google Drive, OneDrive, and SharePoint in SaaS Security Data at Rest Scanning DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./Malware policies
+1 moreshow less
Adds Admin Quarantine and Restore Admin Quarantine remediation options for file sharing apps on the Assets with Incidents page
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AI inventory, scan rules for scheduling, on-prem scanner for file shares, Snowflake predicates, and saved views across multiple pages.
Adds AI Inventory page for managing and analyzing AI/ML resources in cloud environments
Adds Data Posture Policies with specific checks for AWS, Azure, On-Premises MySQL, and Snowflake (e.g., 'AWS Bedrock Custom Model containing sensitive data can be invoked by external entities')
Introduces Scan Rules configuration to customize data scan schedules for greater granularity
Adds support for scanning on-premises file servers via the On-Premises Scanner deployment
Adds Saved Views functionality allowing users to save filtered/customized table views on Resource Inventory, AI Inventory, and Compliance pages
+4 moreshow less
Adds Snowflake predicates Is Dormant and Stale Access Keys for use in Investigation & Policy Queries
Enables notification emails to specific recipients for onboarding configuration or permission issues
Supports Azure Databricks discovery and classification of sensitive data
Displays resource names for AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. virtual machines in the Resource Inventory instead of instance IDs
9 details in Everything
└──▷ BREAKING ON UPGRADE
!DSPM has migrated to Authentication Service; users must now access the DSPM Admin Portal via the Authentication Service Landing Page and manage users/roles there.
ZPA adds Extranet client type to Access Policies and Azure prebuilt Network Connector image.
Enables Extranet as a supported client type in Access Policies
Provides new Azure prebuilt Network Connector image for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. redundancy
Updates Manager software (v25.47.3) to restart automatically after OS library changes
ZIA adds custom DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. file types, quarantine location configuration, and corresponding API endpoints.
Supports specifying a desired quarantine location for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning policies in Google Drive, Microsoft OneDrive, and Microsoft SharePoint.
Enables creation of Custom File Types for use in DLP and File Type Control policies.
Adds Download User-Defined File Type and Upload User-Defined File Type filters/columns to Web Insights Logs.
Adds NSS filter attributes customDownloadFiletype and customUploadFiletype.
Deploys new Cloud Service API endpoints for managing custom file types: GET /fileTypeCategories, GET /customFileTypes, POST /customFileTypes, PUT /customFileTypes, GET /customFileTypes/{id}, DELETE /customFileTypes/{id}, GET /customFileTypes/count.
+1 moreshow less
Replaces fileTypes attribute with fileTypeCategories in /webDlpRules and /fileTypeRules endpoints.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The fileTypes attribute used in /webDlpRules and /fileTypeRules endpoints is replaced with fileTypeCategories.
ZPA PCC v25.47.3 adds encrypted backup/restore, Notifications service integration, and new debugging/troubleshooting commands
Adds Support for remote troubleshooting (i.e., Support Information) to allow Zscaler support teams to collect diagnostic data remotely from the Private Cloud Controller.
Adds Support for backup and restore with database encryption to enable encrypted database backups for the Private Cloud Controller, preserving confidentiality of stored configuration.
Adds Support for the Notifications service to integrate Private Cloud Controllers with the Zscaler Notifications service for alerting and status updates.
Adds Support for debugging commands to provide new CLI-based troubleshooting capabilities directly on the Private Cloud Controller appliance.
ZIA adds custom file types for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./File Type Control policies with new API endpoints and UI filters.
Adds GET /fileTypeCategories, GET/POST/PUT/DELETE /customFileTypes* API endpoints to manage custom file types programmatically
Adds fileTypeCategories attribute in /webDlpRules and /fileTypeRules endpoints for rule conditions using predefined and custom file types
Adds ZmanageNssFeed attributes customDownloadFiletype and customUploadFiletype to filter NSS feeds by user-defined file types
Adds Download User-Defined File Type and Upload User-Defined File Type filters and columns in Web Insights Logs
Increases default limit of Users, Groups, Locations, & Departments in policies from 4 or 8 to 32
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The fileTypes attribute in /webDlpRules and /fileTypeRules endpoints is replaced with the fileTypeCategories attribute
Client Connector 4.4.0.465 for Windows updates packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. mode and fixes network status display.
Updates Zscaler Client Connector to run Npcap in non-promiscuous mode (instead of promiscuous mode) when performing packet capturespacket capturesA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.
ZIA adds Gen AI app category to NSS feeds, SafeSearch per-app control, document sub-type logging, expandable rule limits, and several new/updated API endpoints.
Adds Gen AI as an application category in NSS and Cloud NSS feeds for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Logs, enabling selection of generative AI apps (e.g., ChatGPT) and custom Feed Output Format edits for SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. streaming
Adds override Boolean query parameter to the PUT /ipDestinationGroups/{ipGroupId} endpoint on zscaler.net, zscalertwo.net, zscalerthree.net to override IPs in destination groups
Adds GET /nssDownload/{nssId} endpoint to Cloud Nanolog Streaming Service (NSS) API for downloading NSS virtual appliance information by server ID
Adds CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. REST endpoints for Virtual Service Edge: GET /virtualZenNodes, POST /virtualZenNodes, GET /virtualZenNodes/{virtualZenNodeId}, PUT /virtualZenNodes/{virtualZenNodeId}, DELETE /virtualZenNodes/{virtualZenNodeId}
Adds CRUD REST endpoints for Workload Groups: POST /workloadGroups, GET /workloadGroups/{workloadGroupId}, PUT /workloadGroups/{workloadGroupId}, DELETE /workloadGroups/{workloadGroupId}
+7 moreshow less
Adds safeSearchApps field to the AdvancedUrlFilteringCloudAppOptions model referenced in the /advancedUrlFilterAndCloudAppSettings endpoint for granular SafeSearch app control
Adds UI drop-down for SafeSearch Applications on Advanced Policy Settings page (Policies > URL & Cloud App Control > Advanced Policy Settings) when Enforce SafeSearch is enabled
Expands per-rule limit for users, groups, locations, and departments to 32 across Bandwidth Control, Secure Browsing, URL & Cloud App Control, DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest., Outbound Email Policy, Endpoint DLP, Firewall Control, FTP Control, DNS Control, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Forwarding Control, Mobile App Store Control, Sandbox, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection, SaaS Security
Adds UTF-8 BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly., UTF-16 LE, UTF-16 BE file types to File Type Control and DLP (Rule without content inspection) policies under the Other category
Adds 'No. of Transactions' column to Cloud Applications table in Shadow IT Report to show transactions per application status (blocked or allowed)
Adds Subdocument Type filter and column to Web Insights Logs and SaaS Security Insights Logs pages for document subtypes
Adds %s{upload_doc_sub_type} field to NSS/Cloud NSS feed output format for web logs and %s{upload_doc_subtype} for SaaS Security file application feeds
Zscaler Risk360 adds DORA and NIS2NIS2EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. risk framework compliance support.
Adds Digital Operational Resilience Act (DORA) framework support to Risk360 assessments
Adds Network and Information Security Directive 2 (NIS2) framework support to Risk360 assessments
ZIA adds strict date format checking for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. EDM templates with support for hyphen/period separated formats.
EDM (Exact Data Match) policy rules can now perform strict checking against popular date formats in Data Loss Prevention (DLP).
Supported formats include 6- to 8-digit dates containing hyphens (-) or periods (.), such as 25-12-2025, 25-12-25, 25.12.2025, and 25.12.25.
ZIA enables stricter date format validation in DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. EDM configurations to reduce false negatives.
ZIA adds custom file types to DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./File Type Control policies and expands document classification in NSS/Insights logs
Adds support for user-defined custom file types in DLP and File Type Control policies, with filters for Download User-Defined File Type and Upload User-Defined File Type added to Web Insights Logs and NSS feeds
Introduces new API endpoints (GET /fileTypeCategories, GET /customFileTypes, POST /customFileTypes, PUT /customFileTypes, GET /customFileTypes/{id}, DELETE /customFileTypes/{id}, GET /customFileTypes/count) for managing custom file types via the Cloud Service API
Adds Subdocument Type column and filter to Web Insights Logs and SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights Logs for categorized document logging
Adds %s{upload_doc_sub_type} and %s{upload_doc_subtype} fields to NSS Feed Output Formats for web logs and SaaS Security feeds to log uploaded/downloaded document subtypes
Increases the default limit of Users, Groups, Locations, and Departments in policies from 4/8 to 32
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The fileTypes attribute used in /webDlpRules and /fileTypeRules endpoints is replaced with the new fileTypeCategories attribute.
ZDX Data Explorer now supports User Groups and Metric-Based filters for End User Monitoring. Cloud Path Probe configuration expands to include Probing Type, PMTU capture, and DSCP settings for enhanced network diagnostics.
ZIA adds IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure.SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection policies, Docusign/Copilot SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. onboarding, expanded policy limits, Gen AI NSS feeds, and web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. content location match.170 chars
Adds IoT group to the Device Groups criterion in the ZIA Admin Portal (Policy > SSL Inspection > SSL Inspection Policy) to create SSL Inspection policies based on IoT AI/ML classifications.
Adds a new Unauthenticated Traffic Bypass for IoT Classifications predefined rule to the SSL Inspection Policy page.
Enables onboarding of Docusign and Microsoft Copilot as SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application tenants for Advanced SSPM scans via the new SSPM Scan checkbox in the Admin Portal.
Extends AI/ML document classification to support ~200 new document types, adding Subdocument Type filter/column to Web Insights Logs and SaaS Security Insights Logs, and %s{upload_doc_sub_type}/%s{upload_doc_subtype} fields to NSS Feed Output Format.
Adds UTF-8 BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly., UTF-16 LE, and UTF-16 BE file types to File Type Control and DLP policies (rule without content inspection).
+5 moreshow less
Adds No. of Transactions column to the Cloud Applications table in the Shadow IT Report.
Expands the default limit for Users, Groups, Locations, & Departments in policies from 4/8 to 32, with support for further expansion upon request.
Increases the limit of users, groups, departments, and locations per rule to 32 across Bandwidth Control, Secure Browsing, URL & Cloud App Control, DLP, Outbound Email Policy, Endpoint DLP, Firewall Control, FTP Control, DNS Control, IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Forwarding Control, Mobile App Store Control, Sandbox, SSL Inspection, SaaS Security categories.
Adds Gen AI as an application category in NSS and Cloud NSS feeds for SaaS Security Logs, allowing streaming of generative AI SaaS application logs (e.g., ChatGPT) to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems.
Enables content location match criteria (File, Document Properties, File Content, File Name, HTTP Body) for Web DLP rules via a new dlpContentLocationsScopes attribute in the /webDlpRules API endpoints and Admin Portal.
VMware Network Connector image updated to support upcoming VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. redundancy features; requires firewall filter rule modification if firewalld is enabled.
ZIA adds content location match criteria for DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rules, OpenOffice file type support, and strict EDM date format checking.
Adds dlpContentLocationsScopes attribute to the WebDlpRule API model in /webDlpRules endpoints to configure content location matching (File, File Content, File Name, HTTP Body).
Enables DLP rules to use Content Location as a match criteria, targeting specific sections of a file or transaction (File metadata/properties, File content, File name, or HTTP Body).
Adds support for OpenOffice Drawings (.odg, .otg) in the OpenOffice category for DLP policy rules with content inspection.
Enables strict checking of 6- to 8-digit date formats (with hyphens or periods) in DLP Exact Data Match (EDM).
New Discovered Application Segments usage insights and CSV column for ZPA application discovery data
Application Segments Usage page now includes Discovered Host Count reports showing the top 10 application segments by discovered host count.
Detailed report CSV files (downloaded from the Application and User Group Relationships page) now include a Discovered Application column indicating if an application was discovered.
ZIA adds strict EDM date formats, Gen AI report enhancements with prompt classification logs, and conditional step-up authentication.
Adds support for strict checking of popular date formats in Data Loss Prevention Exact Data Match (EDM) templates, covering 6- to 8-digit formats with hyphens or periods.
ZPA enables finer-grained Usage Insights by allowing administrators to choose specific SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. identity attributes.
Adds Token Validators in the Admin Portal to validate JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. for ZIA authorization
ZIA adds expandable policy limits and content location match criteria for Web DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rules
Increases default limit of Users, Groups, Locations, and Departments in policies from 4 or 8 to 32, with ability to request further expansion via Zscaler Sales
Adds Content Location match criteria (File Document Properties, File Content, File Name, HTTP Body) for Web DLP rules targeting specific sections of files or transactions
Adds dlpContentLocationsScopes attribute to the WebDlpRule model in /webDlpRules endpoints of the Cloud Service API
ZPA adds Total Users/Group Size column and renames Users to Observed Users in AI Recommendation drawer
Adds a Total Users or Group Size column to the Users and Attributes tabs in the Recommended Configuration drawer to compare observed user counts against total population.
Renames the existing Users column to Observed Users in the Recommended Configuration drawer for clearer distinction between observed and total users.
ZIA adds Source Countries filter to URL Filtering rules, Cloud-to-Cloud DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. forwarding, Gen AI NSS feeds, and REST APIsREST APIsA convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. for VSE/Workload Groups.
Source Countries field added to the Add URL Filtering Rule window (Policies > URL & Cloud App Control > URL Filtering Policy) to filter traffic by origin country.
Support for Cloud-to-Cloud Incident Forwarding in DLP, allowing Inline Web, Data at Rest, Outbound Email, and Endpoint DLP incidents to be forwarded to external appliances like GCP, AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., or Azure VMs.
New API endpoints GET /virtualZenNodes, POST /virtualZenNodes, GET /virtualZenNodes/{virtualZenNodeId}, PUT /virtualZenNodes/{virtualZenNodeId}, and DELETE /virtualZenNodes/{virtualZenNodeId} for creating and managing Virtual Service Edges.
New API endpoints POST /workloadGroups, GET /workloadGroups/{workloadGroupId}, PUT /workloadGroups/{workloadGroupId}, and DELETE /workloadGroups/{workloadGroupId} for managing Workload Groups.
New API endpoint GET /nssDownload/{nssId} to download Cloud Nanolog Streaming Service virtual appliance information.
+4 moreshow less
New query parameter override (Boolean) available for the PUT /ipDestinationGroups/{ipGroupId} endpoint to override IPs.
New Gen AI application category in NSS and Cloud NSS feeds for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Logs, enabling streaming of logs for generative AI applications like ChatGPT to SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems.
Prompt Classification filter and column added to Web Insights Logs.
Limit of users, groups, departments, and locations per policy rule increased to 32 from 4 users, 8 groups, 8 departments, and 8 locations.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!In /webDlpRules and /casbDlpRules endpoints, the attributes zscalerIncidentReceiver and icapServer are deprecated in favor of the new attribute receiver.
!API calls using the deprecated attributes zscalerIncidentReceiver and icapServer are no longer supported.
Notes tab added to App Panel and Control Panel for collaborative comments in ZIA.
Adds a Notes tab to the App Panel in 3rd-Party App Governance and the Control Panel in Advanced SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPMSSPMSaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications.) to allow users to leave notes and comment on each other's notes.
Cohesive VNS3 6.7.7 adds Host Header Poisoning protection, API plugin network editing, and expanded firewall/overlay warnings
Adds a section in the Settings page to restrict control plane (port 8000) access to specific internal interface addresses, preventing Host Header Poisoning attacks.
Enables editing plugin network configuration via API, mirroring the existing UI capability.
Increases overlay certificate authority expiration warning from six months to twelve months, displaying a banner on every UI page when near expiry.
Extends GET firewall rules API response to include packet count information for each rule.
Restores support for IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications.%any peer setting in the 6.x line after an IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. migration regression.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Host Header Poisoning Protection is DISABLED by default in version 6.7.7+; enabling it requires manual configuration and may irrecoverably block control plane access if misconfigured.
Sophos Connect 2.5 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based Windows support and restricts OS to 64-bit Win10/11.
Adds tbot application-proxy service and copy-binaries CLI; adds @<project-id>.iam suffix for GCP Postgres usernames.
└──▷ GET THIS VERSION
$ git clone --branch v18.2.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.2.3
Introduces application-proxy service to tbot for HTTP proxying to applications protected by Teleport
Added tctl tokens configure-kube helper command to easily trust Kubernetes clusters and allow secure repeatable joining
Added tbot copy-binaries command to simplify using tbot as a Kubernetes sidecar
Added automatic @<project-id>.iam suffix to GCP Postgres usernames (Teleport Connect)
Added support for generating VSCode and Claude Code MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers configurations to the tsh mcp config and tsh mcp db config commands
+1 moreshow less
Allow controlling the description of auto-discovered Kubernetes apps with an annotation
6 details in Everything
7 more releases in this issue
· 2025-09-02 → 2025-09-29
Teleport v17.7.5 adds bound_keypair join method, tctl SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. token updates, and multi-resource editing in tctl edit.
└──▷ GET THIS VERSION
$ git clone --branch v17.7.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.7.5
└──▷ TRY IT
Create a new bound_keypair join token for machine authentication in environments without platform-specific join methods.
Adds default namespace support for tbot kubeconfig generation and SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. plugin configuration with OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user./GitHub connectors
└──▷ GET THIS VERSION
$ git clone --branch v17.7.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.7.4
└──▷ HOW TO FIND IT
View, lock, unlock, or delete a bot's lifecycle status directly via the web UI.
📍1. Navigate to Identity › Bots.
2. Select a bot.
3. Use the new Lock, Unlock, or Delete buttons on the Bot Details page.
Added default_namespace config option to tbot for controlling the Kubernetes namespace in generated kubeconfig files
Added Lock, unlock, and delete operations on the Bot Details page UI for managing bot lifecycle
Teleport v18.2.0 adds HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.-backed session recording encryption, GCP AlloyDB support, AI summaries, Terraform Access List provisioning, and Intune device sync.
└──▷ GET THIS VERSION
$ git clone --branch v18.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.2.0
Added auth_server.session_recording_config.enabled: yes in Teleport file configuration to enable static encryption of session recordings via HSMsHSMsA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.
Added dynamic resource configuration via session_recording_config with spec.encryption.enabled: yes for runtime HSM-backed recording encryption
Added AI-generated summaries for SSH, Kubernetes, and database sessions in the web UI for Identity Security users
Added support for provisioning Access Lists and their members (including nested lists) via Terraform
Added hosted plugin for Microsoft Intune to synchronize trusted devices into Teleport Device Trust
+8 moreshow less
Added MySQL database client REPL directly in the Teleport web UI terminal interface
Added database access support for GCP AlloyDB instances
Added user_agent field to MySQL database session start audit events
Added configuration of a default namespace for kubeconfig files generated by tbot's kubernetes/v2 service
Added enhanced RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. rules for session recording access referencing creator’s roles, traits, and resource properties
Added support to configure SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Plugin with OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. or Github Teleport Connectors
Added health check metrics for healthy, unhealthy, and unknown states for database monitoring
Added SSH SELinuxSELinuxA mandatory access control system built into the Linux kernel, maintained by the NSA and Red Hat, that enforces fine-grained policies restricting what processes can access, even if they run as root. module management capability in teleport-update
13 details in Everything
└──▷ BREAKING ON UPGRADE
!Access List review notification check has been removed from the tsh login/status flow, changing the pre-login assessment state for users with pending access list reviews.
tbot Kubernetes Secret destination now supports specifying a namespace; new oidc Kubernetes joining mode for delegated auth providers.
└──▷ GET THIS VERSION
$ git clone --branch v17.7.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.7.3
tbot Kubernetes Secret destinations can now specify a custom namespace via the namespace field in the secret configuration
Added oidc joining mode for Kubernetes delegated joining to support providers with public OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. endpoints (e.g., EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves., AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations., GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure.)
Support setting "*" in role kubernetes_users to match all users
Teleport v16.5.15 adds tctl top prometheus metrics view and Helm chart tbot credential support for event plugins.
└──▷ GET THIS VERSION
$ git clone --branch v16.5.15 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v16.5.15
└──▷ TRY IT
Override the default client-side gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. message size limit for large responses.
$ export TELEPORT_UNSTABLE_GRPC_RECV_SIZE=1048576
Helm charts for teleport-plugin-discord, teleport-plugin-email, teleport-plugin-jira, teleport-plugin-mattermost, teleport-plugin-msteams, teleport-plugin-pagerduty, and teleport-plugin-event-handler now support obtaining plugin credentials using tbot.
Added TELEPORT_UNSTABLE_GRPC_RECV_SIZE environment variable to overwrite the client-side maximum gRPC message size.
Enabled Azure joining with VMSS for node registrations.
Windows desktop LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. discovery now auto-populates the resource's description field.
SPIRE v1.13.1 adds EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. cluster verification for aws_iid, configurable node-info caching, and refresh hints for bundle publishers.
└──▷ GET THIS VERSION
$ git clone --branch v1.13.1 https://github.com/spiffe/spire.git
# already have the repo? check out this version:$ git checkout v1.13.1
Enables aws_iid NodeAttestor to verify that attesting nodes belong to specified EKS clusters.
Adds server-side configuration for how long attested node information is cached, reducing node fetch dependency for RPCs.
Adds refresh hint support to aws_s3, gcp_cloudstorage, and k8s_configmap BundlePublisher plugins for published bundles.
Secureframe adds EU AI ActEU AI ActEU regulation that classifies AI systems by risk level and imposes compliance obligations—documentation, transparency, human oversight—on developers and deployers, shaping how AI-based cyber tools are built and sold in Europe. framework, MongoDB Atlas and Freshdesk integrations, plus custom automated testing for repos.
EU AI Act Framework support added for risk-based AI governance compliance.
MongoDB Atlas Integration enables automated compliance testing for authentication, backup, encryption, firewall, and logging.
Freshdesk Integration adds bi-directional sync for tasks and uses Freshdesk tickets as automated evidence for compliance tests.
Custom Automated Testing (CAT) now supports repository-based data sources.
Mondoo adds DORA and BSI SYS 1.5 compliance, experimental MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. security scanning, and improved finding filters.
Adds support for EU DORA compliance framework
Adds support for German BSI SYS 1.5 compliance framework
The vendor import template adds service descriptions and assessment fields for bulk onboarding.
Enhances the vendor import template with service description, assessment status and justification, last assessment date and assessor, recurrence, and next assessment date.
Adds Service Description field to the import template
Adds Assessment Status field with options: Not Assessed, In Progress, Assessed, Needs Reassessment
Adds Assessment Justification field to the import template
Adds Last Assessment Date field to the import template
+3 moreshow less
Adds Last Assessed By field to the import template
Adds Recurrence field with options: Annually, Biannually, Quarterly, Monthly, Never, Custom
Adds Next Assessment Date field to the import template
Contributors with the required RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. permissions can access Teammates AI chat through the bottom-right chat icon.
Improved ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 20000-1:2018 compliance mapping with comprehensive requirements and corrected control mappings.
Updated ISO 20000-1:2018 framework mapping to include all previously missing requirements
Remapped evidence and policies for a more intuitive compliance process
Drata expands its GitHub integration capabilities to include Enterprise-level Rulesets, enhancing compliance automation for GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically..
Adds integration with Enterprise-level GitHub Rulesets for broader compliance coverage
Vanta introduces Collaborator role for Issue Management and question reordering/duplication in TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. builder
Adds Collaborator role to Issue Management, enabling object-level access to specific issues without full module permissions.
Enables duplication and reordering of questions within the TPRM questionnaire builder.
2 details in Everything
3 more releases in this issue
· 2025-09-07 → 2025-10-04
Redesigned TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Security Review workflow and early access Data inventory & ROPA builder
New redesigned TPRM Security Review workflow that auto-resumes the last step and separates tasks by status
Early Access feature to build a data inventory and generate a ROPA directly in Vanta with spreadsheet import
Zanshin adds historical score analysis (12mo), new scan targets, and updated compliance standards.
Analyze historical security score records for up to 12 months.
Scan Digital Ocean and Trend Micro Vision One as new target types.
Generate compliance reports aligned with CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Controls 8.1, NIST CSFNIST CSFThe NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. v2.0, and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001:2022.
Panorays Q3’25 adds Live Dashboards per supplier, granular Tags management, questionnaire segments, and answer updates.
└──▷ HOW TO FIND IT
Create multiple report versions for a specific supplier using Live Dashboards widgets.
📍In the Live Dashboards interface, select the single-supplier view, add interactive widgets for risk indicators, and save the custom version.
Group vendors by department to streamline targeted assessments.
📍Navigate to Tags Management and create a new tag labeled Department: Finance to group relevant vendors.
Live Dashboards with interactive widgets allow building and saving multiple versions of single-supplier reports to highlight specific data for stakeholders
Tags Management enables grouping and labeling vendors by location, department, or risk level from a single page for targeted assessment plans
Segments feature allows defining how each segment’s Questionnaire Rating is calculated, including mirroring parent company questionnaires or creating dedicated ones
Internal Questionnaires enhancements allow responders to update answers to already-submitted questionnaires without requesting a new one, with automatic notification to the sender
Adds managing GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. rights requests and their visibility in my-assignments to CISO Assistant v3.0.6
└──▷ GET THIS VERSION
$ git clone --branch v3.0.6 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.0.6
└──▷ HOW TO FIND IT
Review all outstanding GDPR rights requests assigned to your current profile.
📍Navigate to the My Assignments view in the CISO Assistant UI.
Process a specific GDPR rights request linked to a framework control.
📍Open a GDPR Framework detail page and use the Rights Requests tab to manage status.
feat: managing GDPR rights requests enables handling data subject access and deletion requests directly within the platform
feat: add ISO objectives and GDPR requests to my-assignments surfaces relevant compliance tasks in the user's personal assignment view
2 details in Everything
7 more releases in this issue
· 2025-09-05 → 2025-09-26
CISO Assistant v3.0.5 adds user expiry management, context menu evidence status changes, and incident report generation.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.5 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.0.5
└──▷ HOW TO FIND IT
Set an expiration date for a specific user account to automate access revocation.
📍In the console, go to Users › Edit User and set the Expiry Date field
Quickly change an evidence's status without opening its full details page.
📍In the Evidence list, right-click the row and select Switch Status from the context menu
Generate a formatted incident report for external sharing or archival.
📍In the console, go to Incidents › Select Incident › Export and choose PDF or Markdown
manage users expiry date allows setting expiration dates for user accounts
context menu on evidences enables switching the status directly from the list view
evidences review feature integrated into the audit workflow for evidence validation
incident report generation supports output to PDF and Markdown formats
risk assessment CSV and PDF exports now include a strength of knowledge column/field
CISO Assistant v3.0.4 adds Svelte DataGrid to the Risk section and links incidents to third-party entities via UI.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.4 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.0.4
Introduces a new Svelte DataGrid component for displaying risk-related metrics in the risk interface section
Adds the capability to link security incidents directly to third-party entities (vendors) within the application interface
CISO Assistant v3.0.3 adds findings export (Excel, PDF, MD), new filters for TaskTemplate occurrences, and MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. identification capabilities.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.3 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.0.3
└──▷ HOW TO FIND IT
Export audit findings to a spreadsheet for offline review or reporting.
📍Use the export option in the findings view and select Excel as the format.
Filter TaskTemplates to see only those recurring in a specific time window.
📍Apply last_occurrence and next_occurrence filters in the TaskTemplate query interface.
Identify users who have not enabled Multi-Factor Authentication for security auditing.
📍Use the user identification feature to filter or list users based on MFA status.
Adds export feature supporting Excel, PDF, and Markdown formats for findings data
Adds last_occurrence and next_occurrence filters to TaskTemplate queries
Enables identification of users with or without Multi-Factor Authentication (MFA) enabled
CISO Assistant v3.0.2 adds bulk re-triggering of all CRQ simulations at once.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.0.2
└──▷ HOW TO FIND IT
When you need to re-run the entire set of control remediation queries (CRQ) simulations simultaneously, typically after updating underlying data or dependencies.
📍Steps: Navigate to the CRQ section in the CISO Assistant UI and select the option to re-trigger all simulations.
CISO Assistant v3.0.1 moves compliance average progress by framework to the main analytics view.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.0.1
CISO Assistant v3.0 adds the Cyber Risk Quantification module and custom qualifications to risk profiles.
└──▷ GET THIS VERSION
$ git clone --branch v3.0.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v3.0.0
└──▷ HOW TO FIND IT
Configure custom qualification tags for assets or users within the risk assessment workflow
📍Navigate to Risk › Assessment › Profiles and enable custom qualifications
Start quantifying cyber risk exposure using the new engine introduced in v3.0
📍Open the Cyber Risk Quantification module from the main dashboard
Filter audit logs to view only entries where a specific condition is met
📍In Audit Logs, use the Filter dropdown to select fields and values
Adds the Cyber Risk Quantification module (epic) for cost-structure-based risk analysis
Introduces custom qualifications for configuring user or asset risk profiles
Enables filtering the audit logs table directly via UI controls
Allows filtering risk assessments by null status in the UI
Expands analytics cards with new summary metrics and enhancements
+1 moreshow less
Displays full folder paths in the user groups dropdown menu
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The applied_controls cost structure has evolved to a more advanced object, requiring schema migration for existing data
CISO Assistant v2.9.2 adds risk assessment-to-action sync and a feature flag for Terminologies control
└──▷ GET THIS VERSION
$ git clone --branch v2.9.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.9.2
feat: control Terminologies entry by a feature flag enables toggling the Terminologies module independently of the main release
feat: risk assessment sync to actions automatically links risk assessment outcomes to actionable tasks within the platform
Runlayer is an MCP gateway that enforces identity-mapped permissions and detects threats across the agents and MCP servers employees use.
Runlayer 1.1.3 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server integrations and non-admin analytics access.
Made analytics available for non-admin users, showing only their usage data
1 detail in Everything
5 more releases in this issue
· 2025-09-09 → 2025-09-30
Runlayer 1.0.0 adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user/group sync and role mapping for SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.
Adds support for syncing Users and Groups from SCIM providers.
Adds role mapping capability to map IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Groups to Runlayer roles.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The auth_client_id Terraform variable must be updated to the new client ID provided by Runlayer support.
Runlayer 0.65.0 adds manual OAuth client configuration for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers without DCR
Runlayer 0.59.0 adds a load testing framework and per-server granular security controls with admin-only interface
Adds configurable test scenarios for load testing workloads including SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. response validation and compliance checks.
Enables per-server security settings to override specific global scanner defaults via an Admin-only interface.
v1.15.5 enables HTTP protobuf transport for OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. via OTEL_EXPORTER_OTLP_PROTOCOL and fixes guardrail registration.
4 more releases in this issue
· 2025-09-16 → 2025-09-30
Frontend UI enhancements for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server management traceability and model catalog code generation.
Portkey Enterprise Gateway 1.15.2 adds KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. for Bedrock uploads and custom Entra scopes.
Adds KMS support for file uploads to bedrock/AWS
Supports custom scope for entra auth with deprecated azure serverless models
Enables custom header support for OTelOTelAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. Export of analytics data
Promptfoo tests, evaluates, and red-teams LLM applications to detect vulnerabilities and compare model outputs.
Promptfoo Sept 2025: reusable policy libraries, risk scoring, new AI models/providers, eval pause/resume, and enterprise compliance features.
Adds pause/resume workflow with Ctrl+C to interrupt and promptfoo eval --resume to continue long-running evaluations
Introduces Risk Scoring in red team reports, providing overall risk scores (0-10), risk by category, trends, and visual heatmaps for remediation prioritization
Enables reusable custom policy libraries via CSV upload and reference in red team config
Adds new model support including Claude 4.5 Sonnet, GPT-5 series, Gemini 2.5 Flash, OpenAI Realtime API (audio I/O), web_fetch/web_search tools, and Nscale image generation provider
Enhances CSV exports to include latency, grader reason, and grader comment fields
+2 moreshow less
Introduces promptfoo export logs command creating tar.gz archives for debugging
Adds auto-enabled cloud sharing when connected to Promptfoo Cloud
AI-Infra-Guard v3.4 adds Docker ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. support, task concurrency limits, and i18n to the CLI.
└──▷ GET THIS VERSION
$ git clone --branch v3.4 https://github.com/Tencent/AI-Infra-Guard.git
# already have the repo? check out this version:$ git checkout v3.4
Adds Apple ARM architecture deployment support via the updated one-click Docker script
Adds frontend internationalization (i18n) support for multi-language text display
toolhive-operator-crds 0.0.30 adds enforce flag to MCPRegistry
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.30 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.30
ToolHive CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. v0.0.27 adds Git Source Handler for MCPRegistry
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.27 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.27
ToolHive v0.3.3 introduces thv group run command and file-based registry provider
└──▷ GET THIS VERSION
$ git clone --branch v0.3.3 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.3.3
Adds thv group run subcommand with full container and remote server support to manage multiple tools as a group
Introduces a file-based registry provider in thv-registry-api for defining tool sources via local files
Removes the ability to manage MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers using partial names; full names are now required
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Partial names can no longer be used to manage MCP servers; you must specify the full server name.
ToolHive v0.3.1 adds OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth, authorization, telemetry, and registry filtering via ConfigMap, plus a new thv-registry-api binary.
└──▷ GET THIS VERSION
$ git clone --branch v0.3.1 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.3.1
Adds telemetry propagation, authorization, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth, and audit flags to the ToolHive Operator ConfigMap CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it..
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.25 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.25
Adds telemetry field in the configmap to support propagating telemetry
Adds authorization field in the configmap to support access control settings
Adds oidc field in the configmap to enable OIDC authentication
Adds audit field in the configmap to configure audit logging flags
ToolHive v0.3.0 adds tool overrides via ToolConfig CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it., multi-workload thv rm/stop commands, and proxy_mode API field.
└──▷ GET THIS VERSION
$ git clone --branch v0.3.0 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.3.0
└──▷ TRY IT
Remove multiple stopped workloads in a single command.
$ thv rm workload1 workload2
Check the operational mode of a workload via the API.
ToolHive adds ToolConfig CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. for filtering/renaming and proxy_mode API field
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.23 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.23
Adds propagate configmap configuration to runconfig allowing ConfigMaps to drive workload settings via the operator
ToolHive operator now supports group registries and tool filtering via ToolConfig CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it..
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.12 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.12
Adds a Helm chart for deploying the ToolHive Operator into Kubernetes
Adds ToolConfig CRD for filtering and renaming tools, controlled by the .spec.toolConfigs field
ToolHive operator adds configmap flag to proxy runner for external config reading.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.22 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.22
Adds Tool Middleware config to the HTTP API for the ToolHive Operator
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.21 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.21
Adds a Helm chart for deploying the ToolHive Operator and exposes tool middleware configuration via the HTTP API.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.11 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.11
ToolHive v0.2.17 adds Google OAuth introspection, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. defaults, Kubernetes annotations for Vault, and structured JSON logging.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.17 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.17
Support Google introspection endpoint
Allow setting annotations on the proxy runner pods, use them to set up Vault integration
Enforce structured JSON logging in Kubernetes environments
enables metrics and tracing by default for local CLI
OpenTelemetry Support for Tracing in ToolHive Operator
5 details in Everything
└──▷ BREAKING ON UPGRADE
!metrics and tracing are enabled by default for local CLI instead of disabled
Adds a Helm chart for deploying the ToolHive Operator and introduces Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. proxy session management with ID routing.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.8 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.8
Adds Google introspection support, remote server management APIs, and pod annotations for Vault integration
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.19 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.19
Allow setting annotations on the proxy runner pods to configure external integrations such as Vault.
Support running and managing remote server through APIs.
ToolHive v0.2.14 adds LM Studio client support and telemetry for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers in Kubernetes
└──▷ GET THIS VERSION
$ git clone --branch v0.2.14 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.14
Adds lm-studio client backend to enable local inference via LM Studio.
Enables telemetry data collection for ToolHive MCP Servers running in Kubernetes.
Zenity adds inline protection integration with Microsoft Copilot Studio
Adds Microsoft Copilot Studio integration to intercept agent tool invocations in real time
Enables detection of indirect prompt injectionindirect prompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. attacks via intent analysis on agent behavior
Adds two new API endpoints for listing AI security findings by project or application
Introduces GET /api/v3.0/projects/{projectUuid}/ai/model/findings/security endpoint to retrieve AI model security findings for a specific project.
Introduces GET /api/v3.0/applications/{applicationUuid}/ai/model/findings/security endpoint to retrieve AI model security findings for a specific application.
Adds additional fields to the models endpoint in the Findings - Project API, aligning data with the AI Models page UI.
Superagent v0.0.8 adds ai-firewall CLI with --config flag and Docker support for node-based release.
└──▷ GET THIS VERSION
$ git clone --branch node-v0.0.8 https://github.com/superagent-ai/superagent.git
# already have the repo? check out this version:$ git checkout node-v0.0.8
└──▷ USE IT
Start the ai-firewall service on a specific port using a custom config file.
Superagent node-v0.0.6 adds ai-firewall with start command, --port/--config flags, and new install paths.
└──▷ GET THIS VERSION
$ git clone --branch node-v0.0.6 https://github.com/superagent-ai/superagent.git
# already have the repo? check out this version:$ git checkout node-v0.0.6
└──▷ TRY IT
Install the firewall tool globally via npm to make the ai-firewall command available.
$ npm install -g ai-firewall
Start the firewall service on port 8080 using a custom configuration file.
$ git clone --branch 3.8.0 https://github.com/isislab/CTFd.git
# already have the repo? check out this version:$ git checkout 3.8.0
└──▷ USE IT
Pre-create an admin account and set a known API token for fully automated CTFd deployments (CI/CD pipelines, IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.).
Adds configurable visibility for users' own past submissions via new /api/v1/users/me/submissions endpoint and admin toggle.
Admins can now store and publish challenge solutions, accessible to users via /api/v1/challenges/[challenge_id]/solutions and unlocked through /api/v1/unlocks.
New challenge logic field lets developers require any single flag (any), all flags (all), or a flag from every team member (team) before a solve is counted.
Max Attempts can now act as a timed cooldown (e.g., 5-minute lockout) rather than a permanent lockout.
Participants can submit upvotes/downvotes and written reviews on challenges via /api/v1/challenges/[challenge_id]/ratings; visibility is admin-configurable.
+12 moreshow less
Hints now require an explicit unlock action even when free, improving accidental-view prevention and hint-usage tracking.
Hints can now be given a title shown to users before they unlock the hint.
CTFd logs a challenges.open tracking event in the Tracking table the first time a user opens a challenge.
Adds a matrix scoreboard to the Admin Panel Statistics page to visualise player progression through challenges.
Admin Panel scoreboard now supports brackets.
New admin config option for minimum password length.
Admins can now force users to change their password on next login via the change_password field on /api/v1/users/[user_id].
New PRESET_ADMIN_NAME, PRESET_ADMIN_EMAIL, PRESET_ADMIN_PASSWORD, and PRESET_ADMIN_TOKEN keys in config.ini for pre-creating an admin account in automated deployments.
New PRESET_CONFIGS key in config.ini allows pre-setting server-side configuration without completing the setup wizard or using the API.
New EMAIL_CONFIRMATION_REQUIRE_INTERACTION key in config.ini requires additional user interaction on confirmation links to improve anti-phishing compatibility.
Adds BaseChallenge.partial for plugin authors to indicate partial solves used with all-logic challenges.
The core-beta theme is promoted to core; the previous core theme is renamed core-deprecated.
17 details in Everything
└──▷ BREAKING ON UPGRADE
!Challenge Type Plugins must now return a ChallengeResponse object instead of a (status, message) tuple (legacy tuple behavior is supported until CTFd 4.0).
!The core-beta theme is renamed to core; the previous core theme is renamed core-deprecated — any theme references to core or core-beta in deployments will resolve to different themes after upgrade.
!pybluemonday is replaced with nh3 for HTML sanitisation — any plugin or deployment that depends directly on pybluemonday will break.
Adds advanced issue search queries to gh search and --search flags; adds --clipboard/-c flag for OAuth copy on gh auth login/refresh; adds --ref to gh cache delete.
└──▷ GET THIS VERSION
$ git clone --branch v2.79.0 https://github.com/cli/cli.git
# already have the repo? check out this version:$ git checkout v2.79.0
└──▷ USE IT
Delete a cache for a specific branch using the new --ref flag.
shell
gh cache delete --ref main
Automatically copy the OAuth code to the clipboard during login.
shell
gh auth login --clipboard
Search for open pull requests with specific labels using advanced query syntax.
shell
gh search prs --search 'is:open label:bug'
Adds --ref option to gh cache delete to target a specific branch or tag when removing caches
Adds --clipboard (-c) flag to gh auth login and gh auth refresh to automatically copy the OAuth one-time pass code to the clipboard
Adds advanced issue search query support via --search flag in gh search issues, gh search prs, gh issue list, and gh pr list
SysReptor 2025.80 adds native Excalidraw notes, username auto-complete in comments, custom PostgreSQL schema support, and more.
└──▷ GET THIS VERSION
$ git clone --branch 2025.80 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2025.80
└──▷ USE IT
Use a dedicated PostgreSQL schema to isolate SysReptor's tables within a shared database instance.
yaml
DATABASE_SCHEMA=sysreptor
Adds native Excalidraw diagramming directly into SysReptor core, replacing the need for the separate excalidraw plugin.
Supports importing notes into the design default note structure.
Enables custom PostgreSQL schema configuration via the DATABASE_SCHEMA environment variable.
Adds username auto-complete when writing comments.
Introduces case-sensitive TODO marker parsing.
+1 moreshow less
Updates the HTB CBBH design to the new HTB CWES design.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The excalidraw plugin is deprecated; installations relying on the excalidraw plugin should migrate to the new built-in Excalidraw notes in SysReptor core.
SysReptor 2025.74 adds a scan import plugin and tightens user account security requirements.
└──▷ GET THIS VERSION
$ git clone --branch 2025.74 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2025.74
New scanimport plugin enables importing scan results from various security tools directly into reports.
Requires an email address when creating new users.
Requires a different password when users change their password.
Switches CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks.script-src to use a nonce instead of a hash, improving content security policycontent security policyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. flexibility.
toggle_command_palette keybind action enables a new UI command palette accessible via ctrl+shift+p (GTKGTKA cross-platform widget toolkit maintained by the GNOME project for building graphical user interfaces in C, with bindings for many languages, giving cyber tools a native desktop UI without writing platform-specific rendering code.) or cmd+shift+p (macOS) to invoke keybind actions
ssh-env opt-in feature sets TERM=xterm-256color and forwards env vars for SSH sessions with legacy remote machines
ssh-terminfo opt-in feature copies local Ghostty terminfo to the remote host to enable full feature support over SSH
New quick-terminal-size configuration key allows percentage or pixel sizing (e.g., 25%, 600px) and supports comma-separated primary/secondary axis values for the quick terminal window
background-image configuration key allows specifying a terminal background image with supporting keys: background-image-opacity, background-image-position, background-image-fit, and background-image-repeat
+1 moreshow less
Custom shaders now receive cursor state information, enabling effects like trails or smears on the cursor via custom shader logic
The python-pipx CLI installs and runs Python applications in isolated environments while exposing their commands on the user's PATH.
pipx 1.8.0 adds --all-shells flag to ensure_path, Python 3.13 support, and renames the USE_EMOJI env var.
└──▷ GET THIS VERSION
$ git clone --branch 1.8.0 https://github.com/pypa/pipx.git
# already have the repo? check out this version:$ git checkout 1.8.0
└──▷ TRY IT
After installing pipx on a new machine with multiple shells (bash, zsh, fish), update all shell profiles in one shot instead of running ensurepath per shell.
$ pipx ensurepath --all-shells
Adds --all-shells flag to pipx ensurepath to inject the pipx bin path into every detected shell profile at once.
Supports Python 3.13 as a runtime environment for installed tools.
Renames the USE_EMOJI environment variable to PIPX_USE_EMOJI for consistent namespacing.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The USE_EMOJI environment variable is renamed to PIPX_USE_EMOJI; any script or config that sets USE_EMOJI to control emoji output will have no effect after upgrading.
!Python 3.8 is no longer supported; pipx will not run on Python 3.8 interpreters after upgrading.
Kali Linux 2025.3 adds 10 new tools including Caido and Gemini CLI, Nexmon Wi-Fi support, and CARsenal UI updates.
Adds caido (graphical web security auditing toolkit) and caido-cli to Kali Linux.
Adds gemini-cli, an open-source AI agent for terminal integration.
Adds krbrelayx, a KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. relaying and unconstrained delegation abuse toolkit.
Adds ligolo-mp, a multiplayer pivoting solution.
Adds llm-tools-nmap, enabling LLMsLLMsA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to perform network discovery via nmap.
+6 moreshow less
Adds mcp-kali-server, an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. configuration to connect AI agents to Kali.
Adds patchleaks, a tool to spot security fixes and provide validation or weaponization details.
Adds detect-it-easy (die) for file type identification.
Enables monitor mode and injection for Raspberry Pi built-in Wi-Fi via Nexmon firmware support on Broadcom & Cypress chips.
Updates configurable VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. IP panel plugin (Xfce) to allow selecting which network interface to monitor.
Adds CARsenal UI updates including moved Settings to menu bar, long-press command editing, and new MSF tab for automotive modules.
11 details in Everything
└──▷ BREAKING ON UPGRADE
!Drops support for the ARMel architecture; Raspberry Pi 1 and Zero W are no longer supported.
Cloudflare is a connectivity cloud platform delivering internet security, performance, and developer infrastructure services.
Cloudflare Gateway introduces Application Granular Controls for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. HTTP policies
35 more releases in this issue
· 2025-09-01 → 2025-09-30
SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for all accounts is now free, with API configuration replacing support tickets.
Extends SSO availability to all Cloudflare users (not just Enterprise) at no cost
Adds direct API management of SSO configurations, removing the need to contact support
Cloudflare raises concurrent Container limits: 400GiB RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed., 100 vCPU, 2TB disk, and support for more dev/basic/standard instances.
Increases the memory limit for concurrent live Container instances to 400GiB (up from 40GiB).
Increases the vCPU limit for concurrent live Container instances to 100 (up from 20).
Increases the disk limit for concurrent live Container instances to 2TB (up from 100GB).
Allows running 1000 concurrent dev instance type Containers.
Allows running 400 concurrent basic instance type Containers.
+1 moreshow less
Allows running 100 concurrent standard instance type Containers.
Gateway HTTP DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies now support a Body Phase selector to scan only request or response bodies.
Adds the Body Phase selector in the Gateway HTTP policy builder to control which traffic direction is scanned.
Enables Request Body scanning for user-initiated data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. monitoring (e.g., uploads, form submissions).
Enables Response Body scanning for inspecting file downloads and website content for sensitive data.
Cloudflare R2 now supports serverless SQL queries against Apache IcebergApache IcebergAn open table format for large analytic datasets, maintained by the Apache Software Foundation, that gives cyber tools reliable schema evolution, time-travel queries, and atomic commits on object storage or HDFS. tables via the wrangler r2 sql query command in open beta.
Introduces npx wrangler r2 sql query as a new CLI subcommand for executing distributed SQL queries against R2 Data Catalog tables.
Adds support for querying Apache Iceberg tables managed by R2 Data Catalog using the wrangler toolkit.
Browser Rendering adds GA Playwright v1.55 support, Beta Stagehand automation, and tripled limits on paid plans.
Adds Generally Available support for Playwright v1.55 in Browser Run
Adds Beta support for the Stagehand library to combine code with natural language instructions
Tripling of execution limits for paid plans across REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. and Browser Sessions
AI Search now supports embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. and inference models from third-party providers via AI Gateway.
Cloudflare Pipelines adds SQL transformations and Apache IcebergApache IcebergAn open table format for large analytic datasets, maintained by the Apache Software Foundation, that gives cyber tools reliable schema evolution, time-travel queries, and atomic commits on object storage or HDFS./Parquet output to R2
└──▷ TRY IT
Initialize a new streaming pipeline from the command line to ingest and transform events.
$ npx wrangler pipelines setup
Adds SQL transformation engine for stream processing in Cloudflare Pipelines
Enables writing transformed data to R2 as Apache Iceberg tables via wrangler pipelines setup or dashboard
Provides npx wrangler pipelines setup CLI command for pipeline initialization
Cloudflare Access now GA for browser-based RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. with IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., Magic WAN/WARP on-ramps, and enhanced keyboard/input support.
Browser-based RDP is generally available for all Cloudflare customers
Added support for targets with IPv6 addresses
Added Magic WAN as an on-ramp for browser-based RDP sessions
Added WARP Connector as an on-ramp for browser-based RDP sessions
Enhanced keyboard layout support for non-English languages (e.g., Portuguese, Chinese)
+2 moreshow less
Improved handling of usernames containing spaces, quotes, or special characters
Enhanced error messaging on the login page for RDP connection issues
Cloudflare Tunnel adds hostname-based routing for private and public apps
Adds hostname and domain routing for Cloudflare Tunnel, allowing routes to be defined by individual hostnames (e.g., payroll.acme.local) or entire domains (e.g., *.acme.local) instead of only IP addresses or CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges.
Enables precise egress control by routing traffic for public hostnames (e.g., bank.example.com) through a specific Tunnel to enforce a dedicated source IP.
New interactive DNS Firewall analytics panels in Cloudflare dashboard.
Enables cross-panel filtering by dimensions including query name, query type, cluster, data center, protocol (UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.), IP version, and response code/reason
Provides access to 62 days of historical data with flexible intervals for trend analysis
Cloudflare introduces AI-powered search and Ask Cloudy agent in the Zero Trust Dashboard.
Adds AI-powered search for resources (applications, policies, device profiles), pages, and products within the Zero Trust Dashboard.
Integrates Ask Cloudy, an AI agent trained on developer documentation and implementation guides, allowing users to ask configuration questions and receive recommendations while navigating between dashboard pages.
Adds a new Find Recents tab under Zero Trust Overview displaying recent searches and Ask Cloudy history.
Log Explorer adds UI pivots for IP/JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. reputation, error docs, and Gateway policies
Adds right-click pivot from http_requests or fw_events IP Address or JA3 Fingerprint to Investigate portal
Adds direct links from EdgeResponseStatus or OriginResponseStatus fields to documentation
Adds click-to-link pivot from gateway_httppolicyid to Zero Trust Gateway policy settings
Adds Regional Email Processing locations (Germany, India, Australia) selectable during domain onboarding in Cloudflare Email security
Allows customers to select the email processing region (Germany, India, or Australia) for new domains via the UI when using MX, BCC, or Journaling onboarding methods.
Enables automatic MX record updates from the UI when onboarding a domain managed by Cloudflare in Germany, India, or Australia.
Wrangler now supports interactive deployment of static sites without a pre-existing configuration file via wrangler deploy [directory]
└──▷ USE IT
Deploy a static site immediately without setting up wrangler.jsonc first, letting CLI guide you through naming and config generation.
shell
wrangler deploy dist
wrangler deploy [directory] or wrangler deploy --assets [directory] without an existing config triggers interactive prompts for project name, type, and compatibility date
Automatically generates a wrangler.jsonc configuration file in the current directory to persist deployment settings
Cloudflare Magic WAN adds custom_ike_id via API for IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnels
Adds @cf/google/embeddinggemma-300m as a new embedding modelembedding modelLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. on Workers AI for multilingual RAGRAGRetrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining.
Enables selection of @cf/google/embeddinggemma-300m in the Generate Index step of the AI Search dashboard to support RAG pipelines across 100+ languages
Adds cloudflare_worker, cloudflare_worker_version, and cloudflare_workers_deployments resources to the Cloudflare Terraform provider (v5.9.0) for separate infrastructure and code lifecycle management
Cloudflare REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. now returns IETF-standard rate limiting headers (Ratelimit, Ratelimit-Policy, Retry-After)
Adds Ratelimit header to all Cloudflare REST API responses to expose remaining quota and reset time
Adds Ratelimit-Policy header to define total quota and time window for each rate limit policy
Adds Retry-After header on 429 errors to indicate seconds until capacity is available
Arcade introduces unoptimized toolkits, a Slack-started MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server, and WhoAmI tools for Confluence.
Advanced error handling added to Google, Microsoft, Slack, and Asana MCP Servers
1 detail in Everything
3 more releases in this issue
· 2025-09-05 → 2025-09-26
Adds MongoDB and HubSpot MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers; removes noisy messages in ClickUp Evals
Adds the MongoDB analytics MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for toolkits (PR #548)
Adds HubSpot MCP server enhancements to the MCP Hub (PR #441)
Removes no content additional messages in ClickUp Evals
Arcade introduces WhoAmI tool across Jira, Google, Clickup, Slack, and Zendesk MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers.
Adds Imgflip MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. and Google Docs editing toolkits plus new dashboard sidebar for Arcade
Adds the Imgflip MCP Server toolkit providing tools for creating memes via MCP protocol.
Adds the Edit Google Document Tool to the available toolkits list.
Introduces a new sidebar and user-verification page in the Dashboard UI.
THE CYBER TOOLCHAIN
NO. -010