The daily firehose — everything the toolchain shipped today, already filtered.
We read every release from the 1309 tools on our watchlist at the source — GitHub and GitLab release notes, vendor release pages and changelogs, project blogs and feeds, vendor press releases, and the source code behind the tag. Bug-fix-only releases and non-product newsroom noise are dropped; what's left is summarized down to the new capability, how to try it, and any screenshots or videos the release itself published. Every entry links to the sources it was built from.
READ AS
Focus:What features shipped and what problems they solve, plus launches, packaging and where the market is moving.
Leaves out:Command-line flags, API-only deltas, usage examples, and releases that are only refinements.
Focus:New security controls, new APIs, and product improvements you can put to work, plus anything an upgrade breaks.
Leaves out:Launch and marketing news, governance, pricing, and documentation changes with no operational effect.
Focus:Dashboards, reporting, and anything you can quantify: metrics, coverage, risk scores, compliance impact, vendor moves.
Leaves out:Settings, flags, API and command-line detail, library bumps, and minor releases with no reporting or posture angle.
Focus:API, SDK and MCP changes, new libraries, breaking changes in what you import, and cyber tooling.
Leaves out:Governance, SOC operations, and vendor launches with no developer surface.
AMOUNT
DETAIL
ORDER
This issue came out before editions were ranked, so it shows the Standard edition in issue order.
A suite of WiFi/Bluetooth offensive and defensive tools for the ESP32.
ESP32 Marauder v1.8.4 adds sleep, ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery., SSH, and Telnet scanning with saved WiFi join support.
└──▷ GET THIS VERSION
$ git clone --branch v1.8.4 https://github.com/justcallmekoko/ESP32Marauder.git
# already have the repo? check out this version:$ git checkout v1.8.4
Adds sleep attack capability to disrupt client connections
Adds network discovery via ARP scan, SSH scan, and Telnet scan modules
Enables automatic connection using saved wifi credentials without manual entry
The open-source wireless research platform for ESP32.
GhostESP v1.7 adds dual ESP32 comms, IR RX, scanap/scanssh commands, and new board support.
└──▷ GET THIS VERSION
$ git clone --branch v1.7 https://github.com/GhostESP-Revival/GhostESP.git
# already have the repo? check out this version:$ git checkout v1.7
└──▷ TRY IT
Scan for active SSH services on a specific host.
$ scanssh 192.168.1.50
Monitor access points in real-time without blocking the terminal.
$ scanap -live
Disable the local WiFi Access Point remotely.
$ apenable off
chipinfo command to display chip information
apenable command to enable/disable the Access Point
disconnect command to disconnect from the current network
setrgbmode command to change the RGB mode
scanarp command to initiate an ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. scan on the local network
+10 moreshow less
scanssh [IP] command to initiate an SSH scan on the target IP
-live argument for scanap for a non blocking scan that lists APs as they're found
Dedicated WebUI section for managing linked devices in Dual ESP32 Communication mode
Power Saving Mode for up to 5x battery life on compatible boards
Infrared RX support (only enabled on TEmbed C1101) for receive and decode of Flipper Zero protocols, including rename, delete, add remotes, and Easy Learn Mode auto-naming buttons
Custom Evil Portal HTML file support from SD Card (max 2048 bytes)
Never display timeout setting
Power Saving setting (turns off AP and lowers CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. frequency) for Cardputer and S3TWatch
Backlight percentage setting for PWM enabled devices
Vim keybindings for keyboard interactions in various screens
airgeddon v11.51 adds Apple CNACNACVE Numbering Authority — an organization authorized by MITRE to assign CVE IDs within a defined scope, letting cyber tools reference vulnerabilities under a globally consistent identifier. bypass for Evil Twin attacks and multi-hook plugin support
└──▷ GET THIS VERSION
$ git clone --branch v11.51 https://github.com/v1s1t0r1sh3r3/airgeddon.git
# already have the repo? check out this version:$ git checkout v11.51
Adds ESSID stripping using invisible characters to bypass Apple SSID grouping in Evil Twin attacks
Improves captive portal HTML and JS to work inside Apple CNA (Captive Network Assistant), capturing credentials from iOS/macOS clients
Enables multiple hooks from different plugins on the same hookable function, expanding plugin composition capabilities
Extends compatibility to Puppy Linux and CachyOS Linux
Hashcat v7.1.1 adds Docker AMD GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. support via HIP/OpenCL and fixes multi-hash LUKS2/KeePass handling.
└──▷ GET THIS VERSION
$ git clone --branch 7.1.1 https://github.com/hashcat/hashcat.git
# already have the repo? check out this version:$ git checkout 7.1.1
Adds initial support for AMD GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. when running Hashcat inside Docker using HIP and OpenCL
Hashcat v7.1.0 adds 16 new hash modes including LUKS2 Argon2i, KeePass KDBX v4, and BLAKE2b-256BLAKE2b-256A cryptographic hash function from the BLAKE2 family, producing a 256-bit digest using the BLAKE2b variant optimized for 64-bit platforms; tools use it for fast, secure integrity checking without the overhead of SHA-2., plus Docker support and 64-bit attack counters.
└──▷ GET THIS VERSION
$ git clone --branch v7.1.0 https://github.com/hashcat/hashcat.git
# already have the repo? check out this version:$ git checkout v7.1.0
Adds AS/400 DES and AS/400 SSHA1 hash modes.
Adds Blockchain My Wallet Legacy Wallets cracking support.
Adds Cisco-ISE Hashed Password (SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data.) hash mode.
Adds LUKS2 with Argon2i KDF type hash mode.
Adds KeePass KDBX v4 hash mode.
+10 moreshow less
Adds SAP CODVN H (PWDSALTEDHASH) isSHA512 hash mode.
Adds sm3crypt $sm3$ / SM3 (Unix) hash mode.
Adds BLAKE2b-256, BLAKE2b-256($pass.$salt), and BLAKE2b-256($salt.$pass) hash modes.
Adds MD6 (256) hash mode.
Adds sha224($pass.$salt), sha224($salt.$pass), sha224(sha1($pass)), and sha224(sha224($pass)) hash modes.
Adds initial support for running hashcat inside Docker.
Warns instead of blocking when GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. memory usage is high, improving operator visibility.
Updates host free-memory query method for more accurate resource reporting.
Improves Python Bridge to support 1:N password-to-hashes mapping.
New Assimilation Bridge enables external resources — CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware., FPGAs, embedded interpreters — to participate directly in the cracking pipeline.
New Python Bridge Plugin lets practitioners implement hash-matching logic in Python without recompilation, with multithreading and rule engine support built in.
Hash-mode autodetection: omit -m entirely and Hashcat infers the hash type, or use --identify to list all possibilities.
Virtual Backend Devices partition physical GPUsGPUsA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. into multiple logical devices for better async workload distribution.
Adds first-class AMD HIP backend support, now preferred over OpenCL when both are available.
+11 moreshow less
Adds native Apple Metal backend with full Apple Silicon compatibility.
58 new application-specific hash types including Argon2Argon2A password-hashing algorithm that makes each guess consume memory as well as computation. This makes a stolen password database harder to crack with specialized hardware., MetaMask, Microsoft Online Account, SNMPv3, GPG, OpenSSH, and LUKS2.
17 new generic hash constructions covering real-world web apps and protocols.
20 new hash-extraction tools supporting APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices., VirtualBox, BitLockerBitLockerA full-disk encryption feature built into Windows, maintained by Microsoft, that protects data at rest by encrypting entire volumes; cyber tools use it to audit encryption status or recover keys from managed endpoints., and various wallet formats.
Memory management rewrite removes the previous 4 GB allocation cap, enabling full device memory usage.
Mask engine now supports 8 custom charsets (-5 through -8).
JSON output format added to status and info commands.
Compressed wordlist handling added with improved I/O error recovery.
Docker build support added for containerized and cross-platform builds, including cross-compilation to Windows.
Major performance gains: scryptscryptA password-hashing function that requires substantial memory for each guess, making large-scale password cracking more expensive. up to +320%, NetNTLMv2 +223% on Intel, RAR3 up to +54%.
Rule engine gains new character class logic and rejection rules for increased flexibility.
certgraph v0.1.0 launches with CT log search, multi-driver support (crt.sh, Censys, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., HTTP/TLS), embedded web UI, and CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. detection.
└──▷ GET THIS VERSION
$ git clone --branch v0.1.0 https://github.com/lanrat/certgraph.git
# already have the repo? check out this version:$ git checkout v0.1.0
Adds Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates. (CT) log support for discovering related domains via certificate records.
Adds crt.sh CT driver for querying the crt.sh certificate transparency search engine.
Adds Censys driver for certificate graph enumeration via the Censys API.
Adds SMTP driver that uses MX records to discover certificate relationships over email infrastructure.
Adds HTTP/TLS (SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination.) driver that follows redirects and collects all certificates encountered.
+15 moreshow less
Supports multi-driver mode, enabling simultaneous use of multiple certificate sources.
Adds embedded web server and interactive web UI for visualizing the certificate graph.
Adds CDN detection to identify domains hosted on content delivery networks.
Adds domain availability checking for discovered related domains.
Adds regex filter to restrict graph traversal to matching domains.
Adds -dns and -tldplus1 (apex) flags for controlling domain resolution behavior.
Adds --save flag to persist discovered certificates to disk (keyed by cert hash to prevent duplicates).
Adds --list flag to output discovered domains as a flat list.
Adds JSON output including scan date, graph depth, command args, and regex config.
Supports searching expired certificates in CT logs.
Supports searching CT subdomains and including related domains as graph neighbors.
Adds Docker support for containerized deployments.
Adds Linux and macOS arm64 cross-compilation support.
Web UI supports data file upload, file drag-and-drop, data paste, and querystring-based data input.
Amass v5 overhauls the architecture: new engine binary, SQLite-backed session queue, database caching, and Docker image ships all executables.
└──▷ GET THIS VERSION
$ git clone --branch v5.0.0 https://github.com/OWASP/Amass.git
# already have the repo? check out this version:$ git checkout v5.0.0
Adds a standalone engine binary (engine) as a separate executable alongside the main amass CLI.
Implements SQLite-backed session entity queue for improved enumeration state management.
Adds database caching layer (asset-db cache) to speed up asset association lookups.
Docker image now ships all project executables, including the engine binary.
New assoc tool now uses database caching for association queries.
+8 moreshow less
Updates enum subcommand to produce structured logs.
Adds Organization deduplication during discovery.
Adds support for regex value matching in triples.
Adds JARM fingerprinting implementation.
Updates GLEIF fuzzy completions API usage for organization enrichment.
Adds Aviato plugin handler for company enrichment.
New DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record service discovery handler and plugin.
Supports OAM v0.14 and asset-db v0.19 data model and schema.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!The subs and emails subcommands have been removed.
!The embedded collection engine has been removed; the engine now runs as a separate binary.
!The enum subcommand has been separated into its own client subcommand.
enum4linux-ng v1.3.5 adds year display to password policy, enhanced session output, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. DNS guidance.
└──▷ GET THIS VERSION
$ git clone --branch v1.3.5 https://github.com/cddmp/enum4linux-ng.git
# already have the repo? check out this version:$ git checkout v1.3.5
Adds year values to password policy output for clearer age-based policy review.
Enhances sessions output with additional detail.
Adds Kerberos ticket permission checks and informs users when DNS must be configured correctly for Kerberos authentication.
evil-winrm-py v1.3.0 adds loadps to source local PowerShell scripts into remote sessions with smart tab completion.
└──▷ GET THIS VERSION
$ git clone --branch v1.3.0 https://github.com/adityatelange/evil-winrm-py.git
# already have the repo? check out this version:$ git checkout v1.3.0
└──▷ TRY IT
Load a local PowerShell script into your active evil-winrm-py session to call its functions remotely — useful for staging recon or post-exploitation tooling without uploading files.
$ loadps /opt/scripts/PowerView.ps1
New loadps command loads functions from a local .ps1 script directly into the remote PowerShell session, with validation of file existence and extension before loading.
Functions loaded via loadps are automatically added to tab completion in the remote shell, making them instantly discoverable.
BloodHound v8.1.0 adds new saved-query APIs, AGT history filtering, ingest error details, and .deb packaging for Kali-style installs.
└──▷ GET THIS VERSION
$ git clone --branch v8.1.0 https://github.com/SpecterOps/BloodHound.git
# already have the repo? check out this version:$ git checkout v8.1.0
New Get SavedQuery API endpoint for retrieving individual saved Cypher queries.
New GetSavedQueryPermissions API endpoint for inspecting sharing/permissions on saved queries.
New GetAllAttackPathFindings API endpoint now accepts an Asset Group parameter for scoped attack-path results.
New API endpoint for file-level ingest error details, enabling per-file troubleshooting of ingestion failures.
Adds infinite-scrolling pagination to selectors and members lists on the Zone Management details page.
+15 moreshow less
Adds an Analyze Now button for on-demand graph analysis.
Adds a history filter dialog to the AGT (Asset Group Tagging) view for filtering tagging history entries.
AGT now records a history entry for auto-certification events during node tagging.
Adds denormalized property fields to the AGT selector nodes table.
Adds custom icon support for Asset Group Tags (AGTs).
Adds an X button to the entity panel header to dismiss the selected item.
Adds an environment parameter to Privilege Zone member endpoints for environment-scoped queries.
Abuse info and GoldenCert attack guidance updated to Certify 2.0 commands.
Allows nullable NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. registry values ingested from SharpHound.
Explore table now supports column sort state persistence.
Reworked Finished Jobs Log table UI.
Debian (.deb) package added for direct installation on distributions such as Kali Linux.
Bundles AzureHound 2.7.1.
Adds disabled-tier icons to the Privilege Zones UI.
AD special identities updated with expanded coverage.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!The timezone setting has been removed from the configuration file because the container image no longer supports it; any existing configuration referencing this setting will need to be updated.
sickle-pdk v4.0.0-Beta adds four new shellcode stubs including an x64 reflective PE loader and AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. reverse shell.
└──▷ GET THIS VERSION
$ git clone --branch v4.0.0-Beta https://github.com/wetw0rk/sickle-pdk.git
# already have the repo? check out this version:$ git checkout v4.0.0-Beta
Adds windows/aarch64/shell_reverse_tcp shellcode stub for Windows AArch64 targets.
Adds windows/x64/egghunter shellcode stub for x64 egg-hunting payloads.
Adds windows/x64/virtualalloc_exec_tcp shellcode stub for x64 VirtualAlloc-based execution over TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it..
Adds windows/x64/reflective_pe_loader shellcode stub for in-memory reflective PE loading on x64.
Snyk Code announces Python XXEXXEXML External Entity injection, a class of attack against XML parsers that tricks them into fetching external resources or local files, letting an attacker read sensitive data or trigger server-side request forgery. detection, Javalin coverage, and clearer issue descriptions for rollout on September 15.
Adds a Python rule for XML External Entity Injection (XXE).
Expands language coverage to include the Javalin web framework for Java and Kotlin
Improves JavaScript framework coverage with detection for Angular's ActivatedRoutes and react-router-dom
Enhances crypto cipher detection for insecure ciphers in Java, Kotlin, and Scala
Granularizes Cleartext Transmission of Sensitive Information findings into specific categories (e.g., unencrypted socket, email, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output., HTTP)
5 details in Everything
9 more releases in this issue
· 2025-08-01 → 2025-08-28
Snyk announces product-update tag filters and an RSS feed link from September 11; the existing feed URL remains unchanged.
Adds an RSS feed link to notify users of new product update announcements as they are published.
Enables filtering product updates using tags like Open Source, CLI, or MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. in the new product updates page.
Snyk CLI v1.1298.3 makes the experimental snyk aibom command publicly accessible and adds Gradle 9 scanning support.
Makes experimental snyk aibom publicly accessible for identifying AI models and datasets and mapping supply-chain connections through MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface..
Snyk Container Registry Agent now supports disabling repository listing via an environment variable
Adds SNYK_DISABLE_LIST_REPOS environment variable to the Snyk Container Registry Agent to disable repository listing
Implements logic in the agent to return an empty list when SNYK_DISABLE_LIST_REPOS=true, preventing integration errors with registries like GitHub and GitLab that do not support or restrict access to the GET /v2/_catalog endpoint
Refreshed UI for the DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Analysis Run page
3 more releases in this issue
· 2025-08-01 → 2025-08-28
Static Analysis Engine v2025.08 adds .NET Semantic Kernel detection, Azure Functions isolated process support, and new language/platform coverage.
static-analysis-engine-v202508 adds .NET Semantic Kernel (SK) flaw detection for hardcoded credentials (CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances.-798) and configuration control issues (CWE-15).
static-analysis-engine-v202508 extends platform coverage to include Dart 3.8, Flutter 3.32, Go 1.25, Node.js 22.x, Scala 3.7, and Micronaut 4.x.
static-analysis-engine-v202508 introduces enhanced CWE-918 detection with reduced false positives for Java/Quarkus scenarios.
Mend SCA v25.7.2 enables organization-level Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license alignment updates
Dependencies SBOM report is now generatable at the organization level, in addition to the existing application/project level support.
Improved license alignment with the SPDX format by replacing legacy license identifiers: Eclipse 1.0 → BSD 3, Jaxen Werken → BSD 3, Cryptix General License → BSD 2, and Cup Parser Generator License → Standard ML of New Jersey.
The Dependencies SBOM report can now be generated at the organization level, expanding access beyond the previous application/project scope.
Updated internal license mapping: Eclipse 1.0 replaced by BSD 3, Jaxen Werken replaced by BSD 3, Cryptix General License replaced by BSD 2, and Cup Parser Generator License replaced by Standard ML of New Jersey for SPDX compliance.
Dependencies SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. report can now be generated at the organization level in Mend SCA.
└──▷ HOW TO FIND IT
Generate a consolidated SBOM for all applications within an organization via the web console.
📍In the Mend SCA console, navigate to Organization › Reports and select Dependencies SBOM.
Adds Dependencies SBOM report generation at the organization level
Improves license alignment with SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. format (e.g., Eclipse 1.0 → BSD 3)
Mend SAST is a static application security testing service that scans source code for vulnerabilities and helps teams prioritize remediation.
Mend SAST 25.8.1 adds Terraform and requirements.txt support for secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. with new local log file output
Secret scanning now supports Terraform files
Secret scanning now supports requirements.txt files
The local log file for secret scans now includes a list of all scanned files
3 details in Everything
2 more releases in this issue
· 2025-08-11 → 2025-08-25
Mend SAST 25.8.1 adds Terraform and requirements.txt to secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. with new log details
Secret scanning now supports Terraform files as well as requirements.txt files.
The local log file for secret scans now includes a list of all scanned files.
Terraform v1.13.0 adds terraform stacks CLI, richer terraform test variable authoring, and parallel teardown for tests.
└──▷ GET THIS VERSION
$ git clone --branch v1.13.0 https://github.com/hashicorp/terraform.git
# already have the repo? check out this version:$ git checkout v1.13.0
└──▷ TRY IT
Discover all available stack sub-commands after upgrading to v1.13.
$ terraform stacks -usage
Define an external variable inline in a test file so complex variable types are validated without a separate tfvars source.
hcl
# inside mymodule.tftest.hcl
variable "region" {
default = "us-east-1"
}
run "deploy" {
variables {
region = var.region
}
}
New terraform stacks command exposes stack operations through the CLI; run terraform stacks -usage to see available sub-commands.
Filesystem functions are now validated for consistent results during apply, catching invalid data earlier.
terraform test: Test authors can define external variable blocks directly inside test files, removing the need for external variable sources.
terraform test: File-level variable blocks can now reference run outputs and other variables, enabling richer test composition.
terraform test: Teardown operations can now run in parallel, reducing test suite cleanup time.
+2 moreshow less
Improved type-mismatch error messages make diagnosing configuration type errors faster.
The terraform rpcapi command is now generally available, exposing Terraform operations over a go-plugin-compatible RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. interface.
DAST_FF_DIAGNOSTIC_JOB_OUTPUT: "true" config key overrides concise DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. job output with detailed diagnostics
GitLab REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services.spp_repository_pipeline_access field added to PUT requests for enabling/disabling pipeline execution policies via API
SessionNotOnOrAfterSAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. attribute support allows GitLab to automatically expire sessions based on IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. settings
New UI setting in Admin area allows administrators to set path-based URLs as the default for new GitLab Pages sites instead of unique domain URLs
Instance-level compliance frameworks and security policies can now be created in a top-level group and enforced across all other groups (Beta)
Scan execution policy templates (Merge request, Scheduled, Release) added to accelerate creation of security scan policies
New audit event types security_policy_create, security_policy_delete, security_policy_update, etc. provide comprehensive auditing for security policies
Service accounts and access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. can now be designated as exceptions in approval policies to bypass merge request approval requirements
New Snowflake integration, Bedrock/LangGraph tracing support, dark mode UI, and member-restricted role.
Add directly connect Snowflake tables to projects integration
Add SDK support for tracing Bedrock models, OpenAI Agents, Pydantic AI systems, and LangGraph systems
Add new Member restricted role that can perform member actions without viewing data source data
Allow hosting Openlayer on subpaths in on-prem deployments
Allow users to override LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. costs with custom costs via the platform
+2 moreshow less
Include standard deviation score in LLM-as-a-judge and Ragas test results
Add new prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. test to detect adversarial attacks on LLM systems
Mend Platform v25.8.1 adds SAML SSOSAML SSOAn authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties.-only enforcement, Jira label mapping config, and CSV findings export.
Adds a configuration option in the SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. integration settings to enforce SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only login by disabling username/password authentication
Enhances the Jira integration by mapping Mend attributes to Jira fields for adding labels with Mend attributes or free text
Context Previews now available by default for non-VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. Secret Leaks incidents to accelerate investigation.
Adds automatic Context Preview visibility for Secret Leaks in non-VCS sources (SharePoint, OneDrive, Slack, Confluence) directly within GitGuardian incidents.
1 detail in Everything
1 more release in this issue
· 2025-08-01 → 2025-08-20
Infisical v0.146 adds SRP removal, new last logged in auth method field, sticky secret table headers, and MSSQL servername host support
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.146.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.146.0-postgres
Removes the deprecated SRP protocol by @DanielHougaard in https://github.com/Infisical/infisical/pull/4270
Adds last logged in field to track which authentication method was last used for an account
Makes the secret overview table header sticky with underlines for env links and a limited height for scrolling
Updates frontend styling and overflow behavior for the audit log filter
Infisical v0.145.0 adds audit log storage disable flag, GitHub Enterprise integration, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. auth for the Kubernetes operator
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.145.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.145.0-postgres
Adds auditLog.disableStorage config key to prevent audit logs from being persisted in the database
Adds GitHub Enterprise Server as a supported connection target for app integrations
Adds LDAP authentication support for the Infisical Kubernetes agent-injector operator
Infisical v0.144.0 adds GitLab secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it., Netlify app connections, Cloudflare DNS provider, HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. support, events system, and bulk admin endpoints
└──▷ GET THIS VERSION
$ git clone --branch infisical/v0.144.0-postgres https://github.com/Infisical/infisical.git
# already have the repo? check out this version:$ git checkout infisical/v0.144.0-postgres
feature(secret-scanning): enables native GitLab Secret Scanning integration for discovering exposed credentials in GitLab repositories.
feat(app-connections, PKI): adds Cloudflare as a supported DNS provider for application connections.
feat: introduces Netlify app connection and automatic secrets synchronization.
HSM support is added to the main Docker image, enabling Hardware Security ModuleHardware Security ModuleA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. backend storage.
The new events system implementation provides event-driven capabilities within the platform.
+1 moreshow less
New server admin bulk operations: a bulk delete users endpoint and corresponding UI table actions.
TruffleHog finds, verifies, and analyzes leaked credentials across Git, chat, wikis, cloud storage, and more
TruffleHog v3.90.5 adds UTF-16 BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. support, expanded Unicode escape detection, and custom Bitbucket OAuth proto definitions.
└──▷ GET THIS VERSION
$ git clone --branch v3.90.5 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.90.5
Supports UTF-16 BOM-encoded files, enabling secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. across a wider range of text encodings.
Adds additional Unicode escape sequence support, improving detection of obfuscated secrets in source files.
Updates proto definitions to support custom Bitbucket OAuth configurations.
3 details in Everything
2 more releases in this issue
· 2025-08-04 → 2025-08-14
TruffleHog v3.90.3 adds Webex Bot, Tableau PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it., and Rootly detectors plus GitLab Group scanning and filesystem scan resumption
└──▷ GET THIS VERSION
$ git clone --branch v3.90.3 https://github.com/trufflesecurity/trufflehog.git
# already have the repo? check out this version:$ git checkout v3.90.3
New Webex Bot secret detector.
New Tableau Personal Access Token detector.
New Rootly API token detector.
Supports scanning GitLab Groups (in addition to individual projects).
Supports sub-unit resumption in filesystem scans, enabling interrupted scans to resume mid-directory.
$ git clone --branch v2.4.0 https://github.com/openbao/openbao.git
# already have the repo? check out this version:$ git checkout v2.4.0
└──▷ TRY IT
Validate a configuration file before starting the service.
$ bao operator validate-config /etc/openbao/config.hcl
sys/auth/inline mount type enables passing authentication information inline with main operations.
Declarative Self-Initialization via a new request-driven initialization path on first server start.
list_scan_response_keys_filter_path parameter filters LIST and SCAN responses to readable or listable values.
Configuration-based audit devices allow creating and removing audit devices through server configuration updates applied on restart and SIGHUP.
Delay recovery key generation for auto-unseal mechanisms and make rotation authenticated with new endpoints.
+3 moreshow less
Static key unseal mechanism added for auto-unseal in environments with explicit trust chaining.
bao operator validate-config subcommand validates configuration file syntax.
sys/seal-status endpoint explicitly adds recovery seal type to the barrier seal type response.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!certutil.ParsePublicKeyPEM now returns crypto.PublicKey instead of any, requiring removal of existing type assertions.
!Removed packages sdk/helper/base62, sdk/helper/mlock, sdk/helper/parseutil, sdk/helper/password, sdk/helper/strutil, and sdk/helper/tlsutil; use github.com/openbao/go-secure-stdlib/xxx or github.com/hashicorp/go-secure-stdlib/xxx instead.
!Removed LegacyStringToSliceHookFunc from sdk/framework; use mapstructure.StringToWeakSliceHookFunc instead.
!Removed Initialize method from ConnectionProducer interface and SQLConnectionProducer struct in sdk/database/helper/connutil.
1 more release in this issue
· 2025-08-08 → 2025-08-28
OpenBao v2.3.2 introduces configurable audit mount and log prefixing controls via new API flags.
└──▷ GET THIS VERSION
$ git clone --branch v2.3.2 https://github.com/openbao/openbao.git
# already have the repo? check out this version:$ git checkout v2.3.2
└──▷ USE IT
Allow API-driven audit mount creation after disabling it by default in v2.3.2.
api
PUT /v1/sys/config/audit
{
"unsafe_allow_api_audit_creation": true
}
Disable audit log prefixing for new mounts to comply with hardened defaults.
api
PUT /v1/sys/config/audit
{
"allow_audit_log_prefixing": false
}
Adds unsafe_allow_api_audit_creation setting to control creation of audit mounts via the API
Adds allow_audit_log_prefixing setting to control availability of the prefix audit mount option
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The audit subsystem no longer allows creation of new devices via the API unless unsafe_allow_api_audit_creation is explicitly enabled.
!TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. codes must now be exactly N numeric digits with no leading or trailing whitespace; malformed codes are rejected by the API.
Adds filePathGlobs option to @secretlint/secretlint-rule-pattern for path-scoped detection
└──▷ GET THIS VERSION
$ git clone --branch v11.1.0 https://github.com/secretlint/secretlint.git
# already have the repo? check out this version:$ git checkout v11.1.0
└──▷ USE IT
Limit secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. to specific config files rather than the whole repo, reducing noise on non-secret code.
GitGuardian Self-Hosted 2025.8 adds AWS ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. detection, Log Collector Helm values, custom webhook selection, Bitbucket Cloud API auth, Valkey support, and W&B/Bitbucket/Mercad
Adds image.registry parameter in Helm values to configure the Log Collector image location (Loki, MinIO, Fluent Bit) for air gap deployments.
Adds AWS ECR Container Registry detection for hardcoded secrets.
Adds 3 new secrets detectors: Weights & Biases, Bitbucket App Password, and Mercado Pago.
Enables granular event selection for custom webhooks.
Adds support for Bitbucket Cloud API token authentication in VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. monitoring.
+1 moreshow less
Adds Valkey (Redis 7.2 fork) support for Redis-compatible deployments.
sslyze 6.2.0 adds custom TLS compliance profiles and SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address.-less certificate chain retrieval.
└──▷ GET THIS VERSION
$ git clone --branch 6.2.0 https://github.com/nabla-c0d3/sslyze.git
# already have the repo? check out this version:$ git checkout 6.2.0
└──▷ TRY IT
Audit a server against your own TLS policy (e.g. org-wide cipher/protocol baseline) instead of a Mozilla preset.
Retrieve the certificate chain presented by a server that doesn't support or require SNI — useful for IP-only TLS endpoints.
$ sslyze --certinfo <target>
Supports specifying a custom TLS configuration/profile to validate servers against, as an alternative to the built-in Mozilla old/intermediate/modern profiles.
Supports retrieving a server's certificate chain when no Server Name Indication (SNI) is supplied via --certinfo.
jwt-hack v2.2.0 adds JWE support, EdDSAEdDSAA fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. algorithms, and an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server mode
└──▷ GET THIS VERSION
$ git clone --branch v2.2.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:$ git checkout v2.2.0
MCP server mode for AI model integration
JWE (JSON Web Encryption) decryption capabilities
EdDSA (Edwards-curve Digital Signature Algorithm) signature verification
3 details in Everything
1 more release in this issue
· 2025-08-10 → 2025-08-29
New SCIM 2.0SCIM 2.0A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning, AI-LSSR token tracking, auto-scan stop on 429, and Trend Matrix
Adds user provisioning with SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. 2.0 for Teams
Implements Trend Matrix for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Targets
Added a filter on the Vulnerabilities page to show vulnerabilities found on APIs
Implemented AI-Aided Login to automatically regenerate invalid reused LSR files and save AI-generated LSR files
Added support for tracking session tokens in URL Parameters for LSR recorder
+2 moreshow less
DeepScan now scans all path fragments discovered in locations for potential vulnerabilities
Updated the design of the Agents Page and Added the Technologies tab to the Application dashboard
7 details in Everything
1 more release in this issue
· 2025-08-14 → 2025-08-28
Invicti 20250814 adds HTTP method restriction for DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces., bulk actions, NTA standalone mode, and automated vulnerability sync
└──▷ HOW TO FIND IT
Restrict a DAST scan to only test GET and POST methods on a target URL
📍Steps: In the Invicti UI, navigate to Scan Configuration › Target Settings and enable HTTP Methods, then select GET and POST.
View which SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. sources were last modified to audit recent changes in your scan configuration
📍Steps: In the Invicti UI, go to Projects › SAST Sources and check the Last updated column for each source.
Filter vulnerabilities in a specific environment to isolate testing issues
📍Steps: In the Invicti UI, go to Vulnerabilities page, select Environment from the filter dropdown, and choose your target.
DAST scan targets can now be restricted to specific HTTP methods during configuration
Added Export to file bulk action in Projects to export multiple items simultaneously
Added Sync vulnerabilities bulk action in Projects for batch synchronization
SAST sources in Projects now display a Last updated timestamp per source
Standard and compliance reports can now consolidate all SAST asset vulnerabilities for an application overview
+7 moreshow less
Application dashboard includes a new Most vulnerable technologies list
Vulnerabilities page supports filtering by application, asset, and environment
NTA Standalone mode is available as a new deployment option for Network Traffic Analysis
API catalog now displays details about an API operation
Past scans tab includes a new Scan comparison feature
Automation now pushes vulnerabilities to issue trackers upon discovery, creating or updating work items automatically
Vulnerabilities can be assigned to a specific user via the assignment interface
SSTImap v1.3 adds error-based and boolean blind detection techniques, Spring EL injection plugin, and new engine capabilities.
└──▷ GET THIS VERSION
$ git clone --branch v1.3 https://github.com/vladko312/SSTImap.git
# already have the repo? check out this version:$ git checkout v1.3
Adds error-based detection and exploitation technique for SSTI scanning.
Adds boolean error-based blind detection and exploitation technique.
Enables ordered technique testing — techniques are now tested in the user-specified order.
New plugin for Spring EL injection detection and exploitation.
Supports fromfile data type to supply request body parts from files.
+8 moreshow less
Freemarker engine now supports expression evaluation.
Dust.js now supports rendered code execution.
Adds Base64 exfiltration support (available for plugin use).
Context suffix can now include closure or reversed closure.
Plugins can now specify header and trailer length for more precise injection control.
SSTImap can now run with form detection disabled when optional dependencies are not installed.
Twig CVE payload replaced with |map()-based payload (CVE payload moved to Extras).
Generic template engines are now skipped by default in favor of generic plugins.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!Generic template engines are now skipped by default; setups relying on generic template engine detection without explicitly enabling them may no longer test those engines.
WCVS 2.0 rewrites HTTP client with fasthttp, adds NextJS DoS techniques, new cache indicators, and RFC-violating request support.
└──▷ GET THIS VERSION
$ git clone --branch 2.0.0 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner.git
# already have the repo? check out this version:$ git checkout 2.0.0
Replaces net/http with fasthttp, enabling RFC-violating requests that can surface web cache poisoning vulnerabilities previously unreachable.
Adds cache indicator support for eo-cache-status, Netlify, x-kinsta-cache, and x-ac headers, broadening cache-hit detection coverage.
Introduces a new parameter encoding technique for detecting cache poisoning via unkeyed parameters.
Adds status code analysis as an indicator for identifying impactful or unkeyed parameters.
Expands UTM parameter list with gad_campaignid for broader parameter fuzzing.
+10 moreshow less
Adds multiple new cache-based DoS testing techniques, including NextJS-specific methods.
Adds enhanced DoS headers with metacharacters and streamlines Host Header Override (HHO) DoS testing.
Supports setting multiple host headers for host header poisoning tests.
Socket adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for Cargo.toml-only crates missing lockfiles.
Adds support for generating Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOM) for Rust crates that contain only a Cargo.toml file without a Cargo.lock.
SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export endpoints now officially document support for NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code., Crates, and RubyGems ecosystems
Socket enables File Explorer visibility for Maven BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. projects
Syft v1.32.0 adds full Go build list cataloging, package.json author parsing, and basic Conda ecosystem support.
└──▷ GET THIS VERSION
$ git clone --branch v1.32.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.32.0
Catalogs the entire Go build list (not just go.mod-listed packages), surfacing transitive dependencies in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
Parses the authors keyword from package.json, enriching Node.js package metadata.
Adds basic Conda ecosystem support, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for Conda environments.
3 details in Everything
2 more releases in this issue
· 2025-08-08 → 2025-08-26
Syft v1.31.0 adds the ability to set a PackageSupplier field in the root of SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. documents.
└──▷ GET THIS VERSION
$ git clone --branch v1.31.0 https://github.com/anchore/syft.git
# already have the repo? check out this version:$ git checkout v1.31.0
Sonatype Nexus 3.83.0 adds container policy enforcement via Firewall, path-based Docker routing, configurable password hashing, and a new data consistency repair task.
Adds automated detection and quarantine of non-compliant Docker images through Repository Firewall with a new Containers dashboard for violations.
Adds support for Docker Registry path-based repository routing to simplify deployment without custom subdomains.
Adds a new Verify and Repair Data Consistency task to recover missing component metadata, with support for scoping by blob store/repository and a Dry Run option.
Removes legacy Repair - Reconcile component database from blob store task in favor of the new consistency task.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The legacy Repair - Reconcile component database from blob store task is removed; any scheduled tasks using this name are automatically deleted during upgrade.
sbomify v0.17 adds vulnerability scanning via Dependency Track and OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories., a new metrics dashboard, and product description fields.
└──▷ GET THIS VERSION
$ git clone --branch v0.17 https://github.com/sbomify/sbomify.git
# already have the repo? check out this version:$ git checkout v0.17
Adds Vulnerability Scanning Integration with Dependency Track and OSV support, including team-level configuration and automated weekly scans
Introduces a Vulnerability Dashboard for real-time metrics, historical tracking, and time series analysis
Adds optional product description fields to products for documentation and organization
LavaMoat webpack plugin gains improved handling for globals requiring more than a simple unwrap from core.
└──▷ GET THIS VERSION
$ git clone --branch webpack-v1.2.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout webpack-v1.2.0
Adds support for globals that require more complex handling beyond a simple unwrap from lavamoat-core, improving compatibility with a wider range of webpack bundles.
git-safe-dependencies v0.3.0 increases resilience against network conditions and git issues.
└──▷ GET THIS VERSION
$ git clone --branch git-safe-dependencies-v0.3.0 https://github.com/lavamoat/lavamoat.git
# already have the repo? check out this version:$ git checkout git-safe-dependencies-v0.3.0
Improves resilience against network conditions and git failures when verifying safe dependencies.
Backport migration to NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. 2.0 data feeds
└──▷ GET THIS VERSION
$ git clone --branch 4.13.4 https://github.com/DependencyTrack/dependency-track.git
# already have the repo? check out this version:$ git checkout 4.13.4
Migrates the dependency analysis engine to use NVD 2.0 data feeds instead of the previous CVE data source format.
BunkerWeb 1.6.4 adds human-readable size values for ModSecurityModSecurityAn open-source web application firewall engine, maintained by the OWASP community, that inspects HTTP traffic against rule sets to block malicious requests before they reach an application. request body limits and expands Linux platform support.
└──▷ GET THIS VERSION
$ git clone --branch v1.6.4 https://github.com/bunkerity/bunkerweb.git
# already have the repo? check out this version:$ git checkout v1.6.4
Enhances the ModSecurity plugin to accept human-readable size values (e.g., 10m, 512k) for request body limits on requests without files.
Adds Linux package support for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10.0.
Adds Linux package support for Debian 13 (Trixie).
3 details in Everything
1 more release in this issue2 more releases in this issue · 2025-08-05 → 2025-08-30
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. agent 4.69.0 adds Debian 13 support and improved detections.
Adds x86_64 and arm64 support for Debian 13 (trixie)
Improved CMDEXE detection
Improved SQLI detection
3 details in Everything
5 more releases in this issue
· 2025-08-05 → 2025-08-14
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. introduces Deception action and Invalid Login Response for ATO defense
Adds the Deception action to Edge WAF rules, enabling deception-type responses against login attempts
Supports the Invalid Login Response deception type to return a fake invalid credentials page when attackers are blocked
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds account-level rules API to manage WAF configs across multiple workspaces.
Fastly Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. adds programmatic API for account lists, analytics, reports, alerts, and custom signals.
account-level lists are now creatable via the New-Gen WAF API
Detailed timeseries metrics at account and workspace levels via API
Structured reports for signals and attacks accessible via API
Workspace alerts with full CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations available via API
Custom signals create and manage support at account and workspace levels via API
Fastly control panel now supports Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. features (Advanced Rate Limiting, Dashboards) and Bot Management product visibility for Professional/Premier customers.
Next-Gen WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. introduces custom signal creation and management capabilities.
Enables Custom Signals allowing customers to create and manage custom detection signals at the account and workspace level.
Wallarm adds Node-side request size limits and cloud-based adaptive detection for OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. API4:2023 Unrestricted Resource Consumption
Adds Maximum Total Request Size and Maximum Size per Parameter configuration options to the File Upload Restriction Policy for real-time node-side mitigation of oversized requests.
Adds stub Analyzers & Responders for testing and development purposes.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.25 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.25
2 more releases in this issue
· 2025-08-01 → 2025-08-25
AbuseIPDB 1.1 gains contextual improvements and an analyzer template; Mailer receives fixes and improvements.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.23 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.23
Adds an analyzer template to the AbuseIPDB integration (v1.1), improving contextual output presentation.
Cortex Analyzers 3.5.22 adds Slack channel/war-room creation and upgrades the GreyNoise analyzer to the v3 API.
└──▷ GET THIS VERSION
$ git clone --branch 3.5.22 https://github.com/thehive-project/cortex-analyzers.git
# already have the repo? check out this version:$ git checkout 3.5.22
Adds a Slack integration responder that can create a Slack channel or war room directly from Cortex.
Updates the GreyNoise analyzer to support the GreyNoise v3 API.
Hayabusa v3.4.0 adds field-name abbreviations in search, 32-bit/64-bit OS compatibility, and filebeat-safe JSON/L output.
└──▷ GET THIS VERSION
$ git clone --branch v3.4.0 https://github.com/Yamato-Security/hayabusa.git
# already have the repo? check out this version:$ git checkout v3.4.0
└──▷ TRY IT
Run a search and keep full, unabbreviated field names in the output for easier parsing or correlation.
$ hayabusa search -d <evtx-dir> -b
Adds automatic field-name abbreviations in the search command output, disableable with -b, --disable-abbreviations.
Enables the 32-bit Hayabusa binary to run on 64-bit operating systems.
Appends a trailing return character after the last line in JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output files so filebeat no longer misses the final event.
Bloomcheck gains storage support and new Yeti environment variables in the OSDFIR Helm chart.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.4.3 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.4.3
Adds storage support to the Bloomcheck component in the OSDFIR Helm chart.
Adds new Yeti environment variables to the Bloomcheck component configuration.
2 details in Everything
2 more releases in this issue
· 2025-08-08 → 2025-08-15
Adds OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. StorageClass support and bumps Timesketch version in the OSDFIR Helm chart.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.4.2 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.4.2
Adds GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. allowlist support for OpenRelik privileged workers and OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. Daemonset for sysctl init.
└──▷ GET THIS VERSION
$ git clone --branch osdfir-infrastructure-2.4.1 https://github.com/google/osdfir-infrastructure.git
# already have the repo? check out this version:$ git checkout osdfir-infrastructure-2.4.1
UAC v3.2.0 adds AWS Sig v4 S3 transfers, OS-specific config overrides, symlink collection by default, and new forensic artifacts.
└──▷ GET THIS VERSION
$ git clone --branch v3.2.0 https://github.com/tclahr/uac.git
# already have the repo? check out this version:$ git checkout v3.2.0
└──▷ TRY IT
Transfer collected evidence to S3 using the now-supported AWS Signature Version 4, with a presigned URL injected at runtime via an environment variable.
$ uac -p full /tmp/uac-output --aws-s3-presigned-url '%env:UAC_S3_URL%' --aws-s3-presigned-url-log-file '%env:UAC_S3_LOG_URL%'
Run a full collection over SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel., setting multiple SSH options (e.g., strict host key checking off and a custom identity file) using the renamed flag.
Supports AWS Signature Version 4 (AWS4-HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it.) for Amazon S3 output file transfers.
Adds runtime variable support for --aws-s3-presigned-url, --aws-s3-presigned-url-log-file, --azure-storage-sas-url, and --azure-storage-sas-url-log-file.
Enables OS-specific configuration overrides by placing files named after the OS in the config directory.
Bundles timeout.sh in the bin directory, providing a portable timeout command equivalent across all supported operating systems.
Now collects both regular files and symbolic links by default when file_type is not specified in an artifact.
+13 moreshow less
Adds new files/applications/google_drive.yaml artifact for Google Drive metadata databases and log files [macOS].
Adds new files/browsers/cache.yaml artifact for browser cache data [FreeBSD, Linux, macOS] (disabled by default in all profiles).
Adds new files/system/vyatta.yaml artifact for Vyatta and VyOS configuration files [Linux].
Adds live_response/modifiers/disable_ftrace.yaml modifier to disable ftrace and prevent syscall hooking by LKM rootkits [Linux].
Adds live_response/system/loginctl.yaml artifact for terse runtime status of each user via loginctl [Linux].
Adds live_response/system/utmpdump.yaml artifact for utmp and wtmp (including log-rotated) files via utmpdump [Linux].
Adds live_response/system/show.yaml artifact for consolidated tech-support reports from Vyatta and VyOS systems [Linux].
Velociraptor 0.75 adds yarax(), new artifacts, a decrypt command, S3 path-style support, ADFS/OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., and more.
└──▷ GET THIS VERSION
$ git clone --branch v0.75 https://github.com/Velocidex/velociraptor.git
# already have the repo? check out this version:$ git checkout v0.75
└──▷ TRY IT
Upload to an S3-compatibleS3-compatibleAn object-storage API that mirrors Amazon S3's HTTP interface, so any client or cyber tool written for AWS S3 works unchanged against any compliant storage backend. endpoint (e.g. MinIO) that requires path-style URLs.
$ SELECT upload_s3(file=OSPath, bucket='my-bucket', key=str(str=OSPath), path_style=true) FROM glob(globs='/**')
New yarax() VQL plugin for YARA-X scanning support.
New Windows.System.Threads artifact for enumerating system threads.
New SharpHound artifact for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. bloodhound-style collection.
Adds decrypt CLI command to decrypt an encrypted offline container.
New path_style option on upload_s3() for S3-compatible storage endpoints that require path-style URLs.
+6 moreshow less
Secrets can now be inherited from the root org, enabling cross-org secret sharing.
Updated watch_syslog() to accept a query parameter for filtered syslog monitoring.
New denied_file_accessor_prefix config option to restrict file accessor paths.
Adds ADFS support for OIDC authentication where claims are delivered in the access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions..
Global Messages surface now alerts users when critical server-side errors occur.
Client audit information is now logged on the client side.
CHIPSEC 1.13.15 adds TPM2 support, CML PCH strap lock testing, and more configurable UEFIUEFIA firmware specification maintained by the UEFI Forum that replaces legacy BIOS, defining how an OS and hardware initialize at boot. Cyber tools target or hook it to inspect pre-OS execution environments. variable modification checks.
└──▷ GET THIS VERSION
$ git clone --branch 1.13.15 https://github.com/chipsec/chipsec.git
# already have the repo? check out this version:$ git checkout 1.13.15
Adds TPM2 support for firmware security analysis.
Adds strap lock test support for Comet Lake (CML) PCH platforms.
Makes the UEFI variable modification test more configurable.
Extends reg.is_defined to check BAR when evaluating MMIO/IOBAR registers.
Frida 17.2.15 adds iOS 26 injection via dual-mapping, visionOS platform support, FreeBSD x86 32-bit, and uint type in NativeFunction.
Support iOS 26 through dual-mapping, enabling injection on palera1n
Add preliminary visionOS platform support
Bring x86 (32-bit) support to FreeBSD
Wire up NEON register access on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./arm64 for Linux and Darwin
Adds uint support to NativeFunction / NativeCallback in the Barebone backend.
Capstone 6.0.0-Alpha5 adds Apple AArch64AArch64The 64-bit execution state of the ARM architecture, defined by Arm Ltd., offering a wider register file and cleaner instruction set than 32-bit ARM; cyber tools target it to run natively on ARM-based servers, phones, and embedded devices. proprietary instruction support, SPARC updated to LLVM-18, and Python ABI3 wheels.
└──▷ GET THIS VERSION
$ git clone --branch 6.0.0-Alpha5 https://github.com/aquynh/capstone.git
# already have the repo? check out this version:$ git checkout 6.0.0-Alpha5
Adds support for Apple's proprietary AArch64 instructions (as documented by the Asahi Linux project).
Updates the SPARC module to LLVM-18 via Auto-Sync.
Marks instructions that decode successfully but are otherwise invalid with a new SoftFail flag.
Python bindings now ship as ABI3 wheels, enabling compatibility across Python versions without per-version builds.
Python bindings now include a Windows ARM64ARM64A 64-bit CPU architecture from ARM Holdings, used in mobile chips, Apple Silicon, and cloud servers; cyber tools target it to run natively on those platforms instead of relying on emulation. build.
+5 moreshow less
Adds jump group classification for the generic LoongArch jirl instruction.
Implements cs_regs_access for the Alpha architecture.
Uses cs_ac_type uniformly for operand access mode across all architectures, and cs_xtensa_op_type for Xtensa operand types.
Prints immediate-only memory operands for AArch64.
Enables generation of legacy MC tests for the fuzzer.
Radare2 6.0.2 adds hexfile:// URI handler, RXML DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. API, temporary block modifiers, and F-key shell shortcuts.
└──▷ GET THIS VERSION
$ git clone --branch 6.0.2 https://github.com/radareorg/radare2.git
# already have the repo? check out this version:$ git checkout 6.0.2
└──▷ TRY IT
Open a hex-encoded binary file directly for analysis without pre-converting it.
$ r2 hexfile:///path/to/file.hex
Use the @xf: temporary block modifier to run a command scoped to a specific block context during analysis.
$ pd 10 @xf:0x00401000
Adds hexfile:// URI handler for opening hex-encoded files directly.
Supports R_X86_64_RELATIVE and R_AARCH64_RELATIVEELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. relocation types for improved binary analysis.
Introduces @xc: and @xf: temporary block modifiers for scoped analysis commands.
Adds F-key (function key) shortcut support in the radare2 shell.
Finite State adds reachability analysis for CLT/API and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. policy thresholds to .fsconfig for vulnerability prioritization
Adds reachability analysis capability for both the fs CLI (CLT) and API endpoint to determine if vulnerable code paths are actually executable.
Adds configurable EPSS score threshold policy in .fsconfig.yaml via the epss.threshold key to filter vulnerabilities based on exploit likelihood.
Introduces CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. external reference type support for complete SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself. output format compatibility.
Binary Ninja 5.1.8104 adds Sidekick sidebar widget and improves WARP symbol handling
Adds a Sidekick sidebar widget that can be hidden by installing Sidekick or by right-clicking and choosing hide.
Improves WARP analysis by refining how symbols and comments are applied during scanning
Enhances stability by handling ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. files with no program headers
x64dbg gains intermodular call search in traces, script startup flags, RegistersView font scaling, and a table export feature.
└──▷ GET THIS VERSION
$ git clone --branch 2025.08.19 https://github.com/x64dbg/x64dbg.git
# already have the repo? check out this version:$ git checkout 2025.08.19
Adds ability to search for intermodular calls in trace recordings, with a dedicated module name column — useful for pinpointing where APIs are called during execution.
Introduces -cf flag to specify a script file executed immediately on x64dbg startup, and -c for a one-shot startup command.
Rewrites the scripting engine to execute commands on a deterministic event loop, enabling more reliable complex automation scripts.
Supports adjusting font size in RegistersView via Ctrl+scroll wheel.
Adds export of tables to tab-separated values.
+3 moreshow less
Adds label completion in the Goto dialog.
Enables building x64dbg under Linux via Wine with a custom CMake toolchain.
Moves documentation into the main repository, enabling LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-based querying via DeepWiki.
8 details in Everything
└──▷ BREAKING ON UPGRADE
!dbghelp, DeviceNameResolver, and TitanEngine are removed from the pluginsdk — plugins depending on these headers from the pluginsdk will break.
Prisma Cloud Compute 34.02 adds COLLECT_POD_RESOURCE_LABELS env var for pod labels, multi-container CAAS support, and extends API field limits.
Adds COLLECT_POD_RESOURCE_LABELS environment variable to Orchestrator defenders for collecting pod labels alongside deployment/namespace labels
Adds support for multi-container CaaS deployments on ACI container groups, Google Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., and Amazon EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. on AWS Fargate with account ID attribution
Extends OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. tag-based filtering to compartment level
3 details in Everything
└──▷ BREAKING ON UPGRADE
!Defenders prior to version 31.00 are no longer supported or functional; failure to upgrade Defenders below release v31 results in disconnection from the Console.
ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector scalability enhancement for Prisma Access 6.0
Increases ZTNA Connector onboarding limit to 20,000 applications per tenant across all Connector Groups.
PAN-OS 12.1 adds automatic intermediate certificate retrieval for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Forward Proxy connections.
Enables automatic fetching of missing intermediate certificates during SSL Forward Proxy TLS handshakes using the Authority Information Access (AIA) extension
Caches retrieved intermediate certificates for up to one week and allows recursive fetching of up to three levels to build a chain to a trusted root CA
Populates the Server Certificate Status field in decryption logs with visibility into certificate fetching results
PAN-OS 12.1 adds SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. and SHA-512 symmetric key authentication for NTP servers.
PAN-OS 12.1 adds automated HA firewall pair upgrade orchestration from Panorama
Adds High Availability (HA) Firewall Pair Upgrade Orchestration feature in Panorama to automate the sequential upgrade and reboot of active/passive firewall pairs, supporting up to 200 pairs per workflow job.
Requires Panorama 12.1.2+ and HA firewalls running PAN-OS 10.2.0+ for the new orchestration capability.
PAN-OS 12.1 adds range filters to custom Packet Captures for IPs, ports, and protocols
Adds IP address range filtering in custom PCAPsPCAPsA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. using a dash to specify source or destination subnets or specific IP ranges
Adds port range filtering in custom PCAPs using a dash to define source or destination port boundaries
Adds protocol range filtering in custom PCAPs using a dash to specify a contiguous block of protocols
PAN-OS 12.1 introduces simultaneous HA peer addition in SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. device configuration UI
Adds option to add an HA peer simultaneously when adding a device to SD-WAN Devices via the console UI
Enables automatic configuration propagation from one SD-WAN device to its HA peer
Prevents separate configuration of HA devices in SD-WAN, guiding users to add them as pairs
PAN-OS 12.1 adds post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA.) support for TLSv1.3 inline decryption in SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Forward Proxy and Inbound Inspection profiles.
Adds support for PQ KEMs in decryption profiles to secure TLSv1.3 sessions for SSL Forward Proxy, SSL Inbound Inspection, Decryption Mirror, and Network Packet Broker features
Enables NGFWs to act as cipher translation proxies, translating between PQC and classical encryption for applications not yet post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. ready
PAN-OS 12.1 adds client/server-prefixed decryption log fields and new error messages for SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Forward Proxy.
Decryption logs now distinguish between client-side and server-side sessions using client or server prefixed fields.
New log fields record decryption status, reasons for exclusion, and certificate revocation status (OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists./CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live.).
Simplified existing error messages and added new ones to help identify critical decryption issues.
PAN-OS 12.1 adds optimized Global Find with batched results and explicit UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide./Template filtering.
Adds Search UUIDs and Include Template References options to the Global Find UI for targeted searches
Policy Management columns (Rule Usage, App Usage) and Policy Optimizer are hidden by default after upgrade, fetching data only when explicitly made visible
2 details in Everything
└──▷ BREAKING ON UPGRADE
!After upgrading to PAN-OS 12.1, the Rule Usage, App Usage columns and Policy Optimizer in Policy Management are hidden by default
Adds ICMPv6 NDP Enhanced Application Logs for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. device visibility and Device-ID support
└──▷ USE IT
Disable ICMPv6 EAL logs to prevent log flooding in high-volume IPv6 environments.
shell
set deviceconfig setting logging enhanced-application-logging disable-global icmpv6-ndp
Enables set deviceconfig setting logging enhanced-application-logging disable-global icmpv6-ndp to disable ICMPv6 EAL logging in high-volume deployments
Enables delete deviceconfig setting logging enhanced-application-logging disable-global icmpv6-ndp to re-enable ICMPv6 EAL logging for IPv6 Device-ID classification
Prisma Access 6.0 Preferred Innovation adds ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector support for mainland China and South Africa regions.
ZTNA Connector now provides secure and compliant multi-national enterprise level communication within and across mainland China (requires Prisma Access China L2 add-on license).
South Africa is also added as a supported location for ZTNA Connector.
Prisma Access ZTNAZTNAZero Trust Network Access, a framework that grants users access to specific applications only after continuously verifying identity and device posture, replacing broad VPN-style network access with least-privilege connections. Connector now supports South Africa as a deployment region
Adds South Africa as a supported location for the ZTNA Connector
PAN-OS 12.1 adds Dedicated Tunnels for Panorama Connectivity via direct internet access interfaces.
Enables configuration of primary and secondary termination devices with preferred and secondary DIA interfaces for redundant connectivity paths when Panorama lacks a public IP address.
Prisma Cloud adds COLLECT_POD_RESOURCE_LABELS env var, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. compartment filters, ACI/Run/Fargate support, new RQL, and API field length updates.
Adds COLLECT_POD_RESOURCE_LABELS environment variable to Orchestrator defenders for collecting pod labels via the Kubernetes API.
Adds account ID attribution and defended/undefended status detection for ACI container groups, Google Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity., and Amazon EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. on AWS Fargate.
Extends OCI tag-based filtering to support compartment-level include/exclude filters for hosts.
Adds new API ingestion connectors for alibaba-cloud-network-attach-storage and aws-connect-outbound-campaign.
Updates RQL policies for Azure WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server., Cosmos DB, Storage Account public access, AWS ALBALBAWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. TLS policy, and GCP BigQueryBigQueryA serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. CMEK encryption.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Prisma Cloud will no longer ingest metadata for azure-mysql-server and azure-postgresql-server APIs, removing these assets from the Investigate page and resolving existing alerts as Resource_Deleted.
PAN-OS 12.1 adds Bypass Server Certificate Verification to SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Forward Proxy decryption profiles.
PAN-OS 11.2 adds Dedicated Tunnels to Panorama for non-public IP deployments.
Allows configuration of primary and secondary termination devices with preferred and secondary DIA interfaces for redundant connectivity paths to Panorama.
Introduces a separate VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. address pool dedicated to tunnel IP address assignments that must not overlap with existing SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. overlay configurations.
OpenSnitch v1.7.2 adds localhost default rules, bare IP matching, and comma-separated port/IP support in the Rules Editor.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.2 https://github.com/evilsocket/opensnitch.git
# already have the repo? check out this version:$ git checkout v1.7.2
Distribute 000-allow-localhost.json and 000-allow-localhost6.json rules to allow default localhost connections
Add system-fw.json system firewall rule (netfilter) to bypass interception, disabled by default
Add ability for the daemon to match bare IP requests with empty host names
Allow commas in the Rules Editor UI to specify ports, IPs, and other fields
Add new dark-white theme option in GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. preferences
Aviatrix CoPilot 4.24.0 adds upgrade group ordering, Kubernetes SmartGroup labels, and detailed VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. routes.
Adds an Order column to the Administration > Upgrade > Upgrade Groups page to control multi-group upgrade sequences
Enables creating Kubernetes SmartGroups using Kubernetes Node attributes for label-based selection
Adds a Show Detailed Routes action in Diagnostics > Cloud Routes > VPC/VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. Routes to view non-summarized route lists
Allows skipping gateway upgrades that are already at the target version via the Prepare for Upgrade card in Administration > Upgrade > Upgrade Plan
Adds Account (default) and Billing ID columns to Cloud Resources > Cloud Assets pages for VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules./VNets & Subnets and Virtual Machines
Adds AP6 usage insight for monitoring and categorizing client web traffic and application use.
└──▷ HOW TO FIND IT
Navigate the local UI to turn on usage insight for an AP6 access point.
📍Wireless › Diagnostics › AP6 usage insight
Enables AP6 usage insight in the local UI at Wireless > Diagnostics to monitor and categorize web traffic and application use for clients connected to AP6 access points.
Abnormal AI adds RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for Graymail Dashboard, wildcard/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. bypass rules with CSV bulk upload/export, and multi-tenant scoping
Role-Based Access Controls (RBAC) to control who can view the Graymail Dashboard and manage Email Productivity settings
Wildcard & CIDR Support in Bypass Filter Management for domains and IP ranges
Bulk Upload via CSV to import multiple bypass rules at once
CSV Export of bypass rules including metadata such as type, value, tenant, creation date, and comments
Multi-Tenant & Segmented SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Support to scope rules to specific tenants
5 details in Everything
6 more releases in this issue
· 2025-08-04 → 2025-08-25
Adds manual and auto VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. management via Settings > VIP Management portal
└──▷ HOW TO FIND IT
Configure which job titles automatically tag users as VIPs in the portal.
📍In the console, go to Settings › VIP Management and click Manage VIPs
Malcolm v25.08.1 adds Redis protocol analysis and dashboard, plus major component version updates.
└──▷ GET THIS VERSION
$ git clone --branch v25.08.1 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.08.1
Adds Redis transport protocol parsing and a dedicated Redis dashboard for network traffic analysis.
Updates OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions. and OpenSearch Dashboards to v3.2.0.
Updates Zeek to v8.0.1.
Updates Beats and Logstash to v8.19.2.
Updates Debian base to v13 (Trixie) for ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. installer images and Debian-based containers.
+4 moreshow less
Updates NetBoxNetBoxAn open-source network infrastructure management platform maintained by the NetBox Labs community, used to model IP addresses, devices, and topology so cyber tools can query a live source of truth about the environment. to v4.3.6.
Updates Fluent Bit to v4.0.8.
Updates Supervisor to v4.3.0.
Standardizes debug/informational logging verbosity in Python scripts via -v, -vv, -vvv flags.
9 details in Everything
1 more release in this issue
· 2025-08-07 → 2025-08-28
Malcolm v25.08.0 adds FILEBEAT_CLEANUP_VERBOSITY env var for tunable log verbosity on the processed-folder pruning script.
└──▷ GET THIS VERSION
$ git clone --branch v25.08.0 https://github.com/cisagov/Malcolm.git
# already have the repo? check out this version:$ git checkout v25.08.0
└──▷ USE IT
Enable DEBUG-level output from the log-pruning script to troubleshoot how many Zeek/Suricata files are being considered and at what rate each minute.
env
FILEBEAT_CLEANUP_VERBOSITY=-vvvv
Adds FILEBEAT_CLEANUP_VERBOSITY to filebeat.env to control the verbosity of the clean-processed-folder.py script; setting -vvvv enables DEBUG-level output with per-run file counts and processing rates for Zeek and Suricata log pruning.
Performance improvements to the clean-processed-folder.py script in the filebeat container for pruning already-processed Zeek and Suricata log files.
bettercap UI v1.4.0 adds downloadable WiFi handshakes, CAN bus visualization, and dismissable SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. warnings
└──▷ GET THIS VERSION
$ git clone --branch v1.4.0 https://github.com/bettercap/ui.git
# already have the repo? check out this version:$ git checkout v1.4.0
Enables direct download of captured WiFi handshakes by clicking the red key icon in the UI
Enhances CAN bus module integration with improved icon and event visualization
Adds dismissable SSL warning dialog for improved usability
Publishes a compiled release artifact to GitHub for easier deployment
Hubble v1.18.0 adds policy-name visibility in flow output and IPIP tunnel datapath support.
└──▷ GET THIS VERSION
$ git clone --branch v1.18.0 https://github.com/cilium/hubble.git
# already have the repo? check out this version:$ git checkout v1.18.0
└──▷ TRY IT
Identify which CiliumNetworkPolicy allowed or dropped a specific flow — useful when auditing policy decisions across namespaces.
$ hubble observe --print-policy-names
Adds --print-policy-names flag to hubble observe to display the names of CiliumNetworkPolicies (CNPs/CCNPs) that allowed or denied traffic.
Sends server version via gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. response metadata, enabling clients to inspect the Hubble server version.
Attaches datapath to IPIP tunnel devices, extending network visibility to IPIP tunnels.
Security Onion 2.4.170 adds JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. fingerprinting, hardware virtualization support, Playbooks with airgap support, and an Elasticsearch troubleshooting script.
└──▷ GET THIS VERSION
$ git clone --branch 2.4.170-20250812 https://github.com/Security-Onion-Solutions/securityonion.git
# already have the repo? check out this version:$ git checkout 2.4.170-20250812
└──▷ TRY IT
Monitor Elasticsearch index growth to identify storage pressure before running out of disk space.
$ so-elasticsearch-index-growth
Adds JA4 TLS fingerprinting support for enriched network traffic analysis.
Adds hardware virtualization support, including libvirt states and salt.cloud state execution on standalone and managersearch nodes.
Adds Playbooks feature with support for airgap environments and configurable ruleset repos.
Adds so-elasticsearch-index-growth command for monitoring Elasticsearch index growth.
Adds dns.resolved_ip field support for DNS log enrichment.
+7 moreshow less
Adds network.community_id from Zeek when available, improving cross-log correlation.
Upgrades Elasticsearch to 8.18.4.
Upgrades Zeek EtherCAT plugin.
Enables HTTP Strict Transport Security (HSTSHSTSAn HTTP response header, standardized in RFC 6797, that instructs browsers to contact a site over HTTPS only for a declared period, preventing protocol-downgrade and cookie-hijacking attacks./STSSTSAWS Security Token Service, an Amazon Web Services API that issues short-lived credentials for IAM roles, letting cyber tools authenticate to AWS without storing long-term secrets.) for browser redirects.
Adds user.name field to Kratos identity queries.
Adds RulesetName to rule repository configuration.
Zeek 8.0 adds pluggable connection tracking, Redis analyzer, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. .eml extraction, ZeroMQZeroMQA messaging library that provides socket-like abstractions for async message passing over TCP, IPC, or in-process transports, letting tools wire together distributed components without a dedicated message broker. cluster support, and more.
└──▷ GET THIS VERSION
$ git clone --branch v8.0.0 https://github.com/zeek/zeek.git
# already have the repo? check out this version:$ git checkout v8.0.0
└──▷ TRY IT
Enable VLAN-aware connection tracking so that connections on different VLANs are tracked separately, with VLAN tags logged as id.ctx.vlan and id.ctx.inner_vlan.
$ @load frameworks/conn_key/vlan_fivetuple
Extract raw emails as .eml files from SMTP traffic for offline analysis or malware triage.
Switch a ZeekControl-managed cluster to the ZeroMQ backend with WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. support so zeekctl print and netstats work without the Broker protocol.
ini
ClusterBackend = ZeroMQ
UseWebSocket = 1
Adds pluggable, customizable connection tracking with a built-in VLAN-aware five-tuple implementation (frameworks/conn_key/vlan_fivetuple).
Adds ZeroMQ cluster backend support in ZeekControl via ClusterBackend = ZeroMQ and UseWebSocket = 1 in zeekctl.cfg.
Adds configurable cluster telemetry with per-event, per-topic, and histogram metrics via Cluster::core_metrics and Cluster::websocket_metrics.
Adds X-Application-Name HTTP header support on the WebSocket API (v1/messages/json) for per-application cluster event metrics.
Adds Redis protocol analyzer (from spicy-redis) enabled by default, logging commands and replies to redis.log.
+4 moreshow less
Adds SMTP RFC 822 message forwarding to the file analysis framework, enabling .eml extraction from SMTP traffic.
Adds a generic EventMetadata module with current() and current_all() functions for accessing per-event metadata.
Adds new HookPublishEvent() plugin hook for intercepting, monitoring, modifying, or rerouting published cluster events.
Adds explicit TLS support (AUTH TLS) to the FTP analyzer.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Zeek now requires the ZeroMQ library (libzmq5, libzmq3-dev, cppzmq-dev) to build and run.
!Building Zeek now requires a C++20-capable compiler (GCC 10+, Clang 8+, or Visual Studio 2022+).
!The zeek::Span class is deprecated; telemetry subsystem APIs now use std::span — plugins using zeek::Span for counter/gauge instantiation need updates.
!Broad #include cleanup across the codebase may break third-party plugin builds.
!lookup_connection() and connection_exists() now strictly require a conn_id instance; duck-typed conn_id-like records are no longer accepted.
!Network timestamps are no longer added to events by default; re-enable with redef EventMetadata::add_network_timestamp = T;.
!The ASCII writer's JSON::TS_MILLIS format now produces signed integers for pre-epoch timestamps; revert with redef LogAscii::json_timestamps = JSON::TS_MILLIS_UNSIGNED;.
!The endpoint label in Prometheus and telemetry.log metrics is renamed to node; revert with redef Telemetry::metrics_endpoint_label = "endpoint";.
!current_event_time(), Event::Time(), and EventMgr::CurrentEventTime() now return -1.0 (instead of 0.0 or a stale timestamp) when no timestamp metadata is available.
!Missing network timestamp metadata on remote events is no longer silently set to local network time; re-enable with redef EventMetadata::add_missing_remote_network_timestamp = T;.
!The IsPacketSource() method on IOSource has been removed.
!The --with-binpac and --with-bifclconfigure arguments are deprecated and may break cross-compilation workflows.
!The ssl_session_ticket_handshake event payload no longer includes the two extra leading bytes that preceded the session ticket data; scripts that worked around this must be updated.
Snort 3.9.3.0 adds batched logger with CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. affinity, new HTTP inspect peg count, IEC 104 abort fallback, and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. splitter restart support.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.3.0 https://github.com/snort3/snort3.git
# already have the repo? check out this version:$ git checkout 3.9.3.0
Adds a batched logger to improve packet_tracer output performance, with CPU affinity control for the log writer thread.
Adds a peg count for HTTP inspect tracking when a published body reaches the requested maximum size.
Adds fallback functionality for IEC 104 abort scenarios.
Adds a splitter restart function to stream_tcp, restarting when a hole is skipped by AtomSplitter.
Adds random base file ID generation for IMAP, POP, and SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. service inspectors.
+4 moreshow less
Enables exporting compile commands from the build system.
Notifies DAQ via ioctl message when a packet is injected.
Combines host pattern matchers in AppID for unified matching.
Extracts children-related and current-node evaluation logic into separate functions in the detection engine.
cloud-nuke v0.42.0 adds GCP support and tag filtering for IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. providers, IAM policies, and Route53 hosted zones.
└──▷ GET THIS VERSION
$ git clone --branch v0.42.0 https://github.com/gruntwork-io/cloud-nuke.git
# already have the repo? check out this version:$ git checkout v0.42.0
Extends cloud-nuke to support GCP nuking operations alongside AWS.
Adds tag filtering support for OIDC providers, enabling include/exclude by tag.
Adds tag filtering support for IAM roles, enabling include/exclude by tag.
Adds tag filtering support for Route53 hosted zones, enabling include/exclude by tag.
Adds tag filtering support for IAM policies, enabling include/exclude by tag.
+1 moreshow less
Automatically excludes AWS-managed service-linked IAM roles from nuke operations.
Prowler 5.11.0 adds AWS Security Hub integration, GPT-5 support in Lighthouse AI, 4 new checks, and expanded privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. coverage.
└──▷ GET THIS VERSION
$ git clone --branch 5.11.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.11.0
└──▷ TRY IT
Skip GCP API availability pre-checks to speed up scans in environments where APIs are known to be enabled.
$ prowler gcp --skip-api-check
Run only the new EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. deletion protection check to quickly audit clusters for missing safeguards.
Adds AWS Security Hub integration to automatically forward Prowler findings to Security Hub, with support for session, profile, role, and static credential authentication.
Adds Lighthouse AI support for OpenAI GPT-5, enabling enhanced AI-driven analysis in automated workflows.
Adds new eks_cluster_deletion_protection_enabled check to detect EKS clusters without deletion protection.
Adds new apim_threat_detection_llm_jacking check for Azure API Management, monitoring 25+ LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. API endpoints across major AI providers.
Adds new vm_sufficient_daily_backup_retention_period check to ensure Azure VMs meet a configured minimum daily backup retention period.
+10 moreshow less
Adds new vm_jit_access_enabled check to ensure Azure VMs are configured with Just-in-Time access, reducing management port attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources..
Expands AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. privilege escalation coverage with Bedrock AgentCore combinations, ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. StartTask/RunTask patterns, and updated standalone iam:PassRole detection.
Adds Resource Explorer v2 API actions to the cloudtrail_threat_detection_enumeration check for broader enumeration detection.
Adds certificate authentication support for the M365 provider.
Adds new --skip-api-check command-line flag for GCP provider scans.
Adds a resource agent to Lighthouse AI for querying resource information.
Adds a Cloud Provider type filter to the providers page in the UI.
Adds a Mutelist shortcut under the UI Configuration section menu.
Adds direct links to the configured S3 bucket and folder within each integration in the UI.
Generates ASFF output for AWS providers when Security Hub integration is enabled.
15 details in Everything
1 more release in this issue
· 2025-08-07 → 2025-08-28
Prowler 5.10.0 adds GitHub provider, S3 report integration, 5 new security checks, and CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Azure Benchmark v4.0 support.
└──▷ GET THIS VERSION
$ git clone --branch 5.10.0 https://github.com/toniblyx/prowler.git
# already have the repo? check out this version:$ git checkout 5.10.0
└──▷ TRY IT
Scan only specific repositories in a GitHub org to quickly audit a subset of your codebase.
$ prowler github --repository acme/app acme/lib
Limit a GitHub scan to one or more organizations to reduce noise in large multi-org environments.
Adds GitHub as a supported cloud provider, enabling security posture assessment of GitHub organizations and repositories via Personal Access Tokens, OAuth App Tokens, or GitHub Apps.
Adds --repository and --organization CLI flags for scoped GitHub scanning, letting you target specific repos or orgs instead of scanning everything.
Adds Amazon S3 integration to automatically deliver scan reports to one or more S3 buckets across any provider combination.
Adds new AWS check bedrock_api_key_no_administrative_privileges to detect Bedrock API keys with excessive permissions.
Adds new AWS check bedrock_api_key_no_long_term_credentials to detect long-lived credentials in Bedrock API keys.
+8 moreshow less
Adds new AWS check s3_bucket_shadow_resource_vulnerability to flag shadow resources in S3 buckets.
Adds new Azure check vm_desired_sku_size to validate VMs are configured with the desired SKU size.
Adds new Azure check vm_scaleset_not_empty to ensure VM Scale Sets are not empty.
Adds support for CIS Microsoft Azure Foundations Benchmark v4.0 compliance checks.
Adds GCP provider retry configuration support.
Adds Lighthouse banner to the Overview dashboard for enhanced visibility.
Adds XML validation for SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. metadata in the UI.
Adds default Mutelist placeholder in the UI.
13 details in Everything
└──▷ BREAKING ON UPGRADE
!Memberships is renamed to Organization in the sidebar.
!Browse all resources is removed from the sidebar; the sidebar now shows a single Resources entry.
!Misconfigurations is removed from the Top Failed Findings section in the sidebar.
$ git clone --branch v0.43.0 https://github.com/inspektor-gadget/inspektor-gadget.git
# already have the repo? check out this version:$ git checkout v0.43.0
└──▷ TRY IT
Uninstall Inspektor Gadget without deleting the namespace, safe for shared namespace environments.
$ kubectl gadget undeploy
Adds Helm imagePullSecrets support for the DaemonSetDaemonSetA Kubernetes object that ensures one instance of a specified pod runs on every node in a cluster, making it the standard way cyber tools deploy agents that must observe all cluster traffic or host activity. image, enabling deployments from private registries.
Introduces filter expressions based on the Expr language in the filter operator, enabling richer, programmable event filtering.
Traceloop displays wider parameters column, improving readability of syscall arguments.
kubectl-gadget undeploy no longer removes the namespace, preventing accidental deletion of shared namespaces on uninstall.
Makes the default OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registry URL for image-based gadgets configurable at build time.
+1 moreshow less
Updates vmlinux.h to Linux 6.15.5, extending eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. CO-RE support for the latest kernel.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!kubectl-gadget undeploy removes known resources from versions prior to v0.43.0, which may alter cleanup behavior when upgrading from older deployments.
Grype v0.99.0 adds Raspbian vulnerability matching, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. support, and fix availability data in DB schema.
└──▷ GET THIS VERSION
$ git clone --branch v0.99.0 https://github.com/anchore/grype.git
# already have the repo? check out this version:$ git checkout v0.99.0
Adds fix availability information to the DB schema, surfacing whether a fix exists for matched vulnerabilities.
Supports vulnerability matching for Raspbian packages.
Adds VEX CSAF support for applying CSAF-format VEX documents to filter or contextualize scan results.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!CSAF support introduces a breaking change — existing setups using VEX or related configuration may require updates when upgrading.
2 more releases in this issue
· 2025-08-08 → 2025-08-27
Kata Containers 3.20 adds seccomp support for Cloud Hypervisor and Firecracker runtimes, plus guest NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. components.
└──▷ GET THIS VERSION
$ git clone --branch 3.20.0 https://github.com/kata-containers/kata-containers.git
# already have the repo? check out this version:$ git checkout 3.20.0
└──▷ USE IT
Boot a pod VM directly using agent-ctl for debugging or validation without needing the full CRI stack.
shell
agent-ctl --vm
agent-ctl gains the --vm flag to boot a pod VM directly for testing purposes
runtime-rs adds seccomp syscall filtering for the Cloud Hypervisor runtime
runtime-rs adds seccomp syscall filtering for the Firecracker runtime
Guest-side NVIDIA GPU components are included for AMD64 workloads
kata-types removes the default setting of guest_hook_path from its configuration
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The annotation for passing through initdata confidential containers feature changed from io.katacontainers.config.runtime.cc_init_data to io.katacontainers.config.hypervisor.cc_init_data
The cri-tools project provides command-line and validation tools for the Kubelet Container Runtime Interface (CRI).
cri-tools v1.34.0 adds a metricdescs subcommand, WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. streaming test flags, and automatic pod UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. generation.
└──▷ GET THIS VERSION
$ git clone --branch v1.34.0 https://github.com/kubernetes-sigs/cri-tools.git
# already have the repo? check out this version:$ git checkout v1.34.0
└──▷ TRY IT
List all metric descriptors exposed by the container runtime to discover available metrics.
$ crictl metricdescs
Run CRI streaming conformance tests using WebSocket transport instead of the default HTTP streaming, useful for validating WebSocket support in a runtime.
security-profiles-operator v0.10.0 introduces the spoc CLI, BPFBPFA Linux kernel virtual machine that lets programs attach small, sandboxed bytecode filters to kernel hooks — syscalls, network events, tracepoints — so cyber tools can observe or redirect kernel behaviour without writing a kernel module. log enrichment, audit JSON logging with filtering, TLS 1.3 webhooks, and node debugging support
└──▷ GET THIS VERSION
$ git clone --branch v0.10.0 https://github.com/kubernetes-sigs/security-profiles-operator.git
# already have the repo? check out this version:$ git checkout v0.10.0
Releases spoc, the official Security Profiles Operator Command Line Interface binary for amd64 and arm64
Adds BPF-based log enricher capability to the operator
Adds the --audit-log-interval-seconds option to configure the audit log interval for the JSON Log Enricher
Adds an In-Pod Activity Log recorder outputting in audit JSON lines format
Adds Request UID correlation to the JSON log enricher to link container events with API Server Audit logs
+5 moreshow less
Adds file system support for JSON Log Enricher Audit logging
Adds eBPFeBPFA Linux technology for running verified programs inside the kernel without changing its source. Tools use it to observe processes, enforce rules and process network traffic. support to the JSON audit log enricher
Adds support for kubectl node debugging with the JSON Log enricher
Introduces configurable log filtering capabilities for enrichers via SPOD, enabling filtering of audit JSON and log-enricher output based on custom rules
Supports TLS 1.3 in SPO webhooks
10 details in Everything
└──▷ BREAKING ON UPGRADE
!Removes support for in-memory btf, requiring the kernel to expose /sys/kernel/btf/vmlinux
kube-bench v0.12.0 adds CIS BenchmarkCIS BenchmarkConsensus-based configuration hardening guidelines published by the Center for Internet Security, covering OSes, cloud platforms, and software; cyber tools use them as a ready-made ruleset to audit or enforce secure system baselines. support for EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. v1.7.
└──▷ GET THIS VERSION
$ git clone --branch v0.12.0 https://github.com/aquasecurity/kube-bench.git
# already have the repo? check out this version:$ git checkout v0.12.0
Adds CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Benchmark checks for Amazon EKS v1.7 (eks-v1.7).
New Beta capability allows Databricks agents to integrate with external Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) servers for broader tool access.
35 more releases in this issue
· 2025-08-01 → 2025-08-28
Databricks adds a cell execution minimap to track notebook run states in the right margin
Adds a cell execution minimap in the right margin of the notebook UI to display execution states (skipped, queued, running, success, error) and allow direct navigation by clicking.
Enables hovering over the minimap to view details for each cell's execution state.
OAuth token federation now GA allows API access via IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. tokens with UI and API config
OAuth token federation is now generally available for secure access to Databricks APIs using identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. (IdP) tokens.
Configuration of federation policies is supported directly in the Databricks UI, the Databricks CLI, and the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
Adds CLUSTER BY AUTO to Spark Declarative Pipelines for automatic liquid clustering.
Exposes new or updated SQL definitions in create_streaming_table, table, CREATE MATERIALIZED VIEW (pipelines), and CREATE STREAMING TABLE (pipelines) that support the new clustering mode.
Salesforce Data Cloud File Sharing connector reaches GA for Lakehouse FederationLakehouse FederationA data architecture pattern that lets a single query engine read from multiple external data sources—databases, data lakes, warehouses—without moving or copying the data, reducing pipeline complexity for tools that need broad data access..
Databricks adds support for OpenAI GPT OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. 120B and 20B models on provisioned throughput Foundation Model APIsFoundation Model APIsHosted interfaces to large pretrained AI models—such as those from OpenAI, Anthropic, or Google—that let cyber tools query reasoning or language capabilities without training or hosting a model themselves..
OpenAI GPT OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. models (120B, 20B) now support function and tool callingtool callingA model's ability to answer with a structured request to run a named function or API, which the application executes and returns. It is how agents take actions.
Databricks adds public preview of self-service access request destinations in Unity Catalog
Enables configurable access request destinations (emails, Slack, or Microsoft Teams channels) on Unity Catalog securable objects to automate notification routing for discoverability-driven requests.
Adds support for default email destinations so requests automatically route to the catalog or object owner’s email when no specific destination is configured.
Databricks adds batch inference and structured outputsstructured outputsForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. for OpenAI GPT OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. 120B and 20B models via AI Functions
Adds support for ai_query() batch inference with OpenAI GPT OSS 120B and GPT OSS 20B models
Enables structured outputs specification for inference workloads using OpenAI GPT OSS 120B and GPT OSS 20B
Mosaic AI Model Serving adds support for OpenAI GPT OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees. 120B and 20B models.
Adds support for .databricks.us/.mil domains, OAuth token exchangeOAuth token exchangeAn OAuth 2.0 extension (RFC 8693) that lets a service swap one token for another with different scopes, audience, or type, so cyber tools can delegate access across service boundaries without re-authenticating the user., VOID type, and Windows Server 2025.
Added support for Databricks domains cloud.databricks.us and cloud.databricks.mil
Enabled OAuth Token exchangeToken exchangeAn OAuth 2.0 protocol extension (RFC 8693) that lets a service trade one token for another with different scopes, audience, or type, enabling delegation and impersonation across service boundaries without re-authenticating the user. for IDPs different from the host
Added CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. (Certificate Revocation Lists) cache support on Windows when UseSystemTruststore is enabled
Added VOID type column support, so that VOID columns are now correctly listed in SQLGetColumns
Added support for Windows Server 2025
5 details in Everything
└──▷ BREAKING ON UPGRADE
!The connector no longer supports Databricks Runtime version 10.4 LTS.
Serverless compute can now connect to VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. resources via AWS PrivateLinkAWS PrivateLinkAn AWS networking feature that exposes a service over a private VPC endpoint rather than the public internet, letting tools move data between accounts or to AWS services without traffic ever leaving Amazon's backbone. through an NLB.
Exabeam August 2025 adds dozens of Cloud Collectors, Automation Agents, and Search UI enhancements
Adds AWS CloudWatch Alarms Cloud Collector for ingesting AWS CloudWatch alarms related events
Adds AWS GuardDuty Cloud Collector for ingesting GuardDuty Findings from AWS S3 bucket
Adds AWS Security Lake Cloud Collector for ingesting security events from AWS S3 Security Lake bucket
Adds DataBahn Cloud Collector for ingesting events from DataBahn sources
Adds Dropbox Cloud Collector for ingesting team activity logs from Dropbox
+12 moreshow less
Adds Qualys Cloud Collector for ingesting Activity Logs and Vulnerabilities including VM host detection events from Qualys sources
Adds Slack Cloud Collector for ingesting events from the Audit Logs API endpoints
Adds Tenable Cloud Collector for ingesting vulnerability events from Tenable APIs
Adds Zoom Cloud Collector for ingesting events from the sign-in/sign-out activity and operational logs endpoints
Adds GitHub Cloud Collector in Early Access to ingest GitHub enterprise audit logs via the GitHub Enterprise Audit API endpoint
Adds GCP Cloud Logging Cloud Collector in Early Access to ingest logs from Google Cloud services
Adds GCP Security Command Center Cloud Collector in Early Access to ingest logs from GCP Security Command Center
Adds Progress ShareFile Cloud Collector in Early Access to ingest logs from the ShareFile endpoints: AccessChange, SharesSend, Activity, and SharesRequest
Adds Automation Agents to securely connect Automation Management to segmented networks using Docker-assigned JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. for remote playbook execution
Adds Pre-Defined Case Closed Reasons available when changing case stage to Closed in rule-based playbooks or the Threat Center Overview tab
Adds Vulnerability Scanners context table as a pre-built correlation rules context table in Context Management
Adds Support for Sort Order in Saved and Exported Searches persisted in the Sorting column for recent and saved searches lists
New MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. coverage dashboard in preview to measure security posture and identify gaps
└──▷ HOW TO FIND IT
Use this dashboard to quickly assess current threat coverage and identify gaps in your security posture.
📍In the Google SecOps console, navigate to the MITRE ATT&CK coverage dashboard.
Adds the Change MITRE ATT&CK coverage dashboard for assessing threat coverage against the MITREMITREA US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language.ATT&CKATT&CKA publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. framework
1 detail in Everything
6 more releases in this issue
· 2025-08-04 → 2025-08-29
Google SecOps adds log parsers for Anomali ThreatStream, Cisco ACE/Firepower/Panorama, Duo, ExtraHop, MuleSoft, Palo Alto SD-WANSD-WANSoftware-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience., Recorded Future, Veeam, Veridium, VMware Tan
Adds support for ingesting and normalizing logs from Anomali ThreatStream IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. logs
Adds support for ingesting and normalizing logs from Cisco Application Control Engine (ACE)
Adds support for ingesting and normalizing logs from Cisco Firepower NGFWNGFWA next-generation firewall, combining network access rules with deeper inspection of applications and traffic. It can apply security controls beyond basic addresses and ports.
Adds support for ingesting and normalizing logs from Cisco Firewall Service Module (FWSM)
Adds support for ingesting and normalizing logs from Cisco IronPort
+26 moreshow less
Adds support for ingesting and normalizing logs from Cisco PIX
Adds support for ingesting and normalizing logs from Cisco Prime
Adds support for ingesting and normalizing logs from Cisco Wireless Intrusion Prevention System (WIPS)
Adds support for ingesting and normalizing logs from Cisco Wireless LAN Controller (WLC)
Adds support for ingesting and normalizing logs from Cisco Wireless Security Management (WiSM)
Adds support for ingesting and normalizing logs from Cloudian HyperStore
Adds support for ingesting and normalizing logs from CrushFTP
Adds support for ingesting and normalizing logs from Delinea Distributed Engine
Adds support for ingesting and normalizing logs from Duo User context
Adds support for ingesting and normalizing logs from ExtraHop DNS
Adds support for ingesting and normalizing logs from ExtraHop RevealX
Adds support for ingesting and normalizing logs from Extreme Networks switch
Adds support for ingesting and normalizing logs from Extreme Networks Wireless
Adds support for ingesting and normalizing logs from MuleSoft Anypoint
Adds support for ingesting and normalizing logs from Palo Alto Prisma SD-WAN
Adds support for ingesting and normalizing logs from Recorded Future IOC
Adds support for ingesting and normalizing logs from Veeam
Adds support for ingesting and normalizing logs from Veridium ID
Adds support for ingesting and normalizing logs from VMware Tanzu
Adds support for ingesting and normalizing logs from VMware vCenter
Adds support for ingesting and normalizing logs from VMware vRealize
Adds support for ingesting and normalizing logs from VMware vSphere
Adds support for ingesting and normalizing logs from VSFTPD
Adds support for ingesting and normalizing logs from VyOS
Adds support for ingesting and normalizing logs from Workday audit
Adds support for ingesting and normalizing logs from Yamaha router
Google SecOps adds self-service enablement for Data RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. to simplify onboarding
Google SecOps adds ingestion support for 45 new log sources including Akamai MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone., Fortinet FDR, Lumu SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. and others
Adds AKAMAI_MFA log type support for Akamai Multi-Factor Authentication logs
Adds FORTINET_FORTINDR log type support for Fortinet Network Detection and Response logs
Adds LUMU log type support for Lumu Universal SIEM integration
Adds MICROSOFT_DATABRICKS_WORKSPACES log type support for Microsoft Azure Databricks workspaces
Adds COREVIEW log type support for CoreView Audit-log SIEM integration
+1 moreshow less
Adds VELOCIRAPTOR log type support for Velociraptor digital forensic & incident response tool logs
YARA-L 2.0YARA-L 2.0A rule language developed by Google for writing detection logic in Chronicle SIEM, extending YARA syntax to match sequences of log events over time rather than static file patterns. GA adds condition, dedup, metrics functions, limit keyword, timestamp extraction, and expanded array limits to search.
└──▷ TRY IT
Use the limit keyword to quickly preview a subset of search results for performance testing.
$ search kind=udm | limit 50
Adds condition clause to UDM search and dashboards for filtering aggregates
Introduces dedup section in standard UDM searches and YARA-LYARA-LA rule language developed by Google for Chronicle that extends YARA syntax to express multi-event, time-windowed detections over log data rather than single-file pattern matching. 2.0 queries
Enables metrics functions in the outcome section of UDM searches
Increases element limit for array and array_distinct aggregation functions to 1,000
Adds limit keyword to restrict search result count
+1 moreshow less
Supports earliest and latest timestamps for time range extraction in aggregation
tenzir v5.13.0 adds from_udp operator with structured peer metadata and dns_lookup operator for DNS resolution
Adds from_udp operator that receives UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. datagrams and outputs structured events containing data and peer (ip, port) metadata instead of raw bytes
Adds resolve_hostnames parameter to from_udp to enable inline DNS lookups for sender IPs during ingestion
Adds dns_lookup operator for reverse PTR and forward A/AAAA lookups returning structured records with address, type, and TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. fields
Adds contains_null(x:any) function to check if input values contain null entries
Adds message option to the assert operator to provide context when an assertion fails
+1 moreshow less
Updates Syslog parser to allow . in tag/app_name and any character in process_id fields per RFC 3164RFC 3164The 2001 IETF specification that standardised the BSD syslog protocol, defining message format and UDP transport for system log data. Cyber tools use it to parse or emit legacy syslog reliably across heterogeneous infrastructure.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The split_at_null option of the read_lines operator is deprecated; use read_delimited "\0" instead
Tenzir v5.12.0 adds is_empty() operator, replace operator, OCSFOCSFAn open schema standard, maintained by the OCSF community under CISA and industry backing, that defines a common event format so cyber tools can share and ingest log data without per-source normalization work. 1.6.0 support, and S3 load options.
Adds is_empty() universal emptiness detector for strings, lists, and records
Introduces the replace operator to find and replace specific values across all fields in an event
Supports OCSF 1.6.0 in the ocsf:: family of operators
Adds role and external_id options to the load_s3 operator
ESCU v5.13.0 adds 8 new Cisco IOS/IOS XE detections and an analytic story targeting CVE-2018-0171 exploitation by Russian APT Static Tundra.
└──▷ GET THIS VERSION
$ git clone --branch v5.13.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.13.0
New analytic story: Cisco Smart Install Remote Code Execution CVE-2018-0171, covering the full attack chain abused by Russian state-sponsored group Static Tundra against unpatched IOS/IOS XE devices.
New detection: Cisco Smart Install Port Discovery and Status — surfaces inbound Smart Install traffic on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./4786 using cisco:ios telemetry.
New detection: Cisco Smart Install Oversized Packet Detection — identifies anomalous SMI packet sizes associated with CVE-2018-0171 exploitation, derived from Cisco Talos PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. patterns.
New detection: Cisco IOS Suspicious Privileged Account Creation — catches post-exploitation persistence via privileged account additions on IOS/IOS XE devices.
New detection: Cisco SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. Community String Configuration Changes — detects adversary modification of SNMP community strings (as observed in Static Tundra tooling).
+5 moreshow less
New detection: Cisco Network Interface Modifications — monitors for unauthorized interface-level changes used to establish persistent access.
New detection: Cisco Configuration Archive Logging Analysis — tracks configuration archival events that may indicate staged exfiltration or persistence.
New detection: Cisco TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery. Server Configuration for Data Exfiltration — identifies TFTP-based staging and exfiltration of device configurations.
New detection: Cisco Secure Firewall – Static Tundra Smart Install Abuse — provides Cisco Secure Firewall-specific mapping for unified triage of Smart Install exploitation activity.
Updated detection: Cisco Secure Firewall – Intrusion Events by Threat Activity, extended to incorporate Static Tundra campaign context.
10 details in Everything
2 more releases in this issue
· 2025-08-06 → 2025-08-22
Splunk Security Content v5.12.0 adds 22 new detections and 3 analytic stories covering Medusa Rootkit, MSIX abuse, and RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. artifact evasion.
└──▷ GET THIS VERSION
$ git clone --branch v5.12.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.12.0
New analytic story: Medusa Rootkit (UNC3886) — covers stealthy Linux and Windows persistence malware used by the UNC3886 threat actor.
New detection: Linux GDrive Binary Activity — detects GDrive binary usage on Linux systems associated with Medusa Rootkit activity.
New detection: Linux Medusa Rootkit — identifies Medusa Rootkit indicators on Linux endpoints.
New detection: Windows GDrive Binary Activity — detects GDrive binary usage on Windows systems linked to UNC3886.
New detection: Windows Suspicious VMware Tools Child Process — surfaces anomalous child processes spawned from VMware Tools, a Medusa Rootkit persistence technique.
+21 moreshow less
New analytic story: MSIX Package Abuse — covers abuse of Microsoft MSIX application packages using AppXDeploymentServer/Operational log telemetry.
New detection: Windows Advanced Installer MSIX with AI_STUBS Execution — detects suspicious MSIX packages built with Advanced Installer AI_STUBS.
New detection: Windows AppX Deployment Unsigned Package Installation — flags installation of unsigned MSIX packages.
New detection: Windows PowerShell MSIX Package Installation — detects PowerShell-driven MSIX package installs.
New detection: Windows PowerShell Script From WindowsApps Directory — identifies PowerShell scripts executing from the Windows Apps directory.
New detection: Windows MSIX Package Interaction — monitors interactions with Windows Apps directories for potential sideloading or malware delivery.
New detection: Windows Developer-Signed MSIX Package Installation — detects installation of developer-signed (non-store) MSIX packages.
New detection: Windows AppX Deployment Full Trust Package Installation — surfaces full-trust MSIX package installs that run with elevated permissions.
New detection: Windows AppX Deployment Package Installation Success — logs successful MSIX package deployment events for visibility.
New analytic story: Windows RDP Artifacts and Defense Evasion — covers RDP usage forensics and artifact cleanup techniques.
New detection: Windows Default RDP File Creation — detects creation of Default.rdp files that reveal targeted systems.
New detection: Windows Default RDP File Deletion — flags deletion of RDP files as a potential evasion action.
New detection: Windows Default RDP File Unhidden — identifies un-hiding of RDP files to expose evasion attempts.
New detection: Windows RDP Bitmap Cache File Creation — monitors creation of RDP bitmap cache files as forensic artifacts.
New detection: Windows RDP Cache File Deletion — detects deletion of RDP bitmap cache files indicating artifact cleanup.
New detection: Windows RDP Server Registry Entry Created — alerts on creation of RDP server registry entries.
New detection: Windows RDP Server Registry Deletion — flags removal of RDP server registry keys as an evasion technique.
New detection: Windows RDP Client Launched with Admin Session — detects RDP client invocations using administrative session parameters.
New detection: Windows RDP Login Session Was Established — provides visibility into RDP session establishment events.
New detection: Windows RDP AutomaticDestinations Deletion — detects deletion of RDP AutomaticDestinations jump list entries as artifact cleanup.
Updated analytic story: China-Nexus Threat Activity now maps additional existing detections to UNC3886 activity.
Splunk Security Content v5.11.0 adds 4 new analytic stories and 2 new detections covering Interlock Ransomware, NaiLaoLocker, Interlock RAT, and Scattered Spider.
└──▷ GET THIS VERSION
$ git clone --branch v5.11.0 https://github.com/splunk/security_content.git
# already have the repo? check out this version:$ git checkout v5.11.0
Adds Interlock Ransomware analytic story mapping detections to anomalous PowerShell/CMD processes spawned from Office apps and large-scale file renaming patterns, with updated ransomware extensions and notes lookup files.
Adds NaiLaoLocker Ransomware analytic story covering multi-threaded AES-256-CBC encryption with SM2 key wrapping via DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. side-loading and mutex creation behaviors.
Adds Interlock RAT analytic story surfacing indicators such as anomalous network beaconing, persistence artifacts, credential-theft behaviors, and fake browser-update installer activity.
Adds Scattered Spider analytic story covering SIM-swap attacks, MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. push-bombing, unauthorized remote-access tool execution (TeamViewer, AnyDesk, Ngrok), and cloud API abuse.
New detection: Splunk AppDynamics Secure Application Alerts integrates AppDynamics security alert telemetry into Splunk detections.
+1 moreshow less
New detection: Windows Rundll32 Load DLL in Temp Dir identifies rundll32 loading DLLs from temporary directories, a common DLL side-loading and malware staging technique.
Feedly adds Status, What/So What columns and Recently Reported filter to Cyber Attacks Dashboard.
Adds Status column to the Cyber Attacks Dashboard to distinguish between newly reported attacks and those with recent timeline updates within a time filter
Adds What, So What column to the Cyber Attacks Dashboard providing structured two-bullet insights on threat type, target scope, affected data, and impact
Adds Latest Activity column to the Cyber Attacks Dashboard to surface the most recent timeline event directly in the table
3 details in Everything
1 more release in this issue
· 2025-08-07 → 2025-08-20
Feedly Threat Intelligence adds granular newsletter analytics with interactive graphs and CSV export, Ask AI in Threat Actor Insight Cards, and new Nuclei/Advisory filters.
Adds an interactive graph to compare key metrics like recipients, open rate, and click rate for newsletters
Adds CSV export capability to download and share analytics reports
Adds time range analysis to track performance over custom periods
Adds a reader and article engagement table to see who is reading what
Adds Ask AI functionality in Threat Actor Insight Cards to run specific queries on threat actors
+1 moreshow less
Makes the Nuclei Vulnerability Scanner filter available in the Vulnerability Dashboard
Adds MSSPMSSPA Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. Control for managing multiple customer environments via the UI
Adds MSSP Control feature to manage Anomali environments of individual customers
OpenCTI 6.7.15 adds authorized members on organizations and relationship name tooltips
└──▷ GET THIS VERSION
$ git clone --branch 6.7.15 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.7.15
└──▷ HOW TO FIND IT
Interact with the graph by hovering over relationship lines to identify the specific type of connection.
📍In the OpenCTI UI, navigate to a Stix Domain Object or Stix Cyber-Observable Object page. Hover the mouse cursor over any line connecting two nodes in the relationship graph to display the relationship name tooltip.
Adds authorized_members attribute to organization entities for fine-grained access control
Enables hovering over relationships in the UI to view the relationship's name
2 details in Everything
2 more releases in this issue
· 2025-08-12 → 2025-08-27
OpenCTI 6.7.13 introduces org-scoped user search and Hub integration checks.
└──▷ GET THIS VERSION
$ git clone --branch 6.7.13 https://github.com/OpenCTI-Platform/opencti.git
# already have the repo? check out this version:$ git checkout 6.7.13
└──▷ HOW TO FIND IT
When you need to assign a task or include a participant but want to restrict the available users to your own organization.
📍1. Open an incident, playbook, or report in the OpenCTI UI.
2. Click into the Assignee or Participant field.
3. Observe that only members of your current organization are listed for selection.
assignee and participant fields now filter to show only users from the current organization
MISP v2.5.18 adds an on-demand correlation engine, a built-in task scheduler, and high-performance indexing for No-ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. correlations.
└──▷ GET THIS VERSION
$ git clone --branch v2.5.18 https://github.com/MISP/MISP.git
# already have the repo? check out this version:$ git checkout v2.5.18
└──▷ HOW TO FIND IT
Set up a recurring feed-fetch task so MISP automatically pulls all feeds on a schedule without external cron jobs.
📍Navigate to https://YOUR_MISP_HOST/tasks, click Add Task, select action type Fetch under Feeds, choose All feeds, set your recurrence interval, save, then enable the task.
New OnDemand Correlation Engine fetches correlating values live without persistent storage, reducing disk usage and eliminating the need to re-run correlation jobs.
New built-in Task Scheduler (site-admin only) lets administrators create and manage recurring actions for feeds, servers, workflows, and summaries — accessible at /tasks — replacing external cron-based scheduling.
Scheduler tasks support manual on-demand triggering via a play button, per-task execution logs, and per-user run context.
High-performance indexing support added for No-ACL correlations, with a CLI tool available to apply the required indexes.
Adds a new last_run_at column on tasks and improved job status handling in the task scheduler.
+2 moreshow less
Adds a periodic user summary scheduled task for generating regular reports.
Forgejo CI integration added with a dedicated worker file and Forgejo-compatible YAML workflow.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The process_id field in task/job handling is replaced with last_job_id.
Tines 34.0.0 adds Select AI model, Code Analyst, Case list saved views, API for story runs, and new JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store./JWK functions
Adds the ability to select the AI model used in Workbench flows via a new configuration option
Introduces Code Analyst as an available action within AI Agent workflows
Includes Case list columns in saved views, allowing persistent column selection for case management
Adds API support for saving story runs, enabling programmatic persistence of execution results
Adds Accept all incoming changes option for handling updates to shared configurations or stories
+3 moreshow less
Includes pending_duration in action metadata for tracking wait times in Agent actions
Adds JWK_TO_PEM and PEM_TO_JWK functions for cryptographic key format conversion
Adds JWT_DECODE function for decoding JSON Web Tokens directly in workflows
8 details in Everything
└──▷ BREAKING ON UPGRADE
!Deprecation of Docker Content Trust in favor of cosign; users must update their image verification process
!Images move to the distroless model; base OS layers are removed from official Tines images
2 more releases in this issue
· 2025-08-04 → 2025-08-26
Tines 32.7.0 adds AWS Bedrock integration, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server building, embedded pages in collections, and action metadata
Adds Related events panel to Workbench insight alerts, showing AI-recommended XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. Data Explorer activities.
Virtual Network Sensor 1.0.1532 adds session tracking/hostname lookup config and auto-filtering for other VNS/Deep Discovery traffic.
Adds configuration support for session_tracking and hostname_lookup settings in Virtual Network Sensor to control network behavior analysis scope.
Auto-filters network traffic scanning to exclude flows originating from other Virtual Network Sensors or Deep Discovery Inspector appliances within the same TrendAI Vision One account.
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. module v2.23.127 logs Internet Access auth headers in macOS user defaults during tunnel mode.
Trend Vision One Cloud Email Gateway Protection now supports exporting DMARC compliance checks to CSV.
Exporting selected records happens instantly, while exporting all results triggers an export task. This streamlined export process improves efficiency, supports faster data analysis, and enables easier day-to-day follow-up and reporting.
Trend Vision One ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. adds centralized policy resource management for approved/blocked sender lists.
Adds a centralized location in Email and Collaboration Security to manage approved and blocked sender lists across Cloud Email and Collaboration Protection and Cloud Email Gateway Protection
Enables administrators to define trusted or suspicious senders once and apply them consistently across multiple supported solutions from the central policy resource interface
TrendAI Vision One adds Oracle Cloud compartment support for CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps., risk exposure, and asset discovery
Adds connection of Oracle Cloud compartments via Oracle Resource Manager in Cloud Accounts to monitor cloud assets.
Enables viewing connected Oracle Cloud compartments in the Cloud Assets tab under Attack Surface Discovery.
Allows evaluation of potential attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. for connected Oracle Cloud compartments using Attack Path Prediction.
Introduces project grouping for Oracle Cloud compartments on the Cloud Overview tab within Cloud Security Posture.
Updates the Misconfiguration and Compliance (CSPM) app with forty rules scanning Oracle Cloud compartments mapped to the CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Oracle Foundations benchmark.
Helm Chart 3.1.4 adds configurable logging via LOG_LEVEL and image versioning tags for ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. Fargate tasks.
Adds ability to configure an approved sender list in Data Loss Prevention policies for Exchange Online.
Allows configuring the approved_sender_list in Exchange Online DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies to exclude specific senders from scanning.
Adds tag-based filtering for EBSEBSAmazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. snapshots created by AVTD scanning process in AWS.
Trend Vision One ZTSAZTSAZero Trust Security Architecture: a network access model where no user or device is trusted by default, requiring continuous verification before granting access, letting cyber tools enforce least-privilege policies across any environment. On-premises Gateway 1.0.69 adds HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. port assignment and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest./AI detection logging.
HTTP(S) port 80/443 is now supported for proxy services
DLP and AI content matching data can be recorded into the detection log
CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server.-hosted internet-facing assets now display a CDN tag in their profiles for better situational awareness.
Assets hosted by a content delivery networkcontent delivery networkA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. (CDN) displayed in Attack Surface Discovery are now tagged with a CDN tag in asset profiles.
TrendAI Vision One macOS agent adds quarantine path/SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. to Data Explorer and decouples DDR sensor from Endpoint Sensor.
Adds the quarantine_file_path and sha_256 fields to detection results in Data Explorer
Allows enabling Data Detection and Response / Data Security Sensor independently of the Endpoint Sensor
TrendAI Vision One introduces Agentic SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. with third-party log ingestion, flexible retention, and AI-guided investigation capabilities.
Adds in-app free trial for Agentic SIEM accessible directly from the TrendAI Vision One console
Adds data ingestion support for Microsoft Defender for Endpoint logs alongside existing CEFCEFCommon Event Format, an ArcSight (Micro Focus) log standard that defines a fixed header plus extensible key-value pairs so cyber tools can emit and ingest alerts in a predictable, parseable structure./syslog support
Enables custom filtering to manage third-party data ingestion and retention volume
Adds flexible data retention management supporting analytic (up to two years) and archival (up to seven years) ingestion paths
Introduces unified platform data query capabilities across all data in TrendAI Vision One
+6 moreshow less
Adds purpose-built SIEM widgets and dashboards for threat hunting and monitoring
Enables retroactive scanning for IoAs (Indicators of Attack)
Enhances Workbench Insights console with host investigation, tailored impact scope view, enhanced highlighted object view, and a new timeline view
Introduces AI-guided threat investigation presented in Workbench Insights overview
Adds proactive priority recommendations and false positive detection for Workbench insights to help SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams triage more efficiently
Enables AI-generated PDF reports that include Workbench Insights summaries, threat activity timelines, actions taken, and recommendations
Trend Vision One adds SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. metric tracking to Case Management for Workbench, Risk Event, and Compliance Management case types.
Adds configurable service level agreement (SLA) metrics to Case Management to track compliance with SLA requirements based on case priority or all cases
Enables SLA metrics display in the Mean Time Metrics, Mean Time to Close, and My Open Case widgets
Extends SLA metric support to Workbench, Risk Event, and Compliance Management case types
Sophos Central adds STPSTPSpanning Tree Protocol, an IEEE standard (802.1D) that prevents Layer 2 network loops by electing a root bridge and blocking redundant switch paths, keeping Ethernet networks stable under failure conditions. switch management and TLS encryption visibility reports.
Delivers management for Spanning Tree Protocol (STP) features for Sophos switches
Provides the TLS report with visibility of message encryption versions and non-delivery reasons
2 details in Everything
1 more release in this issue
· 2025-08-09 → 2025-08-11
Sophos Central 2025.32 adds STPSTPSpanning Tree Protocol, an IEEE standard (802.1D) that prevents Layer 2 network loops by electing a root bridge and blocking redundant switch paths, keeping Ethernet networks stable under failure conditions. management for Sophos Switches and a new TLS Report for Sophos Email.
└──▷ HOW TO FIND IT
Review TLS encryption failures to diagnose why messages were rejected by your Secure Message Policy.
📍In Sophos Central, go to Email › Reports › TLS Report to see the TLS version applied to each message and the non-delivery reason for messages that failed TLS requirements.
Adds STP (Spanning Tree Protocol) management for Sophos Switch hardware via Sophos Central, alongside Maintenance Release 02.1.1837 for all Sophos Switch devices.
Adds a TLS Report in Sophos Email that shows which TLS version was applied to each message and the reason for non-delivery when a message failed Secure Message Policy TLS requirements.
Cribl Stream 4.13.1 adds structured metadata support for Grafana/Loki, Avro/JSON schema types for Confluent, dynamic HTTP headers for Loki, and more packs.
Adds Schema type setting to Confluent Cloud Source/Destinations to select Avro or JSON serialization
Adds Enable structured metadata toggle to Grafana/Loki Source/Destination to expose the internal __structuredMetadata field as string key-value pairs
Adds dynamic HTTP header support in Loki Destination by inspecting each event for a __headers object and batching identical values
Adds Monitor subscription for new messages toggle to Google Cloud Pub/Sub Source for monitoring via subscription ID only
Adds REST Collector Packs for CrowdStrike, Okta, and Microsoft O365
5 details in Everything
└──▷ BREAKING ON UPGRADE
!If you use S3 Object Lock, the Amazon S3 Destination will fail when configured to send data to an S3 bucket with default Object Lock enabled due to AWS SDK upgrade; do not upgrade until the patch release.
Automox adds support for Windows 11 ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. with Agent v2.3.34+ requirement.
Adds official support for the Windows 11 ARM operating system to Automox.
Adds Golden Ticket technique support for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. cross-domain attacks
Expands domain trust enumeration capabilities in Active Directory attack content
Displays CVE aliases (e.g., CitrixBleed2) and H3 Weakness IDs in Rapid Response UI
Adds child of indicator in account settings to clarify MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. client hierarchy
+2 moreshow less
Displays subclient assets directly on the asset page for MSP visibility
New Attack Surface API, External Scanner Integration, In-Product Remediation Steps, and Unified Navigation preview for Rapid7 Insight Platform August 2025
Adds Attack Surface Management (ASM) API for Cypher-based queries across assets, identities, and related ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. data types in Surface Command and Exposure Command
Enables Asset and Identity filters using source-specific properties (e.g., Microsoft Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments., Crowdstrike) in Surface Command without custom Cypher queries
Adds detection of container public exposure with full orchestration context (service meshes, ingress controllers, node roles) in Cloud Security (InsightCloudSec) and Exposure Command
Enables real-time exposure validation via external scanner integration that assesses business impact and maps attack vectors for open database ports and misconfigured services
Adds enhanced Bulk Export API using GraphQL to retrieve asset/vulnerability data in Parquet format for Vulnerability Management (InsightVM)
+7 moreshow less
Embeds step-by-step remediation guidance directly within vulnerability findings in Cloud Security (InsightCloudSec) and Exposure Command
Enables dynamic third-party alert prioritization reflecting current severity levels for third-party alerts in Managed Detection and Response (MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools.) and Managed Threat Complete
Adds SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared.-monitored coverage for Okta Identity and Palo Alto Cortex XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss. telemetry via Data Connectors > Data Collectors
Migrates 8 legacy and 5 third-party detection rules into the SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. (InsightIDR) Detection Rule Library
Enables Unified Navigation feature preview with streamlined cross-solution access in Administration
Adds automatic allowlisting settings to disable IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. auto-allowlisting in Threat Intelligence (Intelligence Hub)
Supports Azure Event Driven Harvesting and Least-Privileged Access via automatic deployment in Azure China and Azure Government clouds
DefectDojo 2.49.1 adds a Snyk Code issues parser, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. nginx support, and webhook owner field.
└──▷ GET THIS VERSION
$ git clone --branch 2.49.1 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.49.1
New snyk_issue_api parser for Snyk Code file-based issues.
Enables IPv6 support in nginx when available.
Webhook notifications now include the owner field.
DefectDojo 2.49.0 adds Xeol and Mayhem SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. parsers, CVSS4 support, a new fix_available field, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. nginx support, and more.
└──▷ GET THIS VERSION
$ git clone --branch 2.49.0 https://github.com/DefectDojo/django-DefectDojo.git
# already have the repo? check out this version:$ git checkout 2.49.0
└──▷ TRY IT
Reimport a scan and restart SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. timers for any findings reactivated in this run.
Adds Xeol parser for end-of-life component detection findings.
Adds Mayhem SARIF parser (new parser) for Mayhem security findings.
Adds CVSS4 support across findings, API, and UI.
Adds a fix_available field to findings to surface patch availability.
Adds Sophos, NCSC, and GSD vulnerability ID sources to settings.
+15 moreshow less
Supports whitelisted file extensions via the API.
Supports optional SLA restart on finding reactivation during reimport (restart_sla_on_reactivation).
Extends Mend Platform parser to include Ransomware, Exploitable, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. data.
Extends Twistlock/Prisma parser to parse compliance findings.
Adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. v3 support to the Dependency Check parser.
Supports Sysdig 2025 report formats.
Makes KEV (Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) data visible on the findings listing in the UI.
Adds IPv6 support to the nginx configuration.
Allows users with edit/add user permission to force password resets.
Adds validation to minimum and maximum password length settings.
Includes vuln_id_from_tool in group-by options for findings.
Adds more finding fields to the risk acceptance findings dropdown for better context.
Optimizes view_engineer dashboard using DB-side aggregation to reduce load time.
Ensures consistent Close old findings behavior between UI and API.
Adds JIRA endpoint status to finding description when pushing to JIRA.
20 details in Everything
└──▷ BREAKING ON UPGRADE
!Reimport API: the default for close_old_findings is restored to True — any integrations relying on the previous changed default will now close old findings on reimport.
Edgescan adds EUVDEUVDThe European Vulnerability Database, operated by ENISA, is the EU's official registry of disclosed software vulnerabilities, giving cyber tools a regional authoritative source for CVE-equivalent advisories. support, superuser notes, asset-based user filtering, and batch retests to the UI.
Adds EUVD (EU Vulnerability Database) linkage to vulnerability entries so CVEs linked to EUVD entries are visible
Adds a notes field on vulnerabilities that is only visible to superusers
Adds filtering capability to show which users can view or edit specific assets based on cross-referenced permissions
Enables retesting all currently filtered vulnerabilities from the vulnerability index page in one action
Adds AND logic to existing filters for vulnerability locations, allowing multiple concurrent filter constraints
Tenable One OT Exposure 4.3.74 adds Windows OT Agent, asset tags, policy findings in Tenable One, and new GraphQL mutations for agent management.
Adds the installable OT Agent for Windows to extend active OT asset discovery
Adds OT Agent Management page to configure IP ranges, schedules, and credentials for agent-based discovery
Reports policy events from Tenable One OT Exposure as Tenable.ot Violations Findings in Tenable One
Adds Tags to Assets Groups for searchable organization of assets outside the event policy editor
Enables Enterprise Manager to centrally schedule or perform bulk content updates (plugins, IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity., DFE) for ICPs
+8 moreshow less
Adds remote unlock capability for expired administrative accounts in Tenable Core
Displays Serial Number column on Inventory page and includes it in CSV exports
Enables search by BACnetBACnetA communication protocol for building automation systems, standardized as ASHRAE 135, covering HVAC, lighting, and access control devices. Cyber tools use it to discover and interact with building infrastructure on IP or serial networks. Instance ID on the Inventory quick search bar
Adds responsive side panels for drilling down on Vulnerability Findings while retaining context
Adds version-switcher dropdown to switch product documentation versions via header shortcuts
Updates DFE coverage for additional OT vendor devices including Cisco Catalyst, Eaton Power Xpert Gateways, and Schneider Electric devices
Fleet 4.72.0 adds TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake.-backed host identity via SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention., Apple Account Driven User Enrollment, MS-MDE2 v7.0, and new Fleet-maintained macOS apps.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.72.0 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.72.0
└──▷ USE IT
Restrict SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. logins to a dedicated admin URL so agent and API traffic uses a separate endpoint, preventing authentication errors in dual-URL SSO configurations.
yaml
sso_server_url: https://admin.fleet.example.com
Adds support for issuing host identity certificates via SCEP (Simple Certificate Enrollment Protocol), enabling fleetd to use TPM 2.0 hardware to cryptographically sign all HTTP requests.
Adds --fleet-managed-host-identity-certificate flag to generate fleetd packages for Linux that use TPMs to sign HTTP requests.
Adds sso_server_url configuration option to support SSO setups with separate URLs for admin access vs. agent/API access.
Adds support for Apple Account Driven User Enrollment for iOS/iPadOS when end-user authentication is configured.
Adds support for MS-MDE2 v7.0 Windows MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. Enrollments.
+8 moreshow less
Adds four new Fleet-maintained macOS apps: iTerm2, YubiKey Manager, VNC Viewer, and Beyond Compare.
Host details > Software > Library and Fleet Desktop Self-Service now show installer status, installer actions, and available software updates based on detected software inventory.
Adds fleetd TUF extension support on Linux arm64 and Windows arm64 devices.
Switches to UpgradeCode-based uninstall scripts for MSI custom packages when an UpgradeCode can be extracted, providing more comprehensive uninstall coverage.
Changes enable_software_inventory to default to true when missing from a GitOpsGitOpsA practice where Git repositories serve as the single source of truth for infrastructure and application state, with automated systems continuously reconciling live environments to match what is declared in version control. config.
Removes DEB and RPM installers from installable software lists on hosts with incompatible Linux distributions (e.g., Ubuntu for an RPM).
Increases timeouts on /fleet/mdm/profiles/batch to better support workflows with large numbers of profiles.
Grants Fleet Primo mode users access to Software automations and failing policy ticket & webhook automations.
13 details in Everything
1 more release in this issue
· 2025-08-04 → 2025-08-13
Fleet v4.71.1 adds MS-MDE2 v7.0 Windows MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. enrollment support and a new SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. dual-URL configuration option.
└──▷ GET THIS VERSION
$ git clone --branch fleet-v4.71.1 https://github.com/fleetdm/fleet.git
# already have the repo? check out this version:$ git checkout fleet-v4.71.1
Supports MS-MDE2 v7.0 Windows MDM Enrollments, expanding compatibility with modern Windows enrollment protocols.
New sso_server_url configuration option enables SSO setups where admin access and agent/API access use separate URLs, restricting SSO authentication to the specified URL.
Sophos Mobile 2025.32 adds iOS Safari restrictions, Android Kiosk status bar info, and ABM profile settings
└──▷ HOW TO FIND IT
Disable Safari history clearing on iOS devices via the MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. console UI.
📍In the Sophos Mobile Central Console, go to Devices › Policies › iOS › Restrictions and set Allow clearing Safari history to Off.
Enable Private Browsing for users on iOS/iPadOS via Apple Business Manager profile settings.
📍In the Sophos Mobile Central Console, go to Devices › Policies › Apple Business Manager Profiles and add Multitasking (iOS, iPadOS) or Allow Safari Private Browsing under Additional Privacy Settings.
Show system status bar information in an Android EnterpriseAndroid EnterpriseA Google program that gives organizations APIs and management modes to enroll, configure, and enforce policy on Android devices through an EMM platform. Kiosk app.
📍In the Sophos Mobile Central Console, go to Devices › Policies › Android Enterprise › Kiosk mode and enable Show system information in status bar.
Adds Allow clearing Safari history setting to iOS Restrictions policies to disable the Clear History and Website Data option in Safari
Adds Allow Safari Private Browsing setting to iOS Restrictions policies to enable or disable Private Browsing mode
Adds Show system information in status bar setting to Android Enterprise Kiosk mode configuration to display time, connectivity, and battery indicators
Adds Multitasking (iOS/iPadOS), OS Showcase (iOS/iPadOS), and Additional Privacy Settings (macOS) to Apple Business Manager profiles to skip setup assistant pages
Munki 6.7.0 adds macOS 26 catalog URL and smart display-sleep control during bootstrap
└──▷ GET THIS VERSION
$ git clone --branch v6.7.0 https://github.com/munki/munki.git
# already have the repo? check out this version:$ git checkout v6.7.0
Add the Software Update CatalogURL for macOS 26 to enable automatic updates on future OS versions.
Skip Munki update notifications when a process has asserted display sleep unless a forced logout is imminent, avoiding interruptions during presentations.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Downgrading from 6.7.0 to 6.4.2 or earlier breaks /usr/local/munki/munki-python if the newer version installed a Python 3.12 framework while the older one expects Python 3.10.
!Munki may fail to update itself completely via Munki if the launchd item is not marked as unattended_install during the upgrade.
runZero 4.0.250820.0 adds auto-org assignment for alerts, AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. external IDs, and AD integration scaling.
Adds automatic organization assignment for goals, alert rules, alert channels, and alert templates when the Automatically add new organizations option is selected
Enables creation of an external ID for AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Role credentials
runZero 4.0.250805.0 adds hardware-based asset matching, configurable Qualys scan-age filters, cross-account AWS roles, and an experimental MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server.
Adds hardware information to the asset matching algorithm when available
Adds configurable time-period filter for the Qualys integration to exclude assets not scanned within that window
Adds support for cross-account AWS roles in the AWS integration for authentication
Enables an experimental MCP server extension to let users bring their own LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.
Adds source visibility details to the Asset → Drawer details panel
Adds WAFWAFA reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server.-focused summary to scan logs in the Scan → Logs details panel
PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. now work for related URLs and subdomains in Android v8.11.6.
PasskeyPasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. authentication automatically matches against related URLs and subdomains (e.g., facebook.com credentials apply to meta.com).
Localization improved for supported languages via Crowdin translations.
PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. now work for related URLs and subdomains; Captcha fields are ignored by Autofill.
Passkeys now work for related URLs and subdomains (e.g., facebook.com passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. works on meta.com)
1Password SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Manager August 2025 adds shared accounts tracking, new workflow triggers, and five new integrations.
Adds Track emails in browser extension feature that records authentication emails for shared account identification
Adds Record usernames from browser extension with a new setting at Settings > Browser extension > Tracking to capture login usernames
Adds Task meets criteria workflow trigger to automate actions based on task status or due dates
Adds SaaS Manager integration with Cezanne HRISHRISHuman Resources Information System — software that centralises employee records, payroll, and org data. Cyber tools integrate with it to tie identities and access rights to authoritative HR records. for employee users and teams
Adds SaaS Manager integration with MeisterTask for usage data on users and tasks
+5 moreshow less
Adds SaaS Manager integration with Sensor Tower for usage data on users, roles, provisioning, and deprovisioning
Adds SaaS Manager integration with Hex for usage data on groups, users, activity, provisioning, and deprovisioning
Adds SaaS Manager integration with CodeSignal for usage data on groups, users, provisioning, and deprovisioning
Adds SaaS Manager integration with SecureFrame for usage data on users and devices
Adds SaaS Manager integration with 3CX for usage data on groups, users, provisioning, and deprovisioning
PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. now auto-expand to related URLs and subdomains.
PasskeysPasskeysPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. now work for related URLs and subdomains; Captcha fields are ignored by Autofill in beta 8.11.6-25.
Passkeys now match on related domains (e.g., facebook.com covers meta.com) instead of only the exact saved URL.
Autofill explicitly ignores captchas fields, preventing accidental overwrites or validation errors during form submission.
Ory adds SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. server management and custom domain access to the onboarding portal.
Introduces a new scim flow in the onboarding portal for creating, editing, and deleting SCIM servers alongside existing SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. functionality.
Makes the onboarding portal accessible through custom domains configured for the project.
2 details in Everything
2 more releases in this issue
· 2025-08-01 → 2025-08-29
Ory enables account recovery via SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. with custom templates and configurable HTTP gateway integration
Enables sms as a destination for account recovery codes in addition to email, allowing users to select their preferred method during the flow.
Supports custom SMS templates similar to existing email templates for branded or localized text messages.
Requires configuring an HTTP gateway to handle outbound SMS delivery; new fields in the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. schema expose system-level configuration options.
Stytch PHP SDK release and User Device History for B2B/Consumer auth
└──▷ TRY IT
Install the new PHP SDK via Composer to start building auth flows.
$ composer require stytch/stytch-php
Adds the stytch/stytch-php Composer package for building authentication flows in PHP ecosystems including Laravel, Symfony, or WordPress
Introduces MethodOptions to set custom headers like X-Stytch-Member-Session in B2B Authorization settings
Enables User Device History recording powered by Stytch Device Fingerprinting for known device tracking and adaptive MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. triggers
Stytch adds external ID support to standalone SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. API, copy env configs in Dashboard, and consumer RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. with custom scopes
└──▷ HOW TO FIND IT
Configure RBAC roles and scopes for a consumer app in the dashboard.
📍Dashboard › Management › RBAC Policies
Accepts external_id in Stytch SSO APIs to map unique identifiers from other sources for standalone modules.
Allows copying configurations across environments via the top-level environment switcher or Copy from button on config pages.
Supports RBAC policies and custom scopes for consumer applications, requiring explicit assignment of roles and resources.
Stytch adds standalone SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. external IDs, RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists./copy-env via Dashboard UI, and consumer custom scopes
Adds support for external organization IDs in Stytch SSO APIs for standalone SSO alongside an existing authentication system.
Enables copying configurations across environments in the Stytch Dashboard
Introduces RBAC policies and custom scopes for consumer applications
Stytch launches open-source SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. Shield to detect SAML protocol vulnerabilities like XML signature wrapping before they reach your app.
Launches SAML Shield, a new protocol-level validator that inspects incoming SAML responses using a hardened ruleset to detect threats such as XML signature wrapping, replay attacks, and entity injection.
Adds integration via a managed backend (with automatic rule updates within 24 hours of CVE drops), a proxy mode for applications you do not control, and an open-source Node.js library for local validation.
New isAgent NPM package and panel for detecting agentic traffic; Dashboard redirect URL management.
└──▷ HOW TO FIND IT
Access the new redirect URL settings in the Stytch Dashboard.
📍Go to https://stytch.com/dashboard/redirect-urls or Configuration › Redirect URLs tab.
Adds the @stytch/is-agent npm package with an isAgent() function returning is_agent_client_hint and identity, plus a React <IsAgent> component to detect and handle programmatic/LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. traffic
Adds Dashboard navigation to Configuration > Redirect URLs tab at /dashboard/redirect-urls to update and assign defaults for project redirect URLs
New isAgent NPM package for AI traffic detection, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. panel event, and dashboard redirect URL editor
└──▷ HOW TO FIND IT
Use the new package to conditionally render content for AI agents like ChatGPT.
📍<IsAgent>
<p>Hello, agent!</p>
</IsAgent>
Adds @stytch/is-agent NPM package with JavaScript/React support to detect agentic traffic via is_agent_client_hint and identity fields This is not a security measure: attackers can modify browser responses.
Enables editing and assigning default project redirect URLs in the Dashboard under Configuration > Redirect URLs tab or /dashboard/redirect-urls path
JumpCloud releases App Catalog for macOS to manage apps without MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. enrollment
Adds the JumpCloud App Catalog for macOS, enabling installation and management of curated applications without MDM enrollment.
Enables automatic application updates within the macOS App Catalog to reduce manual maintenance overhead.
2 details in Everything
2 more releases in this issue
· 2025-08-05 → 2025-08-14
JumpCloud adds B2B and custom app support to Apple VPP via new API and updates Go extension for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. auth
Adds support for B2B and custom applications in Apple VPP synchronization via the new App and Book Management API.
Releases JumpCloud Go Chrome Browser Extension version 1.3.25 to enable seamless authentication for Google Workspace users.
Migrates Apple VPP backend from legacy API to App and Book Management API to improve infrastructure reliability.
Passbolt 5.4 stabilizes encrypted metadata, adds ECC keys for new users and a Czech locale.
Adds GET /metadata-settings-getting-started API endpoint to help clients enable E2EE by default for new instances
Sets ECC (Curve25519Curve25519The elliptic-curve key exchange most modern TLS, SSH and WireGuard connections use to agree on a session key. Post-quantum hybrids pair it with ML-KEM./Ed25519Ed25519A fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe.) keys as the default key type for newly created users
Increases the maximum size of secret notes to 50,000 characters
Adds support for importing and exporting multiple URIs on KDBX files in the browser extension
Adds support for importing and exporting custom fields on KDBX files in the browser extension
+2 moreshow less
Makes encrypted metadata stable by default for all new Passbolt instances
Adds azure_sso.login_hint configuration setting to configure Azure SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login hints
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The legacy endpoint is replaced by /complete/recover.json for resource recovery
Nudge Security is a SaaS security platform that discovers shadow IT assets, manages identity governance, and hardens security posture.
Nudge Security adds department-level visibility and direct status management for AI tool access in the usage dashboard
Adds department filtering to the AI usage dashboard to see which AI tools have access to sensitive data like email, files, and source code per department
Enables changing app status directly within the AI usage dashboard without leaving the interface
Authentik v2025.8.1 adds ingress.pathType config for Outposts and fixes several bugs
└──▷ GET THIS VERSION
$ git clone --branch version/2025.8.1 https://github.com/goauthentik/authentik.git
# already have the repo? check out this version:$ git checkout version/2025.8.1
Adds ingress.pathType configuration option to Outposts to allow setting the Kubernetes Ingress path type
Commvault Cloud is a backup, recovery, and cyber-resilience platform for hybrid, multi-cloud, and SaaS workloads.
Commvault Cloud August 2025: Proxmox app-consistent backups, Ubuntu Cleanroom recovery, and DB restore scheduling.
Adds app-consistent backup support for Proxmox VMs using pre/post-thaw scripts with QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. tools.
Adds Azure Local SaaS offering to protect VM workloads in the Azure Local environment.
Adds load balancing for multiple file indexing and live browse nodes to distribute traffic intelligently.
Adds unified onboarding wizard for Azure Blob Storage, Azure ADLS Gen2, and Amazon S3.
Adds automated driver/agent injection for Ubuntu VMs during recovery into AWS Cleanroom.
+4 moreshow less
Enables Threat Scan malware scans on restored AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. virtual machines before production reintroduction.
Adds automatic selection of optimal access nodes for VM recovery in Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. environments.
Adds change tracking via allocated block detection for Proxmox VE backup operations.
Allows tenant admins to edit copy properties such as compliance lock and retention days for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. bundled storage.
9 details in Everything
└──▷ BREAKING ON UPGRADE
!Azure Stack HCI has been renamed to Azure Local; all user interfaces, menus, tooltips, error messages, and documentation have been updated.
Druva is a SaaS data protection platform that backs up enterprise workloads, endpoints, and SaaS applications and restores them after ransomware.
Druva adds Cyber Resiliency Readiness Score with interactive dashboard widget and inline configuration
Adds Cyber Resiliency > Readiness Score card to the Cloud Platform Console dashboard showing a sunburst chart and list view for real-time resilience posture tracking.
Enables in-app configuration of Cyber Resilience settings directly from the new readiness widget.
2 details in Everything
9 more releases in this issue
· 2025-08-02 → 2025-08-28
Druva eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. now allows up to 150 characters for Legal Hold names.
Expands the Legal Hold Name character limit from 35 to 150 characters.
Druva adds Azure Blob Storage protection and Nutanix AHVAHVAcropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. auto-config rules
Adds data protection for Azure Blob Storage with encrypted backup copies accessible via Druva Cloud.
Introduces Auto Configuration Rules for Nutanix AHV virtual machines to automate backup setup using categories.
Supports backups and restores for Transparent Data Encryption (TDE) enabled databases in Azure SQL.
Druva M365 Aug 9 2025 adds eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. Download Client v2.2.0 and groups SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. status alerts into daily digests
Updates the eDiscovery Download client to version 2.2.0 with minor enhancements.
Reduces SaaS Apps Status alert severity from Critical to High and groups disconnections by app.
Sends a single daily digest email to subscribed admins for all disconnected apps instead of immediate per-event alerts.
eDiscoveryeDiscoveryA legal process for identifying, collecting, and producing electronically stored information in response to litigation or investigation; cyber tools integrate with it to extract and preserve forensic evidence in legally defensible formats. Download client v2.2.0 update available for Cloud.
Druva MSPMSPA managed service provider, a company that operates IT services for customers. It may manage systems, networks, backups or other ongoing technology needs. introduces Safe Mode for immediate incident containment and access restriction in the Cloud Console
Adds Safe Mode, a new security feature that restricts Cloud Console access and data operations during incidents
Druva Salesforce updates include SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login capabilities and Bulk API support for data backups.
Users can now log in to the Druva Salesforce app using SSO instead of multiple credentials.
Data backups can leverage Salesforce Bulk API with configurable daily usage limits.
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The Salesforce SSO login feature, once enabled via the toggle, cannot be disabled again.
Adds workerPodMetricSidecar.resources.[requests|limits].ephemeral-storage Helm values to control ephemeral storage quotas for dynamically created metrics sidecar containers.
Adds genericVolumeSnapshot.resources.[requests|limits].ephemeral-storage Helm values to control ephemeral storage quotas for dynamically created worker pods.
Adds gateway.resources.[requests|limits].ephemeral-storage Helm values that propagate to the Gateway deployment resource quota.
Adds global.resources.[limits|requests] Helm value that applies to all Kasten K10 pods (except Prometheus, which uses prometheus.resources), overridable per-pod via resources.<service-name>, and serves as a fallback for dynamically created pods without specific resource configurations.
Updates the Licenses page with new license and node usage cards and a compliance status card identifying nodes running Veeam Kasten-protected workloads that are not licensed.
5 details in Everything
└──▷ BREAKING ON UPGRADE
!Kanister blueprint functions CreateVolumeSnapshot, WaitForSnapshotCompletion, CreateVolumeFromSnapshot, and DeleteVolumeSnapshot are no longer available.
1 more release in this issue
· 2025-08-08 → 2025-08-22
Ubiq adds custom IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. integration support for MSSQL and .NET libs via dashboard
└──▷ HOW TO FIND IT
Set an expiration date when creating a new API key to enforce automated rotation policies.
📍In the Ubiq Dashboard, create a new API key and specify the desired expiration date in the API Key Expiration field.
Adds API Key Expiration capability allowing users to set expiration dates on newly created API keys in the Dashboard
Adds new UI configuration for managing custom IDP integrations in the Ubiq Dashboard, supporting MSSQL without SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave.
Email DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. Proxy now processes multiple outbound emails in a single session.
Netskope Inline App Connector AC-129.0.0 adds DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Teams Scheduled Messages and Azure Azcopy file upload detection.
Adds Microsoft Teams DLP support for Scheduled Messages as Post activity
Adds support for Microsoft Azure Azcopy connector to detect file uploads exceeding 8MB
Adds Postman block policy enforcement for Create and Edit activities using websockets
Adds upload activity detection and Instance ID support for Google Firebase Storage back-end storage (requires account team enablement)
Adds Yahoo App Suite phone one-time-password (OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets.) based login support
+1 moreshow less
Adds Google Translate activity detection for the translate.google.com.tw domain
Publisher 129 adds GSLB auto-reconnect, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. domain field, and deprecates auto-upgrade for pre-R125 versions.
Adds GSLB auto-reconnect capability to automatically reconnect the Publisher when latency increases beyond a threshold
Separates the AD Domain field on the RDP Login Page for explicit domain entry
Netskope Virtual Appliance 128 introduces Destination Profiles and Service Objects with new APIs for granular policy enforcement.
Introduces Destination Profile as a new object type replacing URL Lists, enabling case-insensitive matching and mixed IP/domain entries for SWGSWGA Secure Web Gateway is a network proxy that inspects outbound web traffic, enforcing policy by blocking malicious sites, filtering content, and decrypting TLS — giving cyber tools a choke point for all user HTTP/S sessions. and Cloud Firewall policies
Adds support for matching network traffic by destination port via the new Service Objects feature, allowing Real-time Protection rules on TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports/ranges and SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. decryption exclusions by port
Netskope 129 adds RBI background tabs, Transparent Isolation for social logins, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. Forward Proxy auth, retroactive scan reporting and Android 16 support.
configurable relative latency threshold (0.0 to 1.0) enables Dynamic Reconnection in NPA Publisher based on latency improvement percentage
--password flag added to nsdiag -t disable command to accept master password as an argument
New Accept-Language parameter transport to RBI isolated pages for correct browser language detection
microsoft_purview_acknowledged and microsoft_purview_processing_status fields replace sent_to_microsoft_purview in Skope IT Events attributes
New Netskope Activity boolean field in Next Generation API Data Protection Application Events to distinguish real user vs automated activity
+4 moreshow less
Data Scanned tab with UI columns Entitlement Metric, Platform, Total GB Scanned, and Unit added for retroactive scan usage reporting in CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. API Usage
New alert type Tombstone Failed and disabled Restore/Block actions for SharePoint quarantine failures due to Require Check Out
nsdiag -t disable --password <master password> new option to disable Netskope Client via CLI with master password argument
OpenID ConnectOpenID ConnectOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) support for Forward Proxy Auth enrollment methods (NS Client, IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications./GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation., Enterprise Browser, CEP)
DEM August 2025 adds site-based performance/availability alerting and bulk CSV/JSON/YAML import/export for sites and gateways.
Adds three new Site-Based Alert types: Site-to-POP Performance, Site-to-Application Performance, and Site-to-Application Availability to trigger notifications based on latency or availability thresholds for designated Sites.
Adds bulk import and export capabilities for Sites and Gateways objects via the DEM settings UI, supporting CSV, JSON, and YAML formats with a native compare feature for change verification prior to overwrite.
Cyera introduces a new capability to classify data subjects by age group, enabling more granular privacy control and auditing capabilities for security teams.
Age-based classification allows security teams to automatically tag users as Children, Young Teens, Older Teens, or Adults.
Bytebase 3.9.2 adds hard-delete for projects/instances, draft plan modification, Entra IDEntra IDMicrosoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments.SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. normalization, PostgreSQL CREATE RULE support, and API pagination/filtering.
└──▷ GET THIS VERSION
$ git clone --branch 3.9.2 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.9.2
Adds the ability to hard-delete projects and instances after they are archived
Adds support for adding or removing changes in draft plans
Streamlines approval workflows with a new 'one-click ready for review' action
Updates UpdateMask values in the UpdatePolicy API to follow AIP conventions (field names only, no oneof type names)
Adds normalization of SCIM user emails to lowercase when authenticating via Entra ID
+6 moreshow less
Adds support for the PostgreSQL CREATE RULE statement in the SQL editor
Adds pagination and filtering capabilities to the Group API endpoint
Adds support for empty environments in Terraform instance and database resources
Adds support for filters in Terraform group list data sources
Updates Terraform masking_exception_policy to support the raw_expression field, which overrides other masking fields when provided
Deprecates column, member, and action fields in the Terraform masking_exception_policy in favor of their pluralized counterparts
11 details in Everything
└──▷ BREAKING ON UPGRADE
!The UpdateMask values in the UpdatePolicy API now omit oneof type names, using field names only (see PR #17240)
1 more release in this issue
· 2025-08-14 → 2025-08-28
Bytebase 3.9.1 adds file-backed PG_URL hot-reload, AWS OpenSearchOpenSearchAn open-source search and analytics engine, forked from Elasticsearch by AWS in 2021, that lets cyber tools store, query, and visualize large volumes of log or event data without licensing restrictions.IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. auth, and Terraform sync_databases/masking exceptions
└──▷ GET THIS VERSION
$ git clone --branch 3.9.1 https://github.com/bytebase/bytebase.git
# already have the repo? check out this version:$ git checkout 3.9.1
Adds PG_URL file reading with hot-reload support
Adds AWS OpenSearch IAM authentication support
Adds sync_databases attribute to Terraform instance resource
Adds masking exception configuration in Terraform to skip specific databases, tables, or columns across a project
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The deprecated --pg command-line flag is removed; use the PG_URL environment variable for external PostgreSQL connections instead.
!The --disable-metric flag is replaced by a Workspace setting (the CLI flag no longer exists).
Varonis adds AWS GovCloud integration to Varonis for DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. service.
Adds a Multimatch Validation workflow in the UI to review impacts and conflicts when enabling multimatch on application segments.
Adds a Multimatch Validation window that appears when Multimatch is enabled on Application Segments to identify impacted segments and conflicting features.
1 detail in Everything
41 more releases in this issue
· 2025-08-01 → 2025-08-29
Zscaler EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds ROI scoring for findings, visible on a new Findings Impact page and Top 5 dashboard widget.
Adds Findings Impact page under Insights to view findings' ROI scores, impacted asset counts, and affected percentage.
Adds Top 5 Findings by ROI widget on the Insights dashboard to highlight highest-ROI findings.
Simplified SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels.OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. flow removes country/phone re-entry step for faster authentication
Removes the country and phone number re-entry step in SMS OTP MFAOTP MFAAn authentication scheme that combines a one-time password — a code valid for a single login or short window — with a second factor, so stolen passwords alone cannot grant access., allowing direct entry of the OTP code
ZIA adds Cloud-to-Cloud DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. forwarding, third-party URL lookup, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. rule logging fields, and new API endpoints
Adds Cloud-to-Cloud Incident Forwarding for DLP policies to forward incidents to external appliances such as GCP, AWS EC2EC2Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware., or Azure VMs.
Adds Enable 3rd-Party URL Category Lookup option on the Advanced Policy Settings tab (Policy > URL & Cloud App Control) for uncategorized URLs.
Adds new API endpoints GET /cloudToCloudIR, GET /cloudToCloudIR/{id}, GET /cloudToCloudIR/lite, GET /cloudToCloudIR/count, and GET /cloudToCloudIR/config/{id}/validateDelete to manage Cloud-to-Cloud Incident Receivers.
Updates /webDlpRules and /casbDlpRules endpoints: receiver attribute is now supported for all incident receiver types; zscalerIncidentReceiver and icapServer attributes are deprecated in favor of receiver.
Adds SSL Policy Name filter and column to Web Insights Logs.
+1 moreshow less
Adds %s{ssl_rulename} field to NSS Feed Output Format for web logs.
6 details in Everything
└──▷ BREAKING ON UPGRADE
!The zscalerIncidentReceiver and icapServer attributes in /webDlpRules and /casbDlpRules endpoints are deprecated and no longer supported; API calls using these attributes will fail.
ZIA adds Gen AI report insights, 3rd-party URL lookup, API search params, and EUSA endpoints
└──▷ USE IT
Configure NSS feed output format to include SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. rule name in logs
text
%s{ssl_rulename}
Adds Enable 3rd-Party URL Category Lookup option on the Advanced Policy Settings tab (Policy > URL & Cloud App Control) to allow lookup for uncategorized URLs using a third-party database
Adds new request parameters srcIps, destAddresses, srcIpGroups, destIpGroups, nwApplication, nwServices, and destIpCategories to the GET /firewallFilteringRules API endpoint to support searching firewall rules by IP, groups, application, service, or category
Adds new API endpoints GET /eusaStatus/latest and PUT /eusaStatus/{eusaStatusId} to the cloud service API for programmatic access to End User Subscription Agreement (EUSA) acceptance status
Adds Prompt Classification as a filter and column in Web Insights Logs and an Analyze More option in the Gen AI Security Report to view sanctioned/unsanctioned usage, content types, and department-level visibility
Adds SSL Policy Name as a filter and column in Web Insights Logs, and supports %s{ssl_rulename} field in NSS Feed Output Format for web logs
Adds PPTX report generation for individual EASMEASMExternal Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. organizations via the Administration UI
Enables administrators to generate PPTX reports for individual EASM organizations, translating automated discovery findings into strategic insights.
ZIA DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. now supports OpenOffice Drawings (.odg, .otg) for content inspection
Data Loss Prevention (DLP) policies now inspect OpenOffice Drawings files (.odg, .otg)
ZIA adds OpenOffice DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support and Step-Up Authentication for high-risk access.
OpenOffice Drawings (.odg, .otg) file types are now supported in DLP policies with Content Inspection.
Step-up authentication can be configured via URL Filtering and Cloud App Control policies to require additional identity verification before accessing sensitive resources.
Risk360 adds granular DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. factors replacing the deprecated Are DLP Policies Configured factor.
Adds Data in Motion, Data at Rest, and Endpoint DLP factors to the Data Loss Prevention category for risk quantification
Adds Outbound Email DLP and General DLP factors to the Data Loss Prevention category
Removes the Are DLP Policies Configured factor from the Risk360 Admin Portal
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The existing Are DLP Policies Configured factor is no longer available in the Risk360 Admin Portal.
Zscaler Deception adds AI decoy recommendations, new dashboard queries, landmine policy visibility, and ThreatParse rules.
AI-Powered Recommendations for Zero Trust Network Decoys generate pre-configured decoys using AI analysis of ZPA deployments
Dashboard Enhancements include advanced queries like Internal - High Priority Threat Detection, Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Threat Detection, Identity Threat Detection, CVE Threat Detection, External - High Priority Threat, Lateral Movement, Database Threat Detection, Cloud Threat Detection, and Whitelisted Events in the Select Query drop-down menu
Attack Types filter includes a new Cloud option to filter alerts
New ThreatParse Rules detect exploits for Ivanti Endpoint Manager Mobile (CVE-2025-4427), Themewinter Eventin (CVE-2025-47539), Dassault Systèmes DELMIA Apriso (CVE-2025-5086), Commvault Command Center (CVE-2025-34028), and Microsoft Sharepoint (CVE-2025-53770)
User Interface Changes and Enhancements rename tabs in the Zscaler Deception Admin Portal: Settings > User & Roles > SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. to IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Providers, Settings > Users & Roles > Support Users to Zscaler Remote Assistance, Settings > Advanced Settings > Maintenance to Manage Events & Evidence, and Settings > Advanced Settings > Debugging to Show/Hide Internal Components
+1 moreshow less
View Landmine Policies in Landmine-Based Events adds the landmine.applied_policies field to the Events page
6 details in Everything
└──▷ BREAKING ON UPGRADE
!Settings > User & Roles > SSO is renamed to IdP Providers
!Settings > Users & Roles > Support Users is renamed to Zscaler Remote Assistance
!Settings > Advanced Settings > Maintenance is renamed to Manage Events & Evidence
!Settings > Advanced Settings > Debugging is renamed to Show/Hide Internal Components
ZIA adds folder-level permission triggers for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy rescans in OneDrive and SharePoint
Adds automatic DLP policy rule rescanning for files in OneDrive and SharePoint folders when permissions are modified or shared with a new collaborator
Zscaler DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds unmanaged AI detection, stale data insights, Identity Inventory, and wildcard scan exclusions
Adds Dashboard Enhancements with clickable AI Security summary tiles and resource type hover details
Adds Detection of Unmanaged AI Services and Models scanning VMs for installed services via policy alerts
Adds Stale Data Detection for data untouched for over 90 days with specific dashboard tiles (AWS S3, AWS, Azure, GCP)
Adds Support for AWS Bedrock Custom Models visibility for custom and imported models
Adds new Data Posture Policies for AWS, Azure, GCP, Snowflake, and On-Premises environments covering sensitive data and encryption controls
+5 moreshow less
Adds Identity Inventory feature to scan for identities with excessive privileges and access details
Adds Snowflake Entitlements details in Resource Inventory including permission grants and investigation queries
Adds Evidence UI Enhancements showing DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine relevance, file prefix/suffix context, and direct original file links
Adds Monitor Identities Having Access to Sensitive Files tab showing identity actions and source IP for last 7 days (AWS S3 only)
Enables use of wildcards to exclude AWS, Azure, and GCP data stores from scanning in scan settings
ZTB 8.0.4 adds DHCP on WAN for activation, custom DNS policies with gateways/responses/rejects, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. support, and ZT8010 hardware support.
Allows DHCP to be used on the primary WAN interface for device activation
Enables configuration of custom Site DNS Policies with defined DNS gateways, match conditions (source IP/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. + FQDN), and actions (forward, override, reject)
Adds predefined DNS policies for Zscaler domains (redirect to WAN DNS), AppC process queries (forward to private DNS), and app segment FQDNs (synthetic IP)
Establishes predefined routing policies (Default-ZPA-PBR, Default ZIA Rule, Default-App-Segment-PBR) and firewall policy for Airgap Network
Adds border gateway protocol (BGP) support on WAN links for active/standby gateways to pre-learn routes
+2 moreshow less
Adds DHCP relay support over routed tunnel and ZPA app segments
Supports the ZT8010 platform with 8x 10G SFP+ ports, 10x GbE RJ45 ports, and redundant power supply
ZDX Module 4.4.1.12 enhances remote PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. with configurable durations, file sizes, and header/payload filtering
ZDX Module 4.4.1.12 adds support for longer packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. durations in ZDX.
ZDX Module 4.4.1.12 allows configuring maximum file sizes for remote PCAP captures.
ZDX Module 4.4.1.12 enables header- or payload-specific data collection options for remote PCAP.
Client Connector adds alwaysAllowed firewall param for macOS and fixes Windows PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. parser crash with V8 JS parser
Adds alwaysAllowed parameter to the macOS firewall configuration to control bypassed traffic handling
Introduces V8 JavaScript based PAC Parser as a configurable option in the app profile to resolve ZSATunnel crashes
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The detectAltInterfaceTraffic firewall parameter is deprecated on macOS and must be replaced with enforceTrafficViaTunnel in MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. configurations.
ZPA Private Access adds LAN IP/subnet support for legacy VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. segments and Multimatch validation window.
Supports adding LAN IP addresses and subnets for VPN (for Legacy Apps) network segments
Adds a Multimatch Validation window to review impacted application segments and conflicting features when Multimatch is enabled
Workflow Automation adds Cloud-to-Cloud DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. forwarding to AWS/Azure and new Incidents Dashboard widgets
Adds Cloud-to-Cloud Forwarding support in the DLP Application Integration for sending incident metadata and evidence files to AWS S3 storage buckets and Azure storage containers via the ZIA Admin Portal.
Network Connector 25.46.2 updates RPM packages for RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8.x/9.x and prepares Diagnostics page details.
ZPA App Connector 25.46.2 introduces container security enhancements for Kubernetes and extends platform support to RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8.x/9.x via RPM packages, alongside general optimizations.
Supports Kubernetes enhancements to improve container security
Provides updated App Connector RPM packages for Red Hat Enterprise Linux 8.x and 9.x
ZIA adds new EDM data types for Uruguay and Chile/Peru DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. templates, plus folder-level rescanning in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security DLP.
Adds National Document ID (Uruguay), National Identification Number (Chile), and National Identification Number (Peru) as selectable EDM data types for DLP templates
Enables automatic rescan of files in Microsoft OneDrive and SharePoint folders when permissions are modified or the folder is shared with a new collaborator
ZPA adds new Cloud Service API endpoints for programmatic control of Application Segment Multimatch.
Adds POST /customers/{customerId}/application/multimatchUnsupportedReferences endpoint to manage unsupported references in application segment multimatch programmatically
Adds PUT /customers/144118148382064640/application/bulkUpdateMultiMatch endpoint for bulk updates of application segment multimatch settings
ZIA adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Policy Name filter/column in Web Insights Logs and %s{ssl_rulename} field to NSS Feed Output Format
└──▷ USE IT
Include the SSL rule name in outgoing web log feeds for downstream SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. analysis.
text
%s{ssl_rulename}
Adds SSL Policy Name as a filter and column in ZIA Admin Portal Web Insights Logs to identify which specific SSL Inspection rules were applied to web transactions
Adds %s{ssl_rulename} field to NSS or Cloud NSS feed output format for web logs to export the associated SSL rule name
DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds custom tag validation, unmanaged AI detection, stale data metrics, Identity Inventory, wildcard scan exclusion, and Evidence UI enhancements.
Enables Custom Tag Validation to align onboarding tags with CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. guidelines during account onboarding
Adds unmanaged AI services and models detection by scanning VMs and raising policy alerts for specific risk
Introduces Stale Data Detection with insights for files accessed or modified >90 days across AWS, Azure, GCP
Provides visibility into AWS Bedrock Custom Models and AWS Bedrock Imported Models in the AI Security dashboard
Adds 29 new data posture policies across AWS, Azure, GCP, Snowflake, and On-Premises environments
+5 moreshow less
Launches Identity Inventory to scan data stores for identities with excessive privileges and sensitive access
Expands Resource Inventory with Snowflake entitlements and database access analysis via investigation queries
Enhances Evidence UI with prefix/suffix context for file triggers, relevant DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines, and original file links
Adds Monitor Identities Having Access to Sensitive Files tab showing identity actions and source IPs for last 7 days
Supports wildcard exclusions in scan settings for AWS S3, Azure storage, and GCP Cloud Storage data stores
The AI-Powered Recommendations by Confidence % widget is renamed to AI-Powered Recommendations by Attack Surface Reduction % in the Applications dashboard.
ZPA App Connector Helm chart consolidation, new capability modes, and multi-file isolation uploads.
Supports capabilityMode values of minimal, full, or custom in the unified zpa-app-connector Helm chart to control container security capabilities
Allows setting createNamespace: true/false in values.yaml to control automatic namespace creation during deployment
Supports labels in values.yaml to add deployment-level labels for monitoring and alerting
Enables uploading multiple files simultaneously in ZPA isolation sessions with no upload limits
4 details in Everything
└──▷ BREAKING ON UPGRADE
!The Helm chart directories zscaler-et-dist/helm-charts/k8s/ and zscaler-et-dist/helm-charts/openshift/ are deprecated in favor of the new unified zpa-app-connector chart
!For Kubernetes deployments of App Connector version 25.45.1 or earlier, using minimal or customcapabilityMode will cause unexpected behavior; only full mode is safe
ZIA adds device groups to forwarding rules, step-up auth for conditional access, new DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. types, and API updates for EUSA status and firewall search.
Adds Device Groups criterion in Policy > Forwarding Control > Add Forwarding Rule window for platform-based forwarding
Enables step-up authentication with conditional access in ZIA Admin Portal URL Filtering and Cloud App Control policies
Expands Audit Logs search on zscalerone.net to support searching JSON attribute values via the Changes filter
Updates GET /firewallFilteringRules API endpoint to accept srcIps, destAddresses, srcIpGroups, destIpGroups, nwApplication, nwServices, and destIpCategories parameters
Adds GET /eusaStatus/latest and PUT /eusaStatus/{eusaStatusId} endpoints to the cloud service API for EUSA acceptance status
+1 moreshow less
Adds National Document ID (Uruguay), National Identification Number (Chile), and National Identification Number (Peru) as selectable EDM data types in DLP templates
ZPA adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 Private Cloud Controller images to AWS and Azure Marketplaces.
Zscaler Business Insights now allows users to filter application insights on the All Applications page using multiple criteria such as risk index and contract dates.
ZIA adds collaborator group filtering in SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights logs and NSS feed output fields for File Sharing Applications.
Adds %s{intcollab_groups}, %s{ointcollab_groups}, %s{b64intcollab_groups}, %s{extcollab_groups}, %s{oextcollab_groups}, and %s{b64extcollab_groups} to NSS Feed Output Format for File applications.
Adds External Collaborator Group and Internal Collaborator Group filters and columns to SaaS Security Insights Logs for the File Sharing Applications category.
Adds External Collaborator Group and Internal Collaborator Group columns and advanced filters in the Files tab of Assets with Incidents (Analytics > SaaS Security > Assets > Assets with Incidents).
Supports number of internal and external collaborators as scoping criteria for Google Drive in SaaS Security Data at Rest Scanning DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy.
Termius 9.28 adds mlkem key exchange methods for OpenSSH servers supporting Post-QuantumPost-QuantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. KEX.
mlkem512-sha256, mlkem768-sha256, and mlkem1024-sha384 key exchange methods now supported (requires OpenSSH OQS-v9+ server)
innernet v1.7.0 adds OpenBSD support, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. rename, peer enable/disable CLI flags, and offline state restore.
└──▷ GET THIS VERSION
$ git clone --branch v1.7.0 https://github.com/tonarino/innernet.git
# already have the repo? check out this version:$ git checkout v1.7.0
└──▷ TRY IT
Install innernet directly from crates.io without needing a pre-built package.
$ cargo install innernet
Supports unspecified IP addresses with override-endpoint, giving more flexibility when overriding peer endpoints.
Adds new client and server commands to rename a CIDR block.
Adds CLI parameters to enable or disable individual peers.
Experimental support for OpenBSD as a new platform.
Periodically writes peer mappings to /etc/hosts on the innernet server, enabling hostname-based access across the network.
+3 moreshow less
Exposes innernet-server as a library crate (renamed from server) for programmatic use.
Adds a /user/capabilities API endpoint to query server capabilities.
Published on crates.io, enabling installation via cargo install innernet.
Support for wildcard * in Kubernetes role kubernetes_users and Helm chart support for tbot plugin credentials
└──▷ GET THIS VERSION
$ git clone --branch v18.1.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.1.8
Allows setting * in role kubernetes_users to grant access to all users instead of listing them individually.
Helm charts for teleport-plugin-discord, teleport-plugin-email, teleport-plugin-jira, teleport-plugin-mattermost, teleport-plugin-msteams, teleport-plugin-pagerduty, and teleport-plugin-event-handler now support obtaining plugin credentials using tbot.
2 details in Everything
6 more releases in this issue
· 2025-08-05 → 2025-08-29
tbot can now manage Argo CD clusters and specifies Kubernetes Secret namespace; OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. connector gains separate request_object_mode
└──▷ GET THIS VERSION
$ git clone --branch v18.1.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.1.7
└──▷ TRY IT
Re-enable MySQL health checks that are disabled by default in this release.
$ export TELEPORT_ENABLE_MYSQL_DB_HEALTH_CHECKS=1
tbotkubernetes/argo-cd output service added for MWI to manage Argo CD clusters
Environment variable TELEPORT_ENABLE_MYSQL_DB_HEALTH_CHECKS allows re-enabling MySQL database health checks (disabled by default)
request_object_mode setting enabled for the MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. flow in OIDC connectors
Adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-Secured Authorization to OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., Azure VMSS joining, gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. size env var
└──▷ GET THIS VERSION
$ git clone --branch v18.1.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.1.6
└──▷ TRY IT
Override the default client-side gRPC message size limit for large sessions.
Teleport v17.7.2 adds JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store.-Secured Authorization for OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user., bot device modes, and CLI flags
└──▷ GET THIS VERSION
$ git clone --branch v17.7.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v17.7.2
└──▷ HOW TO FIND IT
Increase the client-side gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. message size limit via an environment variable.
📍export TELEPORT_UNSTABLE_GRPC_RECV_SIZE=10485760
Install the SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. plugin using an OAuth Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. for authentication.
Force output of CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key. signing results even when partial failures occur, useful for HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. clusters.
New CockroachDB web/access support, tctl plugins install scim auth flag, Device Trust modes, and Kubernetes delegated joining. Adds required-for-humans mode to allow bots to run on unenrolled devices.
└──▷ GET THIS VERSION
$ git clone --branch v18.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.1.5
Adds --auth flag to tctl plugins install scim CLI command to support Bearer tokenBearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. and OAuth authentication methods
Enroll new Kubernetes agents in Managed Updates
Adds TeleportDatabaseV3 support to the Teleport Kubernetes Operator
Adds TeleportAppV3 support to the Teleport Kubernetes Operator
Allow the use of ResourceGroupsTaggingApi for KMSKMSA managed service that creates, stores, rotates and controls access to encryption keys, usually backed by HSMs. Applications ask it to encrypt or decrypt rather than holding keys themselves. Key deletion
+8 moreshow less
Tctl top can now display raw prometheus metrics
Enable resource label conditions for notification routing rules
Device Trust: added required-for-humans mode to allow bots to run on unenrolled devices, while enforcing checks for human users
Add new oidc joining mode for Kubernetes delegated joining to support providers that can be configured to provide public OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. endpoints
Enrich the windows.desktop.session.start audit event with additional certificate metadata
Database MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server now supports CockroachDB databases
Added support for CockroachDB Web Access and interactive CockroachDB session playback
Teleport event-handler now accepts HTTP Status Code 204 from the recipient
13 details in Everything
└──▷ BREAKING ON UPGRADE
!Windows desktops cannot be connected to via the Web UI; downgrade proxy servers to 18.1.4, use Teleport Connect instead of the web UI to access desktops, or set your preferred keyboard layout (under account settings) to something other than _system_
Teleport v18.1.3 adds JSONPathJSONPathA query language for extracting values from JSON documents, modeled after XPath for XML. Cyber tools use it to pinpoint specific fields in structured data without parsing the whole document manually. query support for arbitrary JSON OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. claims
└──▷ GET THIS VERSION
$ git clone --branch v18.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:$ git checkout v18.1.3
Aembit adds SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials.JWT-SVIDJWT-SVIDA SPIFFE Verifiable Identity Document encoded as a JSON Web Token, used to prove workload identity across trust boundaries where X.509 certificates are impractical, such as HTTP headers. Credential Provider for workload authentication.
2 more releases in this issue
· 2025-08-19 → 2025-08-26
Aembit adds GitLab CI/CD Component, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. dynamic claims for credential data, and CrowdStrike MAC/IP access conditions
Aembit Edge GitLab CI/CD Component available in the GitLab CI/CD Catalog to simplify pipeline integration.
OIDC ID Token Credential Provider now supports dynamic claims to extract values from OIDC tokens for personalized credential data.
New Access Conditions for CrowdStrike: MAC Address and Local IP Address ensure Host MAC and Local IP match Agent Proxy retrieval.
SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. report review fields (Findings, Controls, Services) converted to 30k-char multi-line text areas
Mondoo expands vulnerability detections with CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmarks and enhances MQLMQLA query language created by Microsoft for hunting across telemetry in Microsoft 365 Defender, letting cyber tools express complex behavioral detections in a structured, readable syntax. for custom policies
Expanded vulnerability detections including the latest CIS benchmarks to strengthen compliance coverage
Added new Ansible remediation snippets for faster threat response
Added new Bash remediation snippets for faster threat response
Added new Terraform remediation snippets for infrastructure remediation
Enhanced Mondoo Query Language (MQL) capabilities to simplify custom policy creation
Vanta adds Issue Management access for Editors role and SentinelOne alert monitoring in public preview.
Expands the Editor role to allow users to create, update, and oversee issues in the Issue Management module
Adds SentinelOne alerts management in public preview, displaying them on the CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps. Alerts page for SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. tracking and remediation
2 details in Everything
4 more releases in this issue
· 2025-08-03 → 2025-09-06
New Tailscale, Keeper, Bocada, and HirePass integrations; Trust Center granular subscriptions and code changes scoping
Add Tailscale integration to sync user accounts hourly for access monitoring and deprovisioning compliance tests.
Add Keeper integration via SCIMSCIMA standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. to sync users and groups hourly for account access tracking and offboarding evidence.
Add Bocada as an integration partner with an initial access-only integration.
Enable HirePass integration using the Connectors API Background Check schema.
Allow Trust Center buyers to subscribe to granular updates instead of receiving all content.
+6 moreshow less
Restrict framework scoping settings to view-only access for users with limited permissions.
Expand Trust Center Private Preview design customization to include buttons, fonts, colors, and borders.
Add CTM knowledge base features including ownership assignment, content health visibility, and automated re-verification.
Add a corrective action card in Issue Management for documenting ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability.-aligned records.
Filter code changes on /code-changes by scoping and segmentation tags to align pull requests with repo scope.
Allow bulk marking of personnel as service accounts or reverting them via the Personnel Hub.
Vanta introduces Policy Library, auto-generated rationale on control drawers, vendor TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. alerts, and improved Issue Mgmt formatting.
Adds new Policy Library UI to manage standard policies (add/remove) for GRCGRCGovernance, Risk, and Compliance — a framework for aligning IT controls with business policy, regulatory requirements, and risk management so organizations can audit and report on their posture systematically. program alignment
Improves direct policy linking on control drawers with auto-generated rationale context
Enables @mentions in policy comments with centralized thread view including approval messages
Introduces TPRM Continuous Monitoring Alerts for high-severity vendor findings (filterable by category/severity/risk)
Improves Issue Management text formatting by preserving line breaks and paragraph spacing
Vanta adds vendor subprocessor visibility in TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data., new Issue Management filters/comments, and Trust Center Account workflows; deprecates public GraphQL API.
TPRM: See Vendor Subprocessors allows viewing vendor subprocessors with details like product names, processing purposes, and geographic locations.
[GA] Trust Center Accounts + Account Workflows enables managing Trust Center Accounts to track trust engagement, manage NDAs/access per account, and monitor activity.
New control scoping via survey in compliance roadmap or settings to automatically unmap unnecessary controls, tests, and evidence.
Issue Management due date filter allows filtering issues by upcoming (7/30 days) or past-due deadlines on the My Work page.
Users can now leave comments directly within Issue Management for discussion and decision documentation.
+2 moreshow less
Assign teams as system approvers/admins for Access Requests allows any team member to act on requests and receive notifications.
Dedicated My Work page groups assigned work by urgency with filters like Needs my approval.
7 details in Everything
└──▷ BREAKING ON UPGRADE
!The public GraphQL API has been fully deprecated; all requests are now redirected to Vanta’s REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..
Vanta adds delegated access request submission, TPRMTPRMAssessing and monitoring the security risk an organization takes on through its vendors, suppliers and service providers. It covers the questionnaires, evidence and continuous checks behind letting a third party hold your data. Q&A export, and Agent SLASLAA formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. remediation with one-click fixes.
Adds the ability to submit access requests on behalf of other users via the Vanta app and Slack flows
Adds export functionality for security review questions and answers from the TPRM flow
Adds Vanta Agent SLA remediation that automatically detects policy/SLA mismatches with one-click fixes
Adds a Risk tab and Risks Associated column in Tests and Asset Management modules to view linked risks without switching contexts
Adds a new Risk tab on Test detail pages (Tests and Cloud Tests) and Asset detail pages that lists all linked risks with columns for Risk ID, name, status, department, assignee, source, and created date
Adds a Risks Associated column to the Asset Management table showing the count of risks per asset; clicking the count navigates directly to the associated risk list
Admins can reassign an unfinished Access Review to an active Scrut user assigned to at least one application in that review.
Admins can change the owner of Draft, Upcoming, Active, or Overdue reviews through the detail-page edit icon; the new owner must be active and assigned to at least one included application.
Azure integration adds subscription scoping and nicknames; existing integrations must be reconfigured to select their scope.
Lets users choose monitored Azure subscriptions and requires existing integrations to be reconfigured; removing a subscription hides its resources and cancels scheduled scans, while re-adding triggers fresh discovery.
Enables adding nicknames to identify environments (e.g., production or staging) during Azure tenant connection
Scrut Monitor automates internal compliance report generation with configurable cadence and attachment to evidence tasks.
Adds Scrut Monitor tab on the Evidence detail page for configuring automated internal reporting workflows
Supports scheduled Employee Directory, Risk Register, and Vendor Compliance reports; unchanged reports are not reattached, and vendor reports export only when all vendors are compliant or reviewed.
Allows enabling Auto-publish evidence task checkbox to automatically publish generated evidence in the workflow
New UI actions and filters for archiving inactive vendors in Scrut
Adds Archive Vendor with required justification; archiving removes any associated Trust Vault sub-processor, disables vendor edits and new documents/questionnaires, and revokes recipient questionnaire access.
Adds vendor status filter to switch between active and archived vendors
Adds Unarchive Vendor action on vendor details page with retention choice for last assessment status
Adds the UK GDPRGDPREU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. framework with pre-mapped controls and cross-framework mappings.
Adds UK GDPR to the available compliance frameworks library
Adds pre-mapped controls linking UK GDPR requirements to internal policies and evidence
Adds cross-framework mappings between UK GDPR and ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, NIST, and EU GDPR
Adds PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. Version 4.0.1 to the Frameworks module.
Framework update adds AI Policy control (K1), updates ISO27001/PCI DSSPCI DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. evidence requirements and endpoint scope for endpoints.
└──▷ HOW TO FIND IT
Suppliers can now define an AI policy during profile completion via the new K1 control.
📍Complete the new K1 AI Policy question in your Risk Ledger supplier profile.
Ensure MFAMFAMulti-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. controls cover customer-facing apps as per updated D6 requirements.
📍Review and update your MFA documentation to explicitly include customer-facing applications for control D6.
Adds a new control question (K1) about AI Policy to assess AI risk governance standards.
Updates MFA control question (D6) to include customer-facing applications.
Expands controls D23-27 from laptops to all endpoints including BYODBYODBring Your Own Device: a policy allowing employees to use personal phones, laptops, or tablets for work, creating a network of unmanaged endpoints that cyber tools must monitor or enforce policy on..
CISO Assistant v2.9.1 introduces custom roles terminology model and CLI PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. authentication
└──▷ GET THIS VERSION
$ git clone --branch v2.9.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.9.1
└──▷ TRY IT
Authenticate CISO Assistant CLI via personal access tokenpersonal access tokenA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it.
$ ciso-assistant --pat <your_pat_token> scan
Import a risk analysis dataset using the data wizard feature (pro)
📍In the console, go to Data › Wizard and select Import Risk Analysis
Filter audit logs by specific business domains in the audit-logs table UI
📍In the console, go to Audit Logs and use the domains filter dropdown to select target areas
audit-logs table gains domains column and filters
CLI now accepts --pat flag for personal access tokenaccess tokenA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. auth
Risk analysis import supported in data wizard (pro)
Controls prioritization view adds impact vs effort review columns (pro)
Terminology model introduces custom risk origins
5 details in Everything
└──▷ BREAKING ON UPGRADE
!CLI authentication now requires the new --pat token flow; existing password-based or default sessions may no longer work
6 more releases in this issue
· 2025-08-06 → 2025-08-30
CISO Assistant v2.9.0 adds threat/reference control imports, risk qualification charts, API score/status support, and new UI controls.
└──▷ GET THIS VERSION
$ git clone --branch v2.9.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.9.0
Adds import capability for threats and reference controls in the UI
Shows risk scenario qualifications via a bar chart in the UI
Displays answered questions within an audit view
Adds a No redirect save button (renaming the existing save action) in create/edit modals
Displays the full path to domains in drop-down menus
+2 moreshow less
Adds score and status parameters to the update_requirement API endpoint
Provides NIST SP-800-53 Rev5 to ISO 27001:2022 mapping library coverage
$ git clone --branch v2.8.2 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.8.2
Adds filters for the findings table to narrow down results
Implements autolocking for deprecated assessments and due audits within campaigns or third parties review
Covers more email notifications with expanded coverage
Improves flash mode layout with annotation, better overflow and navigation
Indicates the risk matrix on a risk assessment to remind definitions
CISO Assistant v2.8.1 adds Objectives/Issues support, assessment locking, and UI enhancements for applied controls and third parties.
└──▷ GET THIS VERSION
$ git clone --branch v2.8.1 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.8.1
└──▷ HOW TO FIND IT
Define new Objectives or Issues in the cyber tooling to track strategic goals and risks.
📍Use the platform UI to create new Objectives and Issues entities under your framework.
Lock an active assessment to prevent further modifications once final.
📍Navigate to the Assessment view and select the lock option for the desired assessment.
Objectives and Issues concepts added to the platform
Assessments can now be locked via a new feature
Applied controls tables and filters improved with new capability
Adds markdown rendering for description/observation fields, observation fields on controls/assets/findings, and audit search by framework name.
└──▷ GET THIS VERSION
$ git clone --branch v2.8.0 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.8.0
Add observation field to applied control, asset and finding
Tasks are included as a sub-item of applied controls with an external link
Adds findings trackers and per-findings visibility in My Assignments, plus applied controls details on reference control pages.
└──▷ GET THIS VERSION
$ git clone --branch v2.7.13 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.13
└──▷ HOW TO FIND IT
Track and monitor individual findings directly within your personal assignment dashboard.
📍In the console, go to My Assignments and look for the new findings trackers and expanded finding details.
See exactly which controls are applied by inspecting a reference control's detail view.
📍Navigate to any reference control in the tool; the details section now lists all attached applied controls.
Adds findings trackers and individual findings to My Assignments view
Enables viewing all applied controls attached to a reference control on its details page
Loads the x-rays page in non-blocking mode for improved responsiveness
CISO Assistant v2.7.12 adds Turkish translation and an experimental priority review matrix via UI steps.
└──▷ GET THIS VERSION
$ git clone --branch v2.7.12 https://github.com/intuitem/ciso-assistant-community.git
# already have the repo? check out this version:$ git checkout v2.7.12
Adds 'experimental priority review matrix' to the applied controls context menu
Portkey Enterprise Gateway 1.14.0 adds Vertex AI timeRangeFilter support and OpenAI GPT-5 parameters.
timeRangeFilter support for Google Search tool in Vertex AI provider updates
New parameters added for GPT-5 compatibility in OpenAI and Azure OpenAI providers
Return reasoning messages if returned by the model in OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code.
Promptfoo tests, evaluates, and red-teams LLM applications to detect vulnerabilities and compare model outputs.
Adds GPT-5 and Claude Opus 4.1 support, cloud model audit sharing, mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. certificate storage, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. agent testing examples.
model provider now supports OpenAI's gpt-5, Anthropic's claude-sonnet-4-20250514, and xAI's grok-code-fast for evals and red teaming
Adds cloud-based model audit sharing to persist scan history, enable team collaboration via centralized storage, and manage recent scan paths
Adds client_certificate store capability for mTLS authentication and signature-based upload support in provider configs
Adds credential sanitization to prevent exposure of secrets in debug logs during evaluation runs
Adds auto-fill capabilities for HTTP provider setup to reduce configuration time
+4 moreshow less
Improves HuggingFace dataset fetching speed and reliability with better retry suggestions
Adds medical_off_label_use plugin to detect inappropriate pharmaceutical recommendations
Adds unverifiable_claims plugin to test susceptibility to fabricated claims
Adds MCP agent testing example for red teaming tool call results
AI-Infra-Guard v3.2 adds model concurrency limit to MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. scans and improves report display
└──▷ GET THIS VERSION
$ git clone --branch v3.2 https://github.com/Tencent/AI-Infra-Guard.git
# already have the repo? check out this version:$ git checkout v3.2
Optimizes MCP Scan Report data dimensions and narrow-screen layout
ToolHive operator v0.0.17 adds LM Studio client support, environment variable secrets fallback, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server telemetry for Kubernetes.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.17 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.17
Adds feat(client): add LM Studio support enabling ToolHive to connect as a client to LM Studio instances
Adds Telemetry Support for ToolHive MCP Servers in Kubernetes to collect operational metrics from deployed servers
2 details in Everything
18 more releases in this issue
· 2025-08-01 → 2025-08-29
ToolHive v0.2.12 adds optional Keycloak deployment, remote server management, and upstream MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry support.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.12 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.12
└──▷ USE IT
List all Kubernetes resources across all namespaces using the new flag.
shell
toolhive list --runtime kubernetes --all-namespaces
Manage workloads on a remote server, such as restarting a specific tool instance.
shell
toolhive restart <remote-server-id> <tool-id>
THOVERRIDE tool overrides now supported in RunConfig.
Added --all-namespaces flag to the Kubernetes runtime list command for broader visibility.
Optional Keycloak deployment available for local Kind cluster setup.
Support for upstream MCP registry format enables compatibility with standard MCP server listings.
Remote servers are now supported in workload management commands (stop, restart, rm).
ToolHive operator now supports upstream MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registry format and allows tool overrides in RunConfig
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.16 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.16
Adds runSpec.toolOverrides support to the RunConfigCRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. schema for overriding MCP server binaries/arguments at deploy time
Adds native parsing for the upstream MCP registry JSON format (index.json) alongside the legacy format in .toolhive/config.yaml
2 details in Everything
└──▷ BREAKING ON UPGRADE
!Container runtime detection for Kubernetes deployments now requires the environment variable TOOLHIVE_RUNTIME=kubernetes to be explicitly set (previously optional or auto-detected).
ToolHive v0.2.10 adds an API server builder pattern with middleware support and a new GET Workload Status endpoint.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.10 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.10
Adds an API server builder pattern with middleware support (Add API server builder pattern with middleware support) allowing custom HTTP middlewares to be inserted into the ToolHive server lifecycle
Adds a GET Workload Status API endpoint to retrieve the status of running workloads
2 details in Everything
└──▷ BREAKING ON UPGRADE
!The --remote flag is removed from commands used to run a remote server
ToolHive v0.2.9 adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server groups, --env-file support, and allows server names in thv mcp commands
└──▷ GET THIS VERSION
$ git clone --branch v0.2.9 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.9
└──▷ USE IT
Load secrets for a new MCP server from an .env file instead of CLI args.
shell
thv run --env-file ./server.env <server_name>
List servers using their registry name rather than a full URL.
shell
thv mcp list <server_name>
thv run --env-file <path> loads environment variables from a file for the spawned server
New groups feature to organize MCP servers into logical groups with client-side control
thv mcp list now accepts MCP server names in addition to URLs
ToolHive Operator 0.2.6 adds server name support for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. lists and SSESSEServer-Sent Events, a browser API and HTTP-based protocol where a server pushes a stream of text events to a client over a single long-lived connection, giving tools a lightweight alternative to WebSockets for one-way real-time updates. proxy default.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.6 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.6
└──▷ USE IT
Use a human-readable identifier instead of the full URL when listing MCP servers.
shell
thv mcp list my-server-name
thv mcp list now accepts server names in addition to URLs
ToolHive Operator adds groups support and a new Workload API endpoint
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.5 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.5
Enables grouping workloads in ToolHive to organize and manage them as logical units.
Adds POST /workloads/editREST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoint for editing existing workloads.
ToolHive Operator v0.2.4 adds a Helm chart for Kubernetes deployment and normalizes registry schema tags.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.4 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.4
Normalizes tag values for server and remote_server in the Registry schema
ToolHive v0.2.8 adds group support to CLI stop command and exposes resource-url via MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.8 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.8
└──▷ USE IT
Stop all workloads in a specific group without stopping others
shell
toolhive stop --group my-group
Add group flag to toolhive stop command to selectively stop workloads within a group
Expose resource-url parameter through MCPServer CRD for external resource targeting
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. add ServiceAccount attribute to MCPServer CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. and group flag to stop command
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.15 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.15
└──▷ TRY IT
Stop all tools belonging to a specific group.
$ toolhive stop --group my-tools
Adds ServiceAccount field to the MCPServer CRD schema for specifying the service account to use when creating pods.
Adds --group flag to the toolhive stop CLI command to allow stopping tools by group.
ToolHive Operator v0.2.2 adds OpenShift deployment support and returns registered groups via API.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-0.2.2 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-0.2.2
Supports deploying the ToolHive Operator into OpenShift
ToolHive CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. gain schemaVersion field in run config and expose resourceURL on MCPServer
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.14 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.14
└──▷ HOW TO FIND IT
Migrate your custom MCPServer manifests to use the new schema_version field.
📍spec:
schema_version: 1
...
Bind an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server to a specific resource endpoint via the CRDCRDA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it..
ToolHive v0.2.7 adds proxy stdio subcommand for Claude Desktop, privileged flag support, and Google Cloud RunCloud RunGoogle's managed container runtime that executes stateless workloads on demand, scaling to zero when idle, so tools can deploy without managing servers or paying for idle capacity.MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.7 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.7
└──▷ USE IT
Run an MCP proxy in stdio mode suitable for direct invocation by Claude Desktop or other LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. clients.
shell
toolhive proxy stdio <container_name>
Deploy an MCP container with elevated privileges for kernel-level operations.
shell
toolhive run --privileged <container_name>
Add proxy stdio subcommand to enable Claude Desktop integration
Add --privileged flag support for MCP containers
Add Google Cloud Run MCP server to the tool registry
ToolHive v0.2.6 adds thv tunnel proxy subcommand, auto-loading secrets from secret manager, and an experimental MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. workload lister.
└──▷ GET THIS VERSION
$ git clone --branch v0.2.6 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.6
└──▷ USE IT
Proxy a workload via ngrok with custom traffic policy and pooling
ToolHive v0.2.4 adds thv build --dry-run, OCP ImageStream push targets, RFC-9728 discovery, and non-OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. OAuth support
└──▷ GET THIS VERSION
$ git clone --branch v0.2.4 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.4
--dry-run flag added to thv build command to validate builds without producing artifacts
-o output path flag added to thv build command to specify the destination for generated images
New task targets added to push container images into OpenShift Container Platform (OCP) ImageStreams
Added RFC-9728 discovery endpoint support for enhanced client discovery capabilities
thv proxy now supports non-OIDC OAuth flows in addition to existing OIDC support
ToolHive Operator CRDsCRDsA Kubernetes extension that adds a new object type to the cluster, so a tool's configuration is stored, validated and versioned by Kubernetes itself rather than in a file beside it. now allow setting the registry via API and configuring group selection for client registration.
└──▷ GET THIS VERSION
$ git clone --branch toolhive-operator-crds-0.0.13 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout toolhive-operator-crds-0.0.13
Adds registry configuration option to the ToolHive API endpoints, enabling dynamic registry specification.
Extends client registration logic with a group selection field for organizing tool clients.
ToolHive v0.2.3 adds thv build subcommand for container-only builds and integrates new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers
└──▷ GET THIS VERSION
$ git clone --branch v0.2.3 https://github.com/stacklok/toolhive.git
# already have the repo? check out this version:$ git checkout v0.2.3
Adds thv build subcommand for building containers without running them.
Adds falcon-mcp server to the registry with network profile support.
Adds plotting-mcp server to the registry.
Supports client configs with "." in JSON keys.
Ensures MCP servers from the registry match their expected provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. information.
Zenity discovers, secures and governs enterprise AI agents from buildtime to runtime across SaaS, endpoint and cloud.
Zenity unifies governance and runtime protection for SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., device-based, and home-grown AI agents
Enables real-time policy enforcement for SaaS-managed agents (Copilot Studio, Salesforce Agentforce) to prevent data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. and misuse of internal APIs.
Extends agent-centric discovery to endpoints to identify device-based agents (GitHub Copilot, Cursor), connected Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and their interactions.
Provides cross-cloud inventory and governance for home-grown agents across AWS Bedrock, Azure AI Foundry, and Google Cloud to flag misconfigurations and risky deployments.
NeMo Guardrails v0.15.0 adds parallel rails execution, OpenTelemetryOpenTelemetryAn open standard and set of tools for collecting traces, metrics and logs from applications. It lets services export observability data without tying instrumentation to one monitoring vendor. tracing API, and external async token generators.
└──▷ GET THIS VERSION
$ git clone --branch v0.15.0 https://github.com/NVIDIA-NeMo/Guardrails.git
# already have the repo? check out this version:$ git checkout v0.15.0
Superagent node-v0.0.4 adds ai-firewall CLI with --config support
└──▷ GET THIS VERSION
$ git clone --branch node-v0.0.4 https://github.com/superagent-ai/superagent.git
# already have the repo? check out this version:$ git checkout node-v0.0.4
└──▷ TRY IT
Start the firewall service using a custom YAML configuration file
$ git clone --branch node-v0.0.2 https://github.com/superagent-ai/superagent.git
# already have the repo? check out this version:$ git checkout node-v0.0.2
Initial Rust release of Superagent offering crates.io install, Docker image, and binary downloads.
└──▷ GET THIS VERSION
$ git clone --branch rust-v0.0.1 https://github.com/superagent-ai/superagent.git
# already have the repo? check out this version:$ git checkout rust-v0.0.1
Publishes the ai-firewall crate to crates.io for installation via cargo install ai-firewall
Superagent node-v0.0.1 introduces ai-firewall service with CLI and Docker support.
└──▷ GET THIS VERSION
$ git clone --branch node-v0.0.1 https://github.com/superagent-ai/superagent.git
# already have the repo? check out this version:$ git checkout node-v0.0.1
└──▷ USE IT
Install the new firewall tool globally for use in a cyber toolchain.
shell
npm install -g @superagent-ai/ai-firewall
Run the service using the new CLI and load a custom configuration.
VS Code 1.103 adds GPT-5, chat checkpoints, Git worktree support, and tool grouping for MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. agents.
└──▷ GET THIS VERSION
$ git clone --branch 1.103.0 https://github.com/microsoft/vscode.git
# already have the repo? check out this version:$ git checkout 1.103.0
Adds GPT-5 model availability for use in VS Code chat.
Adds chat checkpoints to restore a conversation to a previous good state.
Adds Git worktree support to check out multiple branches simultaneously.
Revamps the MCP tool picker experience with improved tool selection UI.
Enables more than 128 tools per agent request via experimental tool grouping.
+1 moreshow less
Adds a dedicated Chat Sessions view (experimental) for managing coding agent sessions.
Joplin v3.4.5 adds OCROCROptical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. text search toggle, HTML-to-Markdown conversion, and editor shortcuts
└──▷ HOW TO FIND IT
Control whether Joplin searches inside the text extracted from scanned images in OCR notebooks.
📍Open Settings › Search › Toggle Search in OCR text
Convert existing HTML notes into Markdown for better compatibility with other tools or cleaner source control.
📍Open Settings › Text formatting › Select Transform HTML to Markdown
Adds Search in OCR text option to enable or disable indexing of extracted text from images
Adds new keyboard shortcut to toggle between Rich Text and Markdown editors
SysReptor 2025.69 adds Markdown report export via new plugin and collapsible plugin menu.
└──▷ GET THIS VERSION
$ git clone --branch 2025.69 https://github.com/Syslifters/sysreptor.git
# already have the repo? check out this version:$ git checkout 2025.69
└──▷ HOW TO FIND IT
Export a completed pentest report as a Markdown ZIP archive for version-control or offline review.
📍In the report view, open the Plugin menu and select markdownexport to download the report as a Markdown ZIP document.
New markdownexport plugin exports reports as Markdown documents packaged in ZIP format.
Allows collapsing the plugin menu in the UI for a cleaner workspace.
Adds logging of backup started and finished times for auditability.
3 details in Everything
└──▷ BREAKING ON UPGRADE
!The Bitnami Redis Docker image is replaced with the official Redis image; deployments relying on the Bitnami image will need to update their container configuration.
Cloudflare is a connectivity cloud platform delivering internet security, performance, and developer infrastructure services.
Cloudflare One introduces a beta AI-driven diagnostic tool for WARP clients to automate root cause identification and troubleshooting guidance via the dashboard.
35 more releases in this issue
· 2025-08-01 → 2025-08-29
New DEX MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI-driven device connectivity and performance queries
Releases an MCP server for Digital Experience Monitoring (DEX) to expose device metrics via the Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.
Allows users to query connectivity and performance data for specific devices via natural language questions directed at the DEX API
New Shadow IT SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. analytics dashboard in Zero Trust with application status tagging for Gateway policies.
Adds the Shadow IT - SaaS analytics dashboard to Cloudflare One Zero Trust
Enables marking applications with approval statuses: Unreviewed, In Review, Approved, and Unapproved
Allows using application approval statuses in Gateway HTTP policies
New Deepgram and Leonardo partner models plus WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. support for low-latency voice agents on Workers AI
Adds @cf/deepgram/aura-1 (text-to-speech), @cf/deepgram/nova-3 (speech-to-text), and @cf/pipecat-ai/smart-turn-v2 (turn detection) models to Workers AI
Adds @cf/leonardo/lucid-origin and @cf/leonardo/phoenix-1.0 text-to-image models to Workers AI
Cloudflare CASBCASBA Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. now supports agentless integrations with ChatGPT, Claude, and Gemini for posture and DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. monitoring.
Adds ChatGPT (OpenAI) integration to Cloudflare CASB for agentless posture and DLP monitoring
Adds Claude (Anthropic) integration to Cloudflare CASB for agentless posture and DLP monitoring
Adds Gemini (Google) integration to Cloudflare CASB for agentless posture and DLP monitoring
Cloudflare Access now supports OAuth for internal MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server authentication, enabling delegated access control.
Adds OAuth support for MCP server authentication within Cloudflare Access policies
Enables self-hosted applications to delegate access to internal MCP servers via OAuth
Cloudflare introduces open beta MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server portals to centralize multiple Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers behind a single HTTP endpoint with unified Access authentication and
Adds the ability to create MCP server portals that present multiple MCP servers on a single HTTP endpoint for agent access
Introduces portal configuration to select specific tools and prompt templates per portal, enabling curated access for AI agents
Enables Cloudflare Access authentication for the portal URL while supporting both unauthenticated and third-party/custom OAuth secured MCP servers
Cloudflare Gateway DLPDLPData Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. now natively detects AI prompt topics with new profiles and logging
Adds native detection and inspection for prompts submitted to Google Gemini, ChatGPT, Claude, and Perplexity via Prompt Detection for AI Applications
Introduces topic classification for DLP engine evaluating Content (PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., Source Code, Credentials and Secrets, Financial Information, Customer Data) and Intent (Jailbreak attempts, requests for malicious code, attempts to extract PII)
Provides five new predefined DLP profiles such as AI Prompt: AI Security and AI Prompt: PII
Enables application granular controls in Gateway HTTP policies to apply DLP profiles to specific AI applications (e.g., ChatGPT) and actions (e.g., SendPrompt)
Adds optional setting in Gateway policy to capture Full Prompt Logging and filter logs by conversation_id
Cloudflare Gateway now supports BYOIPBYOIPBring Your Own IP — a cloud provider feature letting customers move their own publicly routable IP blocks into the provider's network, so traffic to those addresses routes through the cloud without renumbering. dedicated egress IPs via the Egress policies UI.
Enterprise users can onboard their own IPv4 or IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. prefixes for use as dedicated egress IPs in Cloudflare Gateway
Adds a 'Use dedicated egress IPs (Cloudflare or BYOIP)' option and BYOIP dropdown to the Egress policies selection
Workers adds virtual filesystem support via node:fs module and Web File System API compatibility flags.
Adds node:fs module for ephemeral file read/write operations in Workers with nodejs_compat flag (default at date 2025-09-01) or enable_nodejs_fs_module compatibility flag.
Adds disable_nodejs_fs_module compatibility flag to explicitly disable the node:fs module.
Adds enable_web_file_system compatibility flag to expose the Web File System API in Workers without requiring nodejs_compat.
SSH with Cloudflare Access for Infrastructure now allows SFTPSFTPSSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. file transfers.
Cloudflare adds AS Num field to Load Balancing Custom Rules for ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses.-based traffic steering
AS Num added as a selectable Field in the Custom Rule UI within Cloudflare Load Balancing.
Cloudflare Terraform provider adds Python Workers support, content_file/content_sha256 fields, and assets headers/redirects for Workers scripts.
Adds content_type = "text/x-python" to cloudflare_workers_script resource to deploy Python Workers (beta) in Terraform Provider 5.8.0
Adds content_file and content_sha256 fields to cloudflare_workers_script to store script content externally in Terraform Provider 5.7.0+
Adds assets.config.headers and assets.config.redirects support to cloudflare_workers_script resource for Asset headers and redirects in Terraform Provider 5.8.0
Adds .env file support to wrangler dev and vite dev for local development environment variables
└──▷ USE IT
Override values for a specific local environment using an environment-specific .env file
shell
wrangler dev --env staging
Supports .env files in project root to provide secrets and override environment variables during local development with Wrangler and the Cloudflare Vite plugin
Supports .env.<environment-name> files (e.g. .env.staging) for multiple environments, merged when using wrangler <command> --env <environment-name> or CLOUDFLARE_ENV=<environment-name> vite dev
Cloudflare Workers now supports direct import of waitUntil from cloudflare:workers for background tasks
Adds waitUntil as a named export from the cloudflare:workers module to extend Worker execution beyond the request lifecycle without passing the ctx object through function arguments
Cloudflare Radar adds CT insights API endpoints and a dedicated UI page for certificate issuance trends
New /ct/timeseries API endpoint retrieves certificate issuance time series data.
New /ct/summary/{dimension} API endpoint retrieves certificate distribution by dimension.
New /ct/timeseries_groups/{dimension} API endpoint retrieves time series of certificate distribution by dimension.
New /ct/authorities and /ct/authorities/{ca_slug} API endpoints list and detail certification authorities from CCADB.
New /ct/logs and /ct/logs/{log_slug} API endpoints list and detail CT logs from the Google Chrome log list.
+1 moreshow less
Radar now includes a new Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates. insights page for visualizing issuance trends.
Cloudflare Sandbox SDK adds streaming code execution, Git support, process control, and port exposure
Adds createCodeContext function to create persistent Python, JavaScript, or TypeScript code execution contexts
Adds runCode method with onStdout and onResult streaming callbacks for real-time output processing
Adds runCodeStream function for returning a direct streaming response from code execution
Adds rich output support (text, html, png, svg, json, chart) for interpreter results
Adds Git integration via gitCheckout method to clone repositories into the sandbox file system
+2 moreshow less
Adds startProcess, listProcesses, getProcess, killProcess, killAllProcesses, and streamProcessLogs methods for full background process lifecycle control
Adds exposePort method to generate public preview URLs for services running on specific ports inside the sandbox
Agents SDK gains MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. elicitation, HTTP streamable transport, task queues, email adapter, and auto context wrapping.
Adds elicitInput() method to request user input during tool execution with durable state preservation
Adds http-streamable transport support for MCP via the new default export serve signature
Adds .queue() method to Agent class for lightweight background task deferral
Adds onEmail lifecycle method and EmailAgent base class for automatic email processing
Enables automatic context wrapping so getCurrentAgent() works inside RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. methods
Arcade adds Microsoft Teams and Google Sheets MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, Jira toolkit tools, Salesforce config via secrets, and Confluence multi-cloud CLI support.
Adds Microsoft Teams MCP Server to enable Microsoft Teams integration
Adds Jira Toolkit with new List Sprints & Boards tools for Jira automation
Adds pagination support to the GetSpreadsheet tool in the Google Sheets MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface.
Enables configuration of subdomain and max concurrency for the Salesforce MCP Server via secrets
Extends Confluence MCP Server support to Atlassian multi-cloud CLI and TDK
THE CYBER TOOLCHAIN
NO. -011